From 622a7177f69a29e0e4c337e3f84ba881ca72495a Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 09:09:05 +0300
Subject: [PATCH 01/27] Fixed Analytical rules

---
 ... to Team and immediately uploads file.yaml | 56 ++++++++++--
 ...365 - ExternalUserAddedRemovedInTeams.yaml | 60 ++++++++-----
 ... Mail_redirect_via_ExO_transport_rule.yaml | 62 ++++++++-----
 .../Office 365 - Malicious_Inbox_Rule.yaml    | 41 +++++++--
 .../Office 365 - MultipleTeamsDeletes.yaml    | 34 ++++++--
 .../Office 365 - Office_MailForwarding.yaml   | 86 +++++++++++++------
 ...ice 365 - Office_Uploaded_Executables.yaml | 86 +++++++++++++------
 .../Office 365 - RareOfficeOperations.yaml    | 28 ++++--
 ...ce 365 - SharePoint_Downloads_byNewIP.yaml | 76 +++++++++-------
 ...- SharePoint_Downloads_byNewUserAgent.yaml | 74 ++++++++++------
 ...ffice 365 - exchange_auditlogdisabled.yaml | 47 +++++++---
 .../Office 365 - office_policytampering.yaml  | 73 +++++++++++-----
 ...repoint_file_transfer_above_threshold.yaml | 37 ++++++--
 ...file_transfer_folders_above_threshold.yaml | 43 +++++++---
 14 files changed, 570 insertions(+), 233 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml
index ae3352d686..2dc1409234 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml	
@@ -1,5 +1,5 @@
 id: 4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac
-name: Office 365 - Accessed files shared by temporary external user
+name: GSA Enriched Office 365 - Accessed files shared by temporary external user
 description: |
   'This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity.'
 severity: Low
@@ -17,8 +17,41 @@ tactics:
 relevantTechniques:
   - T1566
 query: |
-    let fileAccessThreshold = 10;
-    EnrichedMicrosoft365AuditLogs
+      let fileAccessThreshold = 10;
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where OfficeWorkload =~ "MicrosoftTeams"
+      | where Operation =~ "MemberAdded"
+      | extend MemberAdded = tostring(parse_json(Members)[0].UPN)
+      | where MemberAdded contains "#EXT#"
+      | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName
+      | join kind=inner (
+          OfficeActivity
+          | where OfficeWorkload =~ "MicrosoftTeams"
+          | where Operation =~ "MemberRemoved"
+          | extend MemberAdded = tostring(parse_json(Members)[0].UPN)
+          | where MemberAdded contains "#EXT#"
+          | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName
+      ) on MemberAdded
+      | where TimeDeleted > TimeAdded
+      | join kind=inner (
+          OfficeActivity
+          | where RecordType == "SharePointFileOperation"
+          | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+          | where Operation == "FileUploaded"
+          | extend MemberAdded = UserId
+          | join kind=inner (
+              OfficeActivity
+              | where RecordType == "SharePointFileOperation"
+              | where Operation == "FileAccessed"
+              | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+              | summarize FileAccessCount = count() by OfficeObjectId
+              | where FileAccessCount > fileAccessThreshold
+          ) on OfficeObjectId
+      ) on MemberAdded
+      | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
+    // EnrichedMicrosoft365AuditLogs Query
+    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
     | where Workload =~ "MicrosoftTeams"
     | where Operation =~ "MemberAdded"
     | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)
@@ -49,10 +82,17 @@ query: |
             | where FileAccessCount > fileAccessThreshold
         ) on ObjectId, TeamName
     ) on MemberAdded, TeamName
-    | project-away MemberAdded1, MemberAdded2, ObjectId1, Operation1, Operation2
-    | extend MemberAddedAccountName = tostring(split(MemberAdded, "@")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, "@")[1])
-    | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, "@")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, "@")[1])
-    | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, "@")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, "@")[1])
+    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
+    // Combine Office and Enriched Events and Deduplicate
+    let CombinedEvents = OfficeEvents
+    | union EnrichedEvents
+    | summarize arg_min(TimeAdded, *) by MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
+    // Project Final Output
+    CombinedEvents
+  | extend MemberAddedAccountName = tostring(split(MemberAdded, "@")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, "@")[1])
+  | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, "@")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, "@")[1])
+  | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, "@")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, "@")[1])
+  | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, MemberAddedAccountName, MemberAddedAccountUPNSuffix, UserWhoAddedAccountName, UserWhoAddedAccountUPNSuffix, UserWhoDeletedAccountName, UserWhoDeletedAccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -82,5 +122,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-version: 2.1.2
+version: 2.1.3
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml
index ee67b9c088..b7d16137d2 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml	
@@ -1,5 +1,5 @@
 id: 1a8f1297-23a4-4f09-a20b-90af8fc3641a
-name: Office 365 - External User Added and Removed in Short Timeframe
+name: GSA Enriched Office 365 - External User Added and Removed in Short Timeframe
 description: |
   This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour.
 severity: Low
@@ -17,27 +17,47 @@ tactics:
 relevantTechniques:
   - T1136
 query: |
-    let TeamsAddDel = (Op:string){
+  let TeamsAddDelOffice = (Op:string){
+    OfficeActivity
+    | where OfficeWorkload =~ "MicrosoftTeams"
+    | where Operation == Op
+    | where Members has ("#EXT#")
+    | mv-expand Members
+    | extend UPN = tostring(Members.UPN)
+    | where UPN has ("#EXT#")
+    | project TimeGenerated, Operation, UPN, UserId, TeamName, ClientIP
+  };
+  let TeamsAddDelEnriched = (Op:string){
     EnrichedMicrosoft365AuditLogs
-      | where Workload =~ "MicrosoftTeams"
-      | where Operation == Op
-      | where tostring(AdditionalProperties.Members) has ("#EXT#")
-      | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))
-      | extend UPN = tostring(Members.UPN)
-      | where UPN has ("#EXT#")
-      | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(AdditionalProperties.TeamName), ClientIP = SourceIp
-    };
-    let TeamsAdd = TeamsAddDel("MemberAdded")
+    | where Workload =~ "MicrosoftTeams"
+    | where Operation == Op
+    | where tostring(AdditionalProperties.Members) has ("#EXT#")
+    | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))
+    | extend UPN = tostring(Members.UPN)
+    | where UPN has ("#EXT#")
+    | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(AdditionalProperties.TeamName), ClientIP = SourceIp
+  };
+  let TeamsAddOffice = TeamsAddDelOffice("MemberAdded")
     | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;
-    let TeamsDel = TeamsAddDel("MemberRemoved")
+  let TeamsDelOffice = TeamsAddDelOffice("MemberRemoved")
     | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;
-    TeamsAdd
-    | join kind = inner (TeamsDel) on $left.MemberAdded == $right.MemberRemoved
-    | where TimeDeleted > TimeAdded
-    | project TimeAdded, TimeDeleted, MemberAdded_Removed = MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName
-    | extend MemberAdded_RemovedAccountName = tostring(split(MemberAdded_Removed, "@")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded_Removed, "@")[1])
-    | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, "@")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, "@")[1])
-    | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, "@")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, "@")[1])
+  let TeamsAddEnriched = TeamsAddDelEnriched("MemberAdded")
+    | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;
+  let TeamsDelEnriched = TeamsAddDelEnriched("MemberRemoved")
+    | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;
+  let TeamsAdd = TeamsAddOffice
+    | union TeamsAddEnriched
+    | project TimeAdded, Operation, MemberAdded, UserWhoAdded, TeamName, ClientIP;
+  let TeamsDel = TeamsDelOffice
+    | union TeamsDelEnriched
+    | project TimeDeleted, Operation, MemberRemoved, UserWhoDeleted, TeamName, ClientIP;
+  TeamsAdd
+  | join kind=inner (TeamsDel) on $left.MemberAdded == $right.MemberRemoved
+  | where TimeDeleted > TimeAdded
+  | project TimeAdded, TimeDeleted, MemberAdded_Removed = MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, ClientIP
+  | extend MemberAdded_RemovedAccountName = tostring(split(MemberAdded_Removed, "@")[0]), MemberAdded_RemovedAccountUPNSuffix = tostring(split(MemberAdded_Removed, "@")[1])
+  | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, "@")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, "@")[1])
+  | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, "@")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, "@")[1])
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -67,5 +87,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIp
-version: 2.1.3
+version: 2.1.4
 kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index b4e3a1357d..9c86a9f4da 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -1,5 +1,5 @@
 id: edcfc2e0-3134-434c-8074-9101c530d419
-name: Office 365 - Mail redirect via ExO transport rule
+name: GSA Enriched Office 365 - Mail redirect via ExO transport rule
 description: |
   'Identifies when Exchange Online transport rule configured to forward emails.
   This could be an adversary mailbox configured to collect mail from multiple user accounts.'
@@ -20,24 +20,46 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
-    EnrichedMicrosoft365AuditLogs
-    | where Workload == "Exchange"
-    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
-        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
-      )
-    | extend RuleName = case(
-        Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to what was previously OfficeObjectId
-        Operation =~ "New-TransportRule", ParsedParameters.Name,
-        "Unknown"
-      )
-    | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
-    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
-    | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
-    | extend From = ParsedParameters.From
-    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    let officeActivityQuery = OfficeActivity
+      | where OfficeWorkload == "Exchange"
+      | where Operation in~ ("New-TransportRule", "Set-TransportRule")
+      | mv-apply DynamicParameters = todynamic(Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
+      | extend RuleName = case(
+          Operation =~ "Set-TransportRule", OfficeObjectId,
+          Operation =~ "New-TransportRule", ParsedParameters.Name,
+          "Unknown")
+      | mv-expand ExpandedParameters = todynamic(Parameters)
+      | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+      | extend RedirectTo = ExpandedParameters.Value
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+      | extend From = ParsedParameters.From
+      | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+
+    let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
+      | where Workload == "Exchange"
+      | where Operation in~ ("New-TransportRule", "Set-TransportRule")
+      | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
+          summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+        )
+      | extend RuleName = case(
+          Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to OfficeObjectId
+          Operation =~ "New-TransportRule", ParsedParameters.Name,
+          "Unknown"
+        )
+      | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
+      | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+      | extend RedirectTo = ExpandedParameters.Value
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+      | extend From = ParsedParameters.From
+      | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+
+    // Combine both queries
+    union isfuzzy=true officeActivityQuery, enrichedLogsQuery
+    | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
+    | project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix
+    | order by TimeGenerated desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -51,5 +73,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPAddress
-version: 2.0.5
+version: 2.0.7
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml
index 7f9c6b7ec7..efdb71967e 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml	
@@ -1,5 +1,5 @@
 id: a9c76c8d-f60d-49ec-9b1f-bdfee6db3807
-name: Office 365 - Malicious Inbox Rule
+name: GSA Enriched Office 365 - Malicious Inbox Rule
 description: |
   'Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.
    This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
@@ -21,20 +21,45 @@ relevantTechniques:
   - T1098
   - T1078
 query: |
-    let Keywords = dynamic(["helpdesk", "alert", "suspicious", "fake", "malicious", "phishing", "spam", "do not click", "do not open", "hijacked", "Fatal"]);
-    EnrichedMicrosoft365AuditLogs
+     let Keywords = dynamic(["helpdesk", "alert", "suspicious", "fake", "malicious", "phishing", "spam", "do not click", "do not open", "hijacked", "Fatal"]);
+    // OfficeActivity Query
+    let OfficeEvents = OfficeActivity
+    | where OfficeWorkload =~ "Exchange" 
+    | where Operation =~ "New-InboxRule" and (ResultStatus =~ "True" or ResultStatus =~ "Succeeded")
+    | where Parameters has "Deleted Items" or Parameters has "Junk Email"  or Parameters has "DeleteMessage"
+    | extend Events = todynamic(Parameters)
+    | parse Events  with * "SubjectContainsWords" SubjectContainsWords '}'*
+    | parse Events  with * "BodyContainsWords" BodyContainsWords '}'*
+    | parse Events  with * "SubjectOrBodyContainsWords" SubjectOrBodyContainsWords '}'*
+    | where SubjectContainsWords has_any (Keywords)
+        or BodyContainsWords has_any (Keywords)
+        or SubjectOrBodyContainsWords has_any (Keywords)
+    | extend ClientIPAddress = case(ClientIP has ".", tostring(split(ClientIP, ":")[0]), ClientIP has "[", tostring(trim_start(@'[[]', tostring(split(ClientIP, "]")[0]))), ClientIP)
+    | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))
+    | extend RuleDetail = case(OfficeObjectId contains '/', tostring(split(OfficeObjectId, '/')[-1]), tostring(split(OfficeObjectId, '\\')[-1]))
+    | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, OriginatingServer, OfficeObjectId, RuleDetail
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    | extend OriginatingServerName = tostring(split(OriginatingServer, " ")[0]);
+    // EnrichedMicrosoft365AuditLogs Query
+    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
     | where Workload =~ "Exchange"
     | where Operation =~ "New-InboxRule" and (ResultStatus =~ "True" or ResultStatus =~ "Succeeded")
     | where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "Deleted Items" or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "Junk Email" or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "DeleteMessage"
     | extend Events = parse_json(tostring(AdditionalProperties)).Parameters
     | extend SubjectContainsWords = tostring(Events.SubjectContainsWords), BodyContainsWords = tostring(Events.BodyContainsWords), SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)
     | where SubjectContainsWords has_any (Keywords) or BodyContainsWords has_any (Keywords) or SubjectOrBodyContainsWords has_any (Keywords)
-    | extend ClientIPAddress = case(ClientIp has ".", tostring(split(ClientIp, ":")[0]), ClientIp has "[", tostring(trim_start(@'[[]',tostring(split(ClientIp, "]")[0]))), ClientIp)
-    | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, (iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords)))
+    | extend ClientIPAddress = case(ClientIp has ".", tostring(split(ClientIp, ":")[0]), ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))), ClientIp)
+    | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))
     | extend RuleDetail = case(ObjectId contains '/', tostring(split(ObjectId, '/')[-1]), tostring(split(ObjectId, '\\')[-1]))
     | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, ObjectId, RuleDetail
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    // Combine and Deduplicate
+    let CombinedEvents = OfficeEvents
+    | union EnrichedEvents
+    | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIPAddress;
+    // Final Output
+    CombinedEvents
+    | project StartTimeUtc, EndTimeUtc, Operation, UserId, ClientIPAddress, ResultStatus, Keyword, RuleDetail, AccountName, AccountUPNSuffix;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -52,5 +77,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIPAddress
-version: 2.0.5
+version: 2.0.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml
index aa8d9a37b4..c5992b559f 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml	
@@ -1,5 +1,5 @@
 id: db60e4b6-a845-4f28-a18c-94ebbaad6c6c
-name: Office 365 - Multiple Teams deleted by a single user
+name: GSA Enriched Office 365 - Multiple Teams deleted by a single user
 description: |
   'This detection flags the occurrences of deleting multiple teams within an hour.
   This data is a part of Office 365 Connector in Microsoft Sentinel.'
@@ -19,13 +19,29 @@ relevantTechniques:
   - T1485
   - T1489
 query: |
-    let max_delete_count = 3;
-    EnrichedMicrosoft365AuditLogs
-    | where Workload =~ "MicrosoftTeams"
-    | where Operation =~ "TeamDeleted"
-    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId
-    | where array_length(DeletedTeams) > max_delete_count
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    // Set the maximum number of deleted teams to flag suspicious activity
+        let max_delete_count = 3;
+        // EnrichedMicrosoft365AuditLogs Query
+        let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+            | where Workload =~ "MicrosoftTeams"
+            | where Operation =~ "TeamDeleted"
+            | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId
+            | where array_length(DeletedTeams) > max_delete_count
+            | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+        // OfficeActivity Query
+        let OfficeEvents = OfficeActivity
+            | where OfficeWorkload =~ "MicrosoftTeams"
+            | where Operation =~ "TeamDeleted"
+            | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId
+            | where array_length(DeletedTeams) > max_delete_count
+            | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+        // Combine and Deduplicate Office and Enriched Logs
+        let CombinedEvents = OfficeEvents
+            | union EnrichedEvents
+            | summarize arg_min(StartTime, *) by UserId;
+        // Final Output
+        CombinedEvents
+        | project StartTime, EndTime, DeletedTeams, UserId, AccountName, AccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -35,5 +51,5 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.5
+version: 2.0.6
 kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml
index f68c7dc7d3..d56fff5a6f 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml	
@@ -1,5 +1,5 @@
 id: d75e8289-d1cb-44d4-bd59-2f44a9172478
-name: Office 365 - Multiple Users Email Forwarded to Same Destination
+name: GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination
 description: |
   Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. 
   This could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.
@@ -20,30 +20,64 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
-  let queryfrequency = 1d;
-    let queryperiod = 7d;
-    EnrichedMicrosoft365AuditLogs
-    | where TimeGenerated > ago(queryperiod)
-    | where Workload =~ "Exchange"
-    //| where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")  // Uncomment or adjust based on actual field usage
-    | where tostring(AdditionalProperties.Parameters) has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
-    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
-        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
-      )
-    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
-    | extend DestinationMailAddress = tolower(case(
-        isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
-        isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
-        isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
-        ""))
-    | where isnotempty(DestinationMailAddress)
-    | mv-expand split(DestinationMailAddress, ";")
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
-    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
-    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
-    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
-    | mv-expand UserId to typeof(string)
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    // Set query parameters
+        let queryfrequency = 1d;
+        let queryperiod = 7d;
+        // EnrichedMicrosoft365AuditLogs Query
+        let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+        | where TimeGenerated > ago(queryperiod)
+        | where Workload =~ "Exchange"
+        // Uncomment or adjust the following line based on actual field usage
+        // | where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
+        | where tostring(AdditionalProperties.Parameters) has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
+        | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
+            summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+          )
+        | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
+        | extend DestinationMailAddress = tolower(case(
+            isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
+            isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
+            isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
+            ""))
+        | where isnotempty(DestinationMailAddress)
+        | mv-expand split(DestinationMailAddress, ";")
+        | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+        | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
+        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
+        | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
+        | mv-expand UserId to typeof(string)
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+        // OfficeActivity Query
+        let OfficeEvents = OfficeActivity
+        | where TimeGenerated > ago(queryperiod)
+        | where OfficeWorkload =~ "Exchange"
+        // Uncomment or adjust the following line based on actual field usage
+        // | where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
+        | where Parameters has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
+        | mv-apply DynamicParameters = todynamic(Parameters) on (
+            summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+          )
+        | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
+        | extend DestinationMailAddress = tolower(case(
+            isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
+            isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
+            isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
+            ""))
+        | where isnotempty(DestinationMailAddress)
+        | mv-expand split(DestinationMailAddress, ";")
+        | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+        | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
+        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
+        | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
+        | mv-expand UserId to typeof(string)
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+        // Combine and Deduplicate Office and Enriched Logs
+        let CombinedEvents = OfficeEvents
+        | union EnrichedEvents
+        | summarize arg_min(StartTime, *) by tostring(DestinationMailAddress), ClientIP;
+        // Final Output
+        CombinedEvents
+        | project StartTime, EndTime, DestinationMailAddress, ClientIP, DistinctUserCount, UserId, Ports, EventCount, AccountName, AccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -57,5 +91,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-version: 2.0.4
+version: 2.0.5
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml
index 81fcfb8ad1..ecb8cc0365 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml	
@@ -1,5 +1,5 @@
 id: 178c62b4-d5e5-40f5-8eab-7fccd0051e7a
-name: Office 365 - New Executable via Office FileUploaded Operation
+name: GSA Enriched Office 365 - New Executable via Office FileUploaded Operation
 description: |
   Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive.
   List currently includes exe, inf, gzip, cmd, bat file extensions.
@@ -24,37 +24,71 @@ relevantTechniques:
 query: |
     let threshold = 2;
     let uploadOp = 'FileUploaded';
+    // Extensions that are interesting. Add/Remove to this list as you see fit
     let execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);
     let starttime = 8d;
     let endtime = 1d;
-    EnrichedMicrosoft365AuditLogs
-    | where TimeGenerated >= ago(endtime)
-    | where Operation == uploadOp
-    | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
-    | where SourceFileExtension in (execExt)
-    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-    | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
-    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-    | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName
-    | join kind=leftanti (
-        EnrichedMicrosoft365AuditLogs
-        | where TimeGenerated between (ago(starttime) .. ago(endtime))
+    // OfficeActivity Query
+    let OfficeEvents = OfficeActivity
+        | where TimeGenerated >= ago(endtime)
+        | where Operation =~ uploadOp
+        | where SourceFileExtension has_any (execExt)
+        | extend RecordType = coalesce(tostring(RecordType), "UnknownRecordType")  // Ensure RecordType is a string
+        | project TimeGenerated, OfficeId, OfficeWorkload = OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName
+        | join kind=leftanti (
+            OfficeActivity
+            | where TimeGenerated between (ago(starttime) .. ago(endtime))
+            | where Operation =~ uploadOp
+            | where SourceFileExtension has_any (execExt)
+            | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName
+            // Uncomment the line below to enforce the threshold
+            //| where PrevSeenCount > threshold
+            | mvexpand SourceRelativeUrl, UserId
+            | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId
+        ) on SourceFileName, SourceRelativeUrl, UserId
+        | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+        | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+        | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+        | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string
+        by OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    // EnrichedMicrosoft365AuditLogs Query
+    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+        | where TimeGenerated >= ago(endtime)
         | where Operation == uploadOp
         | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
         | where SourceFileExtension in (execExt)
+        | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
         | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
-        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-        // Uncomment the line below to enforce the threshold
-        // | where PrevSeenCount > threshold
-        | mvexpand SourceRelativeUrl, UserId
-        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)
-    ) on SourceFileName, SourceRelativeUrl, UserId
-    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
-    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
-    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
-    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000)
-    by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+        | extend RecordType = coalesce(tostring(RecordType), "UnknownRecordType")  // Ensure RecordType is a string
+        | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName
+        | join kind=leftanti (
+            EnrichedMicrosoft365AuditLogs
+            | where TimeGenerated between (ago(starttime) .. ago(endtime))
+            | where Operation == uploadOp
+            | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
+            | where SourceFileExtension in (execExt)
+            | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
+            | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+            // Uncomment the line below to enforce the threshold
+            //| where PrevSeenCount > threshold
+            | mvexpand SourceRelativeUrl, UserId
+            | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId
+        ) on SourceFileName, SourceRelativeUrl, UserId
+        | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+        | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+        | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+        | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(tostring(SourceRelativeUrl), 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string
+        by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    // Combine Office and Enriched Logs
+    let CombinedEvents = EnrichedEvents
+        | union isfuzzy=true OfficeEvents
+        | summarize arg_min(StartTime, *) by tostring(FileNames), UserId, Site_Url, tostring(RecordType)  // Ensure FileNames and RecordType are strings
+        | order by StartTime desc;
+    CombinedEvents
+    | project StartTime, EndTime, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder, FileNames, UserAgents, AccountName, AccountUPNSuffix;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -76,5 +110,5 @@ entityMappings:
     fieldMappings:
       - identifier: Name
         columnName: FileNames
-version: 2.0.6
+version: 2.0.7
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml
index 5f7d2be46b..1e483ccf78 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml	
@@ -1,5 +1,5 @@
 id: 433c254d-4b84-46f7-99ec-9dfefb5f6a7b
-name: Office 365 - Rare and Potentially High-Risk Office Operations
+name: GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations
 description: |
   Identifies Office operations that are typically rare and can provide capabilities useful to attackers.
 severity: Low
@@ -19,11 +19,25 @@ relevantTechniques:
   - T1098
   - T1114
 query: |
-    EnrichedMicrosoft365AuditLogs
-    | where Operation in~ ( "Add-MailboxPermission", "Add-MailboxFolderPermission", "Set-Mailbox", "New-ManagementRoleAssignment", "New-InboxRule", "Set-InboxRule", "Set-TransportRule")
-    and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
-    | extend ClientIPOnly = tostring(extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?', dynamic(["IPAddress"]), ClientIp)[0])
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where Operation in~ ( "Add-MailboxPermission", "Add-MailboxFolderPermission", "Set-Mailbox", "New-ManagementRoleAssignment", "New-InboxRule", "Set-InboxRule", "Set-TransportRule")
+      and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
+      | extend ClientIPOnly = tostring(extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?', dynamic(["IPAddress"]), ClientIP)[0])
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Operation in~ ( "Add-MailboxPermission", "Add-MailboxFolderPermission", "Set-Mailbox", "New-ManagementRoleAssignment", "New-InboxRule", "Set-InboxRule", "Set-TransportRule")
+      and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
+      | extend ClientIPOnly = tostring(extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?', dynamic(["IPAddress"]), ClientIp)[0])
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine and Deduplicate Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by Operation, UserId, ClientIPOnly;
+  // Final Output
+  CombinedEvents
+  | project TimeGenerated, Operation, UserId, AccountName, AccountUPNSuffix, ClientIPOnly
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -41,5 +55,5 @@ entityMappings:
     fieldMappings:
       - identifier: AppId
         columnName: AppId
-version: 2.0.6
+version: 2.0.7
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml
index 563af53e1c..c5773d2077 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml	
@@ -1,5 +1,5 @@
 id: 7460e34e-4c99-47b2-b7c0-c42e339fc586
-name: Office 365 - SharePoint File Operation via Previously Unseen IPs
+name: GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs
 description: |
   Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25.
 severity: Medium
@@ -17,40 +17,56 @@ tactics:
 relevantTechniques:
   - T1030
 query: |
-  let threshold = 0.25;
+  let threshold = 25;
   let szSharePointFileOperation = "SharePointFileOperation";
   let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
   let starttime = 14d;
   let endtime = 1d;
-  // Define a baseline of normal user behavior
-  let userBaseline = EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated between(ago(starttime)..ago(endtime))
-  | where RecordType == szSharePointFileOperation
-  | where Operation in (szOperations)
-  | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-  | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-  | where isnotempty(UserAgent)
-  | summarize Count = count() by UserId, Operation, Site_Url, ClientIp
-  | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;
-  // Get recent user activity
-  let recentUserActivity = EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated > ago(endtime)
-  | where RecordType == szSharePointFileOperation
-  | where Operation in (szOperations)
-  | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-  | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-  | where isnotempty(UserAgent)
-  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;
-  // Join the baseline and recent activity, and calculate the deviation
-  let UserBehaviorAnalysis = userBaseline 
-  | join kind=inner (recentUserActivity) on UserId, Operation, Site_Url, ClientIp
-  | extend Deviation = abs(RecentCount - AvgCount) / AvgCount;
+  // Define a baseline of normal user behavior for OfficeActivity
+  let userBaselineOffice = OfficeActivity
+      | where TimeGenerated between(ago(starttime)..ago(endtime))
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent)
+      | summarize Count = count() by UserId, Operation, Site_Url, ClientIP
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIP;
+  // Get recent user activity for OfficeActivity
+  let recentUserActivityOffice = OfficeActivity
+      | where TimeGenerated > ago(endtime)
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIP, OfficeObjectId, OfficeWorkload, UserAgent;
+  // Define a baseline of normal user behavior for EnrichedMicrosoft365AuditLogs
+  let userBaselineEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between(ago(starttime)..ago(endtime))
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent)
+      | summarize Count = count() by UserId, Operation, Site_Url, ClientIp
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;
+  // Get recent user activity for EnrichedMicrosoft365AuditLogs
+  let recentUserActivityEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated > ago(endtime)
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;
+  // Combine user baselines and recent activity, calculate deviation, and deduplicate
+  let UserBehaviorAnalysis = userBaselineOffice
+      | join kind=inner (recentUserActivityOffice) on UserId, Operation, Site_Url, ClientIP
+      | union (userBaselineEnriched | join kind=inner (recentUserActivityEnriched) on UserId, Operation, Site_Url, ClientIp)
+      | extend Deviation = abs(RecentCount - AvgCount) / AvgCount;
   // Filter for significant deviations
   UserBehaviorAnalysis
-  | where Deviation > threshold
-  | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIp, Site_Url, ObjectId, Workload, UserAgent, Deviation, Count=RecentCount
-  | order by Count desc, ClientIp asc, Operation asc, UserId asc
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | where Deviation > threshold
+      | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIP, Site_Url, ObjectId, OfficeObjectId, OfficeWorkload, Workload, UserAgent, Deviation, Count=RecentCount
+      | order by Count desc, ClientIP asc, Operation asc, UserId asc
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -68,5 +84,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: Site_Url
-version: 2.0.5
+version: 2.0.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 2973309921..ea908dd604 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -1,5 +1,5 @@
 id: efd17c5f-5167-40f8-a1e9-0818940785d9
-name: Office 365 - SharePointFileOperation via devices with previously unseen user agents
+name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
 description: |
   Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
 severity: Medium
@@ -17,52 +17,78 @@ tactics:
 relevantTechniques:
   - T1030
 query: |
-  // Set threshold for the number of downloads/uploads from a new user agent
-  let threshold = 5;
-  // Define constants for SharePoint file operations
+    let threshold = 5;
   let szSharePointFileOperation = "SharePointFileOperation";
   let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
-  // Define the historical activity for analysis
-  let starttime = 14d; // Define the start time for historical data (14 days ago)
-  let endtime = 1d;   // Define the end time for historical data (1 day ago)
-  // Extract the base events for analysis
-  let Baseevents =
-      EnrichedMicrosoft365AuditLogs
+  let starttime = 14d;
+  let endtime = 1d;
+  // OfficeActivity - Base Events
+  let BaseeventsOffice = OfficeActivity
+      | where TimeGenerated between (ago(starttime) .. ago(endtime))
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent);
+  // OfficeActivity - Frequent User Agents
+  let FrequentUAOffice = BaseeventsOffice
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  // OfficeActivity - User Baseline
+  let UserBaseLineOffice = BaseeventsOffice
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  // OfficeActivity - Recent User Activity
+  let RecentActivityOffice = OfficeActivity
+      | where TimeGenerated > ago(endtime)
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent)
+      | where UserAgent in~ (FrequentUAOffice)
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
+      by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
+  // EnrichedMicrosoft365AuditLogs - Base Events
+  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
       | where TimeGenerated between (ago(starttime) .. ago(endtime))
       | where RecordType == szSharePointFileOperation
       | where Operation in (szOperations)
       | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
       | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
       | where isnotempty(UserAgent);
-  // Identify frequently occurring user agents
-  let FrequentUA = Baseevents
+  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
+  let FrequentUAEnriched = BaseeventsEnriched
       | summarize FUACount = count() by UserAgent, RecordType, Operation
       | where FUACount >= threshold
       | distinct UserAgent;
-  // Calculate a user baseline for further analysis
-  let UserBaseLine = Baseevents
+  // EnrichedMicrosoft365AuditLogs - User Baseline
+  let UserBaseLineEnriched = BaseeventsEnriched
       | summarize Count = count() by UserId, Operation, Site_Url
       | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  // Extract recent activity for analysis
-  let RecentActivity = EnrichedMicrosoft365AuditLogs
+  // EnrichedMicrosoft365AuditLogs - Recent User Activity
+  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
       | where TimeGenerated > ago(endtime)
       | where RecordType == szSharePointFileOperation
       | where Operation in (szOperations)
       | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
       | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
       | where isnotempty(UserAgent)
-      | where UserAgent in (FrequentUA)
+      | where UserAgent in (FrequentUAEnriched)
       | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
       by RecordType, Operation, UserAgent, UserId, ClientIp, Site_Url;
-  // Analyze user behavior based on baseline and recent activity
-  let UserBehaviorAnalysis = UserBaseLine
-      | join kind=inner (RecentActivity) on UserId, Operation, Site_Url
+  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
+  let UserBehaviorAnalysisOffice = UserBaseLineOffice
+      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
+      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
       | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
-  // Filter and format results for specific user behavior analysis
-  UserBehaviorAnalysis
+  // Combine Office and Enriched Logs
+  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
+      | union UserBehaviorAnalysisEnriched;
+  // Filter and Format Final Results
+  CombinedUserBehaviorAnalysis
       | where Deviation > 0.25
       | extend UserIdName = tostring(split(UserId, '@')[0]), UserIdUPNSuffix = tostring(split(UserId, '@')[1])
-      | project-reorder StartTime, EndTime, UserAgent, UserAgentSeenCount, UserId, ClientIp, Site_Url
+      | project-reorder StartTime, EndTime, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
       | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
 entityMappings:
   - entityType: Account
@@ -81,5 +107,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: Site_Url
-version: 2.2.5
+version: 2.2.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml
index 0db9fcc31d..7d21329a56 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml	
@@ -1,5 +1,5 @@
 id: dc451755-8ab3-4059-b805-e454c45d1d44
-name: Office 365 - Exchange AuditLog Disabled
+name: GSA Enriched Office 365 - Exchange AuditLog Disabled
 description: |
   'Identifies when the exchange audit logging has been disabled which may be an adversary attempt to evade detection or avoid other defenses.'
 severity: Medium
@@ -17,17 +17,38 @@ tactics:
 relevantTechniques:
   - T1562
 query: |
-    EnrichedMicrosoft365AuditLogs
-    | where Workload =~ "Exchange"
-    | where UserType in~ ("Admin", "DcAdmin")
-    | where Operation =~ "Set-AdminAuditLogConfig"
-    | extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(tostring(AdditionalProperties.Parameters)), 3, 3)))[0])).Value)
-    | where AdminAuditLogEnabledValue =~ "False"
-    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue
-    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
-    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
-    | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
-    | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '')
+    // OfficeActivity Query
+      let OfficeEvents = OfficeActivity
+          | where OfficeWorkload =~ "Exchange" 
+          | where UserType in~ ("Admin", "DcAdmin")
+          // Only admin or global-admin can disable audit logging
+          | where Operation =~ "Set-AdminAuditLogConfig"
+          | extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(Parameters), 3, 3)))[0])).Value)
+          | where AdminAuditLogEnabledValue =~ "False"
+          | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue
+          | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
+          | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
+          | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
+          | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
+      // EnrichedMicrosoft365AuditLogs Query
+      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+          | where Workload =~ "Exchange"
+          | where UserType in~ ("Admin", "DcAdmin")
+          | where Operation =~ "Set-AdminAuditLogConfig"
+          | extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(tostring(AdditionalProperties.Parameters)), 3, 3)))[0])).Value)
+          | where AdminAuditLogEnabledValue =~ "False"
+          | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue
+          | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
+          | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
+          | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
+          | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
+      // Combine Office and Enriched Events and Deduplicate
+      let CombinedEvents = OfficeEvents
+          | union EnrichedEvents
+          | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;
+      // Project Final Output
+      CombinedEvents
+      | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -45,5 +66,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-version: 2.0.7
+version: 2.0.8
 kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml
index 5dec340460..f07c58f8c8 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml	
@@ -1,5 +1,5 @@
 id: 0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb
-name: Office 365 - Office Policy Tampering
+name: GSA Enriched Office 365 - Office Policy Tampering
 description: |
   Identifies if any tampering is done to either audit log, ATP Safelink, SafeAttachment, AntiPhish, or Dlp policy. 
   An adversary may use this technique to evade detection or avoid other policy-based defenses.
@@ -21,27 +21,54 @@ relevantTechniques:
   - T1098
   - T1562
 query: |
-  let opList = EnrichedMicrosoft365AuditLogs 
-    | summarize by Operation
-    | where Operation has_any ("Remove", "Disable")
-    | where Operation contains "AntiPhish" or Operation contains "SafeAttachment" or Operation contains "SafeLinks" or Operation contains "Dlp" or Operation contains "Audit"
-    | summarize make_set(Operation, 500);
-  EnrichedMicrosoft365AuditLogs
-    | where RecordType == "ExchangeAdmin"
-    | where UserType in~ ("Admin", "DcAdmin")
-    | where Operation in~ (opList)
-    | extend ClientIPOnly = case( 
-        ClientIp has ".", tostring(split(ClientIp, ":")[0]), 
-        ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))),
-        ClientIp
-      )  
-    | extend Port = case(
-        ClientIp has ".", tostring(split(ClientIp, ":")[1]),
-        ClientIp has "[", tostring(split(ClientIp, "]:")[1]),
-        ""
-      )
-    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    // Query for EnrichedMicrosoft365AuditLogs
+    let enrichedOpList = EnrichedMicrosoft365AuditLogs 
+        | summarize by Operation
+        | where Operation has_any ("Remove", "Disable")
+        | where Operation contains "AntiPhish" or Operation contains "SafeAttachment" or Operation contains "SafeLinks" or Operation contains "Dlp" or Operation contains "Audit"
+        | summarize make_set(Operation, 500);
+    let enrichedLogs = EnrichedMicrosoft365AuditLogs
+        | where RecordType == "ExchangeAdmin"
+        | where UserType in~ ("Admin", "DcAdmin")
+        | where Operation in~ (enrichedOpList)
+        | extend ClientIPOnly = case( 
+            ClientIp has ".", tostring(split(ClientIp, ":")[0]), 
+            ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))),
+            ClientIp
+          )  
+        | extend Port = case(
+            ClientIp has ".", tostring(split(ClientIp, ":")[1]),
+            ClientIp has "[", tostring(split(ClientIp, "]:")[1]),
+            ""
+          )
+        | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    // Query for OfficeActivity
+    let officeOpList = OfficeActivity 
+      | summarize by Operation
+      | where Operation has_any ("Remove", "Disable")
+      | where Operation contains "AntiPhish" or Operation contains "SafeAttachment" or Operation contains "SafeLinks" or Operation contains "Dlp" or Operation contains "Audit"
+      | summarize make_set(Operation, 500);
+    let officeLogs = OfficeActivity
+      | where RecordType =~ "ExchangeAdmin"
+      | where UserType in~ ("Admin","DcAdmin")
+      | where Operation in~ (officeOpList)
+      | extend ClientIPOnly = case( 
+          ClientIP has ".", tostring(split(ClientIP,":")[0]), 
+          ClientIP has "[", tostring(trim_start(@'[[]',tostring(split(ClientIP,"]")[0]))),
+          ClientIP
+        )  
+      | extend Port = case(
+          ClientIP has ".", tostring(split(ClientIP,":")[1]),
+          ClientIP has "[", tostring(split(ClientIP,"]:")[1]),
+          ""
+        )
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    // Combine Enriched Logs and Office Activity Logs
+    union isfuzzy=true enrichedLogs, officeLogs
+    | summarize StartTimeUtc = min(StartTimeUtc), EndTimeUtc = max(EndTimeUtc), TotalOperationCount = sum(OperationCount) by Operation, UserType, UserId, ClientIP, Port, ResultStatus, Parameters, AccountName, AccountUPNSuffix
+    | order by StartTimeUtc desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -55,5 +82,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-version: 2.0.4
+version: 2.0.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 418804b604..02dfc1c3b6 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -1,5 +1,5 @@
 id: 30375d00-68cc-4f95-b89a-68064d566358
-name: Office 365 - Sharepoint File Transfer Above Threshold
+name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
   Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
@@ -18,12 +18,33 @@ relevantTechniques:
   - T1020
 query: |
   let threshold = 5000;
-  EnrichedMicrosoft365AuditLogs
-  | where Workload has_any("SharePoint", "OneDrive") and Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-  | summarize count_distinct_ObjectId=dcount(ObjectId), fileslist=make_set(ObjectId, 10000) by UserId, ClientIp, bin(TimeGenerated, 15m)
-  | where count_distinct_ObjectId >= threshold
-  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField","_", tostring(hash(tostring(fileslist)))))
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_ObjectId=dcount(ObjectId), fileslist=make_set(ObjectId, 10000) 
+      by UserId, ClientIp, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint" 
+      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_OfficeObjectId=dcount(OfficeObjectId), fileslist=make_set(OfficeObjectId, 10000) 
+      by UserId, ClientIP, bin(TimeGenerated, 15m)
+      | where count_distinct_OfficeObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
+  // Final Output
+  CombinedEvents
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -55,5 +76,5 @@ incidentConfiguration:
       - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 1.0.5
+version: 1.0.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index 3ed1db4eff..e5bbb44ee0 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -1,5 +1,5 @@
 id: abd6976d-8f71-4851-98c4-4d086201319c
-name: Office 365 - Sharepoint File Transfer Above Threshold
+name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
   Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
@@ -17,15 +17,36 @@ tactics:
 relevantTechniques:
   - T1020
 query: |
-  let threshold = 500;
-  EnrichedMicrosoft365AuditLogs
-  | where Workload has_any("SharePoint", "OneDrive") and Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-  | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
-  | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-  | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000) by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)
-  | where count_distinct_ObjectId >= threshold
-  | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField","_", tostring(hash(tostring(dirlist)))))
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    let threshold = 500;
+      // OfficeActivity Query
+      let OfficeEvents = OfficeActivity
+          | where EventSource == "SharePoint" 
+          | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+          | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+          | summarize count_distinct_SourceRelativeUrl = dcount(SourceRelativeUrl), dirlist = make_set(SourceRelativeUrl, 10000)
+          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
+          | where count_distinct_SourceRelativeUrl >= threshold
+          | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      // EnrichedMicrosoft365AuditLogs Query
+      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+          | where Workload has_any("SharePoint", "OneDrive")
+          | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+          | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
+          | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+          | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000)
+          by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)
+          | where count_distinct_ObjectId >= threshold
+          | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      // Combine Office and Enriched Logs
+      let CombinedEvents = OfficeEvents
+          | union EnrichedEvents
+          | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
+      // Final Output
+      CombinedEvents
+          | project TimeGenerated, UserId, ClientIP, UserAgent, AccountName, AccountUPNSuffix, DirSample, count_distinct_SourceRelativeUrl
+          | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -57,5 +78,5 @@ incidentConfiguration:
       - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 1.0.5
+version: 1.0.6
 kind: Scheduled

From d2e692ce07763fe5605615ea66a89e6e2653b5e4 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 09:53:06 +0300
Subject: [PATCH 02/27] fixed YAMLs

---
 ... to Team and immediately uploads file.yaml |  88 +++++------
 ...365 - ExternalUserAddedRemovedInTeams.yaml |   8 +-
 ... Mail_redirect_via_ExO_transport_rule.yaml |  84 +++++------
 .../Office 365 - Malicious_Inbox_Rule.yaml    |  75 +++++----
 .../Office 365 - MultipleTeamsDeletes.yaml    |  52 +++----
 .../Office 365 - Office_MailForwarding.yaml   | 116 +++++++-------
 ...ice 365 - Office_Uploaded_Executables.yaml | 142 +++++++++---------
 .../Office 365 - RareOfficeOperations.yaml    |  21 +--
 ...ce 365 - SharePoint_Downloads_byNewIP.yaml |  10 +-
 ...- SharePoint_Downloads_byNewUserAgent.yaml |  19 +--
 ...ffice 365 - exchange_auditlogdisabled.yaml |  74 ++++-----
 .../Office 365 - office_policytampering.yaml  |  81 ++++++----
 ...repoint_file_transfer_above_threshold.yaml |  20 ++-
 ...file_transfer_folders_above_threshold.yaml |  67 +++++----
 14 files changed, 460 insertions(+), 397 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml
index 2dc1409234..e9fa0d76fe 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml	
@@ -17,7 +17,7 @@ tactics:
 relevantTechniques:
   - T1566
 query: |
-      let fileAccessThreshold = 10;
+  let fileAccessThreshold = 10;
   // OfficeActivity Query
   let OfficeEvents = OfficeActivity
       | where OfficeWorkload =~ "MicrosoftTeams"
@@ -50,49 +50,49 @@ query: |
           ) on OfficeObjectId
       ) on MemberAdded
       | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
-    // EnrichedMicrosoft365AuditLogs Query
-    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-    | where Workload =~ "MicrosoftTeams"
-    | where Operation =~ "MemberAdded"
-    | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)
-    | where MemberAdded contains "#EXT#"
-    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
-    | join kind=inner (
-        EnrichedMicrosoft365AuditLogs
-        | where Workload =~ "MicrosoftTeams"
-        | where Operation =~ "MemberRemoved"
-        | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)
-        | where MemberAdded contains "#EXT#"
-        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
-    ) on MemberAdded, TeamName
-    | where TimeDeleted > TimeAdded
-    | join kind=inner (
-        EnrichedMicrosoft365AuditLogs
-        | where RecordType == "SharePointFileOperation"
-        | where Operation == "FileUploaded"
-        | extend MemberAdded = UserId, SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
-        | where SourceRelativeUrl has "Microsoft Teams Chat Files"
-        | join kind=inner (
-            EnrichedMicrosoft365AuditLogs
-            | where RecordType == "SharePointFileOperation"
-            | where Operation == "FileAccessed"
-            | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
-            | where SourceRelativeUrl has "Microsoft Teams Chat Files"
-            | summarize FileAccessCount = count() by ObjectId, TeamName
-            | where FileAccessCount > fileAccessThreshold
-        ) on ObjectId, TeamName
-    ) on MemberAdded, TeamName
-    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
-    // Combine Office and Enriched Events and Deduplicate
-    let CombinedEvents = OfficeEvents
-    | union EnrichedEvents
-    | summarize arg_min(TimeAdded, *) by MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
-    // Project Final Output
-    CombinedEvents
-  | extend MemberAddedAccountName = tostring(split(MemberAdded, "@")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, "@")[1])
-  | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, "@")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, "@")[1])
-  | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, "@")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, "@")[1])
-  | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, MemberAddedAccountName, MemberAddedAccountUPNSuffix, UserWhoAddedAccountName, UserWhoAddedAccountUPNSuffix, UserWhoDeletedAccountName, UserWhoDeletedAccountUPNSuffix
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload =~ "MicrosoftTeams"
+      | where Operation =~ "MemberAdded"
+      | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)
+      | where MemberAdded contains "#EXT#"
+      | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
+      | join kind=inner (
+          EnrichedMicrosoft365AuditLogs
+          | where Workload =~ "MicrosoftTeams"
+          | where Operation =~ "MemberRemoved"
+          | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)
+          | where MemberAdded contains "#EXT#"
+          | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
+      ) on MemberAdded, TeamName
+      | where TimeDeleted > TimeAdded
+      | join kind=inner (
+          EnrichedMicrosoft365AuditLogs
+          | where RecordType == "SharePointFileOperation"
+          | where Operation == "FileUploaded"
+          | extend MemberAdded = UserId, SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
+          | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+          | join kind=inner (
+              EnrichedMicrosoft365AuditLogs
+              | where RecordType == "SharePointFileOperation"
+              | where Operation == "FileAccessed"
+              | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
+              | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+              | summarize FileAccessCount = count() by ObjectId, TeamName
+              | where FileAccessCount > fileAccessThreshold
+          ) on ObjectId, TeamName
+      ) on MemberAdded, TeamName
+      | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
+  // Combine Office and Enriched Events and Deduplicate
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeAdded, *) by MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;
+  // Project Final Output
+  CombinedEvents
+      | extend MemberAddedAccountName = tostring(split(MemberAdded, "@")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, "@")[1])
+      | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, "@")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, "@")[1])
+      | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, "@")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, "@")[1])
+      | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, MemberAddedAccountName, MemberAddedAccountUPNSuffix, UserWhoAddedAccountName, UserWhoAddedAccountUPNSuffix, UserWhoDeletedAccountName, UserWhoDeletedAccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml
index b7d16137d2..c2220e61a0 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml	
@@ -35,7 +35,7 @@ query: |
     | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))
     | extend UPN = tostring(Members.UPN)
     | where UPN has ("#EXT#")
-    | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(AdditionalProperties.TeamName), ClientIP = SourceIp
+    | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), ClientIP = SourceIp
   };
   let TeamsAddOffice = TeamsAddDelOffice("MemberAdded")
     | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;
@@ -66,7 +66,7 @@ entityMappings:
       - identifier: Name
         columnName: MemberAdded_RemovedAccountName
       - identifier: UPNSuffix
-        columnName: MemberAddedAccountUPNSuffix
+        columnName: MemberAdded_RemovedAccountUPNSuffix
   - entityType: Account
     fieldMappings:
       - identifier: FullName
@@ -86,6 +86,6 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
 version: 2.1.4
-kind: Scheduled
\ No newline at end of file
+kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index 9c86a9f4da..8927e62141 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -1,8 +1,8 @@
 id: edcfc2e0-3134-434c-8074-9101c530d419
 name: GSA Enriched Office 365 - Mail redirect via ExO transport rule
 description: |
-  'Identifies when Exchange Online transport rule configured to forward emails.
-  This could be an adversary mailbox configured to collect mail from multiple user accounts.'
+  Identifies when Exchange Online transport rule configured to forward emails.
+  This could be an adversary mailbox configured to collect mail from multiple user accounts.
 severity: Medium
 status: Available 
 requiredDataConnectors:
@@ -20,46 +20,44 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
-    let officeActivityQuery = OfficeActivity
-      | where OfficeWorkload == "Exchange"
-      | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-      | mv-apply DynamicParameters = todynamic(Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
-      | extend RuleName = case(
-          Operation =~ "Set-TransportRule", OfficeObjectId,
-          Operation =~ "New-TransportRule", ParsedParameters.Name,
-          "Unknown")
-      | mv-expand ExpandedParameters = todynamic(Parameters)
-      | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
-      | extend RedirectTo = ExpandedParameters.Value
-      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
-      | extend From = ParsedParameters.From
-      | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-
-    let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
-      | where Workload == "Exchange"
-      | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-      | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
-          summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
-        )
-      | extend RuleName = case(
-          Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to OfficeObjectId
-          Operation =~ "New-TransportRule", ParsedParameters.Name,
-          "Unknown"
-        )
-      | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
-      | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
-      | extend RedirectTo = ExpandedParameters.Value
-      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
-      | extend From = ParsedParameters.From
-      | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-
-    // Combine both queries
-    union isfuzzy=true officeActivityQuery, enrichedLogsQuery
-    | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
-    | project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix
-    | order by TimeGenerated desc;
+  let officeActivityQuery = OfficeActivity
+    | where OfficeWorkload == "Exchange"
+    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
+    | mv-apply DynamicParameters = todynamic(Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
+    | extend RuleName = case(
+        Operation =~ "Set-TransportRule", OfficeObjectId,
+        Operation =~ "New-TransportRule", ParsedParameters.Name,
+        "Unknown")
+    | mv-expand ExpandedParameters = todynamic(Parameters)
+    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+    | extend RedirectTo = ExpandedParameters.Value
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend From = ParsedParameters.From
+    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
+    | where Workload == "Exchange"
+    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
+    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
+        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
+    | extend RuleName = case(
+        Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to OfficeObjectId
+        Operation =~ "New-TransportRule", ParsedParameters.Name,
+        "Unknown"
+      )
+    | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
+    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+    | extend RedirectTo = ExpandedParameters.Value
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend From = ParsedParameters.From
+    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine both queries
+  union isfuzzy=true officeActivityQuery, enrichedLogsQuery
+  | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
+  | project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix
+  | order by TimeGenerated desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -73,5 +71,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPAddress
-version: 2.0.7
+version: 2.1.4
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml
index efdb71967e..2dd383aec3 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml	
@@ -1,9 +1,9 @@
 id: a9c76c8d-f60d-49ec-9b1f-bdfee6db3807
 name: GSA Enriched Office 365 - Malicious Inbox Rule
 description: |
-  'Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.
-   This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
-  Reference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/'
+  Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.
+  This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
+  Reference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/
 severity: Medium
 status: Available
 requiredDataConnectors:
@@ -21,44 +21,69 @@ relevantTechniques:
   - T1098
   - T1078
 query: |
-     let Keywords = dynamic(["helpdesk", "alert", "suspicious", "fake", "malicious", "phishing", "spam", "do not click", "do not open", "hijacked", "Fatal"]);
-    // OfficeActivity Query
-    let OfficeEvents = OfficeActivity
+  let Keywords = dynamic(["helpdesk", "alert", "suspicious", "fake", "malicious", "phishing", "spam", "do not click", "do not open", "hijacked", "Fatal"]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
     | where OfficeWorkload =~ "Exchange" 
     | where Operation =~ "New-InboxRule" and (ResultStatus =~ "True" or ResultStatus =~ "Succeeded")
-    | where Parameters has "Deleted Items" or Parameters has "Junk Email"  or Parameters has "DeleteMessage"
+    | where Parameters has "Deleted Items" or Parameters has "Junk Email" or Parameters has "DeleteMessage"
     | extend Events = todynamic(Parameters)
-    | parse Events  with * "SubjectContainsWords" SubjectContainsWords '}'*
-    | parse Events  with * "BodyContainsWords" BodyContainsWords '}'*
-    | parse Events  with * "SubjectOrBodyContainsWords" SubjectOrBodyContainsWords '}'*
+    | parse Events with * "SubjectContainsWords" SubjectContainsWords '}'*
+    | parse Events with * "BodyContainsWords" BodyContainsWords '}'*
+    | parse Events with * "SubjectOrBodyContainsWords" SubjectOrBodyContainsWords '}'*
     | where SubjectContainsWords has_any (Keywords)
         or BodyContainsWords has_any (Keywords)
         or SubjectOrBodyContainsWords has_any (Keywords)
-    | extend ClientIPAddress = case(ClientIP has ".", tostring(split(ClientIP, ":")[0]), ClientIP has "[", tostring(trim_start(@'[[]', tostring(split(ClientIP, "]")[0]))), ClientIP)
+    | extend ClientIPAddress = case(
+        ClientIP has ".", tostring(split(ClientIP, ":")[0]),
+        ClientIP has "[", tostring(trim_start(@'[[]', tostring(split(ClientIP, "]")[0]))),
+        ClientIP
+      )
     | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))
-    | extend RuleDetail = case(OfficeObjectId contains '/', tostring(split(OfficeObjectId, '/')[-1]), tostring(split(OfficeObjectId, '\\')[-1]))
+    | extend RuleDetail = case(
+        OfficeObjectId contains '/', tostring(split(OfficeObjectId, '/')[-1]),
+        OfficeObjectId contains '\\', tostring(split(OfficeObjectId, '\\')[-1]),
+        "Unknown"
+      )
     | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, OriginatingServer, OfficeObjectId, RuleDetail
     | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
     | extend OriginatingServerName = tostring(split(OriginatingServer, " ")[0]);
-    // EnrichedMicrosoft365AuditLogs Query
-    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+  
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
     | where Workload =~ "Exchange"
     | where Operation =~ "New-InboxRule" and (ResultStatus =~ "True" or ResultStatus =~ "Succeeded")
-    | where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "Deleted Items" or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "Junk Email" or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "DeleteMessage"
+    | where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "Deleted Items" 
+        or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "Junk Email" 
+        or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has "DeleteMessage"
     | extend Events = parse_json(tostring(AdditionalProperties)).Parameters
-    | extend SubjectContainsWords = tostring(Events.SubjectContainsWords), BodyContainsWords = tostring(Events.BodyContainsWords), SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)
-    | where SubjectContainsWords has_any (Keywords) or BodyContainsWords has_any (Keywords) or SubjectOrBodyContainsWords has_any (Keywords)
-    | extend ClientIPAddress = case(ClientIp has ".", tostring(split(ClientIp, ":")[0]), ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))), ClientIp)
+    | extend SubjectContainsWords = tostring(Events.SubjectContainsWords), 
+             BodyContainsWords = tostring(Events.BodyContainsWords), 
+             SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)
+    | where SubjectContainsWords has_any (Keywords) 
+        or BodyContainsWords has_any (Keywords) 
+        or SubjectOrBodyContainsWords has_any (Keywords)
+    | extend ClientIPAddress = case(
+        ClientIp has ".", tostring(split(ClientIp, ":")[0]),
+        ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))),
+        ClientIp
+      )
     | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))
-    | extend RuleDetail = case(ObjectId contains '/', tostring(split(ObjectId, '/')[-1]), tostring(split(ObjectId, '\\')[-1]))
+    | extend RuleDetail = case(
+        ObjectId contains '/', tostring(split(ObjectId, '/')[-1]),
+        ObjectId contains '\\', tostring(split(ObjectId, '\\')[-1]),
+        "Unknown"
+      )
     | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, ObjectId, RuleDetail
     | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-    // Combine and Deduplicate
-    let CombinedEvents = OfficeEvents
+  
+  // Combine and Deduplicate
+  let CombinedEvents = OfficeEvents
     | union EnrichedEvents
     | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIPAddress;
-    // Final Output
-    CombinedEvents
+  
+  // Final Output
+  CombinedEvents
     | project StartTimeUtc, EndTimeUtc, Operation, UserId, ClientIPAddress, ResultStatus, Keyword, RuleDetail, AccountName, AccountUPNSuffix;
 entityMappings:
   - entityType: Account
@@ -69,10 +94,6 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-  - entityType: Host
-    fieldMappings:
-      - identifier: FullName
-        columnName: OriginatingServer
   - entityType: IP
     fieldMappings:
       - identifier: Address
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml
index c5992b559f..789f90df15 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml	
@@ -1,8 +1,8 @@
 id: db60e4b6-a845-4f28-a18c-94ebbaad6c6c
 name: GSA Enriched Office 365 - Multiple Teams deleted by a single user
 description: |
-  'This detection flags the occurrences of deleting multiple teams within an hour.
-  This data is a part of Office 365 Connector in Microsoft Sentinel.'
+  This detection flags the occurrences of deleting multiple teams within a day.
+  This data is a part of Office 365 Connector in Microsoft Sentinel.
 severity: Low
 status: Available
 requiredDataConnectors:
@@ -19,29 +19,29 @@ relevantTechniques:
   - T1485
   - T1489
 query: |
-    // Set the maximum number of deleted teams to flag suspicious activity
-        let max_delete_count = 3;
-        // EnrichedMicrosoft365AuditLogs Query
-        let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-            | where Workload =~ "MicrosoftTeams"
-            | where Operation =~ "TeamDeleted"
-            | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId
-            | where array_length(DeletedTeams) > max_delete_count
-            | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-        // OfficeActivity Query
-        let OfficeEvents = OfficeActivity
-            | where OfficeWorkload =~ "MicrosoftTeams"
-            | where Operation =~ "TeamDeleted"
-            | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId
-            | where array_length(DeletedTeams) > max_delete_count
-            | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-        // Combine and Deduplicate Office and Enriched Logs
-        let CombinedEvents = OfficeEvents
-            | union EnrichedEvents
-            | summarize arg_min(StartTime, *) by UserId;
-        // Final Output
-        CombinedEvents
-        | project StartTime, EndTime, DeletedTeams, UserId, AccountName, AccountUPNSuffix
+  // Set the maximum number of deleted teams to flag suspicious activity
+  let max_delete_count = 3;
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload =~ "MicrosoftTeams"
+      | where Operation =~ "TeamDeleted"
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId
+      | where array_length(DeletedTeams) > max_delete_count
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where OfficeWorkload =~ "MicrosoftTeams"
+      | where Operation =~ "TeamDeleted"
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId
+      | where array_length(DeletedTeams) > max_delete_count
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine and Deduplicate Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTime, *) by UserId;
+  // Final Output
+  CombinedEvents
+      | project StartTime, EndTime, DeletedTeams, UserId, AccountName, AccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -52,4 +52,4 @@ entityMappings:
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
 version: 2.0.6
-kind: Scheduled
\ No newline at end of file
+kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml
index d56fff5a6f..1ab3097e01 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml	
@@ -20,64 +20,64 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
-    // Set query parameters
-        let queryfrequency = 1d;
-        let queryperiod = 7d;
-        // EnrichedMicrosoft365AuditLogs Query
-        let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-        | where TimeGenerated > ago(queryperiod)
-        | where Workload =~ "Exchange"
-        // Uncomment or adjust the following line based on actual field usage
-        // | where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
-        | where tostring(AdditionalProperties.Parameters) has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
-        | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
-            summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
-          )
-        | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
-        | extend DestinationMailAddress = tolower(case(
-            isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
-            isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
-            isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
-            ""))
-        | where isnotempty(DestinationMailAddress)
-        | mv-expand split(DestinationMailAddress, ";")
-        | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
-        | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
-        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
-        | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
-        | mv-expand UserId to typeof(string)
-        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-        // OfficeActivity Query
-        let OfficeEvents = OfficeActivity
-        | where TimeGenerated > ago(queryperiod)
-        | where OfficeWorkload =~ "Exchange"
-        // Uncomment or adjust the following line based on actual field usage
-        // | where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
-        | where Parameters has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
-        | mv-apply DynamicParameters = todynamic(Parameters) on (
-            summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
-          )
-        | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
-        | extend DestinationMailAddress = tolower(case(
-            isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
-            isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
-            isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
-            ""))
-        | where isnotempty(DestinationMailAddress)
-        | mv-expand split(DestinationMailAddress, ";")
-        | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
-        | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
-        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
-        | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
-        | mv-expand UserId to typeof(string)
-        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-        // Combine and Deduplicate Office and Enriched Logs
-        let CombinedEvents = OfficeEvents
-        | union EnrichedEvents
-        | summarize arg_min(StartTime, *) by tostring(DestinationMailAddress), ClientIP;
-        // Final Output
-        CombinedEvents
-        | project StartTime, EndTime, DestinationMailAddress, ClientIP, DistinctUserCount, UserId, Ports, EventCount, AccountName, AccountUPNSuffix
+  // Set query parameters
+  let queryfrequency = 1d;
+  let queryperiod = 7d;
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated > ago(queryperiod)
+      | where Workload =~ "Exchange"
+      // Uncomment or adjust the following line based on actual field usage
+      // | where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
+      | where tostring(AdditionalProperties.Parameters) has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
+      | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
+          summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+        )
+      | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
+      | extend DestinationMailAddress = tolower(case(
+          isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
+          isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
+          isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
+          ""))
+      | where isnotempty(DestinationMailAddress)
+      | mv-expand split(DestinationMailAddress, ";")
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+      | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
+      | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
+      | mv-expand UserId to typeof(string)
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where TimeGenerated > ago(queryperiod)
+      | where OfficeWorkload =~ "Exchange"
+      // Uncomment or adjust the following line based on actual field usage
+      // | where Operation in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
+      | where Parameters has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
+      | mv-apply DynamicParameters = todynamic(Parameters) on (
+          summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+        )
+      | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
+      | extend DestinationMailAddress = tolower(case(
+          isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
+          isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
+          isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
+          ""))
+      | where isnotempty(DestinationMailAddress)
+      | mv-expand split(DestinationMailAddress, ";")
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+      | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
+      | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
+      | mv-expand UserId to typeof(string)
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine and Deduplicate Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTime, *) by tostring(DestinationMailAddress), ClientIP;
+  // Final Output
+  CombinedEvents
+      | project StartTime, EndTime, DestinationMailAddress, ClientIP, DistinctUserCount, UserId, Ports, EventCount, AccountName, AccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml
index ecb8cc0365..954d1961c1 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml	
@@ -22,73 +22,79 @@ relevantTechniques:
   - T1105
   - T1570
 query: |
-    let threshold = 2;
-    let uploadOp = 'FileUploaded';
-    // Extensions that are interesting. Add/Remove to this list as you see fit
-    let execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);
-    let starttime = 8d;
-    let endtime = 1d;
-    // OfficeActivity Query
-    let OfficeEvents = OfficeActivity
-        | where TimeGenerated >= ago(endtime)
-        | where Operation =~ uploadOp
-        | where SourceFileExtension has_any (execExt)
-        | extend RecordType = coalesce(tostring(RecordType), "UnknownRecordType")  // Ensure RecordType is a string
-        | project TimeGenerated, OfficeId, OfficeWorkload = OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName
-        | join kind=leftanti (
-            OfficeActivity
-            | where TimeGenerated between (ago(starttime) .. ago(endtime))
-            | where Operation =~ uploadOp
-            | where SourceFileExtension has_any (execExt)
-            | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName
-            // Uncomment the line below to enforce the threshold
-            //| where PrevSeenCount > threshold
-            | mvexpand SourceRelativeUrl, UserId
-            | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId
-        ) on SourceFileName, SourceRelativeUrl, UserId
-        | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
-        | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
-        | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
-        | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string
-        by OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
-        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-    // EnrichedMicrosoft365AuditLogs Query
-    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-        | where TimeGenerated >= ago(endtime)
-        | where Operation == uploadOp
-        | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
-        | where SourceFileExtension in (execExt)
-        | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-        | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
-        | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-        | extend RecordType = coalesce(tostring(RecordType), "UnknownRecordType")  // Ensure RecordType is a string
-        | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName
-        | join kind=leftanti (
-            EnrichedMicrosoft365AuditLogs
-            | where TimeGenerated between (ago(starttime) .. ago(endtime))
-            | where Operation == uploadOp
-            | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
-            | where SourceFileExtension in (execExt)
-            | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
-            | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-            // Uncomment the line below to enforce the threshold
-            //| where PrevSeenCount > threshold
-            | mvexpand SourceRelativeUrl, UserId
-            | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId
-        ) on SourceFileName, SourceRelativeUrl, UserId
-        | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
-        | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
-        | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
-        | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(tostring(SourceRelativeUrl), 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string
-        by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
-        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-    // Combine Office and Enriched Logs
-    let CombinedEvents = EnrichedEvents
-        | union isfuzzy=true OfficeEvents
-        | summarize arg_min(StartTime, *) by tostring(FileNames), UserId, Site_Url, tostring(RecordType)  // Ensure FileNames and RecordType are strings
-        | order by StartTime desc;
-    CombinedEvents
-    | project StartTime, EndTime, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder, FileNames, UserAgents, AccountName, AccountUPNSuffix;
+  // Set query parameters
+  let threshold = 2;
+  let uploadOp = 'FileUploaded';
+  // Extensions that are interesting. Add/Remove to this list as you see fit
+  let execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);
+  let starttime = 8d;
+  let endtime = 1d;
+  
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where TimeGenerated >= ago(endtime)
+      | where Operation =~ uploadOp
+      | where SourceFileExtension has_any (execExt)
+      | extend RecordType = coalesce(tostring(RecordType), "UnknownRecordType")  // Ensure RecordType is a string
+      | project TimeGenerated, OfficeId, OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName
+      | join kind=leftanti (
+          OfficeActivity
+          | where TimeGenerated between (ago(starttime) .. ago(endtime))
+          | where Operation =~ uploadOp
+          | where SourceFileExtension has_any (execExt)
+          | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName
+          // Uncomment the line below to enforce the threshold
+          //| where PrevSeenCount > threshold
+          | mvexpand SourceRelativeUrl, UserId
+          | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId
+      ) on SourceFileName, SourceRelativeUrl, UserId
+      | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+      | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string
+      by OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated >= ago(endtime)
+      | where Operation == uploadOp
+      | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
+      | where SourceFileExtension in (execExt)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
+      | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+      | extend RecordType = coalesce(tostring(RecordType), "UnknownRecordType")  // Ensure RecordType is a string
+      | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName
+      | join kind=leftanti (
+          EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (ago(starttime) .. ago(endtime))
+          | where Operation == uploadOp
+          | extend SourceFileExtension = extract(@"\.([^\./]+)$", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension
+          | where SourceFileExtension in (execExt)
+          | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)
+          | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+          // Uncomment the line below to enforce the threshold
+          //| where PrevSeenCount > threshold
+          | mvexpand SourceRelativeUrl, UserId
+          | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId
+      ) on SourceFileName, SourceRelativeUrl, UserId
+      | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+      | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(tostring(SourceRelativeUrl), 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string
+      by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+
+  // Combine Office and Enriched Logs
+  let CombinedEvents = EnrichedEvents
+      | union isfuzzy=true OfficeEvents
+      | summarize arg_min(StartTime, *) by tostring(FileNames), UserId, Site_Url, tostring(RecordType)  // Ensure FileNames and RecordType are strings
+      | order by StartTime desc;
+
+  // Final Output
+  CombinedEvents
+      | project StartTime, EndTime, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder, FileNames, UserAgents, AccountName, AccountUPNSuffix;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -101,7 +107,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
   - entityType: URL
     fieldMappings:
       - identifier: Url
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml
index 1e483ccf78..54d0316344 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml	
@@ -22,22 +22,29 @@ query: |
   // OfficeActivity Query
   let OfficeEvents = OfficeActivity
       | where Operation in~ ( "Add-MailboxPermission", "Add-MailboxFolderPermission", "Set-Mailbox", "New-ManagementRoleAssignment", "New-InboxRule", "Set-InboxRule", "Set-TransportRule")
-      and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
+      and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') 
+           and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
       | extend ClientIPOnly = tostring(extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?', dynamic(["IPAddress"]), ClientIP)[0])
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
   // EnrichedMicrosoft365AuditLogs Query
   let EnrichedEvents = EnrichedMicrosoft365AuditLogs
       | where Operation in~ ( "Add-MailboxPermission", "Add-MailboxFolderPermission", "Set-Mailbox", "New-ManagementRoleAssignment", "New-InboxRule", "Set-InboxRule", "Set-TransportRule")
-      and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
+      and not(UserId has_any ('NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\SYSTEM (w3wp)', 'devilfish-applicationaccount') 
+           and Operation in~ ( "Add-MailboxPermission", "Set-Mailbox"))
       | extend ClientIPOnly = tostring(extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?', dynamic(["IPAddress"]), ClientIp)[0])
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
   // Combine and Deduplicate Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
       | summarize arg_min(TimeGenerated, *) by Operation, UserId, ClientIPOnly;
+  
   // Final Output
   CombinedEvents
-  | project TimeGenerated, Operation, UserId, AccountName, AccountUPNSuffix, ClientIPOnly
+      | project TimeGenerated, Operation, UserId, AccountName, AccountUPNSuffix, ClientIPOnly
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -51,9 +58,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIPOnly
-  - entityType: CloudApplication
-    fieldMappings:
-      - identifier: AppId
-        columnName: AppId
 version: 2.0.7
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml
index c5773d2077..b5b02f5145 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml	
@@ -22,6 +22,7 @@ query: |
   let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
   let starttime = 14d;
   let endtime = 1d;
+  
   // Define a baseline of normal user behavior for OfficeActivity
   let userBaselineOffice = OfficeActivity
       | where TimeGenerated between(ago(starttime)..ago(endtime))
@@ -30,6 +31,7 @@ query: |
       | where isnotempty(UserAgent)
       | summarize Count = count() by UserId, Operation, Site_Url, ClientIP
       | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIP;
+  
   // Get recent user activity for OfficeActivity
   let recentUserActivityOffice = OfficeActivity
       | where TimeGenerated > ago(endtime)
@@ -37,6 +39,7 @@ query: |
       | where Operation in~ (szOperations)
       | where isnotempty(UserAgent)
       | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIP, OfficeObjectId, OfficeWorkload, UserAgent;
+  
   // Define a baseline of normal user behavior for EnrichedMicrosoft365AuditLogs
   let userBaselineEnriched = EnrichedMicrosoft365AuditLogs
       | where TimeGenerated between(ago(starttime)..ago(endtime))
@@ -47,6 +50,7 @@ query: |
       | where isnotempty(UserAgent)
       | summarize Count = count() by UserId, Operation, Site_Url, ClientIp
       | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;
+  
   // Get recent user activity for EnrichedMicrosoft365AuditLogs
   let recentUserActivityEnriched = EnrichedMicrosoft365AuditLogs
       | where TimeGenerated > ago(endtime)
@@ -56,15 +60,17 @@ query: |
       | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
       | where isnotempty(UserAgent)
       | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;
+  
   // Combine user baselines and recent activity, calculate deviation, and deduplicate
   let UserBehaviorAnalysis = userBaselineOffice
       | join kind=inner (recentUserActivityOffice) on UserId, Operation, Site_Url, ClientIP
       | union (userBaselineEnriched | join kind=inner (recentUserActivityEnriched) on UserId, Operation, Site_Url, ClientIp)
       | extend Deviation = abs(RecentCount - AvgCount) / AvgCount;
+  
   // Filter for significant deviations
   UserBehaviorAnalysis
       | where Deviation > threshold
-      | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIP, Site_Url, ObjectId, OfficeObjectId, OfficeWorkload, Workload, UserAgent, Deviation, Count=RecentCount
+      | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIP, Site_Url, ObjectId, OfficeObjectId, OfficeWorkload, Workload, UserAgent, Deviation, Count = RecentCount
       | order by Count desc, ClientIP asc, Operation asc, UserId asc
       | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
 entityMappings:
@@ -79,7 +85,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
   - entityType: URL
     fieldMappings:
       - identifier: Url
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index ea908dd604..94d24a64dd 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -17,14 +17,14 @@ tactics:
 relevantTechniques:
   - T1030
 query: |
-    let threshold = 5;
+  let threshold = 5;
   let szSharePointFileOperation = "SharePointFileOperation";
   let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
   let starttime = 14d;
   let endtime = 1d;
   // OfficeActivity - Base Events
   let BaseeventsOffice = OfficeActivity
-      | where TimeGenerated between (ago(starttime) .. ago(endtime))
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
       | where RecordType =~ szSharePointFileOperation
       | where Operation in~ (szOperations)
       | where isnotempty(UserAgent);
@@ -44,11 +44,11 @@ query: |
       | where Operation in~ (szOperations)
       | where isnotempty(UserAgent)
       | where UserAgent in~ (FrequentUAOffice)
-      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
-      by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
+        by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
   // EnrichedMicrosoft365AuditLogs - Base Events
   let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated between (ago(starttime) .. ago(endtime))
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
       | where RecordType == szSharePointFileOperation
       | where Operation in (szOperations)
       | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
@@ -72,8 +72,8 @@ query: |
       | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
       | where isnotempty(UserAgent)
       | where UserAgent in (FrequentUAEnriched)
-      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
-      by RecordType, Operation, UserAgent, UserId, ClientIp, Site_Url;
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
+        by RecordType, Operation, UserAgent, UserId, ClientIp, Site_Url;
   // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
   let UserBehaviorAnalysisOffice = UserBaseLineOffice
       | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
@@ -87,7 +87,8 @@ query: |
   // Filter and Format Final Results
   CombinedUserBehaviorAnalysis
       | where Deviation > 0.25
-      | extend UserIdName = tostring(split(UserId, '@')[0]), UserIdUPNSuffix = tostring(split(UserId, '@')[1])
+      | extend UserIdName = tostring(split(UserId, '@')[0]), 
+               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
       | project-reorder StartTime, EndTime, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
       | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
 entityMappings:
@@ -102,7 +103,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
   - entityType: URL
     fieldMappings:
       - identifier: Url
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml
index 7d21329a56..9ac9b79f19 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml	
@@ -1,7 +1,7 @@
 id: dc451755-8ab3-4059-b805-e454c45d1d44
 name: GSA Enriched Office 365 - Exchange AuditLog Disabled
 description: |
-  'Identifies when the exchange audit logging has been disabled which may be an adversary attempt to evade detection or avoid other defenses.'
+  Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses.
 severity: Medium
 status: Available
 requiredDataConnectors:
@@ -17,37 +17,41 @@ tactics:
 relevantTechniques:
   - T1562
 query: |
-    // OfficeActivity Query
-      let OfficeEvents = OfficeActivity
-          | where OfficeWorkload =~ "Exchange" 
-          | where UserType in~ ("Admin", "DcAdmin")
-          // Only admin or global-admin can disable audit logging
-          | where Operation =~ "Set-AdminAuditLogConfig"
-          | extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(Parameters), 3, 3)))[0])).Value)
-          | where AdminAuditLogEnabledValue =~ "False"
-          | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue
-          | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
-          | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
-          | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
-          | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
-      // EnrichedMicrosoft365AuditLogs Query
-      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-          | where Workload =~ "Exchange"
-          | where UserType in~ ("Admin", "DcAdmin")
-          | where Operation =~ "Set-AdminAuditLogConfig"
-          | extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(tostring(AdditionalProperties.Parameters)), 3, 3)))[0])).Value)
-          | where AdminAuditLogEnabledValue =~ "False"
-          | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue
-          | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
-          | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
-          | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
-          | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
-      // Combine Office and Enriched Events and Deduplicate
-      let CombinedEvents = OfficeEvents
-          | union EnrichedEvents
-          | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;
-      // Project Final Output
-      CombinedEvents
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where OfficeWorkload =~ "Exchange" 
+      | where UserType in~ ("Admin", "DcAdmin")
+      // Only admin or global-admin can disable audit logging
+      | where Operation =~ "Set-AdminAuditLogConfig"
+      | extend ParsedParameters = parse_json(Parameters)
+      | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)
+      | where AdminAuditLogEnabledValue =~ "False"
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
+          by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue
+      | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), 
+                          iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), UserId))
+      | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
+      | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload =~ "Exchange"
+      | where UserType in~ ("Admin", "DcAdmin")
+      | where Operation =~ "Set-AdminAuditLogConfig"
+      | extend ParsedParameters = parse_json(AdditionalProperties.Parameters)
+      | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)
+      | where AdminAuditLogEnabledValue =~ "False"
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
+          by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue
+      | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), 
+                          iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), UserId))
+      | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
+      | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
+  // Combine Office and Enriched Events and Deduplicate
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;
+  // Project Final Output
+  CombinedEvents
       | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain
 entityMappings:
   - entityType: Account
@@ -58,13 +62,9 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-  - entityType: Account
-    fieldMappings:
-      - identifier: Name
-        columnName: AccountNTDomain
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
 version: 2.0.8
-kind: Scheduled
\ No newline at end of file
+kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml
index f07c58f8c8..74ca0aa0cb 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml	
@@ -21,54 +21,69 @@ relevantTechniques:
   - T1098
   - T1562
 query: |
-    // Query for EnrichedMicrosoft365AuditLogs
-    let enrichedOpList = EnrichedMicrosoft365AuditLogs 
-        | summarize by Operation
-        | where Operation has_any ("Remove", "Disable")
-        | where Operation contains "AntiPhish" or Operation contains "SafeAttachment" or Operation contains "SafeLinks" or Operation contains "Dlp" or Operation contains "Audit"
-        | summarize make_set(Operation, 500);
-    let enrichedLogs = EnrichedMicrosoft365AuditLogs
-        | where RecordType == "ExchangeAdmin"
-        | where UserType in~ ("Admin", "DcAdmin")
-        | where Operation in~ (enrichedOpList)
-        | extend ClientIPOnly = case( 
-            ClientIp has ".", tostring(split(ClientIp, ":")[0]), 
-            ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))),
-            ClientIp
-          )  
-        | extend Port = case(
-            ClientIp has ".", tostring(split(ClientIp, ":")[1]),
-            ClientIp has "[", tostring(split(ClientIp, "]:")[1]),
-            ""
-          )
-        | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)
-        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-    // Query for OfficeActivity
-    let officeOpList = OfficeActivity 
+  // Query for EnrichedMicrosoft365AuditLogs
+  let enrichedOpList = EnrichedMicrosoft365AuditLogs 
       | summarize by Operation
       | where Operation has_any ("Remove", "Disable")
-      | where Operation contains "AntiPhish" or Operation contains "SafeAttachment" or Operation contains "SafeLinks" or Operation contains "Dlp" or Operation contains "Audit"
+      | where Operation contains "AntiPhish" 
+          or Operation contains "SafeAttachment" 
+          or Operation contains "SafeLinks" 
+          or Operation contains "Dlp" 
+          or Operation contains "Audit"
       | summarize make_set(Operation, 500);
-    let officeLogs = OfficeActivity
+  
+  let enrichedLogs = EnrichedMicrosoft365AuditLogs
+      | where RecordType == "ExchangeAdmin"
+      | where UserType in~ ("Admin", "DcAdmin")
+      | where Operation in~ (enrichedOpList)
+      | extend ClientIPOnly = case( 
+          ClientIp has ".", tostring(split(ClientIp, ":")[0]), 
+          ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))),
+          ClientIp
+        )  
+      | extend Port = case(
+          ClientIp has ".", tostring(split(ClientIp, ":")[1]),
+          ClientIp has "[", tostring(split(ClientIp, "]:")[1]),
+          ""
+        )
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
+          by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
+  // Query for OfficeActivity
+  let officeOpList = OfficeActivity 
+      | summarize by Operation
+      | where Operation has_any ("Remove", "Disable")
+      | where Operation contains "AntiPhish" 
+          or Operation contains "SafeAttachment" 
+          or Operation contains "SafeLinks" 
+          or Operation contains "Dlp" 
+          or Operation contains "Audit"
+      | summarize make_set(Operation, 500);
+  
+  let officeLogs = OfficeActivity
       | where RecordType =~ "ExchangeAdmin"
       | where UserType in~ ("Admin","DcAdmin")
       | where Operation in~ (officeOpList)
       | extend ClientIPOnly = case( 
           ClientIP has ".", tostring(split(ClientIP,":")[0]), 
-          ClientIP has "[", tostring(trim_start(@'[[]',tostring(split(ClientIP,"]")[0]))),
+          ClientIP has "[", tostring(trim_start(@'[[]', tostring(split(ClientIP,"]")[0]))),
           ClientIP
         )  
       | extend Port = case(
           ClientIP has ".", tostring(split(ClientIP,":")[1]),
-          ClientIP has "[", tostring(split(ClientIP,"]:")[1]),
+          ClientIP has "[", tostring(split(ClientIP, "]:")[1]),
           ""
         )
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
+          by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters
       | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-    // Combine Enriched Logs and Office Activity Logs
-    union isfuzzy=true enrichedLogs, officeLogs
-    | summarize StartTimeUtc = min(StartTimeUtc), EndTimeUtc = max(EndTimeUtc), TotalOperationCount = sum(OperationCount) by Operation, UserType, UserId, ClientIP, Port, ResultStatus, Parameters, AccountName, AccountUPNSuffix
-    | order by StartTimeUtc desc;
+  
+  // Combine Enriched Logs and Office Activity Logs
+  union isfuzzy=true enrichedLogs, officeLogs
+  | summarize StartTimeUtc = min(StartTimeUtc), EndTimeUtc = max(EndTimeUtc), TotalOperationCount = sum(OperationCount) 
+      by Operation, UserType, UserId, ClientIP, Port, ResultStatus, Parameters, AccountName, AccountUPNSuffix
+  | order by StartTimeUtc desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 02dfc1c3b6..a1e0172802 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -4,6 +4,7 @@ description: |
   Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
 severity: Medium
+status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
@@ -23,27 +24,32 @@ query: |
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_ObjectId=dcount(ObjectId), fileslist=make_set(ObjectId, 10000) 
-      by UserId, ClientIp, bin(TimeGenerated, 15m)
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
   // OfficeActivity Query
   let OfficeEvents = OfficeActivity
       | where EventSource == "SharePoint" 
       | where OfficeWorkload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_OfficeObjectId=dcount(OfficeObjectId), fileslist=make_set(OfficeObjectId, 10000) 
-      by UserId, ClientIP, bin(TimeGenerated, 15m)
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
       | where count_distinct_OfficeObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
       | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
+  
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
       | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
@@ -57,7 +63,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
   - entityType: File
     fieldMappings:
       - identifier: Name
@@ -76,5 +82,5 @@ incidentConfiguration:
       - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 1.0.6
+version: 2.0.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index e5bbb44ee0..a8541ad738 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -4,6 +4,7 @@ description: |
   Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
 severity: Medium
+status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
@@ -17,36 +18,42 @@ tactics:
 relevantTechniques:
   - T1020
 query: |
-    let threshold = 500;
-      // OfficeActivity Query
-      let OfficeEvents = OfficeActivity
-          | where EventSource == "SharePoint" 
-          | where OfficeWorkload has_any("SharePoint", "OneDrive") 
-          | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-          | summarize count_distinct_SourceRelativeUrl = dcount(SourceRelativeUrl), dirlist = make_set(SourceRelativeUrl, 10000)
-          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
-          | where count_distinct_SourceRelativeUrl >= threshold
-          | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
-          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-      // EnrichedMicrosoft365AuditLogs Query
-      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-          | where Workload has_any("SharePoint", "OneDrive")
-          | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-          | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
-          | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-          | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000)
+  let threshold = 500;
+  
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint" 
+      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_SourceRelativeUrl = dcount(SourceRelativeUrl), dirlist = make_set(SourceRelativeUrl, 10000)
           by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)
-          | where count_distinct_ObjectId >= threshold
-          | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
-          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-      // Combine Office and Enriched Logs
-      let CombinedEvents = OfficeEvents
-          | union EnrichedEvents
-          | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
-      // Final Output
-      CombinedEvents
-          | project TimeGenerated, UserId, ClientIP, UserAgent, AccountName, AccountUPNSuffix, DirSample, count_distinct_SourceRelativeUrl
-          | order by TimeGenerated desc
+      | where count_distinct_SourceRelativeUrl >= threshold
+      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive")
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000)
+          by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIp, UserAgent;
+  
+  // Final Output
+  CombinedEvents
+      | project TimeGenerated, UserId, ClientIp, AccountName, AccountUPNSuffix, DirSample, count_distinct_SourceRelativeUrl, count_distinct_ObjectId, dirlist
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -78,5 +85,5 @@ incidentConfiguration:
       - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 1.0.6
+version: 2.0.7
 kind: Scheduled

From 17582eeac9546ecc0400dfb7fee58f848abd3fca Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 10:20:56 +0300
Subject: [PATCH 03/27] kql validation fixes

---
 ... Mail_redirect_via_ExO_transport_rule.yaml |  98 ++++++------
 ...- SharePoint_Downloads_byNewUserAgent.yaml | 145 +++++++----------
 ...repoint_file_transfer_above_threshold.yaml |  11 +-
 ...file_transfer_folders_above_threshold.yaml | 151 +++++++++++-------
 4 files changed, 206 insertions(+), 199 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index 8927e62141..c22cb23c12 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -1,63 +1,59 @@
-id: edcfc2e0-3134-434c-8074-9101c530d419
-name: GSA Enriched Office 365 - Mail redirect via ExO transport rule
+id: dc451755-8ab3-4059-b805-e454c45d1d44
+name: GSA Enriched Office 365 - Exchange AuditLog Disabled
 description: |
-  Identifies when Exchange Online transport rule configured to forward emails.
-  This could be an adversary mailbox configured to collect mail from multiple user accounts.
+  Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses.
 severity: Medium
-status: Available 
+status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 1h
-queryPeriod: 1h
+queryFrequency: 1d
+queryPeriod: 1d
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
-  - Collection
-  - Exfiltration
+  - DefenseEvasion
 relevantTechniques:
-  - T1114
-  - T1020
+  - T1562
 query: |
-  let officeActivityQuery = OfficeActivity
-    | where OfficeWorkload == "Exchange"
-    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-    | mv-apply DynamicParameters = todynamic(Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
-    | extend RuleName = case(
-        Operation =~ "Set-TransportRule", OfficeObjectId,
-        Operation =~ "New-TransportRule", ParsedParameters.Name,
-        "Unknown")
-    | mv-expand ExpandedParameters = todynamic(Parameters)
-    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
-    | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
-    | extend From = ParsedParameters.From
-    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
-    | where Workload == "Exchange"
-    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
-        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
-      )
-    | extend RuleName = case(
-        Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to OfficeObjectId
-        Operation =~ "New-TransportRule", ParsedParameters.Name,
-        "Unknown"
-      )
-    | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
-    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
-    | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
-    | extend From = ParsedParameters.From
-    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  // Combine both queries
-  union isfuzzy=true officeActivityQuery, enrichedLogsQuery
-  | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
-  | project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix
-  | order by TimeGenerated desc;
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where OfficeWorkload =~ "Exchange" 
+      | where UserType in~ ("Admin", "DcAdmin")
+      // Only admin or global-admin can disable audit logging
+      | where Operation =~ "Set-AdminAuditLogConfig"
+      | extend ParsedParameters = parse_json(Parameters)
+      | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)
+      | where AdminAuditLogEnabledValue =~ "False"
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
+          by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue
+      | extend AccountName = iff(UserId contains '@', tostring(split(UserId, "@")[0]), 
+                          iff(UserId contains '\\', tostring(split(UserId, "\\")[1]), UserId))
+      | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, "@")[1]), '')
+      | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, "\\")[0]), '');
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload =~ "Exchange"
+      | where UserType in~ ("Admin", "DcAdmin")
+      | where Operation =~ "Set-AdminAuditLogConfig"
+      | extend ParsedParameters = parse_json(AdditionalProperties.Parameters)
+      | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)
+      | where AdminAuditLogEnabledValue =~ "False"
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
+          by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue
+      | extend AccountName = iff(UserId contains '@', tostring(split(UserId, "@")[0]), 
+                          iff(UserId contains '\\', tostring(split(UserId, "\\")[1]), UserId))
+      | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, "@")[1]), '')
+      | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, "\\")[0]), '');
+  // Combine Office and Enriched Events and Deduplicate
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;
+  // Project Final Output
+  CombinedEvents
+      | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain
+      | order by StartTimeUtc desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -70,6 +66,6 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: IPAddress
-version: 2.1.4
+        columnName: ClientIP
+version: 2.0.8
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 94d24a64dd..28cacf36af 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -1,112 +1,87 @@
-id: efd17c5f-5167-40f8-a1e9-0818940785d9
-name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
+id: 30375d00-68cc-4f95-b89a-68064d566358
+name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
+  Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
+  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 1d
-queryPeriod: 14d
+queryFrequency: 15m
+queryPeriod: 15m
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
   - Exfiltration
 relevantTechniques:
-  - T1030
+  - T1020
 query: |
-  let threshold = 5;
-  let szSharePointFileOperation = "SharePointFileOperation";
-  let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
-  let starttime = 14d;
-  let endtime = 1d;
-  // OfficeActivity - Base Events
-  let BaseeventsOffice = OfficeActivity
-      | where TimeGenerated between (ago(starttime)..ago(endtime))
-      | where RecordType =~ szSharePointFileOperation
-      | where Operation in~ (szOperations)
-      | where isnotempty(UserAgent);
-  // OfficeActivity - Frequent User Agents
-  let FrequentUAOffice = BaseeventsOffice
-      | summarize FUACount = count() by UserAgent, RecordType, Operation
-      | where FUACount >= threshold
-      | distinct UserAgent;
-  // OfficeActivity - User Baseline
-  let UserBaseLineOffice = BaseeventsOffice
-      | summarize Count = count() by UserId, Operation, Site_Url
-      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  // OfficeActivity - Recent User Activity
-  let RecentActivityOffice = OfficeActivity
-      | where TimeGenerated > ago(endtime)
-      | where RecordType =~ szSharePointFileOperation
-      | where Operation in~ (szOperations)
-      | where isnotempty(UserAgent)
-      | where UserAgent in~ (FrequentUAOffice)
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
-        by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
-  // EnrichedMicrosoft365AuditLogs - Base Events
-  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated between (ago(starttime)..ago(endtime))
-      | where RecordType == szSharePointFileOperation
-      | where Operation in (szOperations)
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(UserAgent);
-  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
-  let FrequentUAEnriched = BaseeventsEnriched
-      | summarize FUACount = count() by UserAgent, RecordType, Operation
-      | where FUACount >= threshold
-      | distinct UserAgent;
-  // EnrichedMicrosoft365AuditLogs - User Baseline
-  let UserBaseLineEnriched = BaseeventsEnriched
-      | summarize Count = count() by UserId, Operation, Site_Url
-      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  // EnrichedMicrosoft365AuditLogs - Recent User Activity
-  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated > ago(endtime)
-      | where RecordType == szSharePointFileOperation
-      | where Operation in (szOperations)
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(UserAgent)
-      | where UserAgent in (FrequentUAEnriched)
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
-        by RecordType, Operation, UserAgent, UserId, ClientIp, Site_Url;
-  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
-  let UserBehaviorAnalysisOffice = UserBaseLineOffice
-      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
-      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
-  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
-      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
-      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+  let threshold = 5000;
+  
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint" 
+      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
+      | where count_distinct_OfficeObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  
   // Combine Office and Enriched Logs
-  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
-      | union UserBehaviorAnalysisEnriched;
-  // Filter and Format Final Results
-  CombinedUserBehaviorAnalysis
-      | where Deviation > 0.25
-      | extend UserIdName = tostring(split(UserId, '@')[0]), 
-               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
-      | project-reorder StartTime, EndTime, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
-      | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
+  
+  // Final Output
+  CombinedEvents
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: FullName
         columnName: UserId
       - identifier: Name
-        columnName: UserIdName
+        columnName: AccountName
       - identifier: UPNSuffix
-        columnName: UserIdUPNSuffix
+        columnName: AccountUPNSuffix
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-  - entityType: URL
+  - entityType: File
     fieldMappings:
-      - identifier: Url
-        columnName: Site_Url
-version: 2.2.6
+      - identifier: Name
+        columnName: FileSample
+customDetails:
+  TransferCount: count_distinct_ObjectId
+  FilesList: fileslist
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+      - Account
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+version: 2.0.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index a1e0172802..2a3ac82eaa 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -19,12 +19,13 @@ relevantTechniques:
   - T1020
 query: |
   let threshold = 5000;
+  
   // EnrichedMicrosoft365AuditLogs Query
   let EnrichedEvents = EnrichedMicrosoft365AuditLogs
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_ObjectId=dcount(ObjectId), fileslist=make_set(ObjectId, 10000) 
-          by UserId, ClientIP, bin(TimeGenerated, 15m)
+          by UserId, ClientIp, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
@@ -36,7 +37,7 @@ query: |
       | where OfficeWorkload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_OfficeObjectId=dcount(OfficeObjectId), fileslist=make_set(OfficeObjectId, 10000) 
-          by UserId, ClientIP, bin(TimeGenerated, 15m)
+          by UserId, ClientIp, bin(TimeGenerated, 15m)
       | where count_distinct_OfficeObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
@@ -45,11 +46,11 @@ query: |
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIp;
   
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+      | project TimeGenerated, UserId, ClientIp, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
       | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
@@ -63,7 +64,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIP
+        columnName: ClientIp
   - entityType: File
     fieldMappings:
       - identifier: Name
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index a8541ad738..4508159a51 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -1,89 +1,124 @@
-id: abd6976d-8f71-4851-98c4-4d086201319c
-name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
+id: efd17c5f-5167-40f8-a1e9-0818940785d9
+name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
 description: |
-  Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.
-  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
+  Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 15m
-queryPeriod: 15m
+queryFrequency: 1d
+queryPeriod: 14d
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
   - Exfiltration
 relevantTechniques:
-  - T1020
+  - T1030
 query: |
-  let threshold = 500;
+  let threshold = 5;
+  let szSharePointFileOperation = "SharePointFileOperation";
+  let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
+  let starttime = 14d;
+  let endtime = 1d;
   
-  // OfficeActivity Query
-  let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint" 
-      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_SourceRelativeUrl = dcount(SourceRelativeUrl), dirlist = make_set(SourceRelativeUrl, 10000)
-          by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)
-      | where count_distinct_SourceRelativeUrl >= threshold
-      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity - Base Events
+  let BaseeventsOffice = OfficeActivity
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent);
   
-  // EnrichedMicrosoft365AuditLogs Query
-  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive")
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
+  // OfficeActivity - Frequent User Agents
+  let FrequentUAOffice = BaseeventsOffice
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  
+  // OfficeActivity - User Baseline
+  let UserBaseLineOffice = BaseeventsOffice
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  
+  // OfficeActivity - Recent User Activity
+  let RecentActivityOffice = OfficeActivity
+      | where TimeGenerated > ago(endtime)
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent)
+      | where UserAgent in~ (FrequentUAOffice)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
+          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
+  
+  // EnrichedMicrosoft365AuditLogs - Base Events
+  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent);
+  
+  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
+  let FrequentUAEnriched = BaseeventsEnriched
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  
+  // EnrichedMicrosoft365AuditLogs - User Baseline
+  let UserBaseLineEnriched = BaseeventsEnriched
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  
+  // EnrichedMicrosoft365AuditLogs - Recent User Activity
+  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated > ago(endtime)
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
       | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000)
-          by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent)
+      | where UserAgent in (FrequentUAEnriched)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
+          by RecordType, Operation, UserAgent, UserId, ClientIP, Site_Url;
+  
+  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
+  let UserBehaviorAnalysisOffice = UserBaseLineOffice
+      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+  
+  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
+      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
   
   // Combine Office and Enriched Logs
-  let CombinedEvents = OfficeEvents
-      | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIp, UserAgent;
+  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
+      | union UserBehaviorAnalysisEnriched;
   
-  // Final Output
-  CombinedEvents
-      | project TimeGenerated, UserId, ClientIp, AccountName, AccountUPNSuffix, DirSample, count_distinct_SourceRelativeUrl, count_distinct_ObjectId, dirlist
-      | order by TimeGenerated desc
+  // Filter and Format Final Results
+  CombinedUserBehaviorAnalysis
+      | where Deviation > 0.25
+      | extend UserIdName = tostring(split(UserId, '@')[0]), 
+               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
+      | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
+      | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: FullName
         columnName: UserId
       - identifier: Name
-        columnName: AccountName
+        columnName: UserIdName
       - identifier: UPNSuffix
-        columnName: AccountUPNSuffix
+        columnName: UserIdUPNSuffix
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
-  - entityType: File
+        columnName: ClientIP
+  - entityType: URL
     fieldMappings:
-      - identifier: Name
-        columnName: DirSample
-customDetails:
-  TransferCount: count_distinct_ObjectId
-  FilesList: dirlist
-incidentConfiguration:
-  createIncident: true
-  groupingConfiguration:
-    enabled: true
-    reopenClosedIncident: false
-    lookbackDuration: 5h
-    matchingMethod: Selected
-    groupByEntities:
-      - Account
-    groupByAlertDetails: []
-    groupByCustomDetails: []
-version: 2.0.7
+      - identifier: Url
+        columnName: Site_Url
+version: 2.2.6
 kind: Scheduled

From 8c991687753027bd78b30f4ff787f01fa836bc90 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 10:43:30 +0300
Subject: [PATCH 04/27] Fix IDs issues

---
 ... Mail_redirect_via_ExO_transport_rule.yaml |  98 ++++++------
 ...- SharePoint_Downloads_byNewUserAgent.yaml | 149 +++++++++++-------
 ...file_transfer_folders_above_threshold.yaml | 149 +++++++-----------
 3 files changed, 201 insertions(+), 195 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index c22cb23c12..8927e62141 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -1,59 +1,63 @@
-id: dc451755-8ab3-4059-b805-e454c45d1d44
-name: GSA Enriched Office 365 - Exchange AuditLog Disabled
+id: edcfc2e0-3134-434c-8074-9101c530d419
+name: GSA Enriched Office 365 - Mail redirect via ExO transport rule
 description: |
-  Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses.
+  Identifies when Exchange Online transport rule configured to forward emails.
+  This could be an adversary mailbox configured to collect mail from multiple user accounts.
 severity: Medium
-status: Available
+status: Available 
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 1d
-queryPeriod: 1d
+queryFrequency: 1h
+queryPeriod: 1h
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
-  - DefenseEvasion
+  - Collection
+  - Exfiltration
 relevantTechniques:
-  - T1562
+  - T1114
+  - T1020
 query: |
-  // OfficeActivity Query
-  let OfficeEvents = OfficeActivity
-      | where OfficeWorkload =~ "Exchange" 
-      | where UserType in~ ("Admin", "DcAdmin")
-      // Only admin or global-admin can disable audit logging
-      | where Operation =~ "Set-AdminAuditLogConfig"
-      | extend ParsedParameters = parse_json(Parameters)
-      | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)
-      | where AdminAuditLogEnabledValue =~ "False"
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
-          by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue
-      | extend AccountName = iff(UserId contains '@', tostring(split(UserId, "@")[0]), 
-                          iff(UserId contains '\\', tostring(split(UserId, "\\")[1]), UserId))
-      | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, "@")[1]), '')
-      | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, "\\")[0]), '');
-  // EnrichedMicrosoft365AuditLogs Query
-  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload =~ "Exchange"
-      | where UserType in~ ("Admin", "DcAdmin")
-      | where Operation =~ "Set-AdminAuditLogConfig"
-      | extend ParsedParameters = parse_json(AdditionalProperties.Parameters)
-      | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)
-      | where AdminAuditLogEnabledValue =~ "False"
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() 
-          by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue
-      | extend AccountName = iff(UserId contains '@', tostring(split(UserId, "@")[0]), 
-                          iff(UserId contains '\\', tostring(split(UserId, "\\")[1]), UserId))
-      | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, "@")[1]), '')
-      | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, "\\")[0]), '');
-  // Combine Office and Enriched Events and Deduplicate
-  let CombinedEvents = OfficeEvents
-      | union EnrichedEvents
-      | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;
-  // Project Final Output
-  CombinedEvents
-      | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain
-      | order by StartTimeUtc desc
+  let officeActivityQuery = OfficeActivity
+    | where OfficeWorkload == "Exchange"
+    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
+    | mv-apply DynamicParameters = todynamic(Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
+    | extend RuleName = case(
+        Operation =~ "Set-TransportRule", OfficeObjectId,
+        Operation =~ "New-TransportRule", ParsedParameters.Name,
+        "Unknown")
+    | mv-expand ExpandedParameters = todynamic(Parameters)
+    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+    | extend RedirectTo = ExpandedParameters.Value
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend From = ParsedParameters.From
+    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
+    | where Workload == "Exchange"
+    | where Operation in~ ("New-TransportRule", "Set-TransportRule")
+    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
+        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
+    | extend RuleName = case(
+        Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to OfficeObjectId
+        Operation =~ "New-TransportRule", ParsedParameters.Name,
+        "Unknown"
+      )
+    | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
+    | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+    | extend RedirectTo = ExpandedParameters.Value
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend From = ParsedParameters.From
+    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine both queries
+  union isfuzzy=true officeActivityQuery, enrichedLogsQuery
+  | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
+  | project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix
+  | order by TimeGenerated desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -66,6 +70,6 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIP
-version: 2.0.8
+        columnName: IPAddress
+version: 2.1.4
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 28cacf36af..4508159a51 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -1,87 +1,124 @@
-id: 30375d00-68cc-4f95-b89a-68064d566358
-name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
+id: efd17c5f-5167-40f8-a1e9-0818940785d9
+name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
 description: |
-  Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
-  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
+  Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 15m
-queryPeriod: 15m
+queryFrequency: 1d
+queryPeriod: 14d
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
   - Exfiltration
 relevantTechniques:
-  - T1020
+  - T1030
 query: |
-  let threshold = 5000;
+  let threshold = 5;
+  let szSharePointFileOperation = "SharePointFileOperation";
+  let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
+  let starttime = 14d;
+  let endtime = 1d;
   
-  // EnrichedMicrosoft365AuditLogs Query
-  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
-          by UserId, ClientIP, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity - Base Events
+  let BaseeventsOffice = OfficeActivity
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent);
   
-  // OfficeActivity Query
-  let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint" 
-      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
-          by UserId, ClientIP, bin(TimeGenerated, 15m)
-      | where count_distinct_OfficeObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity - Frequent User Agents
+  let FrequentUAOffice = BaseeventsOffice
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  
+  // OfficeActivity - User Baseline
+  let UserBaseLineOffice = BaseeventsOffice
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  
+  // OfficeActivity - Recent User Activity
+  let RecentActivityOffice = OfficeActivity
+      | where TimeGenerated > ago(endtime)
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent)
+      | where UserAgent in~ (FrequentUAOffice)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
+          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
+  
+  // EnrichedMicrosoft365AuditLogs - Base Events
+  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent);
+  
+  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
+  let FrequentUAEnriched = BaseeventsEnriched
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  
+  // EnrichedMicrosoft365AuditLogs - User Baseline
+  let UserBaseLineEnriched = BaseeventsEnriched
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  
+  // EnrichedMicrosoft365AuditLogs - Recent User Activity
+  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated > ago(endtime)
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent)
+      | where UserAgent in (FrequentUAEnriched)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
+          by RecordType, Operation, UserAgent, UserId, ClientIP, Site_Url;
+  
+  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
+  let UserBehaviorAnalysisOffice = UserBaseLineOffice
+      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+  
+  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
+      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
   
   // Combine Office and Enriched Logs
-  let CombinedEvents = OfficeEvents
-      | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
+  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
+      | union UserBehaviorAnalysisEnriched;
   
-  // Final Output
-  CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
-      | order by TimeGenerated desc
+  // Filter and Format Final Results
+  CombinedUserBehaviorAnalysis
+      | where Deviation > 0.25
+      | extend UserIdName = tostring(split(UserId, '@')[0]), 
+               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
+      | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
+      | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: FullName
         columnName: UserId
       - identifier: Name
-        columnName: AccountName
+        columnName: UserIdName
       - identifier: UPNSuffix
-        columnName: AccountUPNSuffix
+        columnName: UserIdUPNSuffix
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-  - entityType: File
+  - entityType: URL
     fieldMappings:
-      - identifier: Name
-        columnName: FileSample
-customDetails:
-  TransferCount: count_distinct_ObjectId
-  FilesList: fileslist
-incidentConfiguration:
-  createIncident: true
-  groupingConfiguration:
-    enabled: true
-    reopenClosedIncident: false
-    lookbackDuration: 5h
-    matchingMethod: Selected
-    groupByEntities:
-      - Account
-    groupByAlertDetails: []
-    groupByCustomDetails: []
-version: 2.0.6
+      - identifier: Url
+        columnName: Site_Url
+version: 2.2.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index 4508159a51..08958fec1f 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -1,124 +1,89 @@
-id: efd17c5f-5167-40f8-a1e9-0818940785d9
-name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
+id: abd6976d-8f71-4851-98c4-4d086201319c
+name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
+  Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.
+  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 1d
-queryPeriod: 14d
+queryFrequency: 15m
+queryPeriod: 15m
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
   - Exfiltration
 relevantTechniques:
-  - T1030
+  - T1020
 query: |
-  let threshold = 5;
-  let szSharePointFileOperation = "SharePointFileOperation";
-  let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
-  let starttime = 14d;
-  let endtime = 1d;
+  let threshold = 500;
   
-  // OfficeActivity - Base Events
-  let BaseeventsOffice = OfficeActivity
-      | where TimeGenerated between (ago(starttime)..ago(endtime))
-      | where RecordType =~ szSharePointFileOperation
-      | where Operation in~ (szOperations)
-      | where isnotempty(UserAgent);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint" 
+      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_SourceRelativeUrl = dcount(SourceRelativeUrl), dirlist = make_set(SourceRelativeUrl, 10000)
+          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
+      | where count_distinct_SourceRelativeUrl >= threshold
+      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   
-  // OfficeActivity - Frequent User Agents
-  let FrequentUAOffice = BaseeventsOffice
-      | summarize FUACount = count() by UserAgent, RecordType, Operation
-      | where FUACount >= threshold
-      | distinct UserAgent;
-  
-  // OfficeActivity - User Baseline
-  let UserBaseLineOffice = BaseeventsOffice
-      | summarize Count = count() by UserId, Operation, Site_Url
-      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  
-  // OfficeActivity - Recent User Activity
-  let RecentActivityOffice = OfficeActivity
-      | where TimeGenerated > ago(endtime)
-      | where RecordType =~ szSharePointFileOperation
-      | where Operation in~ (szOperations)
-      | where isnotempty(UserAgent)
-      | where UserAgent in~ (FrequentUAOffice)
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
-  
-  // EnrichedMicrosoft365AuditLogs - Base Events
-  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated between (ago(starttime)..ago(endtime))
-      | where RecordType == szSharePointFileOperation
-      | where Operation in (szOperations)
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(UserAgent);
-  
-  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
-  let FrequentUAEnriched = BaseeventsEnriched
-      | summarize FUACount = count() by UserAgent, RecordType, Operation
-      | where FUACount >= threshold
-      | distinct UserAgent;
-  
-  // EnrichedMicrosoft365AuditLogs - User Baseline
-  let UserBaseLineEnriched = BaseeventsEnriched
-      | summarize Count = count() by UserId, Operation, Site_Url
-      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  
-  // EnrichedMicrosoft365AuditLogs - Recent User Activity
-  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated > ago(endtime)
-      | where RecordType == szSharePointFileOperation
-      | where Operation in (szOperations)
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive")
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
       | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(UserAgent)
-      | where UserAgent in (FrequentUAEnriched)
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserId, ClientIP, Site_Url;
-  
-  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
-  let UserBehaviorAnalysisOffice = UserBaseLineOffice
-      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
-      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
-  
-  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
-      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
-      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+      | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000)
+          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   
   // Combine Office and Enriched Logs
-  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
-      | union UserBehaviorAnalysisEnriched;
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
   
-  // Filter and Format Final Results
-  CombinedUserBehaviorAnalysis
-      | where Deviation > 0.25
-      | extend UserIdName = tostring(split(UserId, '@')[0]), 
-               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
-      | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
-      | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
+  // Final Output
+  CombinedEvents
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, DirSample, count_distinct_SourceRelativeUrl, count_distinct_ObjectId, dirlist
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: FullName
         columnName: UserId
       - identifier: Name
-        columnName: UserIdName
+        columnName: AccountName
       - identifier: UPNSuffix
-        columnName: UserIdUPNSuffix
+        columnName: AccountUPNSuffix
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-  - entityType: URL
+  - entityType: File
     fieldMappings:
-      - identifier: Url
-        columnName: Site_Url
-version: 2.2.6
+      - identifier: Name
+        columnName: DirSample
+customDetails:
+  TransferCount: count_distinct_ObjectId
+  FilesList: dirlist
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+      - Account
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+version: 2.0.7
 kind: Scheduled

From e8fb60005966ddee56956cccf4ee98c5759265fd Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 11:08:40 +0300
Subject: [PATCH 05/27] KQL Issues

---
 ... Mail_redirect_via_ExO_transport_rule.yaml | 25 ++++++-----
 ...repoint_file_transfer_above_threshold.yaml | 16 +++----
 ...file_transfer_folders_above_threshold.yaml | 44 +++++++++----------
 3 files changed, 44 insertions(+), 41 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index 8927e62141..d7f6ad2cfd 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -1,10 +1,10 @@
 id: edcfc2e0-3134-434c-8074-9101c530d419
-name: GSA Enriched Office 365 - Mail redirect via ExO transport rule
+name: GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule
 description: |
-  Identifies when Exchange Online transport rule configured to forward emails.
-  This could be an adversary mailbox configured to collect mail from multiple user accounts.
+  Identifies when an Exchange Online transport rule is configured to forward emails.
+  This could indicate an adversary mailbox configured to collect mail from multiple user accounts.
 severity: Medium
-status: Available 
+status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
@@ -23,18 +23,22 @@ query: |
   let officeActivityQuery = OfficeActivity
     | where OfficeWorkload == "Exchange"
     | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-    | mv-apply DynamicParameters = todynamic(Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
+    | mv-apply DynamicParameters = todynamic(Parameters) on (
+        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
     | extend RuleName = case(
         Operation =~ "Set-TransportRule", OfficeObjectId,
         Operation =~ "New-TransportRule", ParsedParameters.Name,
-        "Unknown")
+        "Unknown"
+      )
     | mv-expand ExpandedParameters = todynamic(Parameters)
     | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
     | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
     | extend From = ParsedParameters.From
     | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    | extend AccountName = tostring(split(UserId, "@")[0]), 
+             AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
     | where Workload == "Exchange"
     | where Operation in~ ("New-TransportRule", "Set-TransportRule")
@@ -49,10 +53,11 @@ query: |
     | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
     | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
     | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
     | extend From = ParsedParameters.From
     | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+    | extend AccountName = tostring(split(UserId, "@")[0]), 
+             AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   // Combine both queries
   union isfuzzy=true officeActivityQuery, enrichedLogsQuery
   | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 2a3ac82eaa..43db365da9 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -24,8 +24,8 @@ query: |
   let EnrichedEvents = EnrichedMicrosoft365AuditLogs
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_ObjectId=dcount(ObjectId), fileslist=make_set(ObjectId, 10000) 
-          by UserId, ClientIp, bin(TimeGenerated, 15m)
+      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
@@ -36,8 +36,8 @@ query: |
       | where EventSource == "SharePoint" 
       | where OfficeWorkload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_OfficeObjectId=dcount(OfficeObjectId), fileslist=make_set(OfficeObjectId, 10000) 
-          by UserId, ClientIp, bin(TimeGenerated, 15m)
+      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
       | where count_distinct_OfficeObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
@@ -46,11 +46,11 @@ query: |
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIp;
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
   
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIp, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
       | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
@@ -64,7 +64,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
   - entityType: File
     fieldMappings:
       - identifier: Name
@@ -83,5 +83,5 @@ incidentConfiguration:
       - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 2.0.6
+version: 2.0.7
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index 08958fec1f..bae75e117f 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -18,41 +18,39 @@ tactics:
 relevantTechniques:
   - T1020
 query: |
-  let threshold = 500;
+  let threshold = 5000;
   
-  // OfficeActivity Query
-  let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint" 
-      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_SourceRelativeUrl = dcount(SourceRelativeUrl), dirlist = make_set(SourceRelativeUrl, 10000)
-          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
-      | where count_distinct_SourceRelativeUrl >= threshold
-      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
+          by UserId, ClientIp = SourceIp, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
                AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   
-  // EnrichedMicrosoft365AuditLogs Query
-  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive")
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint" 
+      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000)
-          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField", "_", tostring(hash(tostring(dirlist)))))
+      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
+          by UserId, ClientIp, bin(TimeGenerated, 15m)
+      | where count_distinct_OfficeObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
                AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIp, UserAgent;
   
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, DirSample, count_distinct_SourceRelativeUrl, count_distinct_ObjectId, dirlist
+      | project TimeGenerated, UserId, ClientIp, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
       | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
@@ -66,14 +64,14 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIP
+        columnName: ClientIp
   - entityType: File
     fieldMappings:
       - identifier: Name
-        columnName: DirSample
+        columnName: FileSample
 customDetails:
   TransferCount: count_distinct_ObjectId
-  FilesList: dirlist
+  FilesList: fileslist
 incidentConfiguration:
   createIncident: true
   groupingConfiguration:

From f2f7140f37ed1bd5026e053792372957a0de690c Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 11:36:29 +0300
Subject: [PATCH 06/27] ClientIp issues

---
 ... Mail_redirect_via_ExO_transport_rule.yaml |   9 +-
 ...- SharePoint_Downloads_byNewUserAgent.yaml | 149 +++++++-----------
 ...repoint_file_transfer_above_threshold.yaml |   2 +-
 ...file_transfer_folders_above_threshold.yaml |  11 +-
 4 files changed, 69 insertions(+), 102 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index d7f6ad2cfd..bdc22aa86b 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -34,11 +34,12 @@ query: |
     | mv-expand ExpandedParameters = todynamic(Parameters)
     | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
     | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
     | extend From = ParsedParameters.From
     | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
     | extend AccountName = tostring(split(UserId, "@")[0]), 
              AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+
   let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
     | where Workload == "Exchange"
     | where Operation in~ ("New-TransportRule", "Set-TransportRule")
@@ -53,11 +54,13 @@ query: |
     | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
     | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
     | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
     | extend From = ParsedParameters.From
-    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)
+    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters), UserAgent
     | extend AccountName = tostring(split(UserId, "@")[0]), 
              AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+
   // Combine both queries
   union isfuzzy=true officeActivityQuery, enrichedLogsQuery
   | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 4508159a51..71c4021df2 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -1,124 +1,87 @@
-id: efd17c5f-5167-40f8-a1e9-0818940785d9
-name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
+id: 30375d00-68cc-4f95-b89a-68064d566358
+name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
+  Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
+  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 1d
-queryPeriod: 14d
+queryFrequency: 15m
+queryPeriod: 15m
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
   - Exfiltration
 relevantTechniques:
-  - T1030
+  - T1020
 query: |
-  let threshold = 5;
-  let szSharePointFileOperation = "SharePointFileOperation";
-  let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
-  let starttime = 14d;
-  let endtime = 1d;
+  let threshold = 5000;
   
-  // OfficeActivity - Base Events
-  let BaseeventsOffice = OfficeActivity
-      | where TimeGenerated between (ago(starttime)..ago(endtime))
-      | where RecordType =~ szSharePointFileOperation
-      | where Operation in~ (szOperations)
-      | where isnotempty(UserAgent);
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
+          by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   
-  // OfficeActivity - Frequent User Agents
-  let FrequentUAOffice = BaseeventsOffice
-      | summarize FUACount = count() by UserAgent, RecordType, Operation
-      | where FUACount >= threshold
-      | distinct UserAgent;
-  
-  // OfficeActivity - User Baseline
-  let UserBaseLineOffice = BaseeventsOffice
-      | summarize Count = count() by UserId, Operation, Site_Url
-      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  
-  // OfficeActivity - Recent User Activity
-  let RecentActivityOffice = OfficeActivity
-      | where TimeGenerated > ago(endtime)
-      | where RecordType =~ szSharePointFileOperation
-      | where Operation in~ (szOperations)
-      | where isnotempty(UserAgent)
-      | where UserAgent in~ (FrequentUAOffice)
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
-  
-  // EnrichedMicrosoft365AuditLogs - Base Events
-  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated between (ago(starttime)..ago(endtime))
-      | where RecordType == szSharePointFileOperation
-      | where Operation in (szOperations)
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(UserAgent);
-  
-  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
-  let FrequentUAEnriched = BaseeventsEnriched
-      | summarize FUACount = count() by UserAgent, RecordType, Operation
-      | where FUACount >= threshold
-      | distinct UserAgent;
-  
-  // EnrichedMicrosoft365AuditLogs - User Baseline
-  let UserBaseLineEnriched = BaseeventsEnriched
-      | summarize Count = count() by UserId, Operation, Site_Url
-      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
-  
-  // EnrichedMicrosoft365AuditLogs - Recent User Activity
-  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated > ago(endtime)
-      | where RecordType == szSharePointFileOperation
-      | where Operation in (szOperations)
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(UserAgent)
-      | where UserAgent in (FrequentUAEnriched)
-      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserId, ClientIP, Site_Url;
-  
-  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
-  let UserBehaviorAnalysisOffice = UserBaseLineOffice
-      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
-      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
-  
-  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
-      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
-      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint" 
+      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
+      | where count_distinct_OfficeObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), 
+               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   
   // Combine Office and Enriched Logs
-  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
-      | union UserBehaviorAnalysisEnriched;
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
   
-  // Filter and Format Final Results
-  CombinedUserBehaviorAnalysis
-      | where Deviation > 0.25
-      | extend UserIdName = tostring(split(UserId, '@')[0]), 
-               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
-      | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
-      | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
+  // Final Output
+  CombinedEvents
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: FullName
         columnName: UserId
       - identifier: Name
-        columnName: UserIdName
+        columnName: AccountName
       - identifier: UPNSuffix
-        columnName: UserIdUPNSuffix
+        columnName: AccountUPNSuffix
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-  - entityType: URL
+  - entityType: File
     fieldMappings:
-      - identifier: Url
-        columnName: Site_Url
-version: 2.2.6
+      - identifier: Name
+        columnName: FileSample
+customDetails:
+  TransferCount: count_distinct_ObjectId
+  FilesList: fileslist
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+      - Account
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+version: 2.0.7
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 43db365da9..1fc244436a 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -25,7 +25,7 @@ query: |
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
-          by UserId, ClientIP, bin(TimeGenerated, 15m)
+          by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index bae75e117f..fe06f44962 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -25,8 +25,9 @@ query: |
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
-          by UserId, ClientIp = SourceIp, bin(TimeGenerated, 15m)
+          by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
                AccountUPNSuffix = tostring(split(UserId, "@")[1]);
@@ -37,7 +38,7 @@ query: |
       | where OfficeWorkload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
-          by UserId, ClientIp, bin(TimeGenerated, 15m)
+          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
       | where count_distinct_OfficeObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
@@ -46,11 +47,11 @@ query: |
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIp, UserAgent;
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
   
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIp, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
       | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
@@ -64,7 +65,7 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: ClientIp
+        columnName: ClientIP
   - entityType: File
     fieldMappings:
       - identifier: Name

From 5fb79387794441ee30926d7e8742642e3edb7ee5 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 12:00:59 +0300
Subject: [PATCH 07/27] KQL issues

---
 ... Mail_redirect_via_ExO_transport_rule.yaml |  2 +-
 ...- SharePoint_Downloads_byNewUserAgent.yaml |  2 +-
 ...file_transfer_folders_above_threshold.yaml | 49 ++++++++-----------
 3 files changed, 22 insertions(+), 31 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index bdc22aa86b..eabfa1226a 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -54,7 +54,7 @@ query: |
     | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
     | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
     | extend RedirectTo = ExpandedParameters.Value
-    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+    | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
     | extend From = ParsedParameters.From
     | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
     | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters), UserAgent
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 71c4021df2..1fc244436a 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -46,7 +46,7 @@ query: |
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
   
   // Final Output
   CombinedEvents
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index fe06f44962..eb68d9e29b 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -1,8 +1,7 @@
 id: abd6976d-8f71-4851-98c4-4d086201319c
 name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.
-  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
+  Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
 severity: Medium
 status: Available
 requiredDataConnectors:
@@ -19,40 +18,32 @@ relevantTechniques:
   - T1020
 query: |
   let threshold = 5000;
-  
   // EnrichedMicrosoft365AuditLogs Query
   let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
-          by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  
+  | where Workload has_any("SharePoint", "OneDrive")
+  | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+  | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
+  | where count_distinct_ObjectId >= threshold
+  | extend UserAgent = tostring(AdditionalProperties.UserAgent)
+  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   // OfficeActivity Query
   let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint" 
-      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
-          by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
-      | where count_distinct_OfficeObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  
+  | where EventSource == "SharePoint"
+  | where OfficeWorkload has_any("SharePoint", "OneDrive")
+  | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+  | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
+  | where count_distinct_OfficeObjectId >= threshold
+  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
-      | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
-  
+  | union EnrichedEvents
+  | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
-      | order by TimeGenerated desc
+  | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+  | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -85,4 +76,4 @@ incidentConfiguration:
     groupByAlertDetails: []
     groupByCustomDetails: []
 version: 2.0.7
-kind: Scheduled
+kind: Scheduled
\ No newline at end of file

From 8c6bc0d3e3e63c239edbc16d968f591a09939e9c Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 12:28:14 +0300
Subject: [PATCH 08/27] Fixing KQLs

---
 ...- SharePoint_Downloads_byNewUserAgent.yaml | 149 +++++++++++-------
 ...file_transfer_folders_above_threshold.yaml |  60 +++----
 2 files changed, 126 insertions(+), 83 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 1fc244436a..4508159a51 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -1,87 +1,124 @@
-id: 30375d00-68cc-4f95-b89a-68064d566358
-name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
+id: efd17c5f-5167-40f8-a1e9-0818940785d9
+name: GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents
 description: |
-  Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
-  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
+  Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
-queryFrequency: 15m
-queryPeriod: 15m
+queryFrequency: 1d
+queryPeriod: 14d
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
   - Exfiltration
 relevantTechniques:
-  - T1020
+  - T1030
 query: |
-  let threshold = 5000;
+  let threshold = 5;
+  let szSharePointFileOperation = "SharePointFileOperation";
+  let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);
+  let starttime = 14d;
+  let endtime = 1d;
   
-  // EnrichedMicrosoft365AuditLogs Query
-  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
-          by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity - Base Events
+  let BaseeventsOffice = OfficeActivity
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent);
   
-  // OfficeActivity Query
-  let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint" 
-      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
-          by UserId, ClientIP, bin(TimeGenerated, 15m)
-      | where count_distinct_OfficeObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
-               AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity - Frequent User Agents
+  let FrequentUAOffice = BaseeventsOffice
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  
+  // OfficeActivity - User Baseline
+  let UserBaseLineOffice = BaseeventsOffice
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  
+  // OfficeActivity - Recent User Activity
+  let RecentActivityOffice = OfficeActivity
+      | where TimeGenerated > ago(endtime)
+      | where RecordType =~ szSharePointFileOperation
+      | where Operation in~ (szOperations)
+      | where isnotempty(UserAgent)
+      | where UserAgent in~ (FrequentUAOffice)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
+          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
+  
+  // EnrichedMicrosoft365AuditLogs - Base Events
+  let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between (ago(starttime)..ago(endtime))
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent);
+  
+  // EnrichedMicrosoft365AuditLogs - Frequent User Agents
+  let FrequentUAEnriched = BaseeventsEnriched
+      | summarize FUACount = count() by UserAgent, RecordType, Operation
+      | where FUACount >= threshold
+      | distinct UserAgent;
+  
+  // EnrichedMicrosoft365AuditLogs - User Baseline
+  let UserBaseLineEnriched = BaseeventsEnriched
+      | summarize Count = count() by UserId, Operation, Site_Url
+      | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;
+  
+  // EnrichedMicrosoft365AuditLogs - Recent User Activity
+  let RecentActivityEnriched = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated > ago(endtime)
+      | where RecordType == szSharePointFileOperation
+      | where Operation in (szOperations)
+      | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+      | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | where isnotempty(UserAgent)
+      | where UserAgent in (FrequentUAEnriched)
+      | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
+          by RecordType, Operation, UserAgent, UserId, ClientIP, Site_Url;
+  
+  // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
+  let UserBehaviorAnalysisOffice = UserBaseLineOffice
+      | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
+  
+  let UserBehaviorAnalysisEnriched = UserBaseLineEnriched
+      | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url
+      | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;
   
   // Combine Office and Enriched Logs
-  let CombinedEvents = OfficeEvents
-      | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
+  let CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice
+      | union UserBehaviorAnalysisEnriched;
   
-  // Final Output
-  CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
-      | order by TimeGenerated desc
+  // Filter and Format Final Results
+  CombinedUserBehaviorAnalysis
+      | where Deviation > 0.25
+      | extend UserIdName = tostring(split(UserId, '@')[0]), 
+               UserIdUPNSuffix = tostring(split(UserId, '@')[1])
+      | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url
+      | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: FullName
         columnName: UserId
       - identifier: Name
-        columnName: AccountName
+        columnName: UserIdName
       - identifier: UPNSuffix
-        columnName: AccountUPNSuffix
+        columnName: UserIdUPNSuffix
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: ClientIP
-  - entityType: File
+  - entityType: URL
     fieldMappings:
-      - identifier: Name
-        columnName: FileSample
-customDetails:
-  TransferCount: count_distinct_ObjectId
-  FilesList: fileslist
-incidentConfiguration:
-  createIncident: true
-  groupingConfiguration:
-    enabled: true
-    reopenClosedIncident: false
-    lookbackDuration: 5h
-    matchingMethod: Selected
-    groupByEntities:
-      - Account
-    groupByAlertDetails: []
-    groupByCustomDetails: []
-version: 2.0.7
+      - identifier: Url
+        columnName: Site_Url
+version: 2.2.6
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index eb68d9e29b..81410ac5c8 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -17,33 +17,39 @@ tactics:
 relevantTechniques:
   - T1020
 query: |
-  let threshold = 5000;
-  // EnrichedMicrosoft365AuditLogs Query
-  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-  | where Workload has_any("SharePoint", "OneDrive")
-  | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-  | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
-  | where count_distinct_ObjectId >= threshold
-  | extend UserAgent = tostring(AdditionalProperties.UserAgent)
-  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  // OfficeActivity Query
-  let OfficeEvents = OfficeActivity
-  | where EventSource == "SharePoint"
-  | where OfficeWorkload has_any("SharePoint", "OneDrive")
-  | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-  | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) by UserId, ClientIP, UserAgent, bin(TimeGenerated, 15m)
-  | where count_distinct_OfficeObjectId >= threshold
-  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  // Combine Office and Enriched Logs
-  let CombinedEvents = OfficeEvents
-  | union EnrichedEvents
-  | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, UserAgent;
-  // Final Output
-  CombinedEvents
-  | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
-  | order by TimeGenerated desc
+    let threshold = 5000;
+      // EnrichedMicrosoft365AuditLogs Query
+      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload has_any("SharePoint", "OneDrive")
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | extend UserAgent = tostring(AdditionalProperties["UserAgent"])
+      | summarize count_distinct_ObjectId = dcount(ObjectId), 
+                  fileslist = make_set(ObjectId, 10000), 
+                  any_UserAgent = any(UserAgent)
+        by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
+      | where count_distinct_ObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      // OfficeActivity Query
+      let OfficeEvents = OfficeActivity
+      | where EventSource == "SharePoint"
+      | where OfficeWorkload has_any("SharePoint", "OneDrive")
+      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), 
+                  fileslist = make_set(OfficeObjectId, 10000), 
+                  any_UserAgent = any(UserAgent)
+        by UserId, ClientIP, bin(TimeGenerated, 15m)
+      | where count_distinct_OfficeObjectId >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      // Combine Office and Enriched Logs
+      let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, any_UserAgent;
+      // Final Output
+      CombinedEvents
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, UserAgent = any_UserAgent, count_distinct_ObjectId = coalesce(count_distinct_ObjectId, count_distinct_OfficeObjectId), fileslist
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:

From a826a48e894340a006e2abaf508a44762d33f4d1 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 12:48:51 +0300
Subject: [PATCH 09/27] ClientIP issues

---
 .../Office 365 - SharePoint_Downloads_byNewUserAgent.yaml     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 4508159a51..0009e9068a 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -49,7 +49,7 @@ query: |
       | where isnotempty(UserAgent)
       | where UserAgent in~ (FrequentUAOffice)
       | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP, OfficeWorkload, Site_Url;
+          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP = ClientIp, OfficeWorkload, Site_Url;
   
   // EnrichedMicrosoft365AuditLogs - Base Events
   let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
@@ -81,7 +81,7 @@ query: |
       | where isnotempty(UserAgent)
       | where UserAgent in (FrequentUAEnriched)
       | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserId, ClientIP, Site_Url;
+          by RecordType, Operation, UserAgent, UserId, ClientIP = ClientIp, Site_Url;
   
   // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
   let UserBehaviorAnalysisOffice = UserBaseLineOffice

From 377f1854e2af1e6f630e6aa161dda745e002de67 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 13:12:10 +0300
Subject: [PATCH 10/27] KQL fix

---
 .../Office 365 - SharePoint_Downloads_byNewUserAgent.yaml    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index 0009e9068a..c9d57bdca8 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -49,7 +49,7 @@ query: |
       | where isnotempty(UserAgent)
       | where UserAgent in~ (FrequentUAOffice)
       | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP = ClientIp, OfficeWorkload, Site_Url;
+          by RecordType, Operation, UserAgent, UserType, UserId, ClientIP , OfficeWorkload, Site_Url;
   
   // EnrichedMicrosoft365AuditLogs - Base Events
   let BaseeventsEnriched = EnrichedMicrosoft365AuditLogs
@@ -78,10 +78,11 @@ query: |
       | where Operation in (szOperations)
       | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
       | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+      | extend  ClientIP = ClientIp
       | where isnotempty(UserAgent)
       | where UserAgent in (FrequentUAEnriched)
       | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()
-          by RecordType, Operation, UserAgent, UserId, ClientIP = ClientIp, Site_Url;
+          by RecordType, Operation, UserAgent, UserId,ClientIP, Site_Url;
   
   // Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate
   let UserBehaviorAnalysisOffice = UserBaseLineOffice

From 69d2f1f46d3ea80a6a1a7a25a042e4d72c351250 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 13:35:17 +0300
Subject: [PATCH 11/27] Hunting queries

---
 ...repoint_file_transfer_above_threshold.yaml |   2 +-
 ...omolousUserAccessingOtherUsersMailbox.yaml | 113 +++++++++++-------
 .../ExternalUserFromNewOrgAddedToTeams.yaml   |  80 +++++++++----
 ...direct_via_ExO_transport_rule_hunting.yaml |  63 +++++++---
 .../Hunting Queries/MultiTeamBot.yaml         |  53 +++++---
 .../Hunting Queries/MultiTeamOwner.yaml       |  78 ++++++++----
 .../Hunting Queries/MultipleTeamsDeletes.yaml |  64 +++++++---
 ...eUsersEmailForwardedToSameDestination.yaml |  78 ++++++++----
 .../Hunting Queries/NewBotAddedToTeams.yaml   |  58 ++++++---
 ...ReservedFileNamesOnOfficeFileServices.yaml | 110 +++++++++++------
 .../OfficeMailForwarding_hunting.yaml         | 106 ++++++++--------
 .../Hunting Queries/TeamsFilesUploaded.yaml   |  71 +++++++----
 .../UserAddToTeamsAndUploadsFile.yaml         |  61 +++++++---
 ...ReservedFileNamesOnOfficeFileServices.yaml |  63 ++++++----
 .../new_sharepoint_downloads_by_IP.yaml       |  61 ++++++----
 ...new_sharepoint_downloads_by_UserAgent.yaml |  72 ++++++-----
 .../nonowner_MailboxLogin.yaml                |  44 +++++--
 ...powershell_or_nonbrowser_MailboxLogin.yaml |  51 +++++---
 .../Hunting Queries/sharepoint_downloads.yaml |  68 +++++++----
 19 files changed, 865 insertions(+), 431 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 1fc244436a..43db365da9 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -25,7 +25,7 @@ query: |
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
-          by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
+          by UserId, ClientIP, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
       | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
       | extend AccountName = tostring(split(UserId, "@")[0]), 
diff --git a/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml b/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml
index 5a5e54f363..d32cfda704 100644
--- a/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml	
@@ -1,5 +1,5 @@
 id: 271e8881-3044-4332-a5f4-42264c2e0315
-name: Anomalous access to other users' mailboxes
+name: GSA Enriched Office 365 - Anomalous access to other users' mailboxes
 description: |
   'Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox.'
 requiredDataConnectors:
@@ -14,44 +14,77 @@ tags:
   - Solorigate
   - NOBELIUM
 query: |
-    let starttime = todatetime('{{StartTimeISO}}');
-    let endtime = todatetime('{{EndTimeISO}}');
-    let lookback = totimespan((endtime - starttime) * 2);
-    // Adjust this value to alter how many mailbox (other than their own) a user needs to access before being included in results
-    let user_threshold = 1;
-    // Adjust this value to alter how many mailbox folders in other's email accounts a users needs to access before being included in results.
-    let folder_threshold = 5;
-    // Exclude historical as known good (set lookback and timeframe to same value to skip this)
-    EnrichedMicrosoft365AuditLogs
-    | where TimeGenerated between (ago(lookback)..starttime)
-    | where Operation =~ "MailItemsAccessed"
-    | where ResultStatus =~ "Succeeded"
-    | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
-    | where tolower(MailboxOwnerUPN) != tolower(UserId)
-    | join kind=rightanti (
-        EnrichedMicrosoft365AuditLogs
-        | where TimeGenerated between (starttime..endtime)
-        | where Operation =~ "MailItemsAccessed"
-        | where ResultStatus =~ "Succeeded"
-        | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
-        | where tolower(MailboxOwnerUPN) != tolower(UserId)
-    ) on MailboxOwnerUPN, UserId
-    | where isnotempty(tostring(parse_json(AdditionalProperties).Folders))
-    | mv-expand Folders = parse_json(AdditionalProperties).Folders
-    | extend folders = tostring(Folders.Path)
-    | extend ClientIP = iif(ClientIp startswith "[", extract("\\[([^\\]]*)", 1, ClientIp), ClientIp)
-    | extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)
-    | extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)
-    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId
-    | extend folder_count = array_length(set_folders)
-    | extend user_count = array_length(set_MailboxGuid)
-    | where user_count > user_threshold or folder_count > folder_threshold
-    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, "Both User and Folder Threshold Exceeded", folder_count > folder_threshold and user_count < user_threshold, "Folder Count Threshold Exceeded", "User Threshold Exceeded")
-    | sort by user_count desc
-    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-    | extend Account_0_Name = AccountName
-    | extend Account_0_UPNSuffix = AccountUPNSuffix
+  let starttime = todatetime('{{StartTimeISO}}');
+  let endtime = todatetime('{{EndTimeISO}}');
+  let lookback = totimespan((endtime - starttime) * 2);
+  let user_threshold = 1;    // Threshold for number of mailboxes accessed
+  let folder_threshold = 5;  // Threshold for number of mailbox folders accessed
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where TimeGenerated between (ago(lookback)..starttime)
+      | where Operation =~ "MailItemsAccessed"
+      | where ResultStatus =~ "Succeeded"
+      | where tolower(MailboxOwnerUPN) != tolower(UserId)
+      | join kind=rightanti (
+          OfficeActivity
+          | where TimeGenerated between (starttime..endtime)
+          | where Operation =~ "MailItemsAccessed"
+          | where ResultStatus =~ "Succeeded"
+          | where tolower(MailboxOwnerUPN) != tolower(UserId)
+      ) on MailboxOwnerUPN, UserId
+      | where isnotempty(Folders)
+      | mv-expand parse_json(Folders)
+      | extend folders = tostring(Folders.Path)
+      | extend ClientIP = iif(Client_IPAddress startswith "[", extract("\\[([^\\]]*)", 1, Client_IPAddress), Client_IPAddress)
+      | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId
+      | extend folder_count = array_length(set_folders)
+      | extend user_count = array_length(set_MailboxGuid)
+      | where user_count > user_threshold or folder_count > folder_threshold
+      | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, "Both User and Folder Threshold Exceeded", folder_count > folder_threshold and user_count < user_threshold, "Folder Count Threshold Exceeded", "User Threshold Exceeded")
+      | sort by user_count desc
+      | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | extend Account_0_Name = AccountName
+      | extend Account_0_UPNSuffix = AccountUPNSuffix;
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between (ago(lookback)..starttime)
+      | where Operation =~ "MailItemsAccessed"
+      | where ResultStatus =~ "Succeeded"
+      | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
+      | where tolower(MailboxOwnerUPN) != tolower(UserId)
+      | join kind=rightanti (
+          EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (starttime..endtime)
+          | where Operation =~ "MailItemsAccessed"
+          | where ResultStatus =~ "Succeeded"
+          | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
+          | where tolower(MailboxOwnerUPN) != tolower(UserId)
+      ) on MailboxOwnerUPN, UserId
+      | where isnotempty(tostring(parse_json(AdditionalProperties).Folders))
+      | mv-expand Folders = parse_json(AdditionalProperties).Folders
+      | extend folders = tostring(Folders.Path)
+      | extend ClientIP = iif(ClientIp startswith "[", extract("\\[([^\\]]*)", 1, ClientIp), ClientIp)
+      | extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)
+      | extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)
+      | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId
+      | extend folder_count = array_length(set_folders)
+      | extend user_count = array_length(set_MailboxGuid)
+      | where user_count > user_threshold or folder_count > folder_threshold
+      | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, "Both User and Folder Threshold Exceeded", folder_count > folder_threshold and user_count < user_threshold, "Folder Count Threshold Exceeded", "User Threshold Exceeded")
+      | sort by user_count desc
+      | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | extend Account_0_Name = AccountName
+      | extend Account_0_UPNSuffix = AccountUPNSuffix;
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTime, *) by UserId, ClientIP;
+  // Final Output
+  CombinedEvents
+      | project UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders, AccountName, AccountUPNSuffix
+      | order by user_count desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -59,4 +92,4 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml b/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml
index 9cee2439f7..a76746f8b8 100644
--- a/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml	
@@ -1,5 +1,5 @@
 id: 6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45
-name: External user from a new organisation added to Teams
+name: GSA Enriched Office 365 - External user from a new organisation added to Teams
 description: |
   'This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data.'
 requiredDataConnectors:
@@ -14,30 +14,60 @@ query: |
   let starttime = todatetime('{{StartTimeISO}}');
   let endtime = todatetime('{{EndTimeISO}}');
   let lookback = totimespan((endtime - starttime) * 7);
-  let known_orgs = (
-    EnrichedMicrosoft365AuditLogs
-    | where TimeGenerated between (ago(lookback) .. starttime)
-    | where Workload == "MicrosoftTeams"
-    | where Operation in ("MemberAdded", "TeamsSessionStarted")
-    // Extract the correct UPN and parse our external organization domain
-    | extend Members = parse_json(tostring(AdditionalProperties.Members))
-    | extend UPN = iif(Operation == "MemberAdded", tostring(Members[0].UPN), UserId)
-    | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
-    | where isnotempty(Organization)
-    | summarize by Organization
+  // OfficeActivity Known Organizations
+  let known_orgs_office = (
+      OfficeActivity
+      | where TimeGenerated between(ago(lookback)..starttime)
+      | where OfficeWorkload =~ "MicrosoftTeams"
+      | where Operation =~ "MemberAdded" or Operation =~ "TeamsSessionStarted"
+      | extend UPN = iif(Operation == "MemberAdded", tostring(Members[0].UPN), UserId)
+      | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
+      | where isnotempty(Organization)
+      | summarize by Organization
   );
-  EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated between (starttime .. endtime)
-  | where Workload == "MicrosoftTeams"
-  | where Operation == "MemberAdded"
-  | extend Members = parse_json(tostring(AdditionalProperties.Members))
-  | extend UPN = tostring(Members[0].UPN)
-  | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
-  | where isnotempty(Organization)
-  | where Organization !in (known_orgs)
-  | extend AccountName = tostring(split(UPN, "@")[0]), AccountUPNSuffix = tostring(split(UPN, "@")[1])
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
+  // OfficeActivity Query for New Organizations
+  let OfficeEvents = OfficeActivity
+      | where TimeGenerated between(starttime..endtime)
+      | where OfficeWorkload =~ "MicrosoftTeams"
+      | where Operation =~ "MemberAdded"
+      | extend UPN = tostring(parse_json(Members)[0].UPN)
+      | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
+      | where isnotempty(Organization)
+      | where Organization !in (known_orgs_office)
+      | extend AccountName = tostring(split(UPN, "@")[0]), AccountUPNSuffix = tostring(split(UPN, "@")[1])
+      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+  // EnrichedMicrosoft365AuditLogs Known Organizations
+  let known_orgs_enriched = (
+      EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between(ago(lookback)..starttime)
+      | where Workload == "MicrosoftTeams"
+      | where Operation in ("MemberAdded", "TeamsSessionStarted")
+      | extend Members = parse_json(tostring(AdditionalProperties.Members))
+      | extend UPN = iif(Operation == "MemberAdded", tostring(Members[0].UPN), UserId)
+      | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
+      | where isnotempty(Organization)
+      | summarize by Organization
+  );
+  // EnrichedMicrosoft365AuditLogs Query for New Organizations
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between(starttime..endtime)
+      | where Workload == "MicrosoftTeams"
+      | where Operation == "MemberAdded"
+      | extend Members = parse_json(tostring(AdditionalProperties.Members))
+      | extend UPN = tostring(Members[0].UPN)
+      | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
+      | where isnotempty(Organization)
+      | where Organization !in (known_orgs_enriched)
+      | extend AccountName = tostring(split(UPN, "@")[0]), AccountUPNSuffix = tostring(split(UPN, "@")[1])
+      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by Organization, UPN;
+  // Final Output
+  CombinedEvents
+      | project Organization, UPN, AccountName, AccountUPNSuffix
+      | order by Organization asc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -45,4 +75,4 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml b/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml
index 94de9dade2..43c3385545 100644
--- a/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml	
@@ -1,5 +1,5 @@
 id: 9891684a-1e3a-4546-9403-3439513cbc70
-name: Mail Redirect via ExO Transport Rule
+name: GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule
 description: |
   Identifies when Exchange Online transport rule is configured to forward emails.
   This could be an adversary mailbox configured to collect mail from multiple user accounts.
@@ -14,20 +14,51 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
-  EnrichedMicrosoft365AuditLogs
-  | where Workload == "Exchange"
-  | where Operation in ("New-TransportRule", "Set-TransportRule")
-  | mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
-  | extend RuleName = case(
-      Operation == "Set-TransportRule", ObjectId,
-      Operation == "New-TransportRule", ParsedParameters.Name,
-      "Unknown")
-  | mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)
-  | where ExpandedParameters.Name in ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
-  | extend RedirectTo = ExpandedParameters.Value
-  | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
-  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, AdditionalProperties
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload == "Exchange"
+      | where Operation in ("New-TransportRule", "Set-TransportRule")
+      | mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (
+          summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
+      | extend RuleName = case(
+          Operation == "Set-TransportRule", ObjectId,
+          Operation == "New-TransportRule", ParsedParameters.Name,
+          "Unknown"
+      )
+      | mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)
+      | where ExpandedParameters.Name in ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+      | extend RedirectTo = ExpandedParameters.Value
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+      | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, AdditionalProperties
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where OfficeWorkload == "Exchange"
+      | where Operation in ("New-TransportRule", "Set-TransportRule")
+      | mv-apply DynamicParameters = todynamic(Parameters) on (
+          summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
+      | extend RuleName = case(
+          Operation == "Set-TransportRule", OfficeObjectId,
+          Operation == "New-TransportRule", ParsedParameters.Name,
+          "Unknown"
+      )
+      | mv-expand ExpandedParameters = todynamic(Parameters)
+      | where ExpandedParameters.Name in ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+      | extend RedirectTo = ExpandedParameters.Value
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+      | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, Parameters
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = IPAddress;
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(TimeGenerated, *) by RuleName, UserId;
+  // Final Output
+  CombinedEvents
+      | project TimeGenerated, RuleName, RedirectTo, IPAddress, Port, UserId, AccountName, AccountUPNSuffix
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -39,4 +70,4 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPAddress
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/MultiTeamBot.yaml b/Solutions/Global Secure Access/Hunting Queries/MultiTeamBot.yaml
index b150a46ba9..6f2790c0c1 100644
--- a/Solutions/Global Secure Access/Hunting Queries/MultiTeamBot.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/MultiTeamBot.yaml	
@@ -1,5 +1,5 @@
 id: 9eb64924-ec8d-44d0-b1f2-10665150fb74
-name: Bots added to multiple teams
+name: GSA Enriched Office 365 - Bots added to multiple teams
 description: |
   'This hunting query helps identify bots added to multiple Teams in a short space of time.'
 requiredDataConnectors:
@@ -13,22 +13,41 @@ relevantTechniques:
   - T1176
   - T1119
 query: |
-  // Adjust these thresholds to suit your environment.
-  let threshold = 2;
-  let time_threshold = timespan(5m);
-  EnrichedMicrosoft365AuditLogs
-    | where Workload == "MicrosoftTeams"
-    | where Operation == "BotAddedToTeam"
-    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
-    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId
-    | extend CountOfTeams = array_length(Teams)
-    | extend TimeDelta = End - Start
-    | where CountOfTeams > threshold
-    | where TimeDelta <= time_threshold
-    | project Start, End, Teams, CountOfTeams, UserId
-    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-    | extend Account_0_Name = AccountName
-    | extend Account_0_UPNSuffix = AccountUPNSuffix
+  let threshold = 2;  // Adjust this threshold based on your environment
+  let time_threshold = timespan(5m);  // Adjust the time delta threshold
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where OfficeWorkload =~ "MicrosoftTeams"
+      | where Operation =~ "BotAddedToTeam"
+      | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId
+      | extend CountOfTeams = array_length(Teams)
+      | extend TimeDelta = End - Start
+      | where CountOfTeams > threshold
+      | where TimeDelta >= time_threshold
+      | project Start, End, Teams, CountOfTeams, UserId
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where Workload == "MicrosoftTeams"
+      | where Operation == "BotAddedToTeam"
+      | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
+      | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId
+      | extend CountOfTeams = array_length(Teams)
+      | extend TimeDelta = End - Start
+      | where CountOfTeams > threshold
+      | where TimeDelta <= time_threshold
+      | project Start, End, Teams, CountOfTeams, UserId
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(Start, *) by UserId;
+  // Final Output
+  CombinedEvents
+      | project Start, End, Teams, CountOfTeams, UserId, AccountName, AccountUPNSuffix
+      | order by Start desc
 entityMappings:
   - entityType: Account
     fieldMappings:
diff --git a/Solutions/Global Secure Access/Hunting Queries/MultiTeamOwner.yaml b/Solutions/Global Secure Access/Hunting Queries/MultiTeamOwner.yaml
index 637e316c51..ef14dc12b7 100644
--- a/Solutions/Global Secure Access/Hunting Queries/MultiTeamOwner.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/MultiTeamOwner.yaml	
@@ -1,5 +1,5 @@
 id: 558f15dd-3171-4b11-bf24-31c0610a20e0
-name: User made Owner of multiple teams
+name: GSA Enriched Office 365 - User made Owner of multiple teams
 description: |
   This hunting query identifies users who have been made Owner of multiple Teams.
 requiredDataConnectors:
@@ -11,28 +11,58 @@ tactics:
 relevantTechniques:
   - T1078
 query: |
-  // Adjust this value to change how many teams a user is made owner of before detecting
-  let max_owner_count = 3;
-  // Identify users who have been made owner of multiple Teams
-  let high_owner_count = (
-    EnrichedMicrosoft365AuditLogs
-    | where Workload == "MicrosoftTeams"
-    | where Operation == "MemberRoleChanged"
-    | extend Member = tostring(UserId)
-    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)
-    | where NewRole == 2
-    | summarize TeamCount = dcount(ObjectId) by Member
-    | where TeamCount > max_owner_count
-    | project Member
-  );
-  EnrichedMicrosoft365AuditLogs
-  | where Workload == "MicrosoftTeams"
-  | where Operation == "MemberRoleChanged"
-  | extend Member = tostring(UserId)
-  | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)
-  | where NewRole == 2
-  | where Member in (high_owner_count)
-  | extend AccountName = tostring(split(Member, "@")[0]), AccountUPNSuffix = tostring(split(Member, "@")[1])
+    let max_owner_count = 3;  
+    // Adjust this value to change how many teams a user is made owner of before detecting
+    // OfficeActivity Query: Identify users who have been made owners of more than 'max_owner_count' teams
+    let high_owner_count_office = (
+        OfficeActivity
+        | where OfficeWorkload =~ "MicrosoftTeams"
+        | where Operation =~ "MemberRoleChanged"
+        | extend Member = tostring(parse_json(Members)[0].UPN) 
+        | extend NewRole = toint(parse_json(Members)[0].Role)
+        | where NewRole == 2  // Role 2 corresponds to "Owner"
+        | summarize TeamCount = dcount(TeamName) by Member
+        | where TeamCount > max_owner_count
+        | project Member
+    );
+    // OfficeActivity Query: Fetch details for users with high ownership count
+    let OfficeEvents = OfficeActivity
+        | where OfficeWorkload =~ "MicrosoftTeams"
+        | where Operation =~ "MemberRoleChanged"
+        | extend Member = tostring(parse_json(Members)[0].UPN)
+        | extend NewRole = toint(parse_json(Members)[0].Role)
+        | where NewRole == 2  // Role 2 corresponds to "Owner"
+        | where Member in (high_owner_count_office)
+        | extend AccountName = tostring(split(Member, "@")[0]), AccountUPNSuffix = tostring(split(Member, "@")[1]);
+    // EnrichedMicrosoft365AuditLogs Query: Identify users who have been made owners of more than 'max_owner_count' teams
+    let high_owner_count_enriched = (
+        EnrichedMicrosoft365AuditLogs
+        | where Workload == "MicrosoftTeams"
+        | where Operation == "MemberRoleChanged"
+        | extend Member = tostring(UserId)
+        | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)
+        | where NewRole == 2  // Role 2 corresponds to "Owner"
+        | summarize TeamCount = dcount(ObjectId) by Member
+        | where TeamCount > max_owner_count
+        | project Member
+    );
+    // EnrichedMicrosoft365AuditLogs Query: Fetch details for users with high ownership count
+    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+        | where Workload == "MicrosoftTeams"
+        | where Operation == "MemberRoleChanged"
+        | extend Member = tostring(UserId)
+        | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)
+        | where NewRole == 2  // Role 2 corresponds to "Owner"
+        | where Member in (high_owner_count_enriched)
+        | extend AccountName = tostring(split(Member, "@")[0]), AccountUPNSuffix = tostring(split(Member, "@")[1]);
+    // Combine Office and Enriched Logs
+    let CombinedEvents = OfficeEvents
+        | union EnrichedEvents
+        | summarize by Member, AccountName, AccountUPNSuffix;
+    // Final Output
+    CombinedEvents
+    | order by Member asc
+    | project Member, AccountName, AccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -40,5 +70,5 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.1
+version: 2.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/MultipleTeamsDeletes.yaml b/Solutions/Global Secure Access/Hunting Queries/MultipleTeamsDeletes.yaml
index edc5adc288..a616206b7f 100644
--- a/Solutions/Global Secure Access/Hunting Queries/MultipleTeamsDeletes.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/MultipleTeamsDeletes.yaml	
@@ -1,5 +1,5 @@
 id: 64990414-b015-4edf-bef0-343b741e68c5
-name: Multiple Teams deleted by a single user
+name: GSA Enriched Office 365 - Multiple Teams deleted by a single user
 description: |
   'This hunting query identifies where multiple Teams have been deleted by a single user in a short timeframe.'
 requiredDataConnectors:
@@ -12,23 +12,49 @@ relevantTechniques:
   - T1485
   - T1489
 query: |
-  // Adjust this value to change how many Teams should be deleted before including
-  let max_delete = 3;
-  let deleting_users = (
-    EnrichedMicrosoft365AuditLogs
-    | where Workload == "MicrosoftTeams"
-    | where Operation == "TeamDeleted"
-    | summarize count_ = count() by UserId
-    | where count_ > max_delete
-    | project UserId
-  );
-  EnrichedMicrosoft365AuditLogs
-  | where Workload == "MicrosoftTeams"
-  | where Operation == "TeamDeleted"
-  | where UserId in (deleting_users)
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
+    let max_delete = 3;  // Adjust this value to change how many Teams should be deleted before being included
+    // EnrichedMicrosoft365AuditLogs - Users who deleted more than 'max_delete' Teams
+    let deleting_users_enriched = (
+        EnrichedMicrosoft365AuditLogs
+        | where Workload == "MicrosoftTeams"
+        | where Operation == "TeamDeleted"
+        | summarize count_ = count() by UserId
+        | where count_ > max_delete
+        | project UserId
+    );
+    // EnrichedMicrosoft365AuditLogs Query
+    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+        | where Workload == "MicrosoftTeams"
+        | where Operation == "TeamDeleted"
+        | where UserId in (deleting_users_enriched)
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix
+        | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;
+    // OfficeActivity - Users who deleted more than 'max_delete' Teams
+    let deleting_users_office = (
+        OfficeActivity
+        | where OfficeWorkload =~ "MicrosoftTeams"
+        | where Operation =~ "TeamDeleted"
+        | summarize count_ = count() by UserId
+        | where count_ > max_delete
+        | project UserId
+    );
+    // OfficeActivity Query
+    let OfficeEvents = OfficeActivity
+        | where OfficeWorkload =~ "MicrosoftTeams"
+        | where Operation =~ "TeamDeleted"
+        | where UserId in (deleting_users_office)
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix
+        | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;
+    // Combine Office and Enriched Logs
+    let CombinedEvents = OfficeEvents
+        | union EnrichedEvents
+        | summarize arg_min(TimeGenerated, *) by UserId;
+    // Final Output
+    CombinedEvents
+    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix
+    | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -36,4 +62,4 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml b/Solutions/Global Secure Access/Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml
index 12d9310574..c18e91a8f3 100644
--- a/Solutions/Global Secure Access/Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml	
@@ -1,5 +1,5 @@
 id: a1551ae4-f61c-4bca-9c57-4d0d681db2e9
-name: Multiple Users Email Forwarded to Same Destination
+name: GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination
 description: |
   Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. 
   This could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.
@@ -22,25 +22,61 @@ relevantTechniques:
 query: |
   let queryfrequency = 1d;
   let queryperiod = 7d;
-  EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated > ago(queryperiod)
-  | where Workload == "Exchange"
-  | where AdditionalProperties has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
-  | mv-apply DynamicParameters = todynamic(AdditionalProperties) on (summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
-  | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
-  | extend DestinationMailAddress = tolower(case(
-      isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
-      isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
-      isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
-      ""))
-  | where isnotempty(DestinationMailAddress)
-  | mv-expand split(DestinationMailAddress, ";")
-  | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
-  | extend ClientIp = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
-  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIp
-  | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
-  | mv-expand UserId to typeof(string)
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated > ago(queryperiod)
+      | where Workload == "Exchange"
+      | where AdditionalProperties has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
+      | mv-apply DynamicParameters = todynamic(AdditionalProperties) on (
+          summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
+      | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
+      | extend DestinationMailAddress = tolower(case(
+          isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
+          isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
+          isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
+          ""
+      ))
+      | where isnotempty(DestinationMailAddress)
+      | mv-expand split(DestinationMailAddress, ";")
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
+      | extend ClientIp = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIp
+      | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
+      | mv-expand UserId to typeof(string)
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+      | where TimeGenerated > ago(queryperiod)
+      | where OfficeWorkload =~ "Exchange"
+      | where Parameters has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress")
+      | mv-apply DynamicParameters = todynamic(Parameters) on (
+          summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
+      )
+      | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')
+      | extend DestinationMailAddress = tolower(case(
+          isnotempty(column_ifexists("ForwardTo", "")), column_ifexists("ForwardTo", ""),
+          isnotempty(column_ifexists("RedirectTo", "")), column_ifexists("RedirectTo", ""),
+          isnotempty(column_ifexists("ForwardingSmtpAddress", "")), trim_start(@"smtp:", column_ifexists("ForwardingSmtpAddress", "")),
+          ""
+      ))
+      | where isnotempty(DestinationMailAddress)
+      | mv-expand split(DestinationMailAddress, ";")
+      | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
+      | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP
+      | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)
+      | mv-expand UserId to typeof(string)
+      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = ClientIP;
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTime, *) by DestinationMailAddress, ClientIp;
+  // Final Output
+  CombinedEvents
+      | project StartTime, EndTime, DestinationMailAddress, ClientIp, Ports, UserId, AccountName, AccountUPNSuffix
+      | order by StartTime desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -52,5 +88,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: ClientIp
-version: 2.0.1
+version: 2.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/NewBotAddedToTeams.yaml b/Solutions/Global Secure Access/Hunting Queries/NewBotAddedToTeams.yaml
index 7e25db9f10..aef7ce0206 100644
--- a/Solutions/Global Secure Access/Hunting Queries/NewBotAddedToTeams.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/NewBotAddedToTeams.yaml	
@@ -1,5 +1,5 @@
 id: bf76e508-9282-4cf1-9cc1-5c20c3dea2ee
-name: Previously Unseen Bot or Application Added to Teams
+name: GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams
 description: |
   This hunting query helps identify new, and potentially unapproved applications or bots being added to Teams.
 requiredDataConnectors:
@@ -13,22 +13,44 @@ relevantTechniques:
   - T1176
   - T1119
 query: |
-  let starttime = todatetime('{{StartTimeISO}}');
-  let endtime = todatetime('{{EndTimeISO}}');
-  let lookback = starttime - 14d;
-  let historical_bots = 
-    EnrichedMicrosoft365AuditLogs
-    | where TimeGenerated between (lookback .. starttime)
-    | where Workload == "MicrosoftTeams"
-    | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)
-    | where isnotempty(AddonName)
-    | distinct AddonName;
-  EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated between (starttime .. endtime)
-  | where Workload == "MicrosoftTeams"
-  | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)
-  | where AddonName !in (historical_bots)
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    let starttime = todatetime('{{StartTimeISO}}');
+      let endtime = todatetime('{{EndTimeISO}}');
+      let lookback = starttime - 14d;
+      // Historical bots from EnrichedMicrosoft365AuditLogs
+      let historical_bots_enriched = EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (lookback .. starttime)
+          | where Workload == "MicrosoftTeams"
+          | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)
+          | where isnotempty(AddonName)
+          | distinct AddonName;
+      // Historical bots from OfficeActivity
+      let historical_bots_office = OfficeActivity
+          | where TimeGenerated between (lookback .. starttime)
+          | where OfficeWorkload == "MicrosoftTeams"
+          | where isnotempty(AddonName)
+          | distinct AddonName;
+      // Find new bots in Enriched Logs
+      let new_bots_enriched = EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (starttime .. endtime)
+          | where Workload == "MicrosoftTeams"
+          | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)
+          | where AddonName !in (historical_bots_enriched)
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      // Find new bots in OfficeActivity
+      let new_bots_office = OfficeActivity
+          | where TimeGenerated between (starttime .. endtime)
+          | where OfficeWorkload == "MicrosoftTeams"
+          | where isnotempty(AddonName)
+          | where AddonName !in (historical_bots_office)
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+      // Combine both new bots from Enriched Logs and OfficeActivity
+      let CombinedNewBots = new_bots_enriched
+          | union new_bots_office
+          | summarize arg_min(TimeGenerated, *) by AddonName, UserId;
+      // Final output
+      CombinedNewBots
+          | project TimeGenerated, AddonName, UserId, AccountName, AccountUPNSuffix
+          | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -36,4 +58,4 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml b/Solutions/Global Secure Access/Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml
index 19250a6944..cb4b11c014 100644
--- a/Solutions/Global Secure Access/Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml	
@@ -1,5 +1,5 @@
 id: 641ecd2d-27c9-4f05-8433-8205096b09fc
-name: New Windows Reserved Filenames staged on Office file services
+name: GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services
 description: |
   'This identifies new Windows Reserved Filenames on Office services like SharePoint and OneDrive in the past 7 days. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity.'
 description-detailed: |
@@ -18,43 +18,75 @@ tactics:
 relevantTechniques:
   - T1105
 query: |
-  let starttime = todatetime('{{StartTimeISO}}');
-  let endtime = todatetime('{{EndTimeISO}}');
-  let lookback = totimespan((endtime - starttime) * 7);
-  let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);
-  EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated between (starttime .. endtime)
-  | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-  | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)
-  | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-  | where isnotempty(ObjectId)
-  | where ObjectId !~ FileName
-  | where ObjectId in (Reserved) or FileName in (Reserved)
-  | where ClientUserAgent !has "Mac OS"
-  | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, ClientUserAgent, SiteUrl, ObjectId, FileName
-  | join kind=leftanti (
-      EnrichedMicrosoft365AuditLogs
-      | where TimeGenerated between (ago(lookback) .. starttime)
-      | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-      | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)
-      | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-      | where isnotempty(ObjectId)
-      | where ObjectId !~ FileName
-      | where ObjectId in (Reserved) or FileName in (Reserved)
-      | where ClientUserAgent !has "Mac OS"
-      | summarize PrevSeenCount = count() by ObjectId, UserId, FileName
-  ) on ObjectId
-  | extend SiteUrlUserFolder = tolower(split(SiteUrl, '/')[-2])
-  | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
-  | extend UserIdDiffThanUserFolder = iff(SiteUrl has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
-  | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(ClientUserAgent, 100000),
-      Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(FileName, 100000)
-      by Workload, RecordType, UserType, UserKey, UserId, ClientIp, SiteUrl, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-  | extend IP_0_Address = ClientIp
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
-  | extend URL_0_Url = SiteUrl
+    let starttime = todatetime('{{StartTimeISO}}');
+      let endtime = todatetime('{{EndTimeISO}}');
+      let lookback = totimespan((endtime - starttime) * 7);
+      
+      // Reserved file names and extensions for Windows
+      let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);
+      
+      // EnrichedMicrosoft365AuditLogs Query
+      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (starttime .. endtime)
+          | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+          | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)
+          | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+          | where isnotempty(ObjectId)
+          | where ObjectId !~ FileName
+          | where ObjectId in (Reserved) or FileName in (Reserved)
+          | where ClientUserAgent !has "Mac OS"
+          | join kind=leftanti (
+              EnrichedMicrosoft365AuditLogs
+              | where TimeGenerated between (ago(lookback) .. starttime)
+              | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+              | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)
+              | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+              | where isnotempty(ObjectId)
+              | where ObjectId !~ FileName
+              | where ObjectId in (Reserved) or FileName in (Reserved)
+              | where ClientUserAgent !has "Mac OS"
+              | summarize PrevSeenCount = count() by ObjectId, UserId, FileName
+          ) on ObjectId
+          | extend SiteUrlUserFolder = tolower(split(SiteUrl, '/')[-2])
+          | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+          | extend UserIdDiffThanUserFolder = iff(SiteUrl has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+          | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(ClientUserAgent, 100000), Ids = make_list(Id, 100000),
+              SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(FileName, 100000) by Workload, RecordType, UserType, UserKey, UserId, ClientIp, SiteUrl, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+          | extend IP_0_Address = ClientIp
+          | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;
+      // OfficeActivity Query
+      let OfficeEvents = OfficeActivity
+          | where TimeGenerated between (starttime .. endtime)
+          | where isnotempty(SourceFileExtension)
+          | where SourceFileName !~ SourceFileExtension
+          | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)
+          | where UserAgent !has "Mac OS"
+          | join kind=leftanti (
+              OfficeActivity
+              | where TimeGenerated between (ago(lookback) .. starttime)
+              | where isnotempty(SourceFileExtension)
+              | where SourceFileName !~ SourceFileExtension
+              | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)
+              | where UserAgent !has "Mac OS"
+              | summarize PrevSeenCount = count() by SourceFileExtension
+          ) on SourceFileExtension
+          | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+          | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+          | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+          | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000),
+              SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000) by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+          | extend IP_0_Address = ClientIP
+          | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;
+      // Combine Office and Enriched Logs
+      let CombinedEvents = OfficeEvents
+          | union EnrichedEvents
+          | summarize arg_min(StartTime, *) by UserId, ClientIP;
+      // Final Output
+      CombinedEvents
+          | project StartTime, EndTime, Operations, UserAgents, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url
+          | order by StartTime desc
 entityMappings:
   - entityType: IP
     fieldMappings:
@@ -70,5 +102,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: URL_0_Url
-version: 2.0.1
+version: 2.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/OfficeMailForwarding_hunting.yaml b/Solutions/Global Secure Access/Hunting Queries/OfficeMailForwarding_hunting.yaml
index 7734458918..6cad3cce32 100644
--- a/Solutions/Global Secure Access/Hunting Queries/OfficeMailForwarding_hunting.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/OfficeMailForwarding_hunting.yaml	
@@ -1,5 +1,5 @@
 id: d49fc965-aef3-49f6-89ad-10cc4697eb5b
-name: Office Mail Forwarding - Hunting Version
+name: GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version
 description: |
   Adversaries often abuse email-forwarding rules to monitor victim activities, steal information, and gain intelligence on the victim or their organization. This query highlights cases where user mail is being forwarded, including to external domains.
 description-detailed: |
@@ -17,51 +17,63 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
-    EnrichedMicrosoft365AuditLogs
-    | where Workload == "Exchange"
-    | where (Operation == "Set-Mailbox" and tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardingSmtpAddress') 
-        or (Operation in ('New-InboxRule', 'Set-InboxRule') and (tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardTo' or tostring(parse_json(tostring(AdditionalProperties))) contains 'RedirectTo'))
-    | extend parsed = parse_json(tostring(AdditionalProperties))
-    | extend fwdingDestination_initial = iif(Operation == "Set-Mailbox", tostring(parsed.ForwardingSmtpAddress), coalesce(tostring(parsed.ForwardTo), tostring(parsed.RedirectTo)))
-    | where isnotempty(fwdingDestination_initial)
-    | extend fwdingDestination = iff(fwdingDestination_initial has "smtp", (split(fwdingDestination_initial, ":")[1]), fwdingDestination_initial)
-    | parse fwdingDestination with * '@' ForwardedtoDomain 
-    | parse UserId with *'@' UserDomain
-    | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.'))[0])
-    | where ForwardedtoDomain !contains subDomain
-    | extend Result = iff(ForwardedtoDomain != UserDomain, "Mailbox rule created to forward to External Domain", "Forward rule for Internal domain")
-    | extend ClientIPAddress = case(ClientIp has ".", tostring(split(ClientIp, ":")[0]), ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))), ClientIp)
-    | extend Port = case(
-                        ClientIp has ".",
-                        (split(ClientIp, ":")[1]),
-                        ClientIp has "[",
-                        tostring(split(ClientIp, "]:")[1]),
-                        ClientIp
-                    )
-    | project
-        TimeGenerated,
-        UserId,
-        UserDomain,
-        subDomain,
-        Operation,
-        ForwardedtoDomain,
-        ClientIPAddress,
-        Result,
-        Port,
-        ObjectId,
-        fwdingDestination,
-        AdditionalProperties
-    | extend
-        AccountName = tostring(split(UserId, "@")[0]),
-        AccountUPNSuffix = tostring(split(UserId, "@")[1])
-    | extend Host = tostring(parse_json(tostring(AdditionalProperties)).OriginatingServer)
-    | extend HostName = tostring(split(Host, ".")[0])
-    | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))
-    | extend Account_0_Name = AccountName
-    | extend Account_0_UPNSuffix = AccountUPNSuffix
-    | extend IP_0_Address = ClientIPAddress
-    | extend Host_0_HostName = HostName
-    | extend Host_0_DnsDomain = DnsDomain
+    let starttime = todatetime('{{StartTimeISO}}');
+      let endtime = todatetime('{{EndTimeISO}}');
+      
+      // Enriched Logs Query for forwarding rule operations
+      let EnrichedForwardRules = EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (starttime .. endtime)
+          | where Workload == "Exchange"
+          | where (Operation == "Set-Mailbox" and tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardingSmtpAddress') 
+              or (Operation in ('New-InboxRule', 'Set-InboxRule') and (tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardTo' or tostring(parse_json(tostring(AdditionalProperties))) contains 'RedirectTo'))
+          | extend parsed = parse_json(tostring(AdditionalProperties))
+          | extend fwdingDestination_initial = iif(Operation == "Set-Mailbox", tostring(parsed.ForwardingSmtpAddress), coalesce(tostring(parsed.ForwardTo), tostring(parsed.RedirectTo)))
+          | where isnotempty(fwdingDestination_initial)
+          | extend fwdingDestination = iff(fwdingDestination_initial has "smtp", (split(fwdingDestination_initial, ":")[1]), fwdingDestination_initial)
+          | parse fwdingDestination with * '@' ForwardedtoDomain 
+          | parse UserId with * '@' UserDomain
+          | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.'))[0])
+          | where ForwardedtoDomain !contains subDomain
+          | extend Result = iff(ForwardedtoDomain != UserDomain, "Mailbox rule created to forward to External Domain", "Forward rule for Internal domain")
+          | extend ClientIPAddress = case(ClientIp has ".", tostring(split(ClientIp, ":")[0]), ClientIp has "[", tostring(trim_start(@'[[]', tostring(split(ClientIp, "]")[0]))), ClientIp)
+          | extend Port = case(ClientIp has ".", (split(ClientIp, ":")[1]), ClientIp has "[", tostring(split(ClientIp, "]:")[1]), ClientIp)
+          | extend Host = tostring(parse_json(tostring(AdditionalProperties)).OriginatingServer)
+          | extend HostName = tostring(split(Host, ".")[0])
+          | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))
+          | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, HostName, DnsDomain
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+          | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+      // Office Activity Query for forwarding rule operations
+      let OfficeForwardRules = OfficeActivity
+          | where TimeGenerated between (starttime .. endtime)
+          | where OfficeWorkload == "Exchange"
+          | where (Operation =~ "Set-Mailbox" and Parameters contains 'ForwardingSmtpAddress') 
+              or (Operation in~ ('New-InboxRule', 'Set-InboxRule') and (Parameters contains 'ForwardTo' or Parameters contains 'RedirectTo'))
+          | extend parsed = parse_json(Parameters)
+          | extend fwdingDestination_initial = (iif(Operation =~ "Set-Mailbox", tostring(parsed[1].Value), tostring(parsed[2].Value)))
+          | where isnotempty(fwdingDestination_initial)
+          | extend fwdingDestination = iff(fwdingDestination_initial has "smtp", (split(fwdingDestination_initial, ":")[1]), fwdingDestination_initial)
+          | parse fwdingDestination with * '@' ForwardedtoDomain 
+          | parse UserId with * '@' UserDomain
+          | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.') [0]))
+          | where ForwardedtoDomain !contains subDomain
+          | extend Result = iff(ForwardedtoDomain != UserDomain, "Mailbox rule created to forward to External Domain", "Forward rule for Internal domain")
+          | extend ClientIPAddress = case(ClientIP has ".", tostring(split(ClientIP, ":")[0]), ClientIP has "[", tostring(trim_start(@'[[]', tostring(split(ClientIP, "]")[0]))), ClientIP)
+          | extend Port = case(ClientIP has ".", (split(ClientIP, ":")[1]), ClientIP has "[", tostring(split(ClientIP, "]:")[1]), ClientIP)
+          | extend Host = tostring(split(OriginatingServer, " (")[0])
+          | extend HostName = tostring(split(Host, ".")[0])
+          | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))
+          | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, HostName, DnsDomain
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+          | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+      // Combine the results from both Enriched and Office Activity logs
+      let CombinedForwardRules = EnrichedForwardRules
+          | union OfficeForwardRules
+          | summarize arg_min(TimeGenerated, *) by UserId, ForwardedtoDomain, Operation
+          | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, Host_0_HostName, Host_0_DnsDomain, IP_0_Address, Account_0_Name, Account_0_UPNSuffix;  
+      // Final output
+      CombinedForwardRules
+          | order by TimeGenerated desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -79,5 +91,5 @@ entityMappings:
         columnName: Host_0_HostName
       - identifier: DnsDomain
         columnName: Host_0_DnsDomain
-version: 2.0.1
+version: 2.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/TeamsFilesUploaded.yaml b/Solutions/Global Secure Access/Hunting Queries/TeamsFilesUploaded.yaml
index a61d6f2fa9..164e850522 100644
--- a/Solutions/Global Secure Access/Hunting Queries/TeamsFilesUploaded.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/TeamsFilesUploaded.yaml	
@@ -1,5 +1,5 @@
 id: 90e198a9-efb6-4719-ad89-81b8e93633a7
-name: Files uploaded to teams and access summary
+name: GSA Enriched Office 365 - Files uploaded to teams and access summary
 description: |
   'This hunting query identifies files uploaded to SharePoint via a Teams chat and
   summarizes users and IP addresses that have accessed these files. This allows for 
@@ -16,27 +16,52 @@ relevantTechniques:
   - T1102
   - T1078
 query: |
-  EnrichedMicrosoft365AuditLogs
-  | where RecordType == "SharePointFileOperation"
-  | where Operation == "FileUploaded"
-  | where UserId != "app@sharepoint"
-  | where ObjectId has "Microsoft Teams Chat Files"
-  | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-  | join kind=leftouter (
-      EnrichedMicrosoft365AuditLogs
-      | where RecordType == "SharePointFileOperation"
-      | where Operation == "FileDownloaded" or Operation == "FileAccessed"
-      | where UserId != "app@sharepoint"
-      | where ObjectId has "Microsoft Teams Chat Files"
-      | extend UserId1 = UserId, ClientIp1 = ClientIp
-  ) on ObjectId
-  | extend userBag = bag_pack("UserId1", UserId1, "ClientIp1", ClientIp1)
-  | summarize AccessedBy = make_bag(userBag), make_set(UserId1, 10000) by bin(TimeGenerated, 1h), UserId, ObjectId, SourceFileName
-  | extend NumberOfUsersAccessed = array_length(bag_keys(AccessedBy))
-  | project timestamp = TimeGenerated, UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
+  // Define the query for EnrichedMicrosoft365AuditLogs
+  let enrichedLogs = EnrichedMicrosoft365AuditLogs
+    | where RecordType == "SharePointFileOperation"
+    | where Operation == "FileUploaded"
+    | where UserId != "app@sharepoint"
+    | where ObjectId has "Microsoft Teams Chat Files"
+    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+    | join kind=leftouter (
+        EnrichedMicrosoft365AuditLogs
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileAccessed")
+        | where UserId != "app@sharepoint"
+        | where ObjectId has "Microsoft Teams Chat Files"
+        | extend UserId1 = UserId, ClientIp1 = ClientIp
+    ) on ObjectId
+    | extend userBag = bag_pack("UserId1", UserId1, "ClientIp1", ClientIp1)
+    | summarize AccessedBy = make_bag(userBag), make_set(UserId1, 10000) by bin(TimeGenerated, 1h), UserId, ObjectId, SourceFileName
+    | extend NumberOfUsersAccessed = array_length(bag_keys(AccessedBy))
+    | project timestamp = TimeGenerated, UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    | extend Account_0_Name = AccountName
+    | extend Account_0_UPNSuffix = AccountUPNSuffix;
+  // Define the query for OfficeActivity
+  let officeLogs = OfficeActivity
+    | where RecordType == "SharePointFileOperation"
+    | where Operation == "FileUploaded"
+    | where UserId != "app@sharepoint"
+    | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+    | join kind=leftouter (
+        OfficeActivity
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileAccessed")
+        | where UserId != "app@sharepoint"
+        | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+    ) on OfficeObjectId
+    | extend userBag = bag_pack(UserId1, ClientIP1)
+    | summarize AccessedBy = make_bag(userBag, 10000), make_set(UserId1, 10000) by TimeGenerated, UserId, OfficeObjectId, SourceFileName
+    | extend NumberUsers = array_length(bag_keys(AccessedBy))
+    | project timestamp = TimeGenerated, UserId, FileLocation = OfficeObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed = NumberUsers
+    | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+    | extend Account_0_Name = AccountName
+    | extend Account_0_UPNSuffix = AccountUPNSuffix;
+  // Union both results
+  enrichedLogs
+  | union officeLogs
+  | order by timestamp desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -44,4 +69,4 @@ entityMappings:
         columnName: AccountName
       - identifier: UPNSuffix
         columnName: AccountUPNSuffix
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/UserAddToTeamsAndUploadsFile.yaml b/Solutions/Global Secure Access/Hunting Queries/UserAddToTeamsAndUploadsFile.yaml
index f1ba1da23c..e8dde43e14 100644
--- a/Solutions/Global Secure Access/Hunting Queries/UserAddToTeamsAndUploadsFile.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/UserAddToTeamsAndUploadsFile.yaml	
@@ -1,5 +1,5 @@
 id: 3d6d0c04-7337-40cf-ace6-c471d442356d
-name: User added to Teams and immediately uploads file
+name: GSA Enriched Office 365 - User added to Teams and immediately uploads file
 description: |
   'This hunting query identifies users who are added to a Teams Channel or Teams chat
   and within 1 minute of being added upload a file via the chat. This might be
@@ -13,25 +13,50 @@ tactics:
 relevantTechniques:
   - T1566
 query: |
-  let threshold = 1m;
-  let MemberAddedEvents = EnrichedMicrosoft365AuditLogs
-    | where Workload == "MicrosoftTeams"
-    | where Operation == "MemberAdded"
-    | extend TeamName = tostring(parse_json(AdditionalProperties).TeamName)
-    | project TimeGenerated, UploaderID = UserId, TeamName;
-  let FileUploadEvents = EnrichedMicrosoft365AuditLogs
-    | where RecordType == "SharePointFileOperation"
-    | where ObjectId has "Microsoft Teams Chat Files"
-    | where Operation == "FileUploaded"
-    | extend SourceFileName = tostring(parse_json(AdditionalProperties).SourceFileName)
-    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = ObjectId, SourceFileName;
-  MemberAddedEvents
-    | join kind=inner (FileUploadEvents) on UploaderID
-    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold
-    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID
+    let threshold = 1m;
+      // Define MemberAddedEvents for EnrichedMicrosoft365AuditLogs
+      let MemberAddedEvents_Enriched = EnrichedMicrosoft365AuditLogs
+        | where Workload == "MicrosoftTeams"
+        | where Operation == "MemberAdded"
+        | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)
+        | project TimeGenerated, UploaderID = UserId, TeamName;
+      // Define FileUploadEvents for EnrichedMicrosoft365AuditLogs
+      let FileUploadEvents_Enriched = EnrichedMicrosoft365AuditLogs
+        | where RecordType == "SharePointFileOperation"
+        | where ObjectId has "Microsoft Teams Chat Files"
+        | where Operation == "FileUploaded"
+        | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+        | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = ObjectId, SourceFileName;
+      // Perform join for EnrichedMicrosoft365AuditLogs
+      let EnrichedResults = MemberAddedEvents_Enriched
+        | join kind=inner (FileUploadEvents_Enriched) on UploaderID
+        | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold
+        | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;
+      // Define MemberAddedEvents for OfficeActivity
+      let MemberAddedEvents_Office = OfficeActivity
+        | where OfficeWorkload == "MicrosoftTeams"
+        | where Operation == "MemberAdded"
+        | extend TeamName = iff(isempty(TeamName), Members[0].UPN, TeamName)
+        | project TimeGenerated, UploaderID = UserId, TeamName;
+      // Define FileUploadEvents for OfficeActivity
+      let FileUploadEvents_Office = OfficeActivity
+        | where RecordType == "SharePointFileOperation"
+        | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+        | where Operation == "FileUploaded"
+        | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = OfficeObjectId, FileName = SourceFileName;
+      // Perform join for OfficeActivity
+      let OfficeResults = MemberAddedEvents_Office
+        | join kind=inner (FileUploadEvents_Office) on UploaderID
+        | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold
+        | project-away UploaderID1
+        | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;
+      // Union both results
+      EnrichedResults
+      | union OfficeResults
+      | order by timestamp desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
       - identifier: Name
         columnName: AccountCustomEntity
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml b/Solutions/Global Secure Access/Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml
index 226886457a..35997c9b51 100644
--- a/Solutions/Global Secure Access/Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml	
@@ -1,5 +1,5 @@
 id: 61c28cd7-3139-4731-8ea7-2cbbeabb4684
-name: Windows Reserved Filenames Staged on Office File Services
+name: GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services
 description: |
   'This identifies Windows Reserved Filenames on Office services like SharePoint and OneDrive. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity.'
 description-detailed: |
@@ -18,27 +18,44 @@ tactics:
 relevantTechniques:
   - T1105
 query: |
-  // Reserved FileNames/Extension for Windows
-  let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);
-  EnrichedMicrosoft365AuditLogs
-  | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
-  | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-  | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
-  | where isnotempty(ObjectId)
-  | where ObjectId in (Reserved) or SourceFileName in (Reserved)
-  | where UserAgent !has "Mac OS"
-  | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
-  | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
-  // identify when UserId is not a match to the specific site url personal folder reference
-  | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
-  | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), ObjectIds = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(SourceFileName, 100000)
-  by Workload, RecordType, UserType, UserKey, UserId, ClientIp, Site_Url, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
-  // Use mvexpand on any list items and you can expand out the exact time and other metadata about the hit
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-  | extend IP_0_Address = ClientIp
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
-  | extend URL_0_Url = Site_Url
+    let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);
+      // Query for OfficeActivity
+      let OfficeActivityResults = OfficeActivity
+        | where isnotempty(SourceFileExtension)
+        | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)
+        | where UserAgent !has "Mac OS"
+        | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+        | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+        | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+        | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000)
+        by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend IP_0_Address = ClientIP
+        | extend Account_0_Name = AccountName
+        | extend Account_0_UPNSuffix = AccountUPNSuffix
+        | extend URL_0_Url = Site_Url;
+      // Query for EnrichedMicrosoft365AuditLogs
+      let EnrichedMicrosoft365Results = EnrichedMicrosoft365AuditLogs
+        | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)
+        | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
+        | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+        | where isnotempty(ObjectId)
+        | where ObjectId in (Reserved) or SourceFileName in (Reserved)
+        | where UserAgent !has "Mac OS"
+        | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])
+        | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\.', '_'))
+        | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)
+        | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), ObjectIds = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(SourceFileName, 100000)
+        by Workload, RecordType, UserType, UserKey, UserId, ClientIp, Site_Url, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend IP_0_Address = ClientIp
+        | extend Account_0_Name = AccountName
+        | extend Account_0_UPNSuffix = AccountUPNSuffix
+        | extend URL_0_Url = Site_Url;
+      // Combine both queries
+      OfficeActivityResults
+      | union EnrichedMicrosoft365Results
+      | order by StartTime desc;
 entityMappings:
   - entityType: IP
     fieldMappings:
@@ -54,4 +71,4 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: Site_Url
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_IP.yaml b/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_IP.yaml
index 1ef34600f9..271f7cb1e0 100644
--- a/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_IP.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_IP.yaml	
@@ -1,5 +1,5 @@
 id: e3d24cfd-b2a1-4ba7-8f80-0360892f9d57
-name: SharePointFileOperation via previously unseen IPs
+name: GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs
 description: |
   'Shows SharePoint upload/download volume by IPs with high-risk ASNs. New IPs with volume spikes may be unauthorized and exfiltrating documents.'
 description-detailed: |
@@ -22,29 +22,46 @@ query: |
   let endtime = todatetime('{{EndTimeISO}}');
   let lookback = starttime - 14d;
   let BLOCK_THRESHOLD = 1.0;
-  let HighBlockRateASNs =
-    SigninLogs
-    | where TimeGenerated > lookback
-    | where isnotempty(AutonomousSystemNumber)
-    | summarize make_set(IPAddress), TotalIps = dcount(IPAddress), BlockedSignins = countif(ResultType == "50053"), TotalSignins = count() by AutonomousSystemNumber
-    | extend BlockRatio = 1.00 * BlockedSignins / TotalSignins
-    | where BlockRatio >= BLOCK_THRESHOLD
-    | distinct AutonomousSystemNumber;
-  let ASNIPs =
-    SigninLogs
-    | where TimeGenerated > lookback
-    | where AutonomousSystemNumber in (HighBlockRateASNs)
-    | distinct IPAddress, AutonomousSystemNumber;
-  EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated between (starttime .. endtime)
-  | where RecordType == "SharePointFileOperation"
-  | where Operation in ("FileDownloaded", "FileUploaded")
-  | where ClientIp in (ASNIPs)
-  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIp
-  | extend IP_0_Address = ClientIp
+  // Identify Autonomous System Numbers (ASNs) with a high block rate in Sign-in Logs
+  let HighBlockRateASNs = SigninLogs
+      | where TimeGenerated > lookback
+      | where isnotempty(AutonomousSystemNumber)
+      | summarize make_set(IPAddress), TotalIps = dcount(IPAddress), BlockedSignins = countif(ResultType == "50053"), TotalSignins = count() by AutonomousSystemNumber
+      | extend BlockRatio = 1.00 * BlockedSignins / TotalSignins
+      | where BlockRatio >= BLOCK_THRESHOLD
+      | distinct AutonomousSystemNumber;
+  // Retrieve IP addresses from these high block rate ASNs
+  let ASNIPs = SigninLogs
+      | where TimeGenerated > lookback
+      | where AutonomousSystemNumber in (HighBlockRateASNs)
+      | distinct IPAddress, AutonomousSystemNumber;
+  // OfficeActivity Query: File activities from identified ASN IPs
+  let OfficeEvents = OfficeActivity
+      | where TimeGenerated between(starttime .. endtime)
+      | where RecordType == "SharePointFileOperation"
+      | where Operation in ("FileDownloaded", "FileUploaded")
+      | where ClientIP in (ASNIPs)
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIP
+      | extend IP_0_Address = ClientIP;
+  // EnrichedMicrosoft365AuditLogs Query: File activities from identified ASN IPs
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+      | where TimeGenerated between (starttime .. endtime)
+      | where RecordType == "SharePointFileOperation"
+      | where Operation in ("FileDownloaded", "FileUploaded")
+      | where ClientIp in (ASNIPs)
+      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIp
+      | extend IP_0_Address = ClientIp;
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+      | union EnrichedEvents
+      | summarize arg_min(StartTime, *) by ClientIP;
+  // Final Output
+  CombinedEvents
+      | project StartTime, EndTime, RecentFileActivities, IP_0_Address
+      | order by StartTime desc
 entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: IP_0_Address
-version: 2.0.1
+version: 2.0.2
diff --git a/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_UserAgent.yaml b/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_UserAgent.yaml
index be10886060..fe4a679dbc 100644
--- a/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_UserAgent.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/new_sharepoint_downloads_by_UserAgent.yaml	
@@ -1,5 +1,5 @@
 id: f2367171-1514-4c67-88ef-27434b6a1093
-name: SharePointFileOperation via devices with previously unseen user agents
+name: GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents
 description: |
   'Tracking via user agent is one way to differentiate between types of connecting device.
   In homogeneous enterprise environments the user agent associated with an attacker device may stand out as unusual.'
@@ -15,33 +15,47 @@ tactics:
 relevantTechniques:
   - T1030
 query: |
-  let starttime = todatetime('{{StartTimeISO}}');
-  let endtime = todatetime('{{EndTimeISO}}');
-  let lookback = starttime - 14d;
-  let MINIMUM_BLOCKS = 10;
-  let SUCCESS_THRESHOLD = 0.2;
-  let HistoricalActivity = 
-    SigninLogs
-    | where TimeGenerated > lookback
-    | where isnotempty(ClientAppUsed)
-    | summarize SuccessfulSignins = countif(ResultType == "0"), BlockedSignins = countif(ResultType == "50053") by ClientAppUsed
-    | extend SuccessBlockRatio = 1.00 * SuccessfulSignins / BlockedSignins
-    | where SuccessBlockRatio < SUCCESS_THRESHOLD
-    | where BlockedSignins > MINIMUM_BLOCKS;
-  EnrichedMicrosoft365AuditLogs
-  | where TimeGenerated between (starttime .. endtime)
-  | where RecordType == "SharePointFileOperation"
-  | where Operation in ("FileDownloaded", "FileUploaded")
-  | extend ClientAppUsed = tostring(parse_json(AdditionalProperties).UserAgent)
-  | extend SiteUrl = tostring(parse_json(AdditionalProperties).SiteUrl)
-  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientAppUsed, UserId, ClientIp, SiteUrl
-  | join kind=innerunique (HistoricalActivity) on ClientAppUsed
-  | project-away ClientAppUsed1
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-  | extend IP_0_Address = ClientIp
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
-  | extend URL_0_Url = SiteUrl
+    let starttime = todatetime('{{StartTimeISO}}');
+    let endtime = todatetime('{{EndTimeISO}}');
+    let lookback = starttime - 14d;
+    let MINIMUM_BLOCKS = 10;
+    let SUCCESS_THRESHOLD = 0.2;
+    // Identify user agents or client apps with a low success-to-block ratio in Sign-in Logs
+    let HistoricalActivity = SigninLogs
+        | where TimeGenerated > lookback
+        | where isnotempty(UserAgent)
+        | summarize SuccessfulSignins = countif(ResultType == "0"), BlockedSignins = countif(ResultType == "50053") by UserAgent
+        | extend SuccessBlockRatio = 1.00 * SuccessfulSignins / BlockedSignins
+        | where SuccessBlockRatio < SUCCESS_THRESHOLD
+        | where BlockedSignins > MINIMUM_BLOCKS;
+    // OfficeActivity Query: File operations by matching user agents
+    let OfficeEvents = OfficeActivity
+        | where TimeGenerated between (starttime .. endtime)
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileUploaded")
+        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIP, Site_Url
+        | join kind=innerunique (HistoricalActivity) on UserAgent
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend IP_0_Address = ClientIP, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;
+    // EnrichedMicrosoft365AuditLogs Query: File operations by matching client apps (UserAgent)
+    let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+        | where TimeGenerated between (starttime .. endtime)
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileUploaded")
+        | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)  // Ensure matching with UserAgent column
+        | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)
+        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIp, SiteUrl
+        | join kind=innerunique (HistoricalActivity) on UserAgent
+        | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+        | extend IP_0_Address = ClientIp, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;
+    // Combine Office and Enriched Logs
+    let CombinedEvents = OfficeEvents
+        | union EnrichedEvents
+        | summarize arg_min(StartTime, *) by UserId, ClientIP;
+    // Final Output
+    CombinedEvents
+        | project StartTime, EndTime, RecentFileActivities, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url
+        | order by StartTime desc;
 entityMappings:
   - entityType: IP
     fieldMappings:
@@ -57,5 +71,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: URL_0_Url
-version: 2.0.1
+version: 2.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/nonowner_MailboxLogin.yaml b/Solutions/Global Secure Access/Hunting Queries/nonowner_MailboxLogin.yaml
index 43497e3531..a8397ba778 100644
--- a/Solutions/Global Secure Access/Hunting Queries/nonowner_MailboxLogin.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/nonowner_MailboxLogin.yaml	
@@ -1,5 +1,5 @@
 id: 0a8f410d-38b5-4d75-90da-32b472b97230
-name: Non-owner mailbox login activity
+name: GSA Enriched Office 365 - Non-owner mailbox login activity
 description: |
   'Finds non-owner mailbox access by admin/delegate permissions. Whitelist valid users and check others for unauthorized access.'
 description-detailed: |
@@ -22,17 +22,37 @@ tags:
   - Solorigate
   - NOBELIUM
 query: |
-  EnrichedMicrosoft365AuditLogs
-  | where Workload == "Exchange"
-  | where Operation == "MailboxLogin"
-  | extend Logon_Type = tostring(parse_json(tostring(AdditionalProperties)).LogonType)
-  | extend MailboxOwnerUPN = tostring(parse_json(tostring(AdditionalProperties)).MailboxOwnerUPN)
-  | where Logon_Type != "Owner"
-  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIp
-  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
-  | extend IP_0_Address = ClientIp
-  | extend Account_0_Name = AccountName
-  | extend Account_0_UPNSuffix = AccountUPNSuffix
+    let starttime = todatetime('{{StartTimeISO}}');
+      let endtime = todatetime('{{EndTimeISO}}');
+      // Enriched Logs Query for Mailbox Logins (non-owner)
+      let EnrichedMailboxLogins = EnrichedMicrosoft365AuditLogs
+          | where TimeGenerated between (starttime .. endtime)
+          | where Workload == "Exchange"
+          | where Operation == "MailboxLogin"
+          | extend Logon_Type = tostring(parse_json(tostring(AdditionalProperties)).LogonType)
+          | extend MailboxOwnerUPN = tostring(parse_json(tostring(AdditionalProperties)).MailboxOwnerUPN)
+          | where Logon_Type != "Owner"
+          | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIp
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+          | extend IP_0_Address = ClientIp
+          | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+      // Office Activity Query for Mailbox Logins (non-owner)
+      let OfficeMailboxLogins = OfficeActivity
+          | where TimeGenerated between (starttime .. endtime)
+          | where OfficeWorkload == "Exchange"
+          | where Operation == "MailboxLogin" and Logon_Type != "Owner"
+          | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIP
+          | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+          | extend IP_0_Address = ClientIP
+          | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;
+      // Combine both results
+      let CombinedMailboxLogins = EnrichedMailboxLogins
+          | union OfficeMailboxLogins
+          | summarize arg_min(StartTime, *) by UserId, MailboxOwnerUPN, Logon_Type;
+      // Final output
+      CombinedMailboxLogins
+          | project StartTime, EndTime, Operation, UserId, MailboxOwnerUPN, Logon_Type, Account_0_Name, Account_0_UPNSuffix, IP_0_Address
+          | order by StartTime desc
 entityMappings:
   - entityType: Account
     fieldMappings:
diff --git a/Solutions/Global Secure Access/Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml b/Solutions/Global Secure Access/Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml
index a04c13e8d0..298d6ca30d 100644
--- a/Solutions/Global Secure Access/Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml	
@@ -1,5 +1,5 @@
 id: 49a4f65a-fe18-408e-afec-042fde93d3ce
-name: PowerShell or non-browser mailbox login activity
+name: GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity
 description: |
   'Detects mailbox login from Exchange PowerShell. All accounts can use it by default, but admins can change it. Whitelist benign activities.'
 description-detailed: |
@@ -21,18 +21,41 @@ relevantTechniques:
   - T1098
   - T1114
 query: |
-  EnrichedMicrosoft365AuditLogs
-  | where Workload == "Exchange" and Operation == "MailboxLogin"
-  | extend ClientApplication = tostring(parse_json(AdditionalProperties).ClientInfoString)
-  | where ClientApplication == "Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client"
-  | extend TenantName = tostring(parse_json(AdditionalProperties).TenantName)
-  | extend MailboxOwner = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
-  | extend LogonType = tostring(parse_json(AdditionalProperties).LogonType)
-  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, TenantName, UserType, UserId, MailboxOwner, LogonType, ClientApplication
-  | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
-  | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
-  | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
-  | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '')
+    let starttime = todatetime('{{StartTimeISO}}');
+        let endtime = todatetime('{{EndTimeISO}}');
+        // EnrichedMicrosoft365AuditLogs query
+        let EnrichedMailboxLogin = EnrichedMicrosoft365AuditLogs
+            | where TimeGenerated between (starttime .. endtime)
+            | where Workload == "Exchange" and Operation == "MailboxLogin"
+            | extend ClientApplication = tostring(parse_json(AdditionalProperties).ClientInfoString)
+            | where ClientApplication == "Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client"
+            | extend TenantName = tostring(parse_json(AdditionalProperties).TenantName)
+            | extend MailboxOwner = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
+            | extend LogonType = tostring(parse_json(AdditionalProperties).LogonType)
+            | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, TenantName, UserType, UserId, MailboxOwner, LogonType, ClientApplication
+            | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
+            | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
+            | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
+            | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
+        // OfficeActivity query
+        let OfficeMailboxLogin = OfficeActivity
+            | where TimeGenerated between (starttime .. endtime)
+            | where OfficeWorkload == "Exchange" and Operation == "MailboxLogin"
+            | where ClientInfoString == "Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client"
+            | extend LogonType = "Unknown"  // If LogonType does not exist, create a placeholder
+            | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, LogonType, ClientInfoString
+            | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)
+            | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')
+            | extend AccountName = iff(UserId contains '\\', tostring(split(UserId, '\\')[1]), AccountName)
+            | extend AccountNTDomain = iff(UserId contains '\\', tostring(split(UserId, '\\')[0]), '');
+        // Combine Enriched and Office queries
+        let CombinedMailboxLogin = EnrichedMailboxLogin
+            | union OfficeMailboxLogin
+            | summarize arg_min(StartTime, *) by UserId, Operation
+            | project StartTime, EndTime, Operation, TenantName, OrganizationName, UserType, UserId, MailboxOwner, LogonType, ClientApplication, ClientInfoString, Count, AccountName, AccountUPNSuffix, AccountNTDomain;
+        // Final output
+        CombinedMailboxLogin
+            | order by StartTime desc;
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -42,5 +65,5 @@ entityMappings:
         columnName: AccountUPNSuffix
       - identifier: NTDomain
         columnName: AccountNTDomain
-version: 2.0.1
+version: 2.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/sharepoint_downloads.yaml b/Solutions/Global Secure Access/Hunting Queries/sharepoint_downloads.yaml
index 0e9fc5b856..d124fc3abe 100644
--- a/Solutions/Global Secure Access/Hunting Queries/sharepoint_downloads.yaml	
+++ b/Solutions/Global Secure Access/Hunting Queries/sharepoint_downloads.yaml	
@@ -1,5 +1,5 @@
 id: e8ae1375-4640-430c-ae8e-2514d09c71eb
-name: SharePoint File Operation via Client IP with Previously Unseen User Agents
+name: GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents
 description: |
   New user agents associated with a client IP for SharePoint file uploads/downloads.
 requiredDataConnectors:
@@ -11,30 +11,52 @@ tactics:
 relevantTechniques:
   - T1030
 query: |
-  let starttime = todatetime('{{StartTimeISO}}');
-  let endtime = todatetime('{{EndTimeISO}}');
-  let lookback = starttime - 14d;
-  let historicalUA = EnrichedMicrosoft365AuditLogs
-  | where RecordType == "SharePointFileOperation"
-  | where Operation in ("FileDownloaded", "FileUploaded")
-  | where TimeGenerated between(lookback..starttime)
-  | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)
-  | summarize by ClientIp, ClientApplication;
-  let recentUA = EnrichedMicrosoft365AuditLogs
-  | where RecordType == "SharePointFileOperation"
-  | where Operation in ("FileDownloaded", "FileUploaded")
-  | where TimeGenerated between(starttime..endtime)
-  | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)
-  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIp, ClientApplication;
-  recentUA | join kind=leftanti (
-     historicalUA
-  ) on ClientIp, ClientApplication
-  // Some EnrichedMicrosoft365AuditLogs records do not contain ClientIp information - exclude these for fewer results
-  | where not(isempty(ClientIp))
-  | extend IP_0_Address = ClientIp
+    let starttime = todatetime('{{StartTimeISO}}');
+      let endtime = todatetime('{{EndTimeISO}}');
+      let lookback = starttime - 14d;
+      // Historical user agents in EnrichedMicrosoft365AuditLogs
+      let historicalUA_Enriched = EnrichedMicrosoft365AuditLogs
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileUploaded")
+        | where TimeGenerated between (lookback .. starttime)
+        | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)
+        | summarize by ClientIp, ClientApplication;
+      // Recent user agents in EnrichedMicrosoft365AuditLogs
+      let recentUA_Enriched = EnrichedMicrosoft365AuditLogs
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileUploaded")
+        | where TimeGenerated between (starttime .. endtime)
+        | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)
+        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIp, ClientApplication;
+      // Combine historical and recent user agents from EnrichedMicrosoft365AuditLogs
+      let Enriched_UA = recentUA_Enriched
+        | join kind=leftanti (historicalUA_Enriched) on ClientIp, ClientApplication
+        | where not(isempty(ClientIp))
+        | extend IP_0_Address = ClientIp;
+      // Historical user agents in OfficeActivity
+      let historicalUA_Office = OfficeActivity
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileUploaded")
+        | where TimeGenerated between (lookback .. starttime)
+        | summarize by ClientIP, UserAgent;
+      // Recent user agents in OfficeActivity
+      let recentUA_Office = OfficeActivity
+        | where RecordType == "SharePointFileOperation"
+        | where Operation in ("FileDownloaded", "FileUploaded")
+        | where TimeGenerated between (starttime .. endtime)
+        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIP, UserAgent;
+      // Combine historical and recent user agents from OfficeActivity
+      let Office_UA = recentUA_Office
+        | join kind=leftanti (historicalUA_Office) on ClientIP, UserAgent
+        | where not(isempty(ClientIP))
+        | extend IP_0_Address = ClientIP;
+      // Final combined result
+      Enriched_UA
+      | union Office_UA
+      | project StartTime, EndTime, ClientIp, ClientApplication, IP_0_Address;
 entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
         columnName: IP_0_Address
-version: 2.0.1
+version: 2.0.2

From d8ae992f7f2235b668c717ab5a7795827f1e3738 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 13:56:34 +0300
Subject: [PATCH 12/27] Update Office 365 -
 sharepoint_file_transfer_above_threshold.yaml

---
 .../Office 365 - sharepoint_file_transfer_above_threshold.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 43db365da9..f3258d6690 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -24,6 +24,7 @@ query: |
   let EnrichedEvents = EnrichedMicrosoft365AuditLogs
       | where Workload has_any("SharePoint", "OneDrive") 
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+      | extend ClientIP = ClientIp
       | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
           by UserId, ClientIP, bin(TimeGenerated, 15m)
       | where count_distinct_ObjectId >= threshold
@@ -51,7 +52,7 @@ query: |
   // Final Output
   CombinedEvents
       | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
-      | order by TimeGenerated desc
+      | order by TimeGenerated descc
 entityMappings:
   - entityType: Account
     fieldMappings:

From f89d57e0276f1f563eee151a418ccecb37387106 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 14:22:51 +0300
Subject: [PATCH 13/27] Update Office 365 -
 sharepoint_file_transfer_above_threshold.yaml

---
 .../Office 365 - sharepoint_file_transfer_above_threshold.yaml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index f3258d6690..82243b34ae 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -52,7 +52,7 @@ query: |
   // Final Output
   CombinedEvents
       | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
-      | order by TimeGenerated descc
+      | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:

From 97e6baada14987ece0c4719a9252fc5e20dfa6ae Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Wed, 2 Oct 2024 14:35:51 +0300
Subject: [PATCH 14/27] package

---
 .../Global Secure Access/Package/3.0.0.zip    |  Bin 37346 -> 42645 bytes
 .../Package/createUiDefinition.json           |   74 +-
 .../Package/mainTemplate.json                 | 1029 ++++++++---------
 3 files changed, 540 insertions(+), 563 deletions(-)

diff --git a/Solutions/Global Secure Access/Package/3.0.0.zip b/Solutions/Global Secure Access/Package/3.0.0.zip
index eb1e288242796a29fddb3e8fff4e2e3155d97d28..e33be3976441c5ae8cd76bcac237e6867da12c7c 100644
GIT binary patch
literal 42645
zcmaI6Q;??7vaVa!U$$*^*|u%lwr#7c%eHOXwr#tMr{`MpM4S^lV&9C5jEpy)H*<{q
zF7i{51_eU}0s?{p0(BPBWGgau(ZB=(;z<Ak!uS_8b}}_|F;%q`F*UQavvjevx1+am
zwzs?1y>!|XOa1Ou{eaia$VNUt5LNPtw$4U1=8UWKnb(l|9CT_I$di155-^?%uprN@
z@J;n?@=f|Xb3PJVgi9eDgiE8W90$dMy<OVt{H}x3`+4dQ<#?w*k~==e?Li7}rkR>1
zKA7Ll6w$SoIUzB!-uJ;Nf84j4*l8Xn9(>p@$uD`_ob<S#tm2jadH=UOt4zaGYBczd
zXIgn~LH}-S+>g`Tq5E_f2b8JQtylS{3J&i$1j$Y3O0cyLopNwond719joU%79w{@6
zP_+ITGW|POPMM`E@ShaVO23x{APfpU3zOO|=9icUYx&1v0c?I%$&;PWUFr;&<oEbr
z(icTLJ`Aesv;?POB_76NsKgt0GFQD{&N?dfu;GO05S%{wr5muNBRFZ7=f{C*m4uo3
ztB|ir@o${TR$P-4ySq9gf9|unYhB0*w%bW&gwC<3lsFU1$C}2>lw@2mFWRF@jc6&j
zehUqgKMo|+%=s1$W|`efDCqzE^!`xnF#N@4AMRvdc#*ATy5$}wy#}+-QB9T7l)2t=
zH4B>+;(ZzD&B4u<CYZh-9eXWi6n;hb8z+S6U?CMW?nsk_<$XX;3-xeEyY!?@Vf6H+
z-9f9f2pj3{#O&N(X>n91Wt!$Oh&Pi5QxZcxyofaU?Ke-o4#864?gl?FBd~T~8#Bz-
zU~7|1A4bP>Pd|qgrik3;g)A&_D5x@!BSCZMXBRf5bNn>H|9&j;(GyN|ajtK3x*S^r
zBpfLqO=6U7NbQ#fiHw0k+(!bk7gL;jz62YwFc63aM;9uES@b~AE;Sz;S3HL@B9U}K
z_}bWz2s|9XQL>QDZC-v99%B@-FnpSt)Do{EBBHyhUKWs&w}OUF6fb<Oe}8TLYwB<4
zDz!l4eE}y=*MkS4R3uT(h~`D)X=%(Ax4T~qXnGhx>%C$+^vS#)Vjk5DTnuiD@E7(Y
zyb1APKuPzIvgY+YzViB6SsHwv2|-G|{5FaY879OYNR*%sVz?&U(-<vXM5mxBXubqo
z7oh<abl$%0!kxjK9Oy_+=e~7vx;W2s<L~0Tn7Sk@ST9dwUph-Ck=RzQZft8`QwfKx
zr=e_alBbrjlwUhX`A3tZ`isv5P9Pg9pLBnyO8T$k(;@W`)viGbZh0!_n-hR&X!|MY
z>o(DTNYuQkz=ul-=*_V#daaAQQD(>qR*Riw?GDMg<~%PZnE@m_7(2__5$`pR9eGWj
zns&~E57W=BJ5PBSAa_kQW*m^yvIm0juy_&5Q_$SHBcwkf_ObLH>wNQ=-VqP&$6ySs
zkk4Val?1&jk`VZhD@g$FQgI=pzYw;I)Id#^A0L9?AqfS^Icd_2zXKe|$;;zt?Jub?
zhlHjgl2Bvkm%~N0xratLQifA~2Ir!|eN!)ZG_m+eV{`bwp!$Q54(w7-p5vnUw+Tc?
zmrL}83VS|A6{swB(hj5NH=U@T6-}c<GF2v(2D})g3Ka`-1SU$jZ1{>@J@PHkA!!52
zsY#bZMRdXO6BZ{!ia0fq=<3b2v7yL=7}msnB^JbX6E4&;6mD-zsw9fD6-E|qRxA<g
z7xCs`JG%>SKEyCcCx}8<0!>OJUAa77o(dvmC=J$Qb|YRv@w2&{4@9ZY@K)OPow3fe
ze<}KwzVq^Na&cY|@Lmz%5g7Gds<pnBt7iG1fbh*LhUlKKERR#EM2TI_4c3THuND$P
zJDQdVPbFe!KfVhfwCyiTQ$pR11gPY+5A;Z8lDZYtK}2E`Pu+%u^y8NwOjViVVttBu
z({J;7V0cQ7f;1Sf7do$*1PtB;w4UWSTz4GYvscOPp_L?`W1KO%zScc#=TO#E59?#V
zaVg*u-#}(`CE|q_4C>R<P5(l`*Tu(uA+$0Xl7AlBKNh@w2oP`hzNrmA>j<<7w>@L)
zuZSsAu0oc47K69A1)KxZk^hz5uUAW94{Y+n*?JskwxGwT!l(TmROW{J9b${CBnJ)0
zeuV=G-4uS}Tsk*-!K32;!SMv*na@Pt2S)-nW09=0uJ*@09*yaV`7fjP`ih;&AfV|x
zPG#`7ILl-zn#ktO86LQPbp=iFjpEsdTj{|)oCxQ>5F|LHyigq;B9YIpp0EyZ<9_O8
z%)%h4Slv?dSKh*`D2dDc<Tq1WJ7T5dS+IcL!kN;h1<DNfxLyUuCT!(kx-UX2vlv01
z%Cs&sYEgd-n%)W(%A~t@8dB=L?=r?03=H&R?guxxwq)@uBZE332on1IN@~bN07dmd
z_<+u;dgIlQD<&;I^KnCYU0d(*zj)SmOX<}Mf`2+s+&n8T;t(ja%*I8unPwWYQg;9!
z@Zi2xsvG9KR_!19>|!&Av!$dmN+++!kWxV^7MkW~15LzpAf&%~JN)GZ_H~xU?UO*Q
z%^LjJtdIK%z{czYO;p)XyY%X~G_QeO4AG2MY?=d|X{eE~BnFGgZlE<2!q?U^773V*
z?9qhzL{cC7t(d|p0op9L)YK~L1NDSFVnLb+FgV@VF&TYSATIeR!qS4ajaZV2XmL8h
z6~6(uKO9qX8^P<M7qaAa60IP0$=e_{JunPc5DJz6hs1bNXE30q3En`F$Ouz0yr((D
z8EU4U6y+qkAdT<C^R+!TTW$yF(BkBRfrSx5l`oGUPc3&#K#jUTjQx<=Qf~9F4~*s9
zXOhqE3wh3lmt}&+f=iZc?cq5Qm|HL%U8E{Zr>UrUu#A4$xTBn9+lUijuq^Qo#lq4B
zp?dt^R+wO)a26P7qP-s1AUMdRHoJ_DyR)(-h4#C8u*5&XF!;IkGi$%h-vd?05uPz8
zPMQ;gJ~NlZ<UDf@BA=BT%^zKJuon8P?Lh89Ne@q6BAtjkw<-1<CG*ky7E=@T>|pG>
zpW~CaYkjZMg}8$_)V&0V*enQL)$e1@m=R~0hY|-u{?;`prRh`TvuAG*05Cx~H%aA?
zG}l@aF*bV`fgI*pRvZZ!>AT>#*?K`<*mPu%07KWTUV!yGrr|roYEmwhZ;-B9BAqqv
zl{hx#s+;i>!}m{_m>?j0IFcNJ-r(IF%MWaC?=v!Jq+?w6Rjz~|)w-N3ERF1(pypN-
z^gCQ6YGcQ!weVlLkTRJB`FA<MvOQ8=cW57$KnEHEkuSAXir36kpanJN<(Fp_)-JBK
zNa;~(bjx%k=aq28=j(sV8tV0uVJO#!&Z0{R=!k|W!`U&S>N!-y*wzgWHQuevHN5nI
zE#w#o1J&fV3L}%nrh=>>awjzkWcS7b_6B2csYy$-Fp0sz@`&8)Aw9gX&Y7@q3|8mP
z#%dY?LLio15<CtyCmeW1Wihgs3LTp;DOHJ~l@4P;3uY(9^c64<XDJe)&jER1SLD$y
zhd`a3+J>rhomvApdkbltkk?38LAP>)2o6Nu5qUyC!+tWI#NmFC0Y?;sUR<aP!QknF
znlICe@nSALoO}&|o<gnNVJqb^gmYD=0mxuxbNiImg69FPZcuDaAO*#6=p;!o^IUn#
z79PYhcF4yx*_lq4c38cyTF9YxkruCcbbpMt@=kHYg%WPF#@&GnWGUe+4xxHle?gHC
zPjA>)WfosmkTI}0!qQrWJZ2w2wbk@(05j=95Oe;KY`4aeeAO0QkZyYh$^^P6II~}!
z0BzArex+hNazBlUh&4X_-m$4gBs{)(=L!=ASodae<NWkxOs5BbjadYWv5B{22_)sh
zz%kil#sjHiZq;2X4c33REyW|)gU)B&Y;cH*KnIQuS%I{euJKwxyX7Y@&KeU>s~Nl)
zm@|08u_r1IhmO*dB*|yJjeANX@#H2l%?ST7&G8q_%yTB7B9C;%OcX|O=~Innr|Ho#
z(CkY+`q3K)w~5UYA%T`a)`l2}{eV&ho1S;hank_`IouEcX@zsX#auc-%>SiEZ*2>4
zz&&B#=;<>OtSrOTILar+spQsY1FIB<4e=D_1S3hwj~tq7&X<eO2d-eYKAH?aJ>Vf&
zbU@_ykc2>>LzhHi4^<wLOMvVGuE_JXhpO>Nq~%ja>`Xw|!9T?qX4u*FP=}{SH58=U
zL5r(VIzSyjDQ94l<%@sw1wUIvs9ctkg_S&Jy9K4~868B%LEASb$_CCOp3Ie)?F}bI
zimwfa(MlWCYlop$Burd0{xSFJ=G@4=#5n?P4t^ZJPS{_9^zyuO222*fl@$x^IpU?i
z8Z|s<1fXz?+q^^r`QrxPFX84Y*&Jw52DM^EW#YHnTJC_VRn7bOp&DkY*hBNY|5k=}
z*Fj*u66zJ$9U&Z;`5HiQ4Jv{rR8W`GXq0jME$4@usixZz=4IsK2(gka5jFetR*RHx
zD;CnH>*6K0Nd;0?&H;yV8cv=Tm!U<odC4}P)!2>3_JN}#zSFE$x8O<H(%a+eo@!T=
zL2N)RYalyBkzd6D%I?b%ldyz0k?(^2ju>266xbK)`!3LhGdQ<l<BQN}Y#P{9YEM=5
z(&o{T+cX0ht-c$e0h`YC6A2+Yj38NexcPp)8~IEN!JZ5?k8&70Nk8(iKWeKw>#L#k
z>i)g%DF_L)mI!H-gnNJYb9|>RsK`gbzLGA69SEmA^uQttk6HH-#3WyRlSuTnw48|P
zMG)#k&dd0vNd^TZem4-85Bs<|4jQ-x26G+IJ`ok>5NMtXr^q;*d9ZM57Jf-QwI_60
zMrtl<(;kD3ztS)c;2l+kQO#leV+E<p_*n9+;~Gat$PSW;VLrR=N2O_0ir;jYtk!k{
z*BMYZVJ?~ifB6oI8~w#Tp@U{yNgOflJU!0m5SwX^MN|EElmTild@KpQNvOm;9q7V4
zvYA5nYmO8FD>syNlg(xWT4-4WOmY>5kk-Au3c3q4<10cJ;q&v;1~9fBeW#MH5jsp!
zKagZiYmQGTP){1M8WYQGVr<wM#!ayCD-xH~S}}*N4lMDaV2Ghp!$_+hve^KCk>FWI
zV8z||%JrFnGW;o@UHHIw@e~p49PetZFfB0DfwKz#avZlZparZ+>qm&{!X_@QnH`k2
z*ciGD5t&{o2Y`wlZ?#mxxz9`Sx*_(lojNaPU~iOtCY(t@;YE&i=M3<%4w1n+#W4@)
z{1^tBn;n0Mezb^@Og0w!;GC^f;-=)>$<H{512dEEhes>NF7(Z-9?N{@lT-*72k{Oa
zkOP)E1A5h2w+`GJnNIfhzix?L@xIPyEjM8nXDrL}6gkd?!sF7i#gBh|F{hzW+7f{x
z45Qlr9d`)BfAwonWG{4j-<Ev08PFrt=yLq5z#APz(}fy$G)9)2pz*q}q+NHJPF*dV
zqW~M4guE9*uY^^Wv87@st-UN`A9sDI!#7^6Cn?9-_e8x}Mq6^^R#f$;8<Qi)R?)lQ
z9@BHKJRgUczO%jx7Mq+DZ5jP$U}2LYRpnXodbr3ic{WrWP32J4F-cidn>CFIeF&n-
z_;L$-USc~9NmoZp^Ca1M(@kW^nB9Dn$Lj}hI{)!Q&vTI%RE6J%w9^BPA)oY-!19}a
zpl|pd)BoWXW2zT{Eq8_!dsL+ng%}Fx^$>>`Lh{{NTNi-690aN`$v)eN@FFxzQx+g?
z0^p`j6L~ioY10yBlID2PES32EIR2i0JrW%LyWxk^k$SKfm8Z;wl@B76r<84Ut#T9y
z#;@f*WMY)Wx_#t<L={V0v|D{7%a$7b!zVXOp@8suxLH61ty@%sb;$$|tv=?GCx+1o
zgZpF;Y`?q0Z0>w1dU@9E&A1K;f<4ve4!$}#R#h&+kg0S4KhC;!8W(|m7T4T?&sxM}
zLdG0KG@Gal!Vu6hJLtO?nX!E%H&EY{=WLR(rDzUCe@AC?SKu|`sTv4yfp6oK)UFdW
zobktgItD@nF3bZrmE~@!uXO{p!*SQQ$9I=|7i!B2#`MWi#+nEX?P1-z7OiV3yDB-)
zG<r8hMAeglWI|T9zNGGTH?qLXqF!}hXSMO%Brw%hS!jTC93Q2s2b^miur|BbqC~UV
zLh8n3)@vR7E{WL@6g-&9aTaOkA$)kR7%FZ|fVZoG|5TaW)h1cPUH?Xd>9~hx@7twC
z3`uYX&Mu~amUM{(-mlnb(V=S-+5FXPGAHW{c=lrjq2GXhj$1pn2zI8OIlGEx!qu2n
zUQhe9mvJ)J?gQ|7hj<L0P;H#EhyG}BIXDei8CxqehcAOxlz7b9BDj+4F3k=cIxQgO
zB05c!FLLSfDJr-`vC>)wiPBpAiQy;|_En-U$@6e+#hWhb$;yOn@)HvcYHiL487Xqh
zY+e(Qp_}Nvw+h(|m}`LnTuKk-n8lOCss%Hv1=C<eEIPCXZP&h3g)|4QYvHBIinQ>B
z6odfUDQ`^FF@Op4Rthw52M2Wj48aoaz<}+3JydvLFK$8>CKO6%(jH>jw*;KB?R8~C
z-MVvCM&_HX{HWb^A5xE!n{Cabp}&niXv@RW7-;S`kTtzzO__mT|A8BE6H2c-7fXTp
z@`8utRBQtm+1XY8TB(3~#M;8tQ{;97b;QhX1&KiD83U;wfqg}dQ{&V{jzVLyFHqFA
zGYif3qRHEkqdT+;qHS@>c%hWs^Jz_8vG_<`8RXqrHT0y<RvnWJ7}F9uVQp8XR;u@o
zeg?v^x7D&}1!>i9RWp7>4<zPgcj;=Au_U6j4-YeGYZ@5&yRDoxrL*+M2E4x$FuD%&
z_%5iPTO=!*(y&9WqW(}~l*v?dl`g}R2cwsHbR9a@TF+{3Iu0vslWAzp*D7arO(ba@
zrDq3v+oWCfw?WN7hUGe%Sm`bKBVk$12)(m%50?`Xgb|vHVr&7UzG^c678jA_=b;SJ
zot%h=gV0T-(oX=LP9|!EYQil(tzndIhO{7d430v0_96Z<s4!BgIM$*Gv~|;W$pwAm
z(b@M%3$+5}5xtXb!Umt+NGh`t+<_iMuLHUo^v>;yn-0xA3Ab7mNg<ZAvZ3jP9>U^*
zGU$&L_m*>4>HC*SD1Gx+2yWia0+#8Y`r_pGb{4hBuvlg^PRv0uAx|ewTXn~}lV6By
z8b_u&F=cAznqd~z@BxbVnt3ixl3v;#hef=QQ%VX!D=MN$I{Ry@lJ;&Jz;q*S97iU%
zcudv<(Jww~@5o|@484<SXQ#xmqXWfBpv$h014&IBSMeUPi*I*t3->-toA$Z0?lhPM
z*#ajNO?Qu`fY508nO4jEt2!Cib&>Tf&xcaF20HY0lcFao({Bf2$Gpb}hKL7_u$89L
z?NIS;c6?6bm6<vG$aN0<LuHl&M5S10`om%rZGL6%D7)~0U6aq`ELjpR`1qvM_KWCo
z;bn}|BPQQT_?Xt5e0$_gX?{v!^YuqZxXr+aIFfuFZP7TT?-%vF82Rwr$9jn)|AR%)
z=m>9Dn_k!FDM6|i)<!4c5jyp<h2NU7b}nMl^SX&SswUNlSJ$JKwlf?|U^UmH$~rlj
zQMKiBh7%ZVxahjo72H`QJ~(gt-!rom8r6BbN1C|P<2Nzv35w9oCFCW45a!y%7Cb`o
zR)fs!hj}@D-l_1Mn7RDHIg;9_>^oliu77{nG3UkY3Fi=zLu{@WbXPEf22Bpae<L>V
z18z=TOeCh(cD#>Tksr4kgE=$6*0$vmy}r=|<Hr=Ze}U!|*$i>c$&h74@!^gnvSPLx
zr%y-Hz7#Q>NeqjdL9NS3UIAw7mCqy!nI#8sXD3*I0rOO#tJKT&yjO(^aa-2va?fSI
zwKr<g``aK=_>6>0vD<#levV6p6uB8K)Vgeix4GQdO*|IXZj2VA*W=Nz>w>*|V-BVi
zbn;l6BPvRP<qpemA{WgnEISrmiQ7OF`3%&HjqcZjs4zpkMYFcR4*s@cX@S$;a-&Jf
z{U>SeqHw~Amm-;bY_C{62cb1`e{(R`g1<sLor>Z(X|fk32FeJMFEyN#;t@4W#X$`n
z=)<EFU%86))e?FsYU;WbZwl*r)MEKWA@1$avy-eaKLXPVYF}2lF4FRD;XU!M_66fb
zC95v2tma{V$z0!3;-Zq83!h~yvA2-d@cqxj%h}C4*`G1>?;<aL!h9NUB!E6fy<5*9
z83dAetZAPF(^;2)!NZjl`>`vQk8>sdaT$XnT%1{Bo?y=&ET7VgIs4fEoHKOq8>M{?
zv0g=s?<G>LKkU&r;!5`u<ZkNZR}jPyr)jgkYrWS*m{rQA$i4{x+P!``;x`~jKY;F7
zqtVlcf31uD*>7HJAn~L6Vx&BoyY8vY^P5Z4yf0j|P<olPUFo{+)+Q{W`tJYvfmZnc
zEhCbi(Xshsfq*zcA%KwnEhB6VE$viHZ5?d>tt9?u4RO_N>%PghLjU<y_52ALXFk)g
zB^6iZ-h9|(m(}D)UhX?OGv%w6RhWrPm5CC$6rqCKy7>3n+`cP;5IQMO&o(_>vso5|
zu&%xy`08?C<o0LxXQ3&$*Q1cz+6vdF6mRSA_teMDFyQ^j!-`|1nzb4CXYI|Fu{BQo
zCZ+pPkLALvSIvI;;vKM<A-e@B<8CW!jxyL9_jBGplZ#Ms1WK}czrVd(-EQ6q?<dY*
zbNI9NQGSe5vTqFMHwt+-rt#)}gPYvbDDJ%KJldnS*fnf(GV?`H`iZ3$fiA?yJWTD8
zb~%wv>+_a&(g<T|>|XQ5;}||7(%B$3hk5P7(!g^I<oqK@!^C_7p#pJ1rDA#z2TM!s
z1BUPwo*ue;|Ji=M^+0W)ZF5?Ey!GyWr-nd~xw57q^Vy4&3_kwqXy<uj#Mj`L(;2OK
ze3s^aoUEZHL|;W~&(dmMB?sBt(bIBA+gJgI(Q~4aYMGvKYsEbH$YRV_{rB4(G5FN_
z=P}i{$j$YXp4<$sVa2b(su$DQ`ADechjXRLUnAq%qsKH&qvB*&bK_^L^Ko`(3R9C+
zZ~ABc=Jskn+sr$|a{Bt$-T3`hcG8i(d@~_vBK`MA@V5{+T&x6oIr(lIAt3sa#Dc`9
z&gpHZgAC@tO2wBo{u1^UN4_#}Mzaj9Okj;qPt${^UhHktkaa0zg2><B!{v#p_d1c>
zyopwKGbQ5_;hT3lFe)kWZl!x!4$t^uZ<7S!eIe)`F|LUQQ>?{Uw$7V(Qh$mmlgVX!
z)(b9LuLdx9J26uFvXLHK5*XBN?Y5!e_{+bIDh`((Zb@q=X{&^dZFT9goe_Vt5RXNP
zAxJ-_-4>Q2)dIACZxdx<KnB1AwcraYRgRk!9?pOtWa3j~xXsYKL{Fgvcob*O;w1!^
zcd$F)W>WT)2|n*qJ@jAkSlFQZTO{6NQRI`5O2J0vL(&p1{aaN5!K_UrO5KH=hg~uw
zw^mNEv^}WzTga@|13#4`jd5mr!Z1&K^fb<Vcjxa8AZLra%1S6US)cshQ$pgi*PpIJ
zdWoXXkecrUZ@IiH^Lit$f;{Km^oP1|)|j5u?Ic)%uLO*KuMQNDloG4>5LUNqxJyQP
z_>WISu;nbB_!4e}6bXy=rfD)D2>f6t=OqT3ik6qMsHhpY5O-vCo*1F3WI<1{^JybV
zMrf(qt}42OFAsj~6a5t}MD8j;HZd(SqtN{6uMh-`p>TagiB#z98h;^sZ!2KJ!?EG|
zHT(FCUgeokvaE2TVoM3<-$R89k+@UNX`MFd2{Plvt1;vJ&A`G)?pNcv#Xz|<dXv}a
zJ5Th~@yWHCQq(dMB4=ca&@TLLvwN!6sx)=8zFVzhyNbJPb{sv^aBXD2iG|B2t<SR&
z&Yi1RjAVUfBv98-c@_SB3&10&9FQvkHpXA|9ae+V&0L_O!O}49X~Kq-wypxuiB`)#
z1&535TYwr@&K1G1Kd7|j*9?$ac3Q)ZcFQ%E#JiN)nlF_<Zw!i6uiLp@4%X}hjFwYx
zY3PQk_SDu4#Nw6LY0<!xIT*iES1py0skEh+4y5hn0h7Hrsiu*#idVPn*tS~p8n0C~
zUtIgyu2r^Lt5t3Xsh8NbX#LaC`LE9O|EuHtA06_N0g-)F)wbWI19TMw?~cssp^^)!
z>mgM6d^N6Nx{WJLPma@dF^<z#FH?@C>&;vvl&YcH)*2F&KKi<$+MQYwl+6VJFs=Cg
zLPEu|fiS@XR22@~@}ZkLq1x@#GD#O=_Eqff+ggQ|O;**8-TKVf&xY0d><0DBR&H8e
z?^<o$9Wa&uk=o=|GHg~uRoH*IQPn7y4T5R?N0nSUfai)vE=lLig3nszRb9@WUogE=
zwo>V?-Q1(MDt>LYZFBymf_76?GeEtouD(ALr=n4f2CmZ9=#8dkwTMi;HLbi)uMcql
zpAx+n+L<pg8y0GYpBLE2T73~sVF^3iXyQ4qg;<qVIJmo_sr~KgfN^&(8nCLS%p2I=
zuB=na3~6={R}A&`q~20iH%wZ>b-PfrUMt7yR>LWY7OOQo<1MqD#D<3(42iY)=chI7
zI&0u{S+%XT@;XcDKmEEzvN=`RXbOROeN<_iRc*_z93U-Ux7F?ztJP<Io=4OTpu;q)
z`)d=UO;=d!j#F*-OEvVvTEQ^%wzAT}U;ST`qClv({K2TJ7RUudH>0SlR-Nl(J38=6
zEH90Hw=gfZH`?sotmqmImtx*MG?+WWirqJSD=py`=VRY5tg4g(LGHwS#l5OlVu;_w
zd|#ugmdeO%>T?hlkUStKuTE%~M4vjk6-yaymZw_4AH{rO;RPo#S2_;o$EsF0JC>&d
z&Q}5!%T@9Mh;L!al&!^(ME$@dvXu(KL~kmno#<7>mCC4@BsZ<t#ADq6skejpHp1M8
zcGdFe4|QP#2%A9kZp^d~*mGRJVNey0bo*VcrYQ@?;(=<Ft(KUgvH)v|s1?$Hq?XN~
z-#(4tbq8g;wapzsH1M5;UbahC8q;R}JXWt<=TTh{Q*y;1;HaMJdD&XbQIroP0@o?n
z%~K1+7%e1J0*N@(Q8Ei!#>%&G8;4rjw?MOnd?R$_%eBkiUbVXw?%uX*u0_-j*a_VK
z%OU9gUye>?E0w%4I9Jgb@LLI(<zjHj%_{azTaDW#uI_m#ADS;Vfn#6L?<#jKv(81!
zmPK9krif)!&HqIK%K0zK-G5OANT^iM(u-Kb%u08!)0%hMDp$3-Tl6kp#p(!|F1zIl
zYuKOtIzH0S>xsb%6aqn_x@a)vtFc5;|03;qNX2T2B{~Q4Bnkc2{^w=d5E8R!4Br;J
zS#1;KdmAy0pkp03E;dJ%fR%~O+q&;Tg<3%%(H;DxoV755m>+~izFbi{f%#d7BfdyM
z)g%esEr++!xXD_!l0WSE6Dn1Zw^4U7Jl2rlVl(v5e+nuh|GzF0{_CRe>7R=j;?p26
z($EUx<fiTs3mccPFD>t_(Cza&_7K5UAR)a{PP?<gnt9e|7g0UXn$myQ>z@aM|9T+w
zmWrKFJ?aF{(e3`K4Q2IDz|%tBjSf$Bs9!)FCL@o**RpbPtz5l4Z#L@=)hRJ6G;12Y
z(=MF1BpNS=){d+DH(Rr_Fgrffg#uMF@+f!2ay&pOx^rmsyk5j^Gkv8AmSKSq5izY-
z!eY&O*_guVD!Fk7Gn|VkcShodDi^>+@7W%QHdR*jlA4(DHEngyVFME&D|6ZE1Ou>j
zFXOeg%}{)T#iUieGr5s#rBG0ZHz!c+rFFYVEqhm2xw}&p7wH;mY+M6$mF-tDs?B<<
z*~JGHTWctHR{ksB@=sok9iG&37u!wiORUn22nFGc;2GQD4x6=m=e+5e4d`q;wZLPu
z6S-FCKl<Y+_TswUk_&D)X(zUeU>Wpwx8WV|#;_F|OXAOQdXOva#TDJzc#-PG&`}51
zCy}j{^m<9C@7?<L=K`7)mq5R@$<r9DVT;bts}{98z;^^yH#fI`U#nUK6?k}i9$c44
z{~^VT>%^<ny<L8f#h(EfJIKX~c~$dTEs4u6GGV6{Q||2i7yjiRygJ4&$&J7pymYw6
zm9sb?HQd#}Ghpdaty)F<)sJjLyaZ9v`xp0;?!U4M+iFYBuV~L8IDn)ToBr32Y`5vU
z5!t-7_<pKoc9}G6u|o7W-D*ScvW~{GTZtiRTLm=7@0IGYo!Fx5Rm064=6BXS7oh8!
z%2(?!XqSZ?zAMcyv(j~zjtb(P<r~>zxC-K#?VeCl8gQiKCfP>g74c^^IP}AajW`1Y
zevlvPs+s#Phr;!nwEyJ8%l&WuK<E<zIMSkQ7N6CVm>EXAGSOgRImu~_wslOH@ZJub
zcAcL(+Wm~1Bg}trZrI{blvUWUS?DO8J0U3rWbIx18A1F5^_MMHHm*<FblE?=gtsRf
zE3>nta8yLII)4MGP+*A3Ejwe$6Sxh$%Li-l%#61|xXoM)>I)CkZFSi@C;rjc{g-AY
z)SxFQKaavG(+pHCk^C(eb_=fmZD8@P*{f0c_8F&-*Pce+y>nx}yh%`Xs9l>YN|rh*
ztq6}jBb)w)^_k5kT8qSh`q^s*Gc~Q+3?LxZy<=Yy<)Plm^_#6Mio;!7T#;E+Sa4w_
zcBid))lhyHXP^WnOy%D<G*%16;#4=F-2kzogRBLVPfDa}0YVk&)b5%xr?708)V9*T
zX(YQv5hpmppnnmRn+@W@xqBHiv#yLKlVrL3(anG{GD3ADFUsoZ=0*ZW6lt+ZZ8l&T
z{mHv>u>$l=3DT!8h>Oi&D*gEziUDhR8;{NbqeUbCe|on4Z)X3i5nT873S6Zs&fo=d
zNmL^6O)?wp-gL+M`T0p5a1Ep=(yf(y=>kM~1ZWm(+zox;wO4X+y)M2CA65!eq8h9i
z7J|-HkRnWeYOuiJTuyw`^myLFEfdKc#K5cG)X5FTW{7>a!2wJJ2=P0AV<^W&EEkX`
zX_&t)TWinSN_Rp^XnU#{lB~uU<)}c!x!;{)1&!d^tA*HNhGyKkE=Rt|*kk;Px&@LN
zcg(VOA__%AaSBo?hQb@{@+q}N3?EKwQ5K6RB5|)jj5b6!DB7bfV@(UKUMmY_)5u|g
z)oY7ChMv`3s9Q05WVozUHg?M(H`RMT-PRkTPXx5=Tw8p)V+govo=~*T*q!*3DXD_z
zRkn%Ay+4v-QB0Ew<-WzR(`Y!$UQ>emIxsTo-MU)@+S5%;yQvg1DMW`JD20!%MqXG4
zF&t@bN#3e^OJ4lcnMX!`x<U+Zy$sxS#7SHz0Gz?;XQ+Gmjz)F*0O>1|2?g)(#jlu1
zGj3ydzG4j8H~OMZ<}4(O_Um<FZ;(PHrM|~d^J!M&qfLDqT=|Usw2diI&rJoW$n!YM
zug-SUw;e|Y?7zKbH70R03Q#SOR^NRjD-`dvU0{M6`U)T_*cIkKX6fcCE0DdrxOKoj
z&Uf2zdPjzajK2Z^F3t+woOOm--gg%yq#}5s`mP>R5NMy^vyMxNTmIk9NACfIOFz@G
z%9YD|y?6dy&w?rS*9qFdGJ~Bs9V1&qANb@is6Enlh?Xn+%fasdv>|=aH^q8Fx{H@t
z@Cd?LFGsD(*{<z>GIX2*vxO^z$is|GuA5|&40#|*QsyBR^lQOun)Co10fmmW5Oz&&
zm2j7#^>P4(cPRx|L?8+)@cd25s7S^pavn(s<}h^GA+3!t{ZK|hC*5F7#ePmQx-MYw
zP?=jP!Psw@31~N*V)*C;&NG~A%iHef+E6$WEUCv+03c`o15(MuV9L(!WG?#0?A6u4
zwJ90p`sCz<5LWp%Y%w=G>zje@7q|<)dNp=bR`boogX7<b?0fIGZEKImk(>aPbLZpu
z`Ifu~%o58*7oYDQ!U2+P`0fY{6Q5VSvLy<MtL^qz^QRM758e@L>^j)p9Ic@mKT~Wo
z`m@npLn>a4o<n{aD!ooYQq0s@aBsXgiu!a?*EPQH3pcx|8@-S(0oL5hiXD7*Z8L<d
z?tnqy4{Qg(VgryUguGlU{{?WaE3|HR*hvq2)@EDKfis;?e@ese0?~23V)oTNAJL;h
zNIj7>S@MauN52W@?mrJ8xLQ=4TGc7+)n+8evTMVU3mvgd*en}gO%GhpYFhN&z<ZWj
zk#xMxV|&)m{0hmj<3rv4&38WT)UXh)qU2sQk|aK2OG7(|Q-w7M*4N|^t+p%|%{|cC
zHRNqZTGxi%phj9kDExg($B`2&5{fNUuv{NeXMZe44fIHkag&&2qU9JZWX6Icst+%B
z46cEs!xzCZ5wezMs>(0n^tzAHr?h2C>t5cc7xdce?w92Z7=ig|#5e8)2eooDgZnHx
zoY!#n0U79Y9;^~YSUZ$<7~^*VOr9APFX)g&Jb|%vH`s$1;S2-=aRDhY{)VQ8;$@1O
zeKuYNNX)557LfuL8`c=d+UjiSd4^LKNmr%Gk`~WBM7i1%87sz;J5$@1d1T0sq#H|K
zEwa;@%wWy&?8z}yv;JvwOy(~p2WYJ4p1JX~t^>!=^d1}YXz@83F_D88)z?08u%&f7
z20oU}`4G9rfZUNfMyBU{a8QgoI-oYOzEdEv$2L8CP?gO~giQsw&pI+UR#fPB6jU$U
zDSJBpjgUREd83CL5bBs{SFPS*g)wwrG!?u@ar55!fB%wp^u6G)UjShQg2vAHnRRd4
z!uJzxnOBy&s$ec<);f{7hP5XCx!3ZKdZI((bFpUMsGQDnwJDMp?i{wO$#+-J&qkg?
zWv6_y--6xSyZ15X5>5{7L~Wp|ySwkJ4LhG35J29#(+TReGMSBmwiE0-35l#JLpef5
ze$WqXHNPX;B*K<YN*ma1l;9MakaoWjUpz<-q$=VgYuyzj-im0KD=Lz9H;NzAgWj19
z;wQGuE5${)MFuU+xsB6ls`UHR<biyli?hr~{rSBTg>btohI4O-Pj}zV+HiL>kc;0Z
z2_boUu$#DY5bME%rbnJC;|OuX%rLKh6n&&_Ws$X635nn$Moj1gb4H7Z#EVLrUMFPR
zFByHoCgUZeIo|_WDjyP>d(C_uJ{~c{eQ|<2>GOr=eX!yCg(hZaquszJ?a$phy;d^V
z?H|2Jgsq{mE0Dps>y_}lNZ{i0(0+d#XdhsPPz6b?v$YVw4A|N9nY8h){Q<Xw%yJ5q
zq_7evCJ%1HlMyqgBR?DlT!Y?=CL6+U-;BjVm4V#*Wo*o*dc$wJ&!uTk;_b=#1+*%`
zU#$bF0p?KjLbU@(;G+Cx8#N)W_ylW~c0n|QwQ1|248^JHncIA;Kjo<3Mv=;j+}@@Q
zk2Hq{z+b}YLj^P#6m-Kt>o$U=6T1eE6XWG%B$4Obc7wob=i*6dKyn5zTjyZ>4W**f
z>fF<&T<sPY@BfI`laXEHEKHyz*U)Gd#tre^;~GN@f=`p#)zs<|_$Yi9sJ85)lY)uK
zj<T9+c(76iaaopW37jVE7-0)l11`pTk@^B!(afZjTp;wT*Q%SKR%DFsX0mhriJ4fo
z!LJBtg2<M7VzuSx1gZ;Gap<mbWZxW%^38(qf&>qOU4=7YauT&aRtWvU2;jYg#!^zG
z_z-?k3%Vks{eFRD-9}5wa)FvgzC?wi4!Tf4;`cy3&n3|$n77Xg22SHnoxQ2u5>y{1
z6*JS|;`ZKOk&x6gTA__3>nWtBwK&AU{RpfgoCnXnt?~GMx1q#Pl>>)DX|wKgN580v
z1W^Y84iPtb=7Xgom`0_|y*;~zKgIlFPl}bDl1F7D4c9AbF2Ll>3>3%*Z27BXhI^1;
zJ8>%!Ldl)pHY{#&c?kO>eZBrMNfW0(*dbSvd<l9fj%`EZjX^z$3R4}5A1N|i8kGEk
z5YG!NM$@M9GH&i_Av6-W(<_`_j-fUI85dYTe|5iB9R&xej&T0``g*Gaj?A+eXcflt
znXc@S8&LH@*$k9HSq=5n+6w|;h<}E>edN|C6AoTe0$C_VJ8C0$Atd!M)<$7&W~=Iw
z793E>0Y@wyFN&$ae%t}i%*gk>q%9G?3b3V(8i31pkz9(nj>XZmCXRDSn4As%Jx}+I
z2Fn1z4wjo>AvFR0Xi}A7pfmhPHr+x><y0?l#NCi1Yd>Ck;!Zmw_O2LWBju&=nl)-S
zg=dvKIisgn^3Kq1+K(M;ISGc8Xg&!t8H0$Nxq*zIoI;5G3k9S#H@6)>=QRK-1cBQX
z`O%#7ytX}uPs4?5BD^1Yn>}Q=2ls}es~nYQTr!DYIi-azL1YPW!FUU?YsK48KdTOt
zE={;H_PRnht_HW$Lu}2)2p0@&IeYhv@)3Mw?Au?2{7I&*lSusdN9D|2_T*4C@>g5Z
zuS4+gTv<&kNpv~GoGG$DE{Wut27jYDft1*U82#r=Q3OxF4Kw+4aa)b|{#fu;#&3l%
z>H&?N?_{XA8NWm%gF#_O_9BkN>|uO`v-*G=->hWw!-5q6e6Yms_K7k$qkfX{u&5xg
zh^NHSn{$o5Z~k_%%v%W5x9BVWr6#mk9xRN1mLKZVGvre;zI#MD0s9-mX5{&sR=P-y
zC;WEC;5V8;kS8F{TEcH)1KxF2!!c{{K0;=8s%6MDydcayw<ipt-^(x6@-6d+>!Uf1
z%e+Fl;HXRrn(H^0eLmY)$a1JWAZ?i5wLGGs=~Y8BDqUD<s*xdlS_OPZ+<DED37g&v
zU2i~$O#JHyRsF~3w;(ydGvFI+-?>f@2o~)N^GbKCy1(V=p>;Qkb+)Av`9W@HL?Ek%
zATsbbNKPP1s(sSo&4vRp(pPh}kNY($E@_-S;!j?Y&WiJ73a+N;<OF$lkIXo;)N%rP
z6jz%}y6^$fU(hZB(UIP7labyKHbHah;`TnsS-3M>QKgCbB%0%Z1xE<E+kK;%*A{s{
zISVI(4LcprEyL9Tt3H5RT=<Rmx*-1A%Pw8m(Ux3azK<hUuqx<t^3vOSDmMS%es@5*
z!JCm4&;*-#xNlJKuOkfvA9$~=M0{(5!2s}?-?=^prA;Q`rV<pP<{b<0@^{N{oDV^e
zytvj$JgZ2)i2Nt{PIuyeBXk|i#P*M5L1$OT<JQRHk*kj#PKa(bc@j7R?M$O($2rNI
z1fZi#%~AevVxsWkJssY5o%L!WP%I4E>>f%&W2nuc$0a0d&vLx<Z28qflV$U?3ybY0
z&lb3X(8QZ#(lMN+x(ki#k3I$5jmooNtqDMWyPR@brVnHtirhE`N-oqhdI$wU`PU)|
z`yj)dm}BlJm=`eMI<0!-TC53%)WKq{YxcaNzhm`k{0Z}?xD_@+uM2YF2_g76)KGz1
zSAf_ir#M`Qn<>st2gIY0Kf<HVZbL(!wmBVRH48zaYr0uYAAyRMf$*!-(g-uaG~7s!
zCz)B2oGK3<mTQV1%q7r$a=Yhj!0Pqp-6~UqFGlkI8wNad3RnngRCOGZ)o`#%RTsej
z_BN1y)2Wsm9D41}lz;F?rpozaLTK1tb>=rdF>8bj24u(MMU3yuu7{XTW*kXR0h8r)
zJa4~f2lTd*zH5+BjF({-c7GwBifAiz_A-BFTrZoHtC(8Cs8OiqxoC>M|Li@jHl~d9
zD}-B4uqB<^{N=YiAK&+h8jVd<`5fkIG%SSD_e=0+W(u1Tai+H9PYk@er--b2Ku0~u
z74lOYG1wUczV9`Sam*n<)^K66>!Z-T*`utWrTKR$|5)P<@l-|Ej1?%9*+2CCg=tAY
z{n8Gz)cXdy31smIsS1kZ20I{Ir#YfyD8AE?*=_UUou5ODWnvk67ZPT02jM^e!W|G2
zc{Z0H5F*8C#xNwhN#<q?S7>^(gX?31PubI(CW!*%R70Mj!;LL!2%sUyQH}oja6U_g
zr4i27z3YGx?NoNS&;UvhVK>)C_?+`l3naL>g!&8+p6~|WVOR}}*#aJ#X<0z2HnoXh
zViUo_DTskn90{W|7Ebs#wBZ6JwEsV$lzO6xHN^iT(}s}^j3<7CJ->Zo57E>if{8-}
z3%39kUJ)XkGFUjJpXh(X)nMV2!Xha|#1n`}rV$ZLA|hDC1+YkpVG;k=@EUZ&ztnp~
zq*%D{hzNWuWq5@9Hh3J~b|A!q{QRdmg!vvrLxQg11V1BXB*LT7!>DW~I~yVpkqh<-
zD8vGme}^d;)Os%y$PjZZ(EOSTSj31Ii2#dQ1W@9bwt<vq1`^@h@u^25k#6Q$xcKP7
zqK6HXZo=F`_^u`g&h0>C&ISLQghk9+7DJy-XgE-SK7wj7r1eosgpIiBH3JDL&MGw5
zO<mTsNEk;r8fn!SgUJ3lCiPzc%REWH%iey#F1)2o9YWWhm$&?2?<=*NNDs_|08Knu
ziHMN79L3z>fq^0%6OsLgfDdlkna87YxIYQEgCXJstngqz<diH}Gi66VX{RuD!y-AT
zaSZUMn9Hmv=InR&zV!_hX>B`TH&~@jpOgrxs{UG|gd7ZQ`Nn|-&-%2-&0N+DOedow
z4sMfui|xS8frrt~{+s||V?fiONfDptF3```il^>Z#@uegl4JIU!+!s&0kasNVrY^q
zatVr_v=N+<hqyKTGGqaJH<Q|jQD>WeFdLrqD^We?BP=QZK$>|zCB4Q6IG_yak%(^A
zNnyQia$NMFfmGz~tv>SDI>&y>7xqKSegMRFgr7RR_Xl1ir#+sf|FJTf|C@v7{d=Sz
z)?lo7T%X&FseVop^r0Ad0_owUha!LB9?8w7fVo*pp4-<wg%+G|c5=>==x#rSm}`R!
z9Vzl|@-`N3O-|!HmkyFSSPhP-+LZIR0`2H%*SLa;K-VaI8)k0cM3#jP3@9eoUR!_s
zAP+LtE9IwN+GDNd0q`}nayL(6i+)!X<wH3&r#oh(I<Af`OQo1yX54oqhJ^Zh^}MQ^
z*)eVucd~A(4w}l-7Alyt-`}W^3t!pN&b<-qH*^=EhCHKNlxA6IW9g=s>8+sLnTWF6
z<K}N^uLbEltoETNT|IWKhmaibWGWR<<u8yC-5d)>(8r7XWnSZac&1+ZBL8fD%&&G|
zZ|mt_AsT-C$(5xitL|Ys$h4EJZ_QoY?m@$=#c06fJ0Nrq{pT2iIR>gl$N4hXoN#_9
z@7)Ur;3Xn}A<NtoT70@YLWikhNU9K(^m%Y4Vt`Z-l+++xm^9aZFrOS^;gS?y)*veA
zOD_1Q3f&U+b|Ovi;$-*A<+h#_$EdZgJ)3H;=xWw&%sOo0I>xnPS_*}k-boCI1QCk}
zPwoyWIU#Qd>H2j2GB6fqQA*R&0%np^J5+;UH3~I3oi2L5bEQ)B#u5k!ck%1Kt%TX>
zA16o26lSE;N)b=W36!fRhx=Uk=cC&UgV8!UC<z#ep_XDVqAP)NXmG|*Rd$tuZ^{KE
zQK0Z*_NJ;e<OsxKMG&M;Fye=)rZ;meJ<a*{p030w?rmk;rH(GBc0Z5jmJr9($Ir*g
zKkX2cUBA9R#p3vT72h9MuV;IS6MbsW;&#1vdOq9U9mlRX-yU$v)p&P4&G#nFkLVm?
z7Y*~_;1IH3<n}a3?K~qZk$pbnAmDI)U&gMpNgRT=g;pM=V|8z5Zr=M<XF_fo|C$G=
zgI`q=$GK7dwoPhQKN4=b0_5B9HK@C_2G?d}#NG=NVqEOO7r7J|mZ7%~a$%E_-^~c;
zlwYe9+?-H*4gb|Xv_7D7pE$rM9Wl4w)AS4FCk^)${;8eHmbr|M(^sOo!!^#SlM7=9
z0RzJRgyD7?_v>;LqJn0$r+4&e1IXKe#--<d11+A3FVN;INI<-pTRjM<YQ8IwQ(++&
z9B`5`9f>Na5PmL6K0GcY5|^aB%?%dhTSJz_;z~JWX&0m*Cy}bhXCN5dUMU`vbkC%|
z<jMB4*X6WzmcmM>;&`L>>{~vO9F!h9`BRlih;TBw2*hZoRHtCURfZA3hl!=d@J6^;
zf{a4lfU})A9~$lfcVHly;dP?k0>MwJ(g-VQ=2s!JPzfgg_aOR_nj?LC^|6=N#b$}L
zmp8O-v7IZbC$=EA9GJ+Htk1qQ6F?E21*T~MlNGT{$&-Z6xLS`4IgVYb$Qw_>&nL@E
zZbA=*M2!-r5S`Qs_T9laD@q5=W|2NKp_>~A?_j2L!t#OZqFegK!H_V<?r3kQfE<7E
zIHGvaF~$@{-PXz>#k@Q>n%S$)G2sc76Y!X#_w$w!3m+Q;&qFLf!?1-FPzofidl*~{
zqZxoL9mi0I0+TQbEY1xN3z~;DI9h*jxShCy0qOxno__5x74YHu#=vaQ<Gi2g%wu4f
zf2s>D_V@3F%3+rd9aBSahjUbo+lW;sJYlF`6hYp?H$Y#JHnhj{3%n?DOn`+5Aw+(A
z@d*##G^-7wZRe+O8~4s?7uRBb=*&^<gaqo1U+Wm6?Ke>87Oo1>?0UqPpw2sXN6W7)
zXehkg0w1iOuy0<bpt$H4>nbOoxT5EdhEMFjFc=gG+#@g7(}GuG0n*0s0@@D66u{zl
z^FY%|WIleVlNeN)_bWekGU%yiEpZs%^?%RPNV%d`cncY9CULIz>rRjrE`#|eMw&H1
zpqtRf=<xGX{osFqRnUqmAn>I9g&p>nhs3;{HJ5j^cZ?2<B{snaU<3y%&t+pKe<Md@
zVS+(H_Xhzj306WlCzs-VL*d5=3@t_XTZ7zU!XvKmeamZ|z<o|qrgrhYml=;g?awE6
z9T3p_cWd=={Oz#09%qL~P>%X}exDkq;;MFOc3WC!r#wmXloMb<<1sX#WpWl%<(amk
zwPj)Bx-k?tUVMHrWuU|RGm;m<7=ddl)d(o4pGx+$6vnTI^E{RdZyEdpH3W)C>zvl!
zXKr5S7qZ~cEh-B$iIIWo$T?8i>)_xaUM=s$#B$OKngu*8SzqDnOggWjC~x`o3(M$x
zM67@!f!`ePGZMK%??<EXB)l)8y}f6H1+;}a7%$JY>_JdT0KYVwG6PXUiXsou(<tN3
zNH+_SY7Pp>g5xRdEL+uwZD7?s-S2ZNy*EJsQYuv3gWAj-4!QGQn5|P?b)!xEY_B<t
zxU5t&fCDViO+CWSN<Uzg^H6C9eM{<7zah24y|b%>eUZs(U_JdhG24bct35k08&1vZ
zrHn;>`X%_&4f&-SyR?w^Q}H&8T<5Qq8AO~hZ1_`PTGKCd3%J^y2>j9}yXy5@BdFEQ
zDl~_A4feo?5+e{uUQJ~r^JDeq0xtzTf#g~28G!P4md0L3K6hyXJF1#uiNbAbs|nD!
zl1H%n|H!F_X>{X}Km(=N+~+s-<%5+6&zsEMgS|0-Kiz@h^R^%FN194VgrOF~8;CWy
z_Y-;`1XLMiiF6g{Rdy|1ijxv3A)hfz@V1uRU`R{}y?DEOKskuvR+6fayv4<{Dt%E=
zgCe5WwZvoxi1&=_UA~yTL}U>i=3}ap;>}%S@C>JVHsu%bTA*xkG7%9!Xr)I5@cDnD
zb61WFHyFAMa6J#%$CM++a4&Q^9x+0Y^fZ<TTf--$n3CrS?`KEoL*Eg}?h{Ek!R8cW
z8d04fDE!F`=I{N!z2pxkKnX^Bupb7&fMEz$AQ#2{c07I1!S(2KdmM~=3-#~F3+ITE
zw}G4h>tgMjGHuY6>uG25lOGjj`HD)Sr@k&4nx&m<BQwE2NtXVCig$^gK%0lXpZqnL
zqc0rZ4f(;(4&CJE6vV(8_asd@J1Wf)BsT69ThR829gFY?y{`=YH9bXE=a0k>%AK_M
z`sOS18c3^>(vbtBER#wUP3u`jnVg00=$w&i%Bna5JbM?NG+A5@bfzVclBJRD0sPCf
zgmX&DMP1D<Ly1C0Lv`s6wh)a#Zl7`k%h)u!QJkFQ;Os1Iy=#=Sopzl(hu1=O<W22t
zu;8n0U(>1_pKhaaGi_*PvD48zQ75B{3lCi-5zTDWb;??Ge5fuf59JuQy7P90J^OfO
zKkEMh>p&F0ow#C0E<L5Q4t-i(x4!Nxwi;pUh4@Hc%ZenW?0hS;vGvI#V#5h-qg1%1
z8&!lNmo#=!UU!UJ7^&0E!H+=lrToHV0V2Ozp%h?3#_A+CIkQqx*@(506p>LaX*sF&
zV!~IcS<p|Cx<!l0uU)(>p?(_}C9;l9doFMrQ@Sp@LsCQ%$(SOo4cx4db_aq$pM2}y
z%hQziDv1Bedlj~DuR^=id9u_=!IV5U{-oUcJtit;h8-?hm1-gsC#A=xfGIQSW75E^
zIlWZDLNa8_n@6gI$#vNyRKt`NVyTE~QY;zfWmvg%UJh_lw#_hat;jH!G+||ic`?e)
zW*Fv*lqpth$uJkCQ8LU+hWXwz%vFul1{mh6kkyvpou{=lD56!IcV4v2HQ4Qa;hnd0
zc<1escfL8^IqrhUPMq-|&K&{`K5u$?Tq9XVQ4#l+Ufxcf2I9@%XL|W~VgTO^Y2NOL
zUiAT;g-q=z$=sk`15AmGa@dr_Ip>Tm?!;N*E`Z2*d-=+-<;3G7lzf7pWTP2a=GqnE
zqa(04Mlr61=uK<{d<~o@tU4!J<zn_71t5=pM}#p+)GW#|mXbFvX5uTxuOj@0N<f=p
z7s^b()U2;F6bDO2A9Gmt@>dZwWk~{>RuH%fl1WQXxpQ8O5Oeu!7#t=<NV&`8#`y#A
z_n0_?ZcYj`mo=l#i&KzncJwCB&Q=tBGzOPi(MOM=w^rrnNTX&YJ3bghiGfv#aZV-8
zDMa%`Y8r272H7(bMJcGMINZ}~8Zas)byX)Watju%Z#scdUSp`BFrp;m?6JvLv9^y)
z#zJkWGSFI4LQ}jWQY5TKOjZyfuS}qsiOL8PO%-3dxU$$ULX~*4ZyX69l2?OJ+5R%I
zU{M!Qq7&^eb6naTN4wj}CD0aP^$bD<Sc>Zt&SWxT7%yFwAjZ?D62)Q#su9K#r4j<v
zV<e3|X2MuWm$K&9cZOUJAjI2Se9vgCuu85=o$4eWAn}=fG3*I0xuxYH0nG*v*qPy%
zq2`K&ngc$bXL~S)M%G%%QhIYQ$Wq)CJ~p~Q_MGvUI0FikQAr$76J<%FT1gX264kmH
zK#$ETmL#f}Oy!a*!*p&yTIZMYc&3s?Q2bFWO?fwG;k!BG=o26>+a^)9S0qtMny@m7
zsu(b}84{HuFvyB6NmQaVN)lB`qS|{Bm8y~2NSMx5px`BFRB3Guif9+7Q57w74VHUf
zXjGjX8dayHQLUdw^$z^F18~)XyLRLczSzd#_1BAmKQ|l?h>QMU4ju8lxm0nrWEn+m
z+*>YHCv`T6H-E1$@HCt-hV+Fq!T1@$2+?qaU=+;}xy=pqldz}8?)=`En;Ka(ddGmK
zB0mc}trIilUQbLobic;R0hbC$-6wCg@!Xwi)5XNMXYkDkfonw?7McN=XsH>{zzjfx
zFSP5Rk*Pb6qQomVLaHM1(4+w~)2LP_i7Wb&R3LUk->=qvEocEYfZo=J*YL$2hpZn!
zE+!A!*#is@dlb72&ZJMpn>P{s4nhNk5l$pG_)U$^)?jEL31{><q~9dIbj(;c$rto?
zP9CQ!!Y#s9FnD!jcves&$pwT7fkdO`Ra3G`Wf^ZKse4eu&A|ufv*X?eA&nB;s@LR4
zOi)rei~XF;MZU{>{U;cn<|}vhaP89m=34y@+ypR>;A0vC*Y+HjT&4R^k(3!;h8l{Q
zm2~Z5xW1GuksO>~K;B^M;Q1Udz=1KDRDL|Xx%v1*<-703@b9~$A1Xgw{`LHl-B|y!
za&u#TdvkM~{BiW}kN@}P=F_KdkKn&QR6f?e`-E99p=Vx__eVc~vxZCY<IO=(C>01M
zyg5LComUU>_DH?oprJWQb}&BAq@#r*s%pV!MWj9|5sLF;g)-6zSDRKz%_7VeuKVIG
zb&<B@(htsKw1Y_eCpFfAPz2N#xHFW{V=-Hc{6=o-mLNes0-L9N73N-;#2{=J-v4~+
zK`ZdCZvGf5J_EwEn-a+M5m-+3-YO02CJpOs3BxK-s7`O8kR=JcLH?sBV6ThawHq|;
zF_?KFq~6elZ7?o&p~g23Woz2rc=6kB4=4V7Vae9M)#Mz3JUV%>JfYucz`RhFVL!$h
zlzE*^yR%@2<=pj(b#Uk4K*CB!Dxu*{>-*i%@yg3zOGaK{M&2vB|3=4v6nTb)+1Q@I
zqMjsKD`!uaMuH&k>W%u7<@1&I#+LWSZd}QN>8$`Miswk>M3sz`sCSpRb~C-ZftMMa
zn&9!QNS(KbN5Brr@Mj-ZS?<H787XleKKQS<%}D92$VibiVP!^2G57vv7%7VI3M;l`
zq=?ce87U<rW$zg&szz!9jFh6N*b*F+wAKYhbc%COik7(sTfHwFlx_|OrCV}PHo-xe
z(7PiC=MEs?0~Gx8=A6XUkYyCLZ*Ms#-Bf!YZ~k6!PA<mKNOISzry213oCNQ&Y5aVk
zflQ&msqI<hvEhT?>N9%IM{^4YfQ<u(P*DgnWs(y?jC?|4`>?yYv=LMae}1+epebfR
zO~L3v7}LjdHG`Bfv8T4L8ABU(R}c6A_$-c45tCgYOG<}IJsf@kAGl>j(j03)Srhl3
z+)1l>2Iz)GT;vZd8~Vy=g)wjuJhZVw@2xSQo6gAkPUGY9{{H?L{Fi_YkfAt#;XQbU
z37&D79;P_{ycgZi53{=Q0_JM?b1;LV?!cii09hf(?+vC81Ax!aJr5;=hM9wVsKbj@
zi8IW0X~cG|k0|pu)<1wm2#C|2HJO3pe5QbtfuoN88eYIl{~iOlN`IU38qz<xTv)c5
zF{Qtmt_E}nZ3KxwN1lKhJM_Vw{ZG_7lm7L_@Qn$=T`OOXn-x|m#Jve%lX4Rtf~-XT
z6ksLvj>>z>1FF;&IkQfaT>}aOZ{4|;e0Q~gZM!9gP@!KEP%3%{6^~kR4r=Am(h_O@
z|Aq5edyS(nB>^pjQBpXj&ycJ@QW;bjf&}uEWG?)Mw1HUASL_--kfez<ls(oC|2X_6
ztE`{k<MDzL&vHv)pT3yOic5bfl*=vzlQjWE3B&k7tMIWB+$IJhPnMaPJfkl1d<l+E
z2%bg=2SNBG+VRIYcw*2ZPlBWBJC0AL<o_7S5C5GGJl~l6z$W_m@zY^u*`HY1N6FG<
z6bjZ{XplV~R|K|{tTO;ml|8P;^CrX#857T{8Ql>JtAzvp%!1dG1k)qJ&Is?O1ixQG
zN-+`~raAgpLm)f1v>W)RP#{SbD>IGf5u(5Bo;r{R_Aw%<AN&zgXX1!3Bzf(aLIUG!
zECIReP6!sp;NF<_RwI_N%5?w$;kkWlJCNDAy|U)8-cB$Fg|1i)m|q5qk9;vvSNXRk
zO~P4*R)d548@$g~9_=oV=(XwjZW*$P$cU9sl7gjO&j%ti?Al9Lnx2>XLZm3^tS0Cw
z{nT-ay^Ro9lG9eQ9GUHn6p}Fsrq)VkqL-Mt#XeM-g0(Hq-Lw3;dzLkK&sLkeXW4W2
zY#--twOKoBzE+;8_h^oO6jO1W7Ps7Wvgwz}%GhzD=s7tqUy!_}dDq5<gu3W=!rrW|
z(rsa9<<RO1@aFV0CE8p{vXV7N<xs}4TSFW>Ifv~GTzrlP1K#k~O`NOud+EfvZm%TH
ztu@NiBMo#{Mzvc`Zm~(Lq|X(@s$r97nBW-SFZx^@jsz%f+w{5aiu5^26IQ0r6+<dF
zL!VPbidnHGeNL1{NuMj}b9+ypQ#Dc>q0ePw<4e%x(pnP~(JfAwD_Z6nZ1cX*<$5`E
zxn4<^+W=jT1%TmKaKM7_nO}DoS3{Oj)V{r?%k@(2d%XG2^13_1gv00!LD(c8hYi2Q
z&d^Nbfm7gc<3^ck&;krqBu-}lWH|6KfSVv&(6z8>0k4K*O;(M+#A`<eHRJD*8)Sht
z2i0fco>pd-fw%h#-0vtTfFJDXVyZa{yb>Ug6^5N6b-*B2AXP17mT5*n+Cm>b6fmG!
z2E+vfUi{|wn+DB`ToRWGpJN(^P=_f)R3Y&4XQMb$2&byCf@w#xC?}rf=LF>tE?m>=
z^*TW?D3B0si7}rW4}*#2-1>JF@l!|I%S4axtXqbER$~Jezh?1q^>cW;)IM}%3W~?A
z7YRngEgBu8O7LD5z?TE@aeR-~_<JP;Pm19M9USe;5Wvfcaj|_Y?yY+-PqUc8^zGrS
zezstt2r{E$gy~=BPaf=cC_1)W;=ccxu+Ga1rQ)K>oW4@<j>H87>jdJ?r?B?&*9xz-
zdeY$f>|MWv*TPOL;WY{L7hW{AnLrE7P?z_A><li7Z^vOPx^1|qw<265X~N2IQL&x+
zX5b=4PYElwgo`3(2HD05cRqQFK8>XO{zzMUxpQBx>Np28GYOPoA2u5)Q!V!mg^q|<
z?i|XcYrmZOgByaoEv{&7ew+pd0X%mp`6ne@wEu9Cs*&0RTvXf#wgiHd*1({MUU3Ae
zXqjs;*ZYDX^>YxUeu*HhA3>sj3^2UO8+uOx9+ZC85K>$ZSw>O)_7+0wr`r5@^Y{9e
zj{qU6OkF$(cV{@7>sUuL&cPwSpabJGz-#$+AMh(;D;|1g;d8LYA{9Q?A{T%R>D3=B
zh(is<J;yksrkJPrg&^_R3~Rd_gns}XqaHnVr!m7pD|LnKJqzo;E}V*niU^f~dY8%5
zG54{8cUea_aPS60Jh*uDscUW#j*5mkeyJI^ZbhgLJ8Q0T=95I7|KPB=7I?tTF#oym
zC~7x`?sxAI&?MK;3=QmTP!{m=EnrhjLTN(h<FQ3vl<cwqyej}>-@l_eMk6}JPL=YD
z1B6GhRwxJU4$tA;95BU+U(dn+4kx6msXq(is|R1+?1cr}y|RFvCL_qs7kGgaE0jK1
zIHde|1*#h5YI}f1j{%4APY&lW8-isV(7EOCC<YV>LlS#hjPDLwWX&s)Q+JwpB?|r2
zz#dy)ZO`|T9S3~^EmTQXRs29)71F*SNvHaW6zvMXCZ5W?Iq)FSclf$^NnwTPgXqW+
zDk<+HQQz6657hG}PmZ7cUKk}$^O^)n%~!vRVC}dsD1hyZe4GqlG2Vko4}ntPFu46d
zM1?t~*l5>Tts|f@jloY}lG%rs%ubi$E;uwda*YX397c65S>czO&X8N$P+_(Trd5do
zvR2_52WB;QT%q+jdg3&LVl#JkkfNtGe@DX-ZFhoByG5;>fy)`VoPl?B16(-+moxC5
z@Wa%XOY7p0$rt8f1h&LNETo!|1);d~+cx{GTSkI_PD2NkR9s~wh$RVV<^4(J{Yj!e
zlwly0cxu%hU(&@Vtup>Y8UG;(jsh^aZ9-pvMM9sX2`dx&is7c4A@nKY)~wi)&?icx
zB=nW>ANHQmr)s1&N$6XOH?Rb^FRiUX5&h!azM^HW!E)~lw@<I<ko)v{$?jV}yN_No
zKA5@SihJ;lDZ*IKo!*yFMV2$7fqP5vBdwQD0to@^E5*+qgEJbu!hAdg7aqYhWP$D@
zT@IOD+QhvDf9v%nOip79&pcGgZ>PxCyF<l<w@~OM-lJ1RboXpB)97GBn%^m4xh4)D
z1DI=5;{lm?<X$5!I9*9T`Nc3TA%F#<#9v$+uwYUZT3(I9!zPWD8o3$C3$I2p-H~@3
zIl%E^hU6aa&YDbKOktXuST8IFQNMu78Ia$s`FD7T7kboXb$BtirtTN3W<cx6EkSsl
z)DPI*Cp>p;wkns9{c%a!r(N^jSO;N{p#R9k%%klg0%5Tv7qhqEmCvL4X-V8cj4+)R
zgg^k*-xJwV_ziFXY*+%04>JZq%Wn<>T@&s(AW`q7siT^zoaHU3xu=vGlwBzu5uGgP
zLO^*DB4)Sibs9EY>=`2WLKMvRVAg=Q0H#$tIT2_Xr+80TJX8d(Nl8-M`44swOGNr-
z#QsR_ACf1kLTS{i3kRqWEWEuSw`H#uNH1c|w+qDY7XYpzP}!nwWaO(DiEx>wi6QrM
zS|+KzqzEM4B}kSM3fR)I`h}41ajsTai)0vjRJmk`c*rd33&jKD0pnvt8byBVj>uUA
zQVlI~oPUJ_ovu>@103UWl@@nv7MFGev$t7HInluWXITTQY+ptFSkAgCUAmTOTvxt!
zE!(zUE@@kfG)!t*<?WJO8TZ^w>n_bD=h8$7GlW9JR?UHNq-!5akg>h-;<w)(PW(CS
zEX2iART$VePEHqzk7PX*K7hB^u5U~deFWuKq7Qk0srFS~=j4)N{tea<++6s<NE>lm
zSl*se25ov8L7N`!?J4a}qYUp9c6S-x>9K`(Drqw@X#s;r)l$VD#nQxOtK!ps=GUeq
zKnHZUZ<{!yN8p<!m^0E=tjwJ$3Q25+J);Z@v4Ttfj3|wgKU4B&_MShZZm2fEpiw}}
zmY~U`HYq40-ZB-UOz~3JVy5?oETiX<W%QCPv$0TEAAofNfV??){S_8dKIx@r&Y00t
z#+;~z`^%Wo)2)770DB!2%L>MWHn#Eh6zB#T0Bga946<3+kOFt^7x?LcD|mFL0l;u|
z2PrRI8~nq>jqO-xbNh=0L>2=2(VJR)fN*SQG+97Z@OxGGYh2ZCf3pGI9ZkVMJT!dz
zb>fvrAtM(iL_X22Z^tTbXt(eshX%p|_6@Br5`TbT1C$&rk6dzMIFxdO2@fGN7c9RO
z201)5U>Eck9&ROc9bgk_fB@Z+NDizA2+}z<CctmC5T>K$!h_iLDJxQFezoqk&`fDx
zY=ggl18w4#EcCc<HW(Muh`c*@g3(SIEDRTw^~DSx9g1~2WbwFyUc?}4pc)tu2SyhZ
zgje+(YtXYVC}D;MRD)iapuT`cJ-7={GweQ}(M3QKP#^|j;pg2C;Tdex4?&Ia2PzW&
z1XaQxpiGAZbHUsM#PeyemmZHI2EY${L;{O#EYipc2{ppLmWqV}(#qu-O>#wyC(1Vv
zXvjEXVu|CXB7zH`ngL^AWQBpO!q*6f9(-^<JMO&`J_W#vgd}<Gc<6BuN+Z`M(Nf}v
zr6aAbG65m%6Ah(O6^g5-<3)e79%R4~J~_Q5?7S=6hY5W?sWJ(@w_q*+TOd3_q2WN|
zRsAQJC=KoL$;2A_NPrUqlE}I=y<3Nte{X@|sbJ>@`gNooA4j@72mz+l=S%iG%_abU
zae;_2h$Pa&8*G3nkQLA<NOB1i-4!%k61hkw^hBH-jE+NN;#d>+o^T``FsNYG@J(Q5
z#N0s~o5-hM$`WH-8WzS#(oXS$p2&ES2`m^biI<|Ff>bOhlsIl+EkOYupUtN@aU?$#
z#$2K`BY|?FvXtt0^tvJ55*QWm7T>)A$-u-EMuDTg%y8VGi}GWw5ysA9Wzd4dBHp<3
zDcJ9@ARdlxZrxg60~I;^@!vP_?-;G`09NnPQqS!1_!`(GkqW}Ipjw2naQFho2&`_6
z$%{iGpJcQCbdpj}4DPl7iIE9ULR^RrW2Wjj??mYdg37NJNGvc}UgTqfB?~^pZDurO
zXi38w#kC=tBWs9rm5SzwDLYTZt|`O&tx&IDfk#{@0LHF36(Ib-MpG}?_ju=5Q@cJ*
z$#%*2*hO4Y#WlxCV$BgTh|$R>2rGyo6JeZJFgnrki%;Jk{RQboy1+1k)uU$(aDSQ|
zq4VhIIHqvSfYJ}eb_4nAB8-@pvLp)Z%gJ)pq&k==HEZH1ECq3nN$rrh(k?IS$G2$2
z0kj6|0UOG|ye=uKApg+@R+<XqdczCP_`rWEgTJ@|*y?b7lne278jEr{UoPj%<-Fo@
zKE9AIvV_mveQswlzn+PBZ<g_#wp}pfp**mmgwrjHjaVf9VbGPq^dSmgwu}>(YoQ`w
z!-T~fdTnXepjJupHD_M0CBot(+&&5;P2AAu5Y^XDMemiD2bZxM*UdwR5egu*dFq(2
z=nXX~#PGLx7ql^X2Y3y7a@R^n*X!xG4Y#}Xl8zqsdPzqodQsBRpI#KlUGw(&nxKH7
zF!g4H^x^&6$0?;?sZ&5qB=2VAgw-ieH|*|oL!2On)TphWZqQdf-5_hl>ZcnD(#JM*
zx<Qq~#|kb_H$;q0dENJCk(N5KjJXqwGi5oog$Mryzx<0^GF)pO8Ll;h4A&R1B>+mG
zbzi#&qF2rKYO++atJCvNqlteCN7w$4oFU+R{3~{FKz7dH*`97tHdGrp-LMLgahYQe
zdhP)QeTicag-czF{ob2n4~@KI4~_EJ!}^asyoUu6eGq8Hb3gCUNEvLR{_XF1herB5
z5EsC{o_Ama#0>^S$WDjOz+o|Y(B}9jA|WHg(U{4E-)F|qh8+_Yv+%6(VnR+9unWFd
zjhXqLfAiACF0n~PegPe*y|=y3JZ(6T*FpGS3*S8!&<lf<nI^xp63~mO?GXkCiMlAf
zqS#72f%Lx1cY)P-?@p{!NPg?k(3fgAV)94VbHnjwE*(!nWHJ=G<8tsXWLY2ndaa#)
zxc=qh{rUC(L2m2S|GBz;{Z6Zdqm{=-gJDY!#ry&|+YvHg3uGl>(oSdg@voNu%AH%8
z`R|+eGm^lB0XP}k-W|Dzlbu*$SHT~OA++e3oFaV`>4Kx2plkuMxc*CrQ*Sqn-)XpV
z_(MTj`0vrvJ<B0i4!NBTx!GeIa*yVA${3xMGBje$1(BwJCUhCvMEtB(@(Y>7glGlU
z&QeH8=2@_rfW-r*dF$TG(=2ANvLsW{*@C$Pu*hrum%Q|^^H)BgO}Dq!oQlgOz(pA?
zZ*QXI33pI#D^i}Ww@PY4*wrO9f#^j^O-N7^aGrVe^aP33$ipYfXnBS4<hTP4T~Axb
zlN+nz$+A|gjwcs%&us`#R&|lGf=fJEltzgsmw592<H^c~Y6E!kDt_{1@Z?4=^4nMf
zPcB^QTI~1U;K|KAJh@ro$?M0H!$4nyGxy#>=7u*IJ^=o5e)-IC<z~vD6ZLR^aph+E
zd=MAFzT(P;<6;ar0u5uhI1-U=Xx$lKY?qvt^DH0Zo@s^<ObsIfA(jb60MhJh6cP0B
z96LGwPEYB-Fxg<^vE}e9<GDN49N<=+Uup*3FI(QRcJ6DIhfFI#2C-HeUM@)jF1ce4
za0k_@YA{N0*8^Yl5zC%iBaE5AL)cZxJUgBkfLtNo$N+Qe>&UW5kUax$tuz)BF+d!A
zr_o*!3l|~^B1ufZyO2JHN8d5j9?bh691nvboL{aEhbO|^wR!Zo-@@u(ZG<=q2$ss<
z-5dnD!=;EAzV3!F+qoIFObWe<lsE)kBmwO7R#pVNGiywskVwBfc)oEGQ^~Xo+c4En
zEHmqrBJu86e2Q3jisNHRa0>Z_W2xfKgg`|x$BMT-0QbSh`48bSZAoA#NgxG|rU(E_
zc&;>hxtCbd>6cqxnDOPd!Y)ZtEsyu)&(IfaJd%#%gEF<_XkyYt_I!!%dzleA=yCMZ
zI&L0=mO$YdJszGh&g?55vx`oHvS^1vOO_j;3U}O!<2A6RD+G^PaR8qzqZlcAA;g+k
zPcWa&28G&&xtXom+{~2Bje;5`t<O4?QPmukTKD9P=L}v4W;4TJa&`wbj?B=}I2DQI
zDlBeC3$nosmaB9PYlgHCs;>B%pO~d3J5@lJp*6|HPco#J?SL$_O4@Ww;&&EWIZ%>G
zMQX^EKFm`qe|i?TglAk_XheoyMeO5RU}2857s2l#Z)E~|ti(<x+%DWWGFeB5a`^c~
zSXW7~5Kv7~O{>|8CyNOZpRd#BZ;4`7!|FomY#0avOT<Z`X>jW(Tv%%0U*Q}`{$vDH
z_<cu_Zr05NYUNXb-oZ|CF)i6ZuUr`2BcLUvl2OvmfRA`i>drnz_ZP7Y)|ovgFH*7h
z1H6t6N6Zsr1HJwV?h)WVuAlAGEQ5^*-BmJrh+dS8o-)|Teg+#UIZxY&p%Dj%5Ej`w
z=c&0W=SkLz)j3ZEp`#6Po>bvGR&dFAirAVmhDI4fWA8an%7$tKoTnA>&}C>(&0K;~
za|zm0;ZoOP!uN*u)XJkhwMyF4Hfc|RPw<(upIRwnPgKYKWk0pjXNI@{_MiP^kI7AL
z&SE+Q?>AuEraM}o#_`KJVQvGgfK!^_FT!L(ykKNiyd&^_d+rF_>+pt*8Up};V18TB
z`Hdo!1QMoXBxE{;<eds<B>|?>K4Jh6M;OGHjrRXOS{qd<$_>JanKsI!?Z|4y`q@iQ
zlDrfPM^e)e4%7G<Xv~EVEb{mA)Fkb(bCXiV!9W;_UTQQ5J(UZ8^Wij*OI%b*F!;@f
z(-ah!;at)H{LuykWxPB|B6l!|fbs~?T>{iiG>x=~qn`pq3s2sPM6~=?6(d%xhfa~&
zED8&<{)(`*=$k!cYSAPiXNMFP*Ut@66QXD???#iVLiA-KHMy%=xN#|wJZO^S+NCg>
z1t?0!y%lU=MX#_BLqcdt2s*B0*%4+kjpiEpVM|-llB$zs^Yc1aWeN~_Iob7(Y8uFE
zZO*Jvu%Wx08S+}HI#HCQx~)(-S*f8}K1mQTmzoO2nJ{2&ZD=k`nFWRUFKy=A*qjH0
zBuU4L6aDyj=T}jo<hc67L>W;01Qu2-@>4p+FIZ<K7ni9-KiNtxk7<`fuak&1gJqZ2
z7{M0EtfFFrRLO&DZBpS2)l&GH>3tj}S7wPX#$?2buq)4LOs@Bq2kru>PgY&h`Hc1B
zMq5H?KR2`4e1|_C$|I$*%ggeaeWV27^~HFUwYf!^iP?NgVbn&uHS4yu1ocs(6_f`V
z8pRm%F)WPoAWKRj-n)hO(H&&OG`r?&F7O4_rHHj}_zU#w9h`nK?D875;9p5e+~8e8
zbXXUlK)qQ^CL5<DhUT|G&9+plz^)hJjRko&!yaQ~^2d2yReAfFqM%Ab;u7dSKxhVX
z<W*2S0^wz%cmbZc>r1`jcr7B8TPGy8RwX3LTCqAIu^^heAwr@mqRt8~35lXKN<v~u
zNZfxyqOzgdC?RoOtcPVdimhBWVQUGFV&PKPV%7JCqu9>lD7H(E;`%v?9uCME;V5F{
zsDY0+-HfgIz!<t;;7{%!dgesMcFF)0b#i}+itY3nBQAh_B`VTEgJb3@7%`Mnf6Yb=
zPziC!0HJUM-vBiicy;iHq3P`!0CEc$9)!R)Bj??ZZ=B1Ch0F`Y1L>V&)QbYR8u53K
z5DCV7Zae@<(!*o`_|5P#D!jwPa}hegZ&6eczJp=p@WM=EvaraP9h$wW-Qzf&Otcwz
z%jl<QBEqCZ_9aON{`0UDiV$Fox0wssaByQnRz-Ns>XN85xSwI1(%Bp;afR<4YjUiG
zNa_Tt#Au)N!%+PxKqfY+l^NF8c4iB3_zRT*ZJ~FyK;dk~U?5}z5Gmfnb%$~x4Fou5
z1mC}<1)=cV5sZ{|kT)edpq&yG2)*iSr)Spd^{w6*#py)+cC(5|{-pHH3&%Q}+h6cr
zG%bx87UoVPfL=W~qwqQUbEEG#K{Wa%q>ZLsHzq;gL%f{$CkLEoGT;EV6!pgG(VL_|
z-c?P9o~euXrwROy5bzo%Z~M{P(-`odRx24thP9SR$pAx-$e=wQSIB@GOf2WtzpDgQ
zKSCOnUJa4I;0=Wg;VF8E@G3V8i}VoUe}m3fD)IsT2r}b93mFpONATaOfk@VP&C^;g
zD<p}o$PA4#jE;i1+DC|ZPiN$$kBbPUF@qT?A0x3)IU5`)(R!BSWu<G;9>+Ckam`r6
zy=O^f%enR}w64`O<1FZYg3J)*!QvWIot|*5x8EtnOiE2y22G-JK(X3$%RB>ErVN_&
zD1s(6%AiT%zcOeN)r*p&P;wNCk~zW&dTq>{m6$JBALYPFQs8;v`R?=#SOoSY#aRWZ
zf-M?;GgyDfMR34<6ogHQ8B$g<l6uQb(*a~6@`Sl`Y~O~ruF9)Anj;_aoaKRJ{(K>G
zeL&LNxw}9gl2XBBVh69D^J?OHmMMH7&AAeO<EIDWBn_qf@l#IvSFvtM&oFV_&qILx
z#Or9=cLzD;zeX*xbD}C{(W){ulzYP7S^gbeGhSJE@u|$!n($O%Zz<|?;!%0|;mW+5
zIQ)Q)_pS48+N<(zWUW}8cT*6Y*bwhV6(C{-m%JNM8YS<h<lXE)??%~BZHjkO5U^T?
zS<}wtz_gcO))X#vEp~fvm^Ga|W=*GL)@+ekGlp>n9b7VOGL@7ML{T^QmtoUMpBv%=
zc+LzPM)U{*L(ri_F`4D)H(JTQDcLs#**BV|%D&OG<@h(tv2VnjTPF}?-?}CXpYieL
zAV`a0-)Jezk#k~n5jC<-G8@QgAl4t{77x!M!K4L_Q6_PrD8c7((|fjl%MclNayAbg
zXt{hIB{olF7%f5N+3_%3oyDUzn53+pwGFAI#!)u?ryNbm(Ui~ip(87o?UT;+S(@on
zjp`1sa+LU^#i~ZXxC!D<Oo_varE-Eu$Rh*B&d92y(uOj1Sftd^mX)NUL<|#ZV_kyj
z{!C!TGVIASzKN|Q6^Y$d-o!@qq9hfSq$2vSBo&pUqLNgUm^e#P(X$KY6GvPSYuGxe
zsIw}mNY;wgNks+mm<^GNR53ADa7ii>rBRZKN>b7OlZuoL)e|Nab#m!Hoh3*`g-czF
z-QF8gQ8$lN)GbLxYata~{o`khh(2^Mw)jLlvz!O*JqY@lN95_Ij4@H|_LnczO*i{-
z0qiSZ$lxOa9zAG?@Q_G39@rm9Fw$t}X@JiAE*`oDe1#&h@MLIsc%2{#o1?K}3>YGy
z(F6nYeE6?17q9=DSjHSsCe4ISb#9Sn#EvJyGtMQt#$Yrf!wJLF%v|gh8;Z9Chj$ec
z038B9N_It6yxH(oqsm}S4A|p?1N}2hrGRljTcHKkR~Sb&@=+|!L!|x7VuHZd(1xAf
z1GZ&q;Q1cBN|Cn9o!=Uc{Tr?Ra6v9E99mfUA#}=Typrhw;H9~BZ%iiI9BqhFSR8O5
zA-0yZNJRb&Rfig%MP$B~P&mIXrWfNY-}HjD1z>DVb~E5x>>+3#Jrs|09e!uvPhjEL
zoq>1k(K~n~GJB5e;R{~SPYaL|K|A@ah_J%J1rVY5oM^vVKI%E$*|Jw6JdMl)yyxOX
zI|LcomU$??6>fkLBy~Qc_f86LsYKyLtesc$(fJI8Ph@{0R!;m*#w}biiG8c-=8<-M
zOfHCnU*&`XdI1uzloY3D@&@!W(z1AQ{PUPL(wNgPx9qMYijG1-scAtQAg$-aNR_7!
zdr?|_Ne!voWM#aRs0Zs6V%-z9TdG_1JJJh|dtXWRf&4p?E2>hO2-TGrK|d5;`ZBS`
zz6*58xfbY2Bt5zJB~y-!9ux>t7;jVK>%bjXGBw~^*>L|RQxmF@aUJ1`WXbJivW`(6
zK}s{LS)~eE7}OsA6$$<Ei(2H5M*Ek2kNlxOhr3B+^U1F8`E$BJp>;_)Q69nY<w<~?
z0~-bN)G<Nu{@k6YV*T_yecqK1Tf8rVn}7lV27vU6<77iI24G1gRe<V_1r@Q71*G+1
zE>n(mNb1A;x5~j7;*ZM1>nr0-@tr#EQMZmWbyvliWUW{oXDYal-w@8E>Puk-mpGFs
zjS^=nai;ypnUoFH(m2!VZlz_grEV??)LjBwDqQMXZ1vt?OT9d7saIl4o4}SXF_1e9
zF;G+Ag;o7ChnRXPLrv7a{e_r%=@vgOfPICSM&O~k4FQ!I8y0vKkr@S>M0^RaLjXtz
zlohH=?kj-2&{4S60GI^|2PlG_Wap^TklkILjUfdUnA#rH0Z}84LeWpN3KxNK_*mCo
zvBqM%#5op?g0~j*CIQfNIY9G%5dbv&5xHeLkwc1Fu-qIUdF_~Cd6*&gKFALZyLN;2
zpOB-Ad6-U$+g?^%aN&nlIm(BAus#WQzv%6jIQhlbXP!?C_=(tk_#}#l2n{BL9aLBT
ztSa|(zxkKx#9@wgN>Avq817M6UP1jN!V2DHNGfdK(qc*xkpjLF%|HN_zhJWCWX(^s
zzkrwg&OerE00M|KBd@2BA$Sy~inT#V9D5V%l*MEcfpCPH&*eJzr<0_Fqfkq{sgf>{
z>vKk@MBu3NOB%(K#M*p-?hUhH+StoPN$W;$dS@kevj^DCqdQ=EW{oY!vtEBO$dar?
zZ~!n7$99S1<i*sE8N(9FDewP|?}%|PxOFI}w<?q)YsKnNPQm^1hM*i(p9L$pgmOe_
zlu%9y<?KI{qim>Fg>s6!mX<+qdbwCjZwUmaaH(rC(R+j7^z#s$eu?0$5y4^T==mju
zaIV0A{LHbNe##&d^=^N$n|`{9j|*U5u^U4;0OY}VKzAX%T^gfk;*CKRs6i*IbldTU
zos5w|G60s^BimhgVbSiGl?RSy;Q&un^XCuj(rS>U1)mYVEjy`0uC2ze4e`Lm6hr`M
z55t?H$A*f)JfVfS;x&H9g#lB@I$<7c+5qJ;AV}AV)~xeG5>wk5kd_a`u(~>lsw>A1
z<jBEGencfqARM+iolM+&a@s~j21o-*<1HchWgJh)J=+p(olt>D`7dQn#k9#21!BHx
zw4LhSX8lab*_@KBJSafrP&%8JbvE1H$b~h;!+JycwL0Z-f#=|6E?vu|YdOAP$EE7l
zUCaGdUCXjotnOMaxSZdRYgu(m#R@K6%c3+&*K+Av-hbD!vY}elwOo8VyNqkOpX&tf
zFX37)T<Tg(^wV@L-yvPrxh1!Jur@*y#it3+a_LxJi(~oJai{JCTwLUy1F~EKkzatj
zYK~95cfi^jx?cysgnfZ-H})sJmu0V<%=xOwN84j@G0VoUXMC~DE1*w;lsvV7wt5|8
znBj}2E9(JWSr4eHaJ3i^!3^}BIESrk;}%Q*M#WE>9_A27f`KD}xn0qf>*6@Ta{zPi
z5WK-;D9GfAS_SHMiv&aXh&Vd1-nqV14|(Oxjq1BVMYQmb%Hi+76UI4u3(v1E{`ljN
zliPveDoqX)>ttenNj*u8DM9Q`rNYaog`YptzR?;y8#X)Y!2KR;{^CU#@{xF}oyBwr
zQUcF-AR#6~bZufu^!~m`S?%vtN@6+1@>1`HQo0#RDKHP0*U|BDD4A&P@WQ8)|7bS{
zXeH0V0D5#-;5ALr^zSVX)-6{gk_pXnwSc6SnM~?~Ili~%6=r!a?xBt!E`L2jQZ;`^
zZ@3BS6tc|;o!bEI(<<~O{*#G8K@>sTkB^zEun#UHh=RgcNg#w#A4|<|1&YdAIC1cX
zYFZ%E>6e=I6~>9Ffzk4;0nQ|eM2u_BwN$v@jHNujH2k}Ga^XHX+a6cwpM&#D7D$8+
zM~_UZHwPc_4lu|#2j6T3!~_36RzCh;{Q2qAH%ItZ=T{wtWgJN!@mhpfNnl)PsHP|e
z0!1)uf^Xvp30^a2`TUYw@y0Orh+P#{X9-!Gow0jG1SIB&zmsRZlw`S#C1sud^TIa8
z)WTzV2CgNNOrZj?jNu(tQY{$JTS`x~$lZN{tm4{0%xr2Vq3SUcB;<P;x7A=vBei*%
zFu}1(ytfR{Z#+k1cvdB=XdDqaW#gT7Kf%;V#6&XC(I8m+*I)T~ujZ9T3J_}a*I13n
z4SBSDdKgIl6?zM$^kq0QkW~TQD|`)?%ltJ1^=fmAUeCqv84Hs~8zWV*s7}iVM`Ucp
zdTJ}TFv`C<s1Mj@g-WC*6+alS1FSGq?^a#zX4OYM&ofaaZBNiI!jvPsQuXLKJ{N9!
z385hHC$XZ~nCQ2^U{S9zU$scqHtZD$K(&+&EPc*r%P)D(XTeejewBYsTy&^QEuJ}E
zcyz5%SbrijdbuPkmt^IVtXz`qd`XsnQLxfA!C4mt%dZL!wxVg*1k?IOZv{@?2`nBl
z-_G(p=W=0Qso+B2#NHwYu5ZYRTE&B<azCyJ0Hkq>z8I4QN&FU;$n-!5ae^{GT$E!g
z^^xKhRFar47hthzI6_XI@pujFCEifZX3K5lD|Z6uT*?)-OMgA2zU5ZnTG#c~alPIs
z<Cm^_Po98NJ;cJ7a+u}ZtQ;0VPoR)ocxWI#4#DuFjWe5~IGmo(YubSj3KF9V6`oCt
z5|yC{D{5&BkQG~UqC{zwoT!o$wP&2D<!w})5tU}5HjP`$c~Wc^^#KE^qzSXy2Jqw%
z=GMczf5Crnl3kF64qY5qSQ)9=NmjAhw2)<`OKWi0fX-{+Tq|X2?OnTsiHoGz8{StV
zhxgSed0%VceZ2<Xz#Mv>(7sIYlfSp7E-d)YfuLnfDY1w3>~rRR#nq8z6t$4eL(iT2
z)p-2eFRt?xmnK?IJX}omiBm$mx<e2cJyBz<?|Qjj;K4c{YY*;1y9a~~XKKVCHG`6^
zG=o%WyqJ^e+rKj$t*e>F15E9=F1-Ec!o!;ZZBHYv1L6^jl}AIvlH<lcZvzsl?%aFr
zUkiKmdGdhk1oS_7nga+KW*UMYE|A8YNh2sJ{2coJu+)KRO?-pjvzLPna_H(G(B~7^
z0I=i)VLhIhm>UG?B={dmXdx$zbQVp;yqf8-UGPkbzZ@MCC=Mid>VX>)yAF$jMtZ(G
zr&=J(7*-IIqa6W*=0OGj{QAGI|4ggKJ&&k8RJ~53P-r!59pHN$<om~+%TsfoB}yd@
z@fT<!&kooa{+fYNsg%T^DiI{M9cU3<9&wns04ATO3SwHRI<OI&fYi6I6k=7=6oaM_
zmE+8Up;SOU!t{?>K?saZs?8rp5BBp`{8b}dGOF|63Kr!^I*6)bX34OLODPmiv?59b
z8Z5jZdq&7YaGFQ$&?iAI*op=w1YE%d_j7qfL}Z4f(-EI1NURF*BC=TmW(<Q!mdqD0
z)i}YVfvZ6nD=t7tcd)M6i97!iMeRXfkF4GK^P93W?d4r$kKC8vNZpS&w(ZMr?97*+
zC4`lI`5A?8%a^aXr(?yIzI;&{r7yqq<?p>OU)4q}>&su&5An2o_ZiX@eBAnz^W87q
zu9)v$-y7e3Gskz|EPeND_uaplyVGB-`-}N4u_M=R=)QlZF8jC^vW%kgvFYZyyX>2f
z-({Z;d%upjD#kDjVA6D~dlqHWqdvpHVL^t)ejnWKVz%V*=)XDcy`x<Su}2w;_cOj2
zfVjMYOC@{4eYu4XPAi|MA_a&3-~SZx|NbWq2O!Bb_MVh+g|t)GAzhH_CC2k7Sy)3g
zbo9~Z9(V+apO_!biF2|=87KXO5pUsudJFN_KQmur>Omi|SjmYI;1r7~zzr)^18Vw_
z$qUnkOdVD|JD+~KYcrj%?D}WDcf`AIhrPyHC4TWwu-dOAhGGice{)W2<--NlH6HO)
zF-;b?{(*5?_3)>vty&JH!tP91k`%j?I8sJ6HF_E^6M#A9%6;@KZJfdh;w+Q5_H)Jg
zHgIL=Q*Qm%t~qIX@wkmAHx~P1K6iE;D+Wu`BUz&82@YHQOje?ZqQ|Eq-ETbl^HT(F
z&4yXM*d~P^A_oQ!zCQFc69~Sb=ui?25Q41|4-HU$fz0FK$$EH8^WrU*CFrVf*Jk`t
zEKM9EUUp+I^~u4O+Q5!d+vtNsF7t+tz&H0)4^TBz9jVQ2gRae;fv#CXSQ&K9D12L>
ztD;wq6<dO?qBKg-wFF)F9&}Z;QR_cIwW=riX~D4>a(>cBsg`cn-X5iD<-oD65{_L9
z9E%Y|20#+G=OFaK7uy)T{(3R+=Z52vTg2vziN!VZIRmqCePkI$HDpuLa|dQyPZ^lS
z;Q&-7Ivg|@4lu!9XxDr=kSloBeyVCKp(LZe+t**|38_3N0DRB2p!L{z3J6?Te*Cc*
zpU;@hz`1kw09s>@E`#o-xG{Yyck6~}$#D!JhNEytBKnBUNU0?3?a)BrZ1g$w949Jp
z%ubCYU;G_?Ufi1;cZp&HnKP6`m<?+cb8<_>Qq`#aI5(@Q*`z{_H<Q#|DC6efgF~Fh
zybC1(5?_-aF=459K~y!8g^?;TMfqt0OWIfN?BUv_D#8cRJFpO7xbg83@c|2-a!HZ2
zBjO#v%DQ$@=TkDp^6)5F<Q=w~#bg{9lS$>r!<(CrKUBW^ZVdmvJNlvW!{uLtSko^n
zH#g?DH#f)0A4mVjNRFRAeR~A|{h{))_T4AUiWj-OB=3)YfW;b@@5h^ipin9lOn7tf
zNsRgkUVGUgE5Uyqw!W%`akd4wezd6+1|WAVr>6nGKL^Po=eD@2S2ItHZ8Ms0Iv=1g
z@*jurABQ2_OPfa|{dg^3Y2>zP<Srkrkqh-;7p83k$SVpDl7#XLWce5|*{~z1aEe2+
zaV-i8l<E`Jm{2E*p|?@e#1n{rDcm#<lN$6Do9na-2Ucr<(gxca+~p%g3%la6eG6MV
z;w%L6$-OZ*HR8hej&B@#$-KLmAZLW!Aa7z@4cPtjJ8z;TjA(F5@|HR$gJ7DGL%KVT
zoLPPSb!<;S9J>yqS-sZlje2?b_UYlktyB+gYuh+*YiBrcmJn9Pfinu<77ncF1Z2gQ
zIIt*<5(h4E;JwFzRc+Mzap0nk>!*eLX2|tP<GxF`Yj1Jib`I{_E^*)W;J&yILpI1y
zuK%2I-MGH7jG~&cDdxH3y6vZo>w=aGRQ13K;cw<(t$0^(gWeT<D#X7GUk|~xZlc%!
z0dz#OoG<p=bx_BJaFt?V!7<wQ^e9#?4VkIY;FiKonVSMn3ZH+3E)Y)nhlyj?ho#@<
znsSpXJv$)WeHsSP)3fh9B{yzfjClc(>r2VQxQCX7@*~khu|hRk<!G}brM?uqLQEAF
z^^$gL@^(}1<0Ri85@3z3M!pfhYwwABu(x=-<_gEz(v+Di%9;XPmScpDk-wH><Pn{(
zV+KjQ>Z~|&qiEHNf;4mvc>>^!B$nx&HJN$*sNI7$l&@Ln#6rSs!E^zQCF?8<lTD89
z?l@>^^)cK>*6je0qU-$<NO^idN;}mh(%v?Z(%u=6k|l(dfs~BGw*{mq?z&mAC6FRY
zqXbe)AZ71?6jd9wejr8FQ}na|lni-3={TlKw`*_Xn09giluikttQSBbmv2932qms@
zETgDsY;t+-5K8AMLntKP_tY@K;e;BG4u?(SC;$WuTr#}qo%1JJ6HpK0Y7+4jvh^44
z55w!iU`#yFYJs1Ga7`g0slCf<KeT}0iiin#7qDKbSjl%9W70mbm`C?_u673+1VsR?
zHZ0X6Lcv1G^=F5%`XAB?QNP?BD5ChXP#DuS1*3fLPOMi%W@$m$6r)mVvCO|(_gFT`
zZ99HiR!kE+WftTF<ct7Z<gW%WiRWMjX0BtBJ7RARh!V<BBy2wMB*NECBH92EA`VMh
zffyPS<array13txXU{m8^quy`@<(^5SxB5FLHwBF;6#8u&-CTao*|!_<9*wN<JPPJ
zJ68ajo7EZ5Y^4maLeceTaYb>mSgzm@n*yk{9aFPXSkl$+zbmA3@<^T;`jrQ+ZOiEJ
z({CFvI!cPPqz&2;pt^6Wk#CNc3ir8QgS2%7F&GIsu$~H>D1d%U%p{^_e9+_qh))eA
z6hd*PP7%o!IvInz0SD)>e3@9c)@yHMz@~GT$Y8zOD>1>RhY5C4y?mW*V}hNXVS-sg
zSQ!({D12L(prRXz6<cD0qBKfOu*3xS9urixQR~M93%Nd@7BHA0)F*wiYUy_E?a8Wc
z4lvj)fx-0wgJ2oRjtl6^u+V<iR~p9kj%5_pjm<O99UkmHWq6RQJ-^F?D87l_8Q>{H
z8(GMg&47gTYYZP$MF(j`fkVyW*#uRlxZu#jYS_+bvcOA=^8K!Kok0CDysVgqo<2UL
zpQhe5@(6W+ICFO9n#VNMSP7oj&~ZmymKY3<__ifys%WV!9d&5a*2aC=Je#^Nd#8?R
zsbFYI+7ja3P3gs>Jvo$>6Lu?hRD*p=TDTN7UCYSXDt^AR;qo}naxOI}mbo1A`3#B2
z6`4={RM$Er5CL<ZT$sIVjE0Vi*y*hhu1Q-bi3hy!T-O*^emlW$&Zn@-^mhi?w0i9-
z{<l2L^#p;NZmJiiyKUg6yEEV>O9(3iHyMR*3%F6-;Im>&;6{{23EY&x&E5kysy1o^
zQSpj9rJfdilOftC4c{!?uDykCdO7e-uY_;b0^b1PGaB6IS%Wumtz#KQWn**Aa|dsF
zPZ_+q46kJW;E+q%VGMvvMmwFs_K?;PZv;xYM07nsj)$RpNDw=6RSOh_e^d^C|D6Q&
zLBG)X)x{rw9HJ{!(=ZD-^Q0MGJEko8#C1OpVO0d_!;jT8y@j4G0v!Efd%g=2g3Tle
zzeDaU$ORhcAq$>!fH_4VM**ma28IjWUqj2k$L^>ERX;us>(2a|#c&SM4{Dlp>9}N^
zvLJt=BEltKvP7Vmpc~*b3|?k-K+=~jlXw6C$XwrR60qzFsdO=~C<}1Bn&d8DA_;H^
z#vH;_43J<W8W)ZbkO&)Sk5}QslK(_cTgXSFkZ;SEn8|xouGvACuBOsTJ-7jlR_c)m
z8nmna;GhfC=q~J+h|wowjlePTzT$WYT{j{mlNgX;8!0jq>)!CSA~+LBR=78bs~6Z!
zmmxJ;yl&x#QXrc|!AjBhp7te4`EmH5yQ)M1W}x)&$e6$~Y2g?%+z3J=jc|?R;hKr)
z5M_@<?_Dor^Odpro-~}(OZCe1whia>b_VBU31MY8C!_Ff!8wXsepYM==ZMlM;hYlA
z*?Txg)kdu!&RNk-^|YX!3^6}xXlLnm?Jcy^&w+OOCA70HXlL*bFh=gZ_uhj2EiC%p
z*!03+@4}&$1|M9(EBN(U13z({WEn+OWV6z92Y&ib8Tf%Ap|K&M@i75zq=|(B@X!%{
zOD`y5xyJBH^Vs-!;t-JU2G=Q7cqui(_pg1Ub!kTCUJC?7q(CKvej(zyM75$}mY6*G
z7lT|Un)v{k>`~?8;j4>Zai+U`Pkx+!_;392>xZ}a<JHAGo&9XEpH23&#eTNg&kp<9
zWj}lDXCHsQy}Tynz)w;R{3PYTPf`y2B;~+QQV#qi<-ku;4*cvNeu_vy>97uM_A<wH
zR`qBz7cw{MOM(nn#4hndlEuH8*w7?&ke=ScFH3$UR!Z_SSGI3`m`|2%1kIfV%mo3;
z5|99Uq5bJUfh<$gpl_e6_z|wf1L;TJ#Pi36_@_I=L*&62X%|-_;_y!w%0Vy3$;2A_
z1{f56z=!@*QY!`3GH%@f13Z$0fLl<qEh^dul}%OQRF!TWinoOF#X%X|eqMpH@IZgU
z;VxdQ5IBjq;fTzlELqxM$INfs31TVO6BGB|nlqO!O96Hn{Hz~q4SuLeD1?4GEaQzk
zpBlbU(j3-`u=W_tty}AB0E->|`0pF|cZ@cF0Bh`&a?kAX`1;OpB6Wmkyk;5-@$dy`
z1*nWMd2vYQ#$?0(bdplhs^-rZfHIAZi6@#}A<AN8=&~#SCIBqPaWZo8A8c*ubx`;+
z<?=wbN=UhMFj!=Ik&gwBg%1VF6iph_G$F&e8BK{j!C#6BNDak%3nQm}K~cu)5-46!
za<Hd~B;-$ngs8S0_N~GyWds=BHLSB~Tf*P|W<7*jP1|!m1IcoI3~P|+>uPFGr>WF#
z;NZkp&o2k{0T?^jq@WaetJ7+?(m_HH#{0LJhL~R_LyqXmk9*P;mcoJ0^-u%^6CO@m
zulb@kkvuxJp*@%6O3xG|Nm}?=$(aj`H7qUU5?$w7qL6%-mhnd9Tu9ahX3~sykSR1%
zmkQ0MgU36a5@S%#r^)$LHj~m}8lO-3)1_wB#OvJYH9BM>lWde>RdlMor1L6OR*CZO
z|FnC#rD+#`jT6JtPvb|~Um54|vrpt_+^~w1OY}T`s1#Ag*F}Qy75_x!)>T?CTl$Kt
zTyYs&jr4}nF@8a$5@uMq6n`qLFyR!xlkF!B9i-ehs!i<AFx%b%A>|UokW&VsW1Y>x
zpx}&(H@44!v7>c0(|GWXwR1=_@mzKv2?-p4Apl4)fCc#Y4U9Anj&16MB~ix>SU11~
zOwt@e4(?p8LT1o3Fi#KgDHD-V3;qCz6wy=7U@MxP@X<g+0opKaon=(yz_zv<cXxMp
zcXxMpcXxMpm%-iL-QAtRVSs_bVSs@FzMgZwKliTNS>0Kkx1Y-Dq$*WA*|oP4!6Sw+
zs+(6!ubt_yYgX*1RkGsWYWF9f9WvG*`6){+;Z3YC48Utg$`bmKl%~CmC>rpo;F2ur
z_x-dbb>Ns)#@a4yt`L)eLF`Z|H?hOL_c=4MV$<!_+P9y)tUe-Hl3|Q*v>-U_3^=WN
ziq<qWXyHd|IAlv6%DCC%vRh^0#qY{FA+w-E<fRc708>|wTZ{lpjZQq11X9XMaU6QH
z%huW-&`c=D!_c_Z%53F*F<K`ts9vL>^5NDrsSq*dyox?xJecRRr4L^>;XFe*WZ6Uj
zva3I{fiN|6`?2liVm9AH@&UKpSBQ9oFR{J{bZy)BZm@RY=_C3?3^*eElp2i<wNASi
z<k}`vlUs(>g0TCr74jk!8Z;iH%Lu9&?1NJ5Mf!LyVR4Qof+;9PMB#!f7fUTovw60p
zasn{vp(zewEh$Y3iqUqsnB&`#i7;i>yYn?l>bA@yy9?E#t#YXP;b&GRO<PxS)&VnV
z$Yf1)TFLLU)mS-mgCK`@$veWcPkU@wR89;9`Quuc4~J;E+$3O5Eau~R))*Va$ox9d
zRLeNI=o2$6VdB$`qE_V;5HL$^Qs4-&FGejYL9lCrRVF1jO`W>({u?%_q|^z~THq{J
zB{geBiD#HBzK7&i9hgB9OZJJuFz@6~5Az^&xo2W0{x?nPlyVu8AOeH%%{3`UI`P+T
zf@Zny_&A*E-XtNBHb^3irZ_^9tRq2{V5V(!LWF^TUoV(jmz3(1uTVbuw}a*4>GD*5
zwSB+rZqHbw&SBFjHX{B?y&8?{4v>pP)h69dSUfGCZI<^}E3Z$yV4U?m^BzWqeN1Ix
zX9mVlDi;0Zy8{?BlSUkS1Bkn7*4+hpQ-k$om+V#A!$?SlJpf{pQsU5vkl6$Tq8ckZ
zq$+eKp*11lH6~$1T-5mNsCI}n;f#noBl|G{*nbTT;NtNqY;9C3GLLnW^7&&Mo;vXE
zB^*Lth%P{HS+|Vpy6oSR9(ovlrP*^(DyaG=0H-(D3uweJRH2s0)rAQEN%~6sY3}Ot
z)I4mI5m!pp$GtMu_jgxID(g>esocfoPuKSKWs8~1pQ<(<=+z#&4!?K5%i5;T<qYzc
zjFV#uY7;7Jt7)>Hl0svOobp<=dmvIxkObH$+9SthNs3lMd^Ru}>UNRmN_)G}+%Vj`
z<Vj@dGgz=(usU|8G!%!?yt^>1M?g5aX7qx4+`bQ4<Y0;^GTy~^IUNYO#vWA1aDX_7
zeC}h@ms!GxNLQk~i8FNAQn~k5!_D$#gMv&)L~v9tiv<4kJ^-!WUdTpvkl{K)?i%mL
z-U`|<HwCLjl?0<^MkLS#_eHp+_d^`q{r7--+83AyiX=_~YHK9?5YC+U_yq<<lUNfy
z&y0Qpzm}zjvcC<PNVI<W4G!(uv1F;=l?rXi8h!3pV{r7lyZu$-du3<Mrf<Ir6Hc&F
z5{UGn2#;msX6HOe`jL|!DTw8)i3P5)<^2vRD6QCV-C-&$wQOk_Xr}s5e<f(mPWA6J
zkgOvneujOc3im?xN2iF)Yo-^a#goqqiWet_T_MzbRGZO#DA%r8)<TXGB_*A+n9GTZ
ze5=LR)k4;jq$+;CC211q!rl3(8`LnzrYfvklm0v*XNP<pvzwl>1&lE^S8R{;7pXL4
z)Iw0GBr?7u5huwiSjDgsWKkuuVSNg&dNV@#X#{a#kJSUX=nnBQelCqFUu=5P4&gUO
zg_|F;o4*nF_po|xQ}gB|6eqz2H+3*+ICkM0T8AE}BfgU)i8LdDiNh(i7oj}^y89l5
zQZ8Zfm+A%jlOiyuQhZIF$Nml>*AGV|Kt>uVofKUq7nO&wDC)hVI>B5)O4tEu*e#x~
zGq$IH$Iv4{Ph1QW(q4@C^kB>`B=p7xr|upZ0Mo|w`Jt0{RNNX3J@$e4`9plDf)7&+
zW`{}~J+?}zOa|y~AZ8cHG9gdch_DvX;zF6}_Uk~SslBissu5K)3$&?Nt8gs%Dd7VC
zp~Cz1{@p3(UffbrS-`}3>_jM>sBWef*Jf@bn?sfaT^03gNX!P3Q_)-`PL^rF<e7ci
z-A5mi9R*%|JJk}m$3ApXt=WDSHtIVqDX2yqhBhi<0Y;nbF1Q6=B|08*eNCtZX;=W?
zGqq;BMjh%8l$yaL&Py<m6d2w4yI*)x`iFbm_|}LC=z?&`3r%4Kpffbx`?An>tcvs#
z5z!Pz_F`;XcMzV$Fea`i;9&?4C>WCwd`$-Mv7BV8u{O7WDdS&0^xW}!BTEWqtixb!
z+#<W&eUkF!dn}TiIk;%>nxaXIqV-K6Y@<@lZd}-BJQOd>#ShZPbAd$0@<S{rb63x@
z%#SdkIletust3H;)whUqbLpd(#+I7*dSGlC{rYu>z>w<YDxo<P+1+2p6)pL?LfPGU
zcF!@xIXVvk-<{7M7<P=fTT`H{IAyur7@R3#@NIK98Mm1VcqxB(ql7=|fPG6yrzouQ
zwukk79<n^40sF=cYKj$@ma|%*$gm0-FrqiAgRkXoTZgqT-q;fa<<|<Fc4WvOFr#G8
zT=|y|ZqN6Jt2}0%HpoX=6bGsfR0w!FY3h_&EI3YdRhJddcpQ^DiTre5P<9YRbgGq=
z<K5FEp}PUQkPuoCcL5LO6|y@u?Jw^I3JC*bL2cYhbx4B_0DWA5l+Z$hr^>~YdOXt`
z$^K&227Z#Sa=28tn-8h)7SwXcQ}MVSx~X&rn8FfmHLfUeMw81jA}aU;tEV<pLi*iX
zWAo-gq$kBj3XU?wWB;J8_W)l2g6Eu+IAvX4s*5bCxvSmST+`n<|BdPwg=}K}Bs)KL
zT?J#^nz{`_VzNnqba<rMiKZ0eSU4)pw6jcY3%#WFQeU0JRqe4&^@K2^+Z(&x)hhZW
zSz*P&ewP($1J27t*qubcho?y7O2jTPrC2OTY^5j}(=%#wY4*-XKHN|X1|wI3GjvFU
z{GG80^zI(_)_T_>XvE4rA-gdt@r)!A;)>|c6?9nAU_8?x>64)=_~viN1%xfeHh(oi
zUg6PC82Yx&x^#&_m#*Q{?7Vm>5MRJux+Htv>zY0A8=Cp>8PyPLPn>neoe-kbJZ73g
z<?w-1<6}lMxOYEKoM$|3Ke%^k3&yA-CoE+C*p#}=cG?FmcUcnRZqhGzwHLWu1)>HD
z$T(Y^MvRtF4TsTrQcSl>p6AlQiKw7#k3C&2cb}<Ap0he$b;llTg*6)cW%e~&2{0Qd
zN1)C72h(nq&P<MKVGSOqJO3&8%l&b8@OrX|<a9q-8|TIQzHKb@?aC_d!@jkU;JI}+
z@Of)d@YCPVM`0$UunhlI=Kor43;lH;3vf4y-k}eo3c`I8Xyu=i)iP=P!)Q0ISGVcX
z`($~O8Hmm$_ci$3;L+{yL;Fie<D3BbG!M1Cm|E3~r=u^nJY7R)hhA>slbHZhJQQ7)
zc!*SZR+h8!f!?Q$fBK>T&Jr*e3=l~nj;J@+0*4e>73eJZtmq9&+jTC9H0M!p-Mvnt
z(!iWHDR$o#K;Caf#|z&`8q-S|=FA1v1$IDmzL9+^a&nXk5dDfc<yt7b{Cb=hbBdDP
zd-2C^tQ50t+9GbllddGqb(TE@P2kXmx^X{kd5M1Cy>lNqV|;5}celT_ejz~odu`ny
zsm>?gK1y#JWnxCF%euHvs(cx$2lOhO*4~#d(__Qy3yYU)3%hfk1E-l(gQRzTm96%h
z_4b)DL={_%u<hXd*&Uu$nfE>xl4NDYf&V_7YG5pbZMWHzH?(Vqy?HluFOUpIJi^>>
zV&)9OOx5h&Eui_}PSM40PuCQX%(`<2A%wAcWR@%>zeJT-u6H*|0~U{H20O<Z&^7vj
zI7frFsFUw!_gEFWvWYA!w6rsTl!;hQREH?5lp*FqEs*ecrRb>+Q(dwvbj89(UD+3+
z+(|IKz$agqKYakX^()up(&pIENj@NOffGwjC@-R#NHhCQl==4nSA^ov<K+f8D!11!
zxXA@1j@&~2!!5<9<L1ZF2eWf6=7Njla<Y70P-HxGoX$mpA}o|ds7*h27tiS}Z>w1s
zBI`rZNxT&yepZHy17>F^PCrDq5kl=i;h+%ZWs;&+31K_bnHMNa$(A>RODU9U3c|}|
ze|9j9>1!MbrU#m3$OJS?Fw9&?f9d+rR~~=-z$hKVfE7FC)F~S(H5qjCid6lT9N5Q(
zDRu29jf!IvD^wMhohrcR!C@)PR+nvlePfWF|9cGJ^he{@@bVJ+nN7~nBe6+!u~6Y?
zLRQ7NM%VOovCutlc!@MADs`j44)-kAhHFyiu9;(^OP1Z$cnQ5!SVc$t0f`{Cf#r|;
zOw<@1v}hi}D4hZ8VmNc%tV<Pet3+>UN+$Iw8dQ(OB@dS0<Ts=&679oEK4Q>pGK~sH
z<vHU*d}_c>9|tld<Az5(m#%sE*JiN7l>@rtvC`^Y#cLF}3oS?9N<|c|F!^gm5@Jvj
z+3yMv+er9}rCJ2QL>FrbC>o*_?i=PAED^6R47#fgLNLOw%U&5@GYxL($0Ao6eJT7O
z%1({k`n-s)UA*|@8i?aA$?OkuqarN@kvK=NP$}gqN5mM2Eq}PB&pd1m@yoJdtmcgq
z*==Nvh3!6!6aVnU4dd6(hwvm?4&zH<%rzrtkG2!`S_YZ-Qub#|HJ0>SSDi?g?oNj#
zI&d-(UUJh4t=%vCvNJlzKh}2M8S%~>K|^@)22psi1wlN%OEDEC?T=E}B3*S<obZF)
z9Gwv8!K+EcO9l`}2-)s@y-In%Kfj%=3Vn4G9Ai5g>E!*9k$~eXcyWf(MNY@WxE_gV
zT7=z=nu~Dt4$EAg%RwwfH1g8Ci)O8jz~I6yvCKS?ayT4#TMm;u6pMR8WV3se`$=Dn
z;TIv<HcR-PA`MQ#?JM>6k|6TdO}Wj9bBk6BB^Pqo%e*Q&HpKC(5_<9RPE0RnLM}at
z9Nc6inca4}pkn!?3PhK4lC`&1-6j1j+!}IYssL<bimv<WgyLd3M`DEq2f7){O)kAh
z#<M0lPqO3_gWAa#is%xdqD6xD@*{X5k6s4P(W0sHZQ^;c2+I~9|B#?lHI0guxY#)@
zJC1*=<*4yG-#<YznK6RdXWm+FO+91R(6>q-y|xO6RV9!rN@~X?-ftEMPicQGn4sZY
z<lT7OpH(;tER6TYNj?US05*GPn9SZmaDfLEc&{(uDMp(luTpZd|L_Mj$uo|!B%C1J
zy!DejmL&@|2thAVWM<pmEudvv>;Vvf-)u3h9MUAzFxGZZAbg$3(bnL9n6WVFRd6zN
z+^MSeHBDpr1Zr2`0x=zRaGYdnah#yY-Z_PWyvB{@yQ^+(A47I1Sn#DTH55L!v3VF&
zCe%&Duy+{L#v2w?gCC3ccXf(s{;=@3{1mhnWRMPS#_%BPtJA=+&?7HL<8V+&WIRXf
zXJw3MfBn~^TSxcC*NG1BJ@Yom{A;iaZ11{tr!?^8rrK{Wa2b2385ndwif|{$kRQ@n
zKM-E{maVGWT)~wz83Vo!3p)gh5ppEZckdY(^z?O=sc`?J-0%JKaee+>Y0$VPU9%MC
z_W3#94p;YNx+@#9;8(&@s@vm_(Kf42n}AYJm&fIU;@J?G=dz=I7bt;u<06A}eW>=R
z8^*s`xRK2xFUmiaw9nYkhZkk4(u(bRTjM9sNw}6(Q{y76X&k5>DoO1PyuZEm%!dvH
zbKGsf8PnmT8KKxNWgMhRjt*zHVaz6zJ_F3)Lv7@-Ym##3OTn1A*g~6;s#3J~mbBTi
z87X&4_g2^gV>?ZmRHf7zSI*C!jtS=DM$|*@VX1?AB;3jUJA`3c4s#uUJl_}}Cuk$5
zdoP*|uG~Zp8h=N>G4uEp-7LgX<cZoBv8SzM!G<dn<>=8^)z}1#@6a*Y#Aci^@F$uM
z%pxn*m?vlD#E3Q}#V0tW4(4EFJwcS*B`d|3bVs$$kWeGZU+G<gr8V}5dI)b##6Uwd
zM#?ggvZIg^l=yl}z0bBG@C<#lzz~MK<3|BeR>}F~HmTQg!MRB5Rzs4pL={Z5KuiW|
zKaG-^p#gig=2Jd$C=ZTj${%HHkCV!&uJY?QHvJx#c%@ZieuyRxT_LKOdz~0`v|?S|
z-_g|E7z)mfsiTHmFW568u9U?hozJf{<FANOPR0<gBi9ks#9c7giuPY2_Cg3?43tN5
znuNsFP}o}7ad66Y)pm+ue#|L<^Feerkh&ys4$VO@8g73dqWw(H2-egxQPaFkSg9MT
z<^Zou{2f_-QXZx@SqoOFda8_{CrdWS?o3<T9E#E~M5BX?!L1RZ_6<qV!mtvPD5Ewx
z!eKtRhMlF+i@o6w&(5y3K2>XQO&V;KuV)c0eEVm~eGOUyEOnA_2SvYk-=%rNeNEeZ
zo6~aFnRykJmnLdAJ|s;x8z<uEoAby0+h`V&0jSF^vF3`oljA_2pO=Rl+Hj{aTI`Wt
zsy(x#YLfOPyc@hUvRDT`Fej}45BFX??_QD>kfm72AF{sN^oXajXL2d=O>G%r)ogfG
zwy4RpTn*y^D$;1C6WW^nu-&p9_Dq^y=||+%o711_#D<|6k6TmOF%RCP-RO7RtYP~C
z3t%?>^pK}C)y+XZ75+40v4Un8PMOZ)Ee2KLw!P8sHXq;A$y)hkB!b7=_(^}qSBqWt
z*pqYvnC6qSHixEsA5(`KBPu&dee@gji5$v{tEMr@E`O3JA5COw<eFKD_%zKhFY2%s
zBNUvSoade$(K8`+;TVl&LAXvx)S=gq591VBU$7A>2s4avfMEm{X9PP!tBtS{f~>>y
zcRjOW56wXF;uCuQL5;J-pym{olED%<Kt3Y3iUeNOJQMu7(80#&`%WPabkkUbt1<un
z*(>m792OZ>4y@B%ed#CET(R<PvC9Sl<RK}Crcw&i)m<~Q_R|Ccz#J}>6e>g2PrlSY
z15YE>m7XY<(#pkZsA|L1)qwRtRRLHJq&aE@5>Oh5HGuV?Ojo4l8&b6;upS^*Gwwt8
zSu)$@{@lc~%r9)6kI+%F8m_CvnCrpLULTF8-za+@Zp-Jph0;d0e~}oisl??_CUmja
z^Sy7nyucl;nUGrCqc9`7!Z5!AgM<nbf-i3~9b02|HK~}Jp~nH;b|0UTw|6};3!k!O
zw93cku=q952XD^)fW`6{=j0RkX1&GbxT&S{EF;q0?`mRM7I9v%Q+_wBujwud7(9?!
zveXC?<q6$(S%5WFM|Dl%ekEX)hn>k26l3mP19&z=ZkA)h@&$=%%e5^nb}awW)tWM2
zJSWyOD^Yfv(2*WYSQNon>C2XpqG2+>L?JdE5Bt4pZr$^IFwOMc;}PM&vpUM@T_=hu
zD(i-S=|TIikRU%#cIh7ZkMoiYbW7EEhxM-P7|wEc;`0zuWx}u`c#mF*QyXh_dzw6+
zP*xH(nWX;Tzqi43UIIoHeyY+VfHaALYJ~ROXk*i^074S&3(FF1jsKPmxdN`rn<>iE
zRhSD7J22oy{ex?*)*O<QjbIAMO{F*Fj_NmU2{xSc=09evoCpG*6@O0@u9kzzSJr}M
z|7*;~{~B{JO|3-;N&|orcoK)yLFB(7G5>4Kx2;)|_#Kv8D!J;Le3?J~<~cahPq*r9
zE$c)OFo5&n`Xw#7y=0!a_sd`<27961q98hBWR~H@>Yt=Z5$}W;@@KktENH9ZRgNGi
zLOfB3*+GAUvl!2GEtNy@m$^0({Z1BLTNkQ>Qf_*7y<LUM!eSAcO3p^tK4=&}OpJV1
zttBETTUI$-*LgEk3L8?=9t+!K@^p{aeCsNRd+iMIS&A~i8Q8wJNQBKoLDrdRN13qA
z#)Dia@x38<)HP+D#MlL!31VCgP0`dVE}R&>yNBGYIeDEPIdnV80w9VD0&7CguaVvm
z2~iQB8x_;7CS^mXXAMi!OgrH(XEtk$`m!YI8>jnw#iZZg&WIe-yvti)b%cEJabW}N
z1%!!8Bu-^!6YRp{Ak0oCdu8Sg<PhXA1P!hkVm0`>$7;_H5uYzp=;C~mi0sac`qcIz
zE9k+kk9`ep`l_UdqyfAMEv8)<LfrOFEeDMtxQ6hE4MqKkgD#*D1w7-Wy>C<?pi&Mo
zh;xrrAWwYb*F7O-0NP~8x^xqL1cwJoU$~hH)16rq0_tow)AR~TxrzP|4~6_|)bt0y
zi{lD_bE^l2#{AXe64l@by|;oIA4@P*be(_tUCe7e=d&RYP$dzmjQ2hoWpmIfoAT@S
zCw%dCEA7d_o8@1=RXy#+OvI&vdc-0Hpz#yT2{e8H-|NnJCA&bafyNKO0b<EfQ25(F
z<40I;Y@*LH*daH4b7$KLX#8w!I}P%HHSIZR249N;^ep(-v95k)Vf$RoP6eCcEy+z<
z9R=Rwp0uhe;-CVUE`^m4l(Ns`<6k<Qi@!t-elF))=%<q;+B)ufTGDHn(xBaMkh-Xd
ze9MN}G=+FMIyYkMF+utPi_%p?uZ3GifsO-UD4sheIgAAvu>mnCAJc+Wqq*h4rFCc^
z{Fbc5Ro<xzCL`!)g%Og@`phncGbT>PJxb04s9NTlMLvw^F=8yTi2+H8U;3#X28jRa
zP*Gd(LM>*A$g)-f_10<)!2O;b)Rx9FaeSpg7t=_YNz)-z2K8W2t0B|w-$sKj7U}rb
zQjDp?O~0X{Up+fAa^5Jr#&cfZgY<KCi@h9)O-WT(zo5j`%}R0JbD}ziMVR7e{p2C%
znRM)JnFdsl<na8R2`+9<%b2(U-E87_lNwPUXmV1!hv2!Q>=LN5vN1&EnDT9u4`u<=
zj27m5B@Cn1wV${=!L{=y@ADR=b~R`>sY~tdJm`{}s?$tx2DA3|CgF7M3Yn4-4H`ec
zPn6niZ&shn>vT!O9r+$PRzDco?bZXVzQy&nTOK*q!+PmK-#mjX3_N3BVPWr`!7jfE
z`K3vr-Q+$y_2VT!m7j_+C8Io)+;?S4N~A-P?z9;46K?8S@h2`qw>Z5)=AcP((=Zpp
zD8h;5V#Q7FO(hMFg?{x2$ggi6S3^wWC5K&;(7UcI<{8>8=d>&gv;SBxI~%(yxJY^T
zrokvN+5Hx{>0TJ!oiX#VQJT52sCfX%W;PVmx=FnAO@;Z)WHube^C@5x9Bntv<qtSs
z(w<$^N#b$ZQ#G!Zh@ZKF{ty<Y4)L+x2Xr+GHO3yFn|9cjmx>ieGY1+6S2UNjz;@Y$
z(em3wea=W#j3iGgH<Y!KfvCWKIPdJr>EPooh&Fy0*N*cy(2s<kHR>jU&J@{EECR&v
zcJ@2`zB!FwIRg~UOcs7+8XngmF3t~W{on+`$HWVanv2>ZeFq*K)H4?KqClrVho$^d
zMwXq;z#IEN%0Dp%7L;Vzp^2LI6Xyx5t1k;uqq=^Z#b^52BC26c&U|Ihkxwd|nEx=j
z9esq+U-^}rsP^vDyZYy?<N0zO@afb3*zw%)0UR7d7i{w8e-iQLOFjtk4F-JZRX$$t
z5P2RRIN2F_83l|g?d+3tQ{8&)hbqpV?{6+>N~goZz<G8oeWL+C7~mYN))UN3S)t}y
zBY}-6Pfu~JWS9YFjEoGqeg@qY>{2o;<UM8S)Vv8D!$Lej-PeEj1|_L~KHYo`9wfKx
z9NAH#=ea~dLkgLl)NL6)myDxuDvg)53+SSufh0bG^_1qf^acZTlRG_}Lej5SYBFTA
zcx(({c{zU!rtc|z7t0(tkC|Lo)Vg*De#GWC)E``YUsucus<ayn&Q~<B8b)t?qeCy3
zeXLRQEZ@<FlYZx|#jI$AS$t5hbT&Nkomd;V0h@gWBwa99>YI(#Q?#c*vC#trpwtF$
zmYlbDcE6xv!6HLg5FnqC>%7cw;HxObDwg{#Ubzk5MK=&iPxeO?NY-2k`gkeM-S#BF
z_Q5}@-XFM%2UXfC2tB$eoi02on)Zw(!v~0l%SmyM`P>B?NxijD`Zjk&^0w+Yrc~`N
zw6t|=dq+}fqmH$-SEiV*VdXUafrH+Lrm2;xh9-3_ZO$)PIpEEJdoAtQ5L-J>4GM*Y
zUjZ5xfeV^08s!RB`*~a%XApJ2wU`Df70eq@cbgP*-2|c+r6Wu+4e~3z60gHNez3k3
zN5{V|e2W*zl%`fqQwBMJB7+k06%Y(U*nnLmC<p?7y<Gn#@H}hHhpDZT5W^9ShRJt}
zaHxDHP!j2FHLQXx%!GBwF*!{2gMW$~#C+nM04w_I+~|u_FfA|^o!Ri)gg|oODhyKs
z{1NNSQ{pa4_s|aM(?Ktnx3>p_6;rnM2H`G#2;trd>dQ-2+o#u{%qc{Wa?Eu=hxB_2
z%^=IASI5FOS{T1?zg2-0u8-WD0@)*sQvLKs4w7>rM7s6{?n0E3sqFUwq$zZDkwBa$
zs*T`_YGzX66r@<>#EHIZ53{`VJ8GIO$t`(@+A8EKaO(FZ%yn*3hfvOJSj1u$v`!Y-
zN=DD{(;LMP0aqU?bAi8RT<9Z=b2O{>k%PBs$v(#r>|uhid<AWQc_ouMg{B*xRY6_Y
zf_T9t5x!tJx-6(W-e=gDn&?f65Lgsr?#QL@P~34z8*rm|$sn8+@4$4{P$4798R1hC
zT>3ra2k#yHm!qbe>YwRPW5k)Lnh+B;VF=1=00S-$6B8fe#+bcvV>-RUEx}XG$4qa;
z&z<JQ@wR@@$7maUqk;Xf$vfAiOcaOD;}P8p{v&Htqdik(o-Pn(aWJH8u{T&pM>5y2
zcTHnY@#b+#58{-XG{c8}lyf{u+7D#-I&BO^47f9T-7)9B6}vj-MG<EZ4BUp7IUP8-
z?4x{ySBN-%8~F6cF-nkpgy_GuUGdqNB-6W3F&7S|2PVmLe7C*j8MvT+UIj0Qa&bF>
zdxwooMc*rjZg2`Ko1$bbbgfF1uXvN?t2z7vQ(?v`5$0lyoNJa@AQTEARe^0aaW3s3
z-kw~n`KiAk*1t<XR)a~wOMYju<SkEDBL-_%lTO|(02X4Z!Xha$Qs_d)G$%U=p(m_J
zA{k}HiPD~E7`o(he~An4^Tospj#2zM%&*ATmHiV$=#~M0_~`c0-qwGHgv6A0`Z?xp
zt+2+AT-4=fMod#^jsxn!6pKuUHRibZqxZ+rP@+cepC`iVxxz$|Mi|S@iq+sBxko=n
zqec<R-`&g~;{u>&NLsofi2VUraHdWsrGd##Lzi4?Rj#Ht2r`3LZ)HZFHlNc1+GCVm
zp*Mp2--a8mZ);>P%*h((VL+BKGM`pA#wTZA$90*5Mp`T_VQ5Du35?V+GNnJpyv>RF
z;Y!u3Zxd|gt^c|aO0)2)9;50=zQ4q^1r18S|7kcqX~>9zNehTRXr?yx7ELFLBR1v9
zR$I*|d~l?LSbf*6c!6W-Z?yCsM3*PB&Jm;@dkV?D2vcPasIqu#LSBustw53+eoD!_
zC>50_s?HGvCK8;~tw@4n38=Gt>q3_=1VS`pPcgX{X+WsP;;jvNwbHgi2?*t6UbKqJ
z7Xl&Rp6V+M`D`%NlyY%D%5)GX)Ye);eRC99=%Oq)R%$KlO?z;P>rDIbzw5{~7PQA+
zScSL5-n&{`GxW!9&{mY9%+OBE7MHg_+3MD27f4dqVlzcm06|+Ii2GkqSFW)E2-^J@
zv}f;Z%e^<{#ruz_i<hw6VA+?w{~xlbyZpd$He*MaC|3|_)3&Fkj@IJP$0%sC1bOj2
zH!jrT@Q?7U8)3eLg4Xb(2#&Yl+C!d{fy%1Joxe6DFcCff`Lg<&I|e^dM##At!=g_*
z(1Q|UaT17$1F;YBf0zsqTL)qs|G{)23w~FdJy=uN_P`d*7N`9@@jPXvw4ttDOSPnV
zRaBXPwKe1Qs6&6l=Afwl!&s35{J#To#c3*XskyhNy1+wo+>7pu!$JN}%=xeQO@;5D
z`2D})8x9BAKe70~VyOz<e@Ni5`A6b%kp2^^|0~v>&Rg|nlegEN^Es8>kB1{MfgJGc
zsbQVC;hyMy{!wtda5h%@Tcq%z!f4~H{ItYFPRLuiT-&(2P8B$-+(Sl77}r!q&4Zhz
z;?bPqi$#4*-BbmY+^IeZ^`*v4PP&KbMwDgnjjYpp^gXc5b>;+9e<_j}i+$%H=nL!b
z?H7o$90({n0384TKm)+sM0GgJ%-prH0RaAF000ZP^?$z1TrEu8Ei`PzEi7#uZQN~~
z92srhoE-mmA*sJHafK2903I+%0LuR;ApuylgNco!x`l(YJ+P?%k3&HI`xPi~2?ws<
I%m01*f3g#iKL7v#

literal 37346
zcmZ6x1CS`O7A-oqZQHhO+qP}nwr$%wW7}tN#<pkP-23jYdiA?2Nq0I~$=W-$dj|^A
zz#u395WhE?7PltA|E@V&Pyj>#0svb>OFI=)TL&9M7gIVbXL~zU6<7f95wT~pvEShN
z{b=Uu0Sy2M@}Fw|jV^nw-M7S=*xtWtT)&0Inav|*BqH~6C&nX<CL(tmX>Fx<H*T7G
zIt2?Tjbwmu08(luJbs>)SI`R_i3g)a6obr+k_6mc-Cdt*^QzAIfByc2C-nAvjYh~l
z_To?Mj=z-e#)pT0P7I2)KVfqfw)q$QSRXF}4`)WW?;7@&Jyo@uwU*&#xp28%Gwz_~
z%8Yf%!+-B{KI=bI)c_1P`g*+NFF(<YjXJdiV|~l_<SXd2yW(39Sb@YpX7W4f$h^-o
z>5Mst@l_((v*mKt{Y;7Q4MRB+)nq`b4G!z1&w3mS8;+o(5($ry_Q&Q1@{y%42aF~d
z4;SRMhj;ehMaj6ThffOdrdGw^3cq;v{vq}_{VPwIcKB9j`gfelK%3@+w$=U<v1esy
zj12d@x$!6e-DC9L*QxSkS||AXn5)^c(uY9$t!7c`R&@RzW-Tj<>#En?hv}h0lQ1|_
z-bPB+3h6JQ^3FrVwOm!-59s>d+du!^D50u!VskdO>V(#J>e}zR?y`M>wjWM{fACT?
zTMw0XM5+hz6mR+5V_yfduEA=itUuw~u{6daH1QeBt#*aug%>g!_w8dO;|=5&U$Opg
zWZcw}O!)qXF*;eg`2tvl1B>6_Uc(?GggQQv<fdZJvEo$(&M2iopb%T+)X?!`%LDcw
zsR~w7ANOB=ou8hLTg0+?OHDSGQ!D@YO*}`!qM8zKS33#E+W7ijXorLQN*M5l65Sw&
z$D7VDy4Q-oZMfPgfyds8R1+VqbTQJh+4v?ZuYyVf1A47nv^5;<?;NH$ok-XftW2fR
z*jm3GWP6>S_UD<}<|Ry#dRBC$@nb5vz=uNYV>O{qW(U3qcFF^!Ec1D{>HXo7Cla6Y
zn4Rcd_2f#_R^!Dwyab>!_oheOZA$M$KptGHsr=PU7tdj-7mZ2JF+rWYtdxh?t-MLp
zML}B)LZwSQX4Hq6lS|*O?lDZYpkB{twR;adMGg%9a4<`M1mfW4Y~;Bz-}ee<Zg15i
zl#Wg$Z7ieEi_~qUD_a@VTb!#@$~g>fx9Znj;)gvM_?o}H2>L!#M?0zCfUSH@PPct?
z7W@25Nr`$<wys<4&7WP7ht|Tk<*A+t4`_vy3lH++E2YccdUBi}H!u^eGiPC`9W@en
z+2=Z*hM=OuIKI%g2tlq|R@GuP+3_>|v1^#?Lzo?uo)r`%X6BxH53c|tZ-_YSNkOTT
z@{E6yzI5dsbEt^kzs-Apm75Nx6fW$WC{&nZMLCyupjbwS3w<9dRQNkbocTmfo%!@9
z3DZ28&W#7(%-D<X72Ia8Wt^+7Z!Tv#QQJz0nCXKhcDJGI#iDhCg<JKNwE~W7Sj%;N
zb*sh9Eqtf2PC*HBCjS&!$(5(9F8-}#ps3^Kgi`<PRRguH3Fg#J=h?Zf2**-ftGtGF
z@ceqx2*;+jkuFE7kL?cVC3D~oY}Bn#60wdRY2V8a(M(bs*O%e44O?|)zM##vSof+8
z?8&Nl<#ZVgw-zp*S+t|C58{N9zaL_)on+`ut1;yFfqtlSvn2?E9W9c9Y`q%z&#cfd
zj%@M9B3G?iYc)L9idpSSHC$J#S}L2itcR(US#u`kQ0$W^hy2@{Xh$O{;_O-!sYpko
zFXHS98R3x3o>P>Ab0P$LCxkWlQz+4N659+I4P>ifEAMH>N?9FjHP=eG>gH+Iuv@Y4
zR#zhB&<v~%iBn3xen|G#ro=z1KS)H|K0w%!Jho6G7$9`z5bbD@4$@H$#)S~gC0V<;
zR!@56TK1<iR?Zq1s!v|F3Rf#G>z5d@Zpu@;(Cw?}`#eV{==-Z_A{_eEX$bqP&!Qaa
z*(iv1|4{ayi4g6kVnwX~gS5;NCYHNe1zQV<YReL9)xK(}=B*{mtQDKJvFw#ew5_Kf
z^6;NdZD}Lz`_yU(g=}r1@9Wqqu_4vw5N&Ic4CQ|Qay#cOUSjJa!(p**(0Qy-yn;2D
z!N?Gn+Bz-(T$x4LpM59FDgXQ=+TKWlII;c@vyEQ`SS>*jZR?T@?feHJE7&cT4g9KV
z*S5`|v%<Z)Yc+I}?aZLyf(%Eb`DJJa7U$%@!s*`PnmzijaD0KrI(clh1Vg-|MLNhu
zJ319YG?ki{igvu()md4M1E>bbV3;|4R>Nn?c9*!G%*wMVhk9Wn9OCXDq8;qDiE^q@
zr6U|}AR`>|*eHp%rzwZDYzf;Gr|3s`Y;7xGFMw;6ai6E%S}j+fs`Rkos=UO@wYpb|
zVY$Y|*sU(29rK`Q0PUCCNXFi>8e#erxB3W9td^;QdN4|sN(kD~p_#-Vxpa$l@mZ?P
zqKCQ^vD>P2tKh403k@?`wWN!4IT?1q9J+W=HG~q{L6?uLN11{?K@z%jVwFHTbJY{j
zg<NSw^#si<vtz>)?O6>!_)doyTX-*3ylsf#y<hhWSZywHIhpUl=Knv8wf|w<{$gl}
zCZGekX%YV*#+P5Q7?S_BP!bvSUNJLQsE6YctF>aeXjwRgja6&Ur5(o}xV%>}fE3(C
zvq-PUoPxMV7PxX^wF))PYeQ&T0<lw{BOa%r#m&+hvw*Fpt=$=10gf+eQLlAvwX4^>
zaM3nvo7C6>a7r%+l7_f%E9mx_(GW|>2XITTRtzLqdw{+dx|Oq*WG=u7nqFkHij{+Y
z=3a4IW2l-jtXIW#@#gxhY0WmP-mz<GQbpSYyY2p;NcR3m2chRzBr<_czc>)_rQ_7&
zG_`yTTfK5yHE!X!wVRi1Emrl`17YJeu3Jx8tMgtP=f<|c6nekfAspWdy1QpJ#uW4e
z;?S!Tt0fwT4&+HAs<&m7mc|Zl+by=>-JGwUL9<ow2KLohnI1K$aJQVPnB%;(1(=#r
z4kQKf)HcxTGov9Mmj{@cTB$&dVQvj|z>`i?Pterj@N}DL+pS`=u!s2Y1a1@5ZB|_Y
zdlG~{-wI6M2<ib8p_d0uL-=Pa==D25VhH#FW$4w5)e!%M7W`j;O}ib8^DDvnO)NKx
zDorqk)AQk~T|1bI&4OZg8CvZG_JE6{$^oRH9$Eu>edaX8f8+s|M^?*1f_O9Y?oY@3
zX3M?u&RR-;tL3CCz!gpF>&aM%<fNbC#JYFt)NGftET)z#)Sp%n`c^Kk$gntBSzPOD
zkv5~o=1=n>0VkJ2axQD>jqG{(y*qDWSDC$4n5*6q=A_Je6>*obd#eoLvRarihVqui
zCwAY{*0akYIXAX6Ms~&go|{Up3I(-0mM~#rxi0;*Y%vUj<yy^IxMN4>EzV|o7Pr=s
zydPKy$-T3q*SDtU^wL_^t}L(Yl<TchuBfxGtm-wbRj_Bo>PuN;0v9TeOzfSdFK7PK
zA6r@@duo1f%|$%imh4`yW~l|FddRWaa{=ttYOUHGJImTlhk46m6MJjz%bA7$RQM&p
z{htbI)!fTkWtz4Y9zFOLSTT$hR>I6ywzXwz)-3gpZS5nwJhHz$W{IBN?wiv|L;Y@6
zvb37HDlBWQlCu~>7Yt#=(OkO3wseVawzoD`x3i1?!&Y}>*X}=TgAL1NwOj34)o%{E
z7?uqr8CtBSD%N7cB%ioSe~az>kFEDF+o`!-ymY--EVG@ORc<l(9R;lwIvd>T9j{u|
zi&pT~U51;{ns(MR-R+Q`v8c@<XHnb8U{Gmmw!%-nZq=2u2E|bPE35YM>;@JLvF4qN
zc|q%h7Zb%Tr09nhLi%WQ{GBw;?#7m0ES#-wuX?HQV7Jzd1uxZ|%jYUx+xgO7vF?R=
zZcojg+9mBgwtuE~Lx<UIBX6<gwi&j~X3JTs>oLSu)&rQk1y@v;vkUqiyB4i8Jv6(k
zkaY6c_e~!Ah;rHoFk?$?ti`*m({NqNg`wiY!r9$&t#&YAD)=y24gPae2er8ePXFx<
z-eC*rtRoLCgmbla@I&e9B}=vJtLjR(SMjD5Ygld8#?tv)E6*0!#F3@29vVH*q@{Gu
zk;kT7uVG7=L(lTwGF)||m?7TMR>Q`^yt($$w45E9{RK;UIqWZmTaI#C$Gk&J%i)?~
zy2To}bFREF1D`^6pVn22wXWXx2J<#2diO1^h5vys{(_%*Y#R11T<>WrTMsr?Shf^;
z>2ih8nl&%rw7Ax;TK@{9P0rPGGa>yCbiC^((g{~yTbX;fY%Q4i`!xVuE<;IGZ&sx`
z_LE?<GXA3h!m+Bf#TM7b{~Fl*ZQ#md(@fqTZi}{;3j}R2tQ`7bJppS)tC^3*P}!0#
zrpMgeR=d2L$96p0iiT%rC7omEuBD}V*be%=cf)SAYDR1(fEj7I5zctF<|!sl>>=;^
ze2Z)6e+~SveAlX#C6}#Qctdwc>Ck*NZ}E!Y14;AF%Cuna^RJHni!Wj77|=Yru!Gv5
zYv04vMjbri4CK6&)Y4w`Aj%+RlMT^|1A-O)>~ml%2bSu`&JJWd;B(_}&efg<X^IQw
z1{wxL_0Hd#!ZG=z)jMeXs$Ndl+j^Rtq!Q987fY0tL0HTNCMEOID__~91WR06jVa4j
z+IE(^MJT@hApc0+0#S`SdQMx4EjN9#n8VSF$~5;W6jfm7vtVD5zOX_8A@%QN&Ty*0
zy}+oibaVwxHg4oX4i-w*L`TKR{H^#_DOh_qwFHq>6R-+-r^%FD6q*Fy|4>*VA+h6a
ze`%XzDBt+47@f%{x-SNVD!x}5Q}h02?sRTBF%5<krxs(1&EBU3EJy9Wj!OUtNS`Kq
zCTLf}y)rY2fN{Rnsuo%|J&A=k!RMBXtU#SuI#HbQ%tM5nETM69nS>)A!Ms9;A|UZ&
zY!-G<i7I3=;#(#oGsfr1{5?bCdESxyGYIr=pbPO1o4_RP9F~SLMr;C5-W<<4(#~zI
zHuM<sf^D)4?!R_W5gtaTNPefvYj1GxJ2qeGCIV}hFqsA(ga>cTM!p5}eNu?ZFHn?%
zMFrjq{bip0p52cJFL{`~i(dTtJ0kcf6S&sk%_qGhuel({>%nUI1O!u*KC4>|7^+v$
zImhM3ZT~mvfA0YV%Rf)8y0vQi`mg-E?*;ekO&hfUW!JG_ao1TMe}~tz1UfIl62)Nk
zcD%vYy#E$x*kDsbdPl27hQ$wOJsq$rXFtFA$I+7v&lac(A`7!cxoMG2G2poE+iY8@
zw%RqT+qz}%RN29Ft5(5l&7fVPhhdQ?RHqc24**zJpoZ9)Q;xm|#F-}TnZY2*l4xxP
z)lX&^bk+sLQtT~~(Dnd=W=`Ko2}XWH4V^t`s~R951ohnIJ@d``&(dH_2+X*fqvY*>
zc#H95OxM-xp8oNV{@`lh`ga<kqpyDxYIvUO@Yb9(g<qDcB5>@uCY5kh<eI)bc2zv)
zt&rvoYQL*tyhr7q*UhkthJv@lLYpU7_xB{mvu3Lh{Vpg5-ybCL9VW6j(b;{-el}oD
zxTg%z@^v+&?>HH>KAiI~v|pG?cfIfMFZ(L@ek*oNFrn|ndbI;j<%~(?@biQ^dmSGx
zZrIlVss3cuDi&LoS^H+GD{^hU_e!0lrK`ZjuwJ>j%a)frsAg}_vETevc1OU0Gg2Rd
z(8hE^kxBi1wzWgA(Ptts{m^unf$66w{bA?ojK_k7`H=-1^DYbaQw+NyI(dcbxh88x
zyO-wUW~-SRU9H}QscP@;GLs}&=}KQA$;Dx#^NZK<+pGvC%p2&Nn#666k&5IcoPpPJ
zi(u=@z+T&vSM4VA{`l|Y1$$<-U=@t5mLL+JmyJJsNNo<G4HAayB55L>D}JzR^z@P$
zi|j}`W-3p0h;YJh%GbWZJ)m~@4u%X~XIbua<nF!x?<D4Qwk%o0%R4%0Jub&<67jms
zfO(}1*b9iYui103<dWmQO$fb*R?Z-`AW@OGn2(;xFtEiW3+g=@I3Z79Fl`>zF#1OW
z-cV$K;;6ocCI=$YEVPDfJVf>=6Pea1Lf-SF;P<MNd?taR(W1#l{Mezx>PH@G`=X6j
zG^ytySF(VVQW?3cT<uK0GI}j$)cRQV#AwRN-+0cMN>)7YDY>)gsCXOKp({u`53L2<
z__CR;`<~WI`ow*dRctbSJ===G^!3qlz6$IzwgLu+3tEtl7_0UT8@2FOttkt)u3o|F
zKlfNFS5^d`kr%-PUZvga%kgZ49&c<KQnQ6a9hxUk*{~@#3+jR^jQ%c9%rRiL?qN^o
z4SLvW*)w9X^?qixOO`NRtj*+Z^4S#(5$)SYWy_emVtS+2U!05WF>mv=xfb<oXqU#s
zzF4!`2gg``?x?fMlPsj<DBsxdz#JYt`uQ@BlS9f-+$ah@+b`6HTsejWka!++I#X;l
zm3*Vb5YwE7MbdR3odF^D)%VXJP)#;ucQlcepLt@Z6qNKhYw=}&$bFS1eW&gEgGIPL
zkP2P)V`zhOQ}@1DUJ)gMc}=}N($_;TUgP%ndd|o4|2P}`)oZk+FH7xj(z?4F-m)O(
z>r#xuuMoVu9@4+@<q*R|RR6-Yq}`1mSN6R3Ciw%|+iDQiXF}Rk?^D!hPj|zckck4u
zNMDc~Ai7OSVLAv^3W`okx7Bb8Y53=j_m)qQ%`c4~4vyDnXM#VMcxI`79a(+$Og%W3
z?@6PnG4p%0b$Y#UxYIj&icqehp+AsC*z?igquk!dXR`H<A9x2~4sROoCiu{bV+msx
zWLNus+{Ux~C+Eyq$0=2moGV_W3})3WgJ}~xlL-!fLcA=R%qQ5@wp^Zw07~Y=GU;!H
zGuW7WLI(Ev;~mN0F>T6^)fV_}&{N2I67v8i!25C@?3MjTNS~v3v~jF$qezkzWYbBW
z;IXyE{F<P@lLSd7KObM?&EqiW)BHZvAk#sC=MXpo%ijZg^$y<uijkN}Bg5$l2CbJ5
zOA-T4Ot<3$Q|6{skc{u(k~yDc-MHSGaJH20`wVM&nBMx7SgLBCBh4?AG3YpS5BA?D
z@17VF(QBg~+J*=-mRYuy!$zn9A?r%^jR13py`&`|@^yK{tVVa!MpTjrnP07D?2br8
zm^VV)&3>M#4-3zx_dYe0%!KZReV#!eNl0te?2~RH?-j`?G8y0p3GNKthB;T<$75ZK
zoACt)4dof~n5t?#JQSg-k}E8%{BJ9}N0OT1_BD-ig$jr$;7D5soJ#yBEqzC(ID#Pu
zS}W<V>$io}|8R_|Y4mY<?=MiG_b=BxaHLU?(>E8ywsSlK>j@S)ckb#=Qth{vGBkRn
zg*#K<)iNGc6Tuh&fdKz8b?JqvDyT`Bsm(K|u@9@#=bcA4QXWaf>JwELXmjdUTSMM^
zwlV5o@--fD62}@}>FmM8qEk2KdOR^3o0T@J1&1GUCev0JQ{djU@I4;Znn*L)Cj6Y_
zz_Wt|sSb9jK%6gcEUq)&Ynfsv>xx%)o|l!Hyy#u3N4ws#(~GAS83+;?V`r!9h2-?)
z%)Si<>IHQ46E}2YXM(&H(Iip$`;BD=z`ly#G$-Dm7!DR$3sN#gWWr5m8nUb5Vq>-{
zHs7tl0rOb#1?Wl@GeuFwc%|!5fvLg%Y{N7F=Mf{T=s_T}gS297e)!(Qn<&DyesnT8
zdkW?c3LGP3tRR^g8p1QcX`4&AuKEHJ-=Q&zYUsQsm4gGGrYnWV8OatDO6OE2g(KYL
zT=Yzn#w}Zzmc;256}_ByqIPoY^-tqrVaeWr6JWLh7)gKUC2y65e_q$Pq?-?)Wec~k
zH3TdKmcwI-YV<ldzp;pz(3axzbwlzBY$M?2HBSi?_oV8wak9u15It#0fVONWLA;in
z?fFQ~@ET2m<sP`#aD!@aYt3e^tPGKX;0CkPABkUsZvj1sda%A_29>zeLps!J&4f=g
z^)-z8jY*D!hRwJ-waF3cVS2}@)NWCUP2+p|>twnSA?j_kT^1(yW0=XekJIkY0KMyb
z4bL5=%sMDQ{&j_RQq)Eh3zC5aiJu`FbCljAJeLQo@%5<V%|}!rbP5cyhd+KfXWUOS
zGA3~_8j+AVS}uQh+QnN^7MCS}<`n%AWvkFL^~aHX>zqwc?}$&$D7!<4*c7B12&2fZ
z4zqNL8dLa<jA1&eKu|Orj(WnUMhot_90+GLUuUJcm7?obqVf=TH~l_v25*0f<ZJd1
zhi88d#~f-o$Wes^B~xmrT_MX?)JkX(>a<aIQ%g)kOI~9G4LdHJ2sz)+SwkY_z?>tO
z%}q>5bylc)gQ6zE_uoH%{2RwrFaW3?A*CE01YQMTmyILb9b3aV7R&p;1Z&?uJz4*F
zm@f<p=+@<rgJ??v^8l09@Q{qHwC)QPom*!|ue2iLvhDZHJ_b{|h|bjtaW+NE70-D2
zqE0H?RV7M2Ce@9G11=@_d^~$r!uGduQ|m0+1l6l_t^)ndlohm-rc{}vzD@y7jzgY$
z0B2Uuvvv2AwUEHwbW`zEGF%(68i3v(8=mVON(7JlD&7cqy8>ZL2_I8lXLaC}RDEw#
zDTNPrhmaoJb13pwu-v~y=IFz501vjGKXj|o9=1I-DH8Qf5SjzuFHJqB8RnvVJezdN
zOX$Wvz7LASW5Xr?;wpkau*37j@ptN82jyet<gq_L)lWY*LN|fbiDWy->7@5Y!$lgK
zuQh7UJSZQ*NeQUAmDTyfNOq3<IF+CD`1kBfv5I+1{*-cm050nQg0t)H5%}i$n7l}V
zYm<|_IA5cYgL{xBo-YQ4%;g-{@vt8Fn&9({Ssu)}0G1!uT~LdV!Mr2EJIRppYy^YH
zNHD~o$cBgy3iAOQ#=e3X83VEtd4n8;I|7sD2jvyjub{%brxd-5U+PAfjrNm-dlVM>
z!>s^HWK#ib!z|BHv(8zQ&$*D>kjb9E{BQ072YIOVLP=Z7aMAdzdGjM+v5Me3YWac!
zS!m1k)OZr>lGvv*{|)JbpR{!t--CEu_6Ce*f58ni73fqXtK4z~uWk_&-ldX(bCM=D
zMv2A>@4Ct>n@{b(YGxY?or3DQv+#m%1|+&ao6Zx~57HgbfuQWf{8(7kb#2B~-Oqv~
zCxorl%<$i#vg`Y>7dKSdMi#2(U%saixPni1B_FC&)n%oVQ_{+ru1uJd?W#3DFL8hK
zO<3T<y5i$vCHb}AUd-PQUmf_w+>KeN`bx>urp(4Z9+@=tIK$+Y&s^wv-`ZQo@|8VW
zErbidRqm^K!p>qjBYu2mG14uWwu_P-f%(dh{PGX{a7=vjT|`pf&}QMR@D@bVZImmP
z+0PvMMz?7mzI|txd%A$H^{j3qTA)Ue$<8fn6Wt?8MUUUnV8a`W3klCfEh1(@!w}9v
z&d$D&hJ=>$jWr_PA7G#z(|H;<MC^2LTgu|ckSGS5v&KNynkIN%pc^|K)Cu+zwqB)t
z;rNpbO*@*P_0$7em>0$vtf(4?H;TdiD*7u1;9F%u{00b*dfmvB$HHRph333m-v8m%
zirPTX!HC*K5V46MVi!fgI_i#uQ5XrMG!jOwBm6)4ivR!Yk>b&?fD=VbIa5tUoFWJ~
zM_rKchNwLRQHKa34w3(6H9i=(L%`jU1Ph}O5=9{(MziaQMnn*ah#(RbK_DuIL{JEc
z{NFGCPxhb-<Nx#aTS(&la1EbBL}a;=*4-nb{K%%o8IVAwyzp`!exVQ15Wi<50R2t@
zk>DIV0zlC}1OnlS2uK7Gu;}+qB!GfQpoW#*o(4$7xB0h-wMalkJsMz9UpFE_Nia25
z^+RuDn?9dH{;09Ag{TRHHF6^1tc*^o505_{d|^_*FmkUkUe9G8Juko`<8vT-2ZJ|=
zKY#T)Vzj6Nn3g9MBPkM-Gfx<vI=J*M0rHvcO?7-QrPfEzi3-$kKi`iEmW{~*Ju(yn
zK2gP=CU6-yu7B?s(XcUuV7JV#c!8Qc9}S^Iaez7Gv(qmGsCnp`5+Gb5JGqi5v51)a
z7F-18e3%P&DV4iqakhhQ!11vjI5=@n+1THQdDEAeRY@kd1KxU@BK_#3S<Gp3ZkOi<
z$AXp)7{;P10ZkJw47XgQs|0yFmC!5hI{RoMcC_ZxuB+gcCkg9Wo<KS54rAC&2RbeK
znShYld`f4E*rBl9Ih@gDq=qqLL!-;&dGOhe%V&<p;t6J-ikm+VbJ9M+P`%Al5B7hb
zr}%ZZG62c$m;aTwWy;jJDCMUvi}MNXUdzLP4~wriM$VFy(sBB!%P9pOkiy0y2L>@q
zv`l~|MO4_A+A9=z{E_+*vz>-fVhw0X*(^<<1qW}MFa<>#f#bl>JB0w3qI)zveJ%B+
z!C6g&*m2U(%XqNYyaYUhRPN=HvhBBuN284D78Orf2z1?SLAs-e`4%A`jJk!Xfyhr~
zR`!eL98pC<<Yh)3&Czv;e^c(;#-$V$1}`|^eCAW!g25$C-eji>mESTr@OCWy%FBHO
zisOl!SX#;MHwW<x{DV>zSm_r&;Y)v^5*-#izlgkV%G>Tj`gL|Nc-p->1M51Mn!Ig4
z-8J8fb#|76pjjuTFgcD%{HA3k>a&yYdAa8XJ!V`ZMa8Qg0u+(6)Kjx$G^*)HuTW=-
z&rG<o4FQO0K0JphKFuqv<~DoBLTf!~_~1-c>=?+vgx%r}CJi(FGo}gt;Zn4W!Pwql
z)1|IeyEMZwt#7GSoY+p&cj8knUk;&4w^hvZlDdu%xsdI;`xm>Y^>0zpG0Ip3NH-uG
z!g`TLW^zt&w9}PLrv7silm8S#tBPY~&1`FP^q9#yBfFzskom%y7xSeQ;;g7vHhT0u
z2s!Wer@1h1w7jf?(K-o83Y5f1T<NCLx?mj{O(bQFcY)HZcw(Fen1jZf0QESUKuA^{
z08tyH2u)VmN`9ylZ@H82lO$E0%Un(|TdAl<Mflv`G=|xGqOZ?)7Ip?^X{+wKxqABf
zlQn4H@3N=2beg0aQvN${dhK+5d3=MX^n$5+^V##K^zte6QSA}r;UE|n_|#{&0u2+Z
zHx$)U{vx(OFf4r@JVBF?=aLEylA&Pr?Wf@G97cY=DI<s~!*rz<U{yy8vU*Lyoaas<
z?YPU<m8<aZ5P9t3j{tg|L0pHk2!o0=mrz$037LZ2a316-I?<IGRHEg(SGAuk59-t=
zJnx^-XWnz^u~W)s3b?0!%X1SweU;B9El!%AKqc}WW<MiELp@{hy7l-qw{cR^;~CI6
zc=O{*+W|)8<-gSkwK-X&CQwrZer9CwBB~|uo=J&>gH)N!q2Wm&;-EuCaY=v5<4{;l
zqu_W+V0E|HX<G_Q+5}bUNI51xrKY_zZfJ@hBR{C_@LD)t!J5hQt~*0Z$76Y+Og%!-
zi_maSKBz@Sh=v%&!InEjA3~kvhN%n(2j?qBs?pCDLE;cOe9!8t|GxA#qMDk)cBA0-
z2z9+#l&Gi`ss@l*ay<gEPzoe#B>gw}L&``5YH=?lnCu1QSi#R`p`?$@B566aSuo*5
zz7`HB>tqE7vH`@RxP)3D37Ey>Jx_8&(n@F1R3v5rdRo#4aa=(UpGza{4E)es(snT~
zX$<JHNKud+D?olyF<WxU^h#Bz->KJ7f9UCUxjj%|GWL@mTg<X3u6;<lM-e+6*>{)Y
zn9_{E(<uxAvQq2hg22W#FPitp5aSXLLs60#EV`{2fd>N|CHLGFNi5`k0~w}~DdX$r
zzh7%t^b;~?3p78i)9*@?%%PAL9fyj-dfmB~JWjxux{@MA8G|{L>TzL2=B%n;sL0zz
z9EZC@BK{-Ipv7K4_oSBr#9DTFk2&?NuhbQ${4+8XK$h@1g20bL{bdk$ghF4bZyIT`
zQIG3wv2zO)GRkqUN5ObRYZ7>XPBKyKn?oe!oL>ob(DE`i_+^A1n1c(_sKJwSfqm=G
zv0jAL=`%o8)M77Z+SqIV>TABx!5j$nRct>ko+}cBvPZdRErpQ1r%QTD>p7+!dOLn`
z&MT=LqkS|p`c105p(e5JlX@7<p*nFKy4k5COU8g}&4KbVRyY+8FC8QP>>r5AjD{(v
zhPMmp%IB{nr}XV{_w580e11{&kCmjqUth0oaqX5poWYycf_ixos*}snp;ouPKx;mt
z$05uu33_H+qRa^MrowWD3^Yrz02As<)M6A;pGDr@wGDVeniW20!D>w(!sO134UZmD
z`!<qT`$<o;U#%LD^72Gjjaq{utzJ8WwK)iLnBEma)lF(#?NY9>1~o&2NIXT~$zQF&
zkUKbx6-hzquyLVbG|NIm3VBs*IBkia2L>xm`G<HM%_1YKPGA^{<#MCg(389}b)f+j
z#fMtJAXd~t)z}llMl%aLBZah8H+&!qnxMf9FwhncXqb9j$7Rg;<<CV~<ck8wzo>KM
zFdpq>NLJd@&^z8tS;eWV#6s3GdTc`LGWgMBX@T*q%w+$E4R5T_+f-EGX_xHEk`09+
zk53RK@M6i6!wJWY^6*`X?dU<_8(xX=u#|xX2I8$f1Az)}CPT(y1`B@5-bE|ZH28ha
zZy2R+mxH}8Od_9FcA@YL$|b($2Gi9LJOs5bNT^_dGZ7j_7k>;S`(s(!;5X&*29qgZ
z$FZi>b&UA-SXRJtz;)NI7e%yM*tx<7q%=~U)DkYNVCNOTt~Pa{o1l@JaupbQu*u$H
z5C3aMH%E{N<vjYJ-Nk`Ir?&v*TfP-Oe4ieV`T;YlGk~p*-H)j=f8DRpHNn^k(rSe0
zxzaryDBd{OFGeR5y2w}pY><#<DQy$C)hK@sf;^6ncpB_;VX05EThOl%$@}NjEVkBu
zzS~BmGT#n8<%_0@6A!J{7dZ-v7pO1v<1HWfw1r?Mr3xQRSPSxtTdI`d8J8b$4Qrib
zz%vivH9Tj(K7b}Zuzq+BW^p72^s=w<HYR9L!TW^ZKBm_%arYh~W@MMi>`VOCnF*}o
zoiHY|5v510^dk08F;7Xt;$kPaRV>`Lf~9{z$g*@?cJ5sk%sV5MA<u|}!HY52>$6uh
zOh$*Qk;opYZEg29HbfG|oc>`5zl+@cOE)VjS|(K0>OhNGOgoi-FU~G(mk$WQp2e+P
zdtauW@&G=QK~$_Ga8z36szigj;$~|TvKX|AQIMRgQl!XR<&5-Zm8lb1TJ;o}qOH-&
z|D30-4H2~uSG29`Kh`>{V`!j&p+S9Jbw;;sUJdmTO(TUmr)oY^VrrJqv&zrz8qEeh
zBgxXMwcI31pDQB`#Pt42P9E^Y&JY4&ZYpU~xXjHfKp<mJmRE&gey$ExR3#EOR1qDQ
z!&YTQMw6TwW2>^Nvs6i43~7z6N(-(T55`bE3V{LL7^;wxRmV_86;qwtt)Tifub9PE
zt^=E>GPPOJ(?wZR*;=%}_Eov{*S?mi)q?(pq2=>^nc7>8p}0|?7`|rA(T675Dy=i)
zx+f%>Dy>Xr{|it}m3`7kyk;At7lI~_Mm#KX(W@#KzZmp%mZ7RthGrx%CAV#c$wtcV
zZ2MFM;HpFtcDMnh5r9!_eEQ54)J<-f9T?xq#Wq<Rt$;;2ilB|shqHJbJ?fv%`3_6W
z<V=;3FQ2NuteZJH8U0C^ZaPpiTB4ELe{E9za!&wNrijT8V5kWt#fb6zdOhk3Vu=(D
z-H=6e0!_<QraHP6VE`Q-`kB^($y!?gr}D8F4z~Wt=*p9Eq8E7$@zRXNP4`-8x)!}e
z*o<R!)HRh_>~xNnuFx<QNUc-$jU?f+EnypJ(urJ?Qld0b^Edg~RpaN((jonElrlSr
zWjKlbT^xb<BH77fev}KSsI0CbZ(j|OnPP5tVdA!=Nvp6)W_r}%nSRWxaFAA^E5e3P
z3L3oQDsz+P`#|pLdGXi{v70;=u|vm#6G@SqQ=QL|n|viSBB8J#AJjGkY8Bdsz=bMp
z2!lglM9oQ|up;MwiPr^Wps^!z8v`v!VIZ{PZGjiGmcWQgA+5IrXv$5<;EjM2l_%)O
z(by2Ix`x1t8Uj6@*${rso-AmZCitr6AXHK7xKUwi59&zMuaBhp>m%8LF6bG6F3{Bw
zu-Sv&!KDTENz0Z^T>jPa`gy$Y#5c3q8g4DPnbq@h$aH%ju<i#@j&M5$n)j1jqX!|J
zo3&kkQ9y!$4;ls*mVl|v&YYUT3ybqE?<O<krn%YMGz&v@n8(kKgvMl;7<j`f1~A`c
zB+7nGgV8k?B5Q86mmOoVa&GK70*P}Y66X$FfRp8pXZ_t{jVuN3#WB@cLeLV3@W$F5
zR=bl@L;I8X_jl^WG=j&x=jf!pQoeM@%emi<F?J1-;EsLLFAgYZgXl~6_}DLS2+1sz
zy;H<H&qx(`M_Q6!F&fw)C(*a3&cg5kfhzoG6moodo|o!8$%$VyNZQZ?pvUHIJ^20b
zitwIM#q+%Ia$hcI`%KTFn7JW7Izc8&%gkzSgmXAcd;hKeg>O^e=0px8JK>8|Mp<q{
zJf^z(QG-H8GO313sl_ie(6-O5>_r_8y$aqar6-sef`<P!1KhibXUlM{Vmn>QBFx=-
zoDSKg4#z@B4UDw6rPg4sapQJ-#n5(j>~N9(V{I+pkM8UB5aHX8=11rK?ZDm~T`2y!
z%Ej0A+rig2;gjO$W657%-~anl81wt9^Re>%(0tkpF!w2{m;MK4D|WBx=At)%!W@k3
zcT*AvYf%O<R^93g%)GMLB>wQBqcO}V8i}b~D2PZEhJO;)v6yXEWy7-N)+!dNT7Bf7
zXk3A+J;X$hBJm*;^ok2%e&f&vGJ_IDT|dPo3eqF`24&CjR+>%j(%D)e>vQPzKU$V_
z(%{u;ihHT*73<Jc;f&G_&O^+doV&*xv2;(ip~@7)9tlL9J=duN*DH|q6+fGvx?VE9
z^k4gQ*LB1~2p_z5v@8PI1gckFMt$1_RPX)lp}Q+-#q6=uG&zEb(Dh8jQrpWT)J`)4
zD>Ik0Sx4-W3ksoIE^vwmREYhcar?#Wz2|e~?{OEQL+)GPss}{0Hj#6{J%^ddjsNZe
z+r>I~fw|W`#gj~n2cHt~3OE>fr1-4y;)_vOvCf)tjj%{Ke%zFJz&&EJ+74837&k=(
z#lu*j^!gUME37ONa`UPSdx{;4H<c&sB4%PEOOt;J3@xYf0>c>yo2rDYybUopE?j&4
zVo%v$p)2Vu;8$vV5~s@~$m1J?fWNdBWm89L9b>m~J3oZwTOd67+2~K=WU#xlgFB#P
zqvb<>g6H*;7pJZ{oWnW@c#7-Rw=Hk|PDrzQ+sqHDL_F1Z7R|li`~9y^zW;z1RRU9F
z`tp$O#sM@&aauiOM*ZI~8H1=x=vVhCvQr5WDlu1HP=n9DKxiCstUoOM!d`#)J9;3x
zoC)lk`~*~@ZI%2h`x0Rra1mf+zerxdY1Gz%_$t4`qRjV2?Dd6lh@@KYl@T8V7JzL`
zJ&uWSgo<SEdk%TGllkkaqvZY05zO-$%cEu7TM9j*r0$@oNP){)wKtg1(H)dc*zHf|
zhW<EZ+`6pN(F!Vp{=eOXC2brQ>DN*5Q|b^pbDLd1+PchFVF?F;Xmpo^G#EGHey-!M
zqMAsS1o;GR_XmV=xteitEAD`3-yVc=k})&P4>C<NuP)A188eAM3E`fEz<s1F6kqRv
zV5YG82@(!1e;9{OjZyi;nA@9@n>U97`md&+v!#=-Nt~>F(3z&F6e?EqTEv$FY6&N?
zmvY{^1SJ~hEC7<cndC?(PCF9^Azz*y$XPHopncTu@QIHPVPxQCbiXPl0ygg0jwAf!
z#zo<1C`V<WWsHruggf!S0?kmrb2tDK2`8&;DWETF8o+K_!AN4l+m#FuRib7SQMY6(
zRz#+wGopb_Njd-yV$Hyxdl%5}Zb1Gg7t()_HafQPdAsMkWrTZL_1Un1?p>fDIA)Xt
zd*&d3KX6lH$mtEv83nZ1YEU1?NnH)&C>@?e;$9UuK)iohAA6Dm^0?z;^W0ZO=9IG<
z*u463R__hxA9A#e1=|GXR$M^6^a@Vq@ObCAC2gU2^Xtj<0cme&gxa{LijSriw+CEk
zDzCV-c69^N+@V`O0q33eDanE3g=+OZC~oZD1uptPT6(fMOWmUtc7@?Wim?s$^v|0w
zVnsvjc8&qNLZPYiRymYlZEqR-neKsPDZ?xw+RdDrTZ5{rYLNOJH&6x+_V5y&Dw-X_
zb|9K~7W$t(0eywHSGP4#hh@VaX9b+@dIO|As}KMne-}v##HkJx34<t3vK_>pD)c9D
zX|$_XtYA3zy9OITyDrXOz8HTG#w$wFmdWUmX1pRfBoSrU115=_(f15_06p~fE1ni_
z*qRFA&)C%m@D0&`KHe=C#G~x%lw4D^EKXUKc0;Dxy)?Ei?y$BlQp##*Q}=G4?HRT#
za>|<r*%YR#Eum_i2~mGtwl4nuA7L#^)A?QN3o5SZl&IX()m7+!Jt5|nUr#9Nd>2U6
zwO&ERUQcnx|8XJm9yT5$d>4aWOL<2c-?BHopz_*O?x8mw#gb7$B%KV7t2D;NP0=Ki
zTls1#Ao3LS*bG!Jq`u<fSz!y}&)f9#bR)ck7KPY8m71tqH^#uY$^#940pm45n_PpK
z<O8uYiSaDG$TVsXUi$h-azhukVpuc2a3uq&xCpcV5Q6VuH>GmoP&Ax>;>Yz=L{U}`
z(R-}25=C0`&4dbWF++f%R)|E*L3knj-#fZPI!#7*N=#ZMPZcvjME=bodAKhnmj`_2
zIdWiJZbXZVF#cd?BxNnZ@}g>m>nRRnKJo3!BQJRuW1jVbPux0)bYy?5kOS!YTc3uG
zG*4pfA^$H~k#>_p{0-fr_FDvX))Jm(%qtI2s*viEo;3!Xv9x{stL_Gr!ItF{<PX0`
zBPCOd0+ot8(6L!uS7|8(*&;Bve}5ip3BRm7`_eBNPNSP@W<E_)b^aX!C5ZBq>Y8T0
zkC9T*NIyAu?LH7J#J_rZN;PqPmUAhkK$X4797Ji=ZAr<;fPSOIMC!)mWh&h~8S6VW
zVGkqGn)L1;B0Xve6qCKo9c(@jtd>QwNIBH)Rz-4&2T1r3=rf^<NNRHU?K?8(s4bF`
zKJF`#(rE6eix~4YHDyj#A=fxUHX_pw#e&qx&Nh(HdBwSG*ac<f4!u<mu%`ACy_QSp
z4CFWV1AWs3`P&UeRt`kEgOOj83asuLACC00Iv%8u)x;vxmuGup<ZzVRsU*-k7_sUG
zBBOKMHIGF;$SGluMyfB$)&pR^pbd8S9uXdzTG|;jr7gSRGOb!cGZ@#Z1&n5c$Kt|a
z$>%njZhyRk1SY4)VUdd{{)>?yFn?nniPgOLwQeB57#rphINHKN4O$F%K?b=EFp3Gj
zB8H0fVxzONp*Z@w0|zW69n@6~_G1u0@d^z4v<STe0STxgK=Px?L*Up&V`B@|AJ>R`
zri`4D1r<i3yXR!8+w};FJ^xwYsG-WyOD&Eji;qBwJU<IH<dq$}HNtMC1XACPh#Lz>
z2KPQpfO2?5peh&kYd()x__a0X5nMQ3mvB2(aJ9z!bc|@{bL%_eOzy5-Kq9n$It^rr
z)Ej`<gN3<g+Ec<R26cHUBX@ADd)ZL1AqtH^!}rypoKnt4o*IJyic#j!Mt^m0K!t{k
z70b#Zp;m)J>;=(!IV}a?PI^qI_vSk$BLVCcf%aOhT5%R6hmZXO&PG@jk5GEc?l6p}
zCW$<iwjrBB4#ap9LmF2R_?a}OoNmA6!XIX@?s{RwBuEB2oO;G!fT9ohl6(U350^nF
zWhF{XfySc&=BrsCf@zMe<fU?vK@gf^1MVpq4kimRQmtQ=Zu>M6#8661I>g3{q(H*a
z4hON-d)Mqw3VVs_i~+AI{pa}VjH`9&=X)8X1Fum}_41N15`lKS9Z&Uy6oaUO#ztRS
zHnRZqt*BSSUei>Id0@uVwNptU&>8Zx>H^-NGHy18ecs5cW&nISS$wDqJTq${EJm=6
zc_CI}r>B#4XN|o!iDcxd8G6B;LB2Rd-N~(<<@<$Nebi2&!Jk`V7|VMh4CJTsPFvIe
zAxQ<_3521AQHWe&JOAWF5(XD!V<_QW>oIf{vNMZ$DE~czP}1W_yJBWfaL&%_Sf%Cd
zXv6Fp876!`^fuZU^#D^Hyr;Ug)*xj6X(~fCl9`6WJmsV3%_v4_f=->Rh-ouIU7LVS
zF>z*Bm_l9=^;yJMjBgLyxh~(r!5j(sNYG?b1Je_!NbIf_^4H8+!|+oi&#V7SAh-ei
z>o`q}xsT($PM(3i>=cq0yFvqX^DMsP?It>y8MS{!z1SCEI^9F9ykZ9e_*Q<9ikEyZ
zwZ_hIpwE@xTIkby>Gy~`a(<mxr-NJ%GiOY_6e`~Vccbzb8s7nTx#jC_gm+@@9Xk70
z)KN-qmU)cm7&?cA#&~w)F^&-nR^?!!-cwlQc=_XG7c`WXD?JLev$?Ev_wi8_`fm>I
zpWsjWi%yGI*SPTNX&^ao|BGuZ?<vT*rCu8<Re|?)6lJe?iPF{LqjA3002NQG#4`!s
zJ_51lQ^>G1EU6Xbk}J>I1a#!FaNQ;H%s_X{i=UJXC6FM=&8LR?)|v<#|CYN!*4Rkl
z=j<zN>o>{`{`5f3KJAuDI!VO{Z?OGwxP?>AsEr$SIW1lZe5BWl;4$xvhOh7sZ!b@C
zzyKX?k%5CF0<Oj>O=RryNGj(YS~jD>Go_^U%5WTnRtnfpX#$!GMll@RYiixpX<s0i
z0KL?qD_l~(JqX84UGI=!0e~T4Y_sX<M87!`y}-j>)d<#S!KslKl-n>|$m)+O7cp1f
zx6T?O!gOQz&nM%S+P6=T^0?I7n%?K%e4Xrx5-D@=2%h^ZU~FKI_`c{2>%yUUD@|~b
zztWk44Ab22xE*;-EmFeWFKvIiCP47)|Hi(H<{2>M>ffJJ;$Z|E4nZPL71nM7W(}7m
za)~dr=1l<_{$azOVKeJ4j_E1_{)XugX{%%OqAEsCML2J~u9s%y>`kzK!D$MP+>B01
z<57d+VkWjE5~f}>R&03!t4GOZ$tjeGG*NGh(U7gVl;TRU>z+EDH<gr_8?UfKOQeE+
zjCXJEoVU$Tzj54X+jq>E$g~&MzMlL3n(I8JB9i@dR%aUCV&@8#Z$~O^_@t=e`;Rgb
zaU)@6%;h5H{dND!*a?aaOWHxwPN{8{bUTulEITa+D@fMFP^5)hOhjw(Q_S0in8;R_
zxTr;~#$Kd_#N<IhOvKZWS+IkFNNEXGOe7R>;enlKl2_4oG{OS+)&cc`$hHtSp)JUD
zVNr#h$yC~l+g?{i-$Yl1z9yQ@UiT63S>#i2zAD{LO=S+l<_X>KH_dy$pdYD`fI%R~
zK)^8HH766D$K;?HeHr<a4}pZ)B|DM=`M3OiAV?S~Dbv%11DhEb4^h+)6#gB)DFYhZ
zd(g=A2X062%fM6LM0L2ayG>VC?jkkAnawLRyDX;GPjDylPXoa9-`bvoaVZ`_E1hTe
zL7v+|%q3$9KVxV8H=o3<qhf0HcHZs1sDSG=w)-VF5)fpr&zt^!qA~n>KmH#Fw<mu@
z#h%apboKHZ2}&IA#X(#!!e)|>ox4w_gE(mu)7k4W<%>PuC&MwhljDBtZCOnq<gg_V
z3r}LSZQTsd$SvUKsckRYOu5Kgo}kRpo^#-BtB1xW=3%3;V8it2EhA_exldFLom;=g
zi&i9ePW#M@E?wh+qa0II0G-QvfITPxJ7l}H4j21e&HAy~X&yLs>iEg7v&U&2u|<vd
zSO*%@>u7!|hq6}3GB2dUN`9_c6@7GbDeFJ)97{>&ui!(O_veZr`#|QuYU5B2WajnH
zp?nc(#muq9HQl7*Q1&GxQqc!A*UCB<E3=WbKXEJ@CCaH(+>^;3%M{|@`i^uqCoZ~p
z0)M$V+u8U7J(i7y8C-WqbXz9&j5O~-=#gy4eHt`FK>WCB2DcB)wP;T}CTh+W|IXJp
zj~Z|O_)km(L;|Dh3OSC}<Merq2egy<u#gfg+vRFhX+3s?t(VvwUF3uc>>M|NIbQ*u
zmVw4Tq}2$0o9TqjoFedd$sN@#nK8zaVnIA+suYZCL=yfUO4~f#_-m9nLI;8%){m8f
z)l*xBYuVg*B^rCOvOR5V90lL61zphqp@l?Ho!iAOy!5;HsxbO=<Ig*T=Jr>Qn}WS0
z{+)j)>d-p{Ul~MqN&j%Sl<2j?Pa#*OKC`n1r@NA}4oJ=V7=cyNL0KIu^XD==`~)Pf
z(T`a7rdWH0qY6~0JulC@Y8ej^HD?zz|4v5s^`PLiBs=eb3z_v&prn#gC#E~}cFfJg
zFh>J9-AF7N#yeVBN1qgf^j$9W&cRT{5>@Kq7Ph2Be=lX@&6}m8<~uBihz!tykux8%
z!@|D32KC5;D(I=ISV4%8(y{a;8Ig;>K`)2+u@L!8ClYY|#yLK$8NzZ7^zzRj0pO_^
zu8dqqNl6`Z0~0258~4cLpx3Y{{KPlaF=JcvBTbGbak3^0MWCs0vLq#C^E4yZ%PW)}
zCi=?Y0_&|56>|09JazK$9=APz1g(uA60~nemfn`7EOaOl4ab22URaufsL<8d<mb1H
zb9?Sqerf|1DxWbfrOW`<;CQJ`_3%cJcWDDo(P6zqM^pZg8*txEpQS)^#I#-pIE8;U
z6TC+QcdB*l(3skUlE5eENPanqSjlbUj3Ns0y^D{H@^RN|G0>tu_M$z>;O%I!@O!K)
z;n%O>fj^_KB=aSZ;IFUJLZBn?Wz_{dLr?gA2!C{zSIG{1TwDIC4?1T@JGhBORro5c
zv@=;vdvwEFv8NMy$_B0a$*Axv`0(D}^J6x?WYq`h_&co!lSL1=-5v&$+hCpy=!$5;
zifbH(bP}3)j+>qVI5HLJwfutJ@-H>=+B43O5g{fPD_3Ut$#!&&9j=$LC(8IrZ^WvA
zM9_VTnD&|lV-GSh{b}__T@O4m9_Vie+Jl=%&-nvYA0LOm2ShmtzZnhUNpD6S9Oq4_
zYRK#*(NLEIh$QH{HsU{=e;dQED|pmG8!-&nG4sK%k{VzkD`I*vG;{7cX3K<wEUOT_
z1Br_?kP;~n-m>f7)7A4LUm%p0vae1zgeKZ@j6wt?V(@}FoXZIr1*IaRX&8is?J91f
zEvOL>k?G>vk<5A6Icm%^pcS4&-~g4xA?#o()mKuW)tx?3k;o*8z?L2lVa9v3IDv*J
z`NSUmP#rTr9x$jd+?<%9pEF~JFw0s1DV2iZ#Vc?YJzP?w7h#%+a3f*(;Enp=<1KVF
zRwVyol(=$!&+x}pwD_TnKWf{VG1u!(W%`pm)Em9tDVyB>xqVF;94p-YG{fI8rnh@n
zjA<|x(_oQYC$RD2NLUnltw)X3(E^j;WbUk)9Fu}_JB&lR(U(M8W+UC^uV)y)%o*4>
zN-+nAIT4zfC7VCU040MFK&ItC#w?m{WmOb!`DZ`0O~NIImYFp&LSbi;G}M68MmBAh
zJhtt=QTpb?__T)*drZ#Q7c$JV11E~gzJdm7OR5~UmdW|o&iE(Y*RYiksFR*;(?Bz0
z0*qc3qfbS55>^gq0xpDukWP_o7MV~}!eA<C5q!IW6vvxUIV}N$-G&lI7D^cTsGfl(
zQ}{QE{IVUKC&?Mj&&idvnW31LLE?mBP9B>6N1Bnzk_?75BhJojS!ZpQv>Np^Ba^1G
z&YzGesW&fzKsPP3>=K$OX=rx;IV0orJD%B?H&7Z{qmCq<3u7gmL8p@cGoXpmAKiBE
zOIpY8OH?)TY<BNQh5<QE)5sxOpM7EOxl8Qy@dvhd;BPb0?fe!eF#>AQ4S!QT5-obF
zG|srpDT5IQ=?Q8^Bc7o!n1x6{)6?k_wJh!d_*{$H^N}X=Q=Mpvxs<cy|3lY1MOoJM
zV542OZQJg$ZQEv-%`V%vZQHhOyUVUR`~CiLaC5Ha%E-Fedn8$z$&)+?HP<j}njWYi
zmdf~q*}0qJLAj%x$Y&jpKic@@Bu2{N>f4_1z#vn-sr#x5@FP8aoBWS=Q4I;UIo(1x
z_E|BbCR~Aj8j3tfEb9V~xy2+MLcxPTm}y2AGQz6{ilXkc7YSvo%U|g<YEETATLJiS
zi2gXj$w5pA444)C>Crxs%M-Ad*6WMuu`bZmAPax{8S9x-D5~AfWZ)tU$Hd1lR{Fwk
za7d<xAc-C@VS5TB<)m5@jaM%7Z@hI2GlTMFs?|QuH)hTc8M;GE8J`oZ5C-YAW^6qV
zv|2F-c+szUrV>q|oIL*E>^m(ri|tBEr=Mlc`I4VV&o&MEgulIzDR?9eu{${2|GPgd
z1g)aF;g9LNCaPc!1F4SdVpG)lX1PFYl!HWMUs1v<QK7EsF)P?4Q2rPpNd9Y;g2by{
zTZ^z`e+HLR@D4UO+8CL|3u?QYhYi2x+Px}%0_LGuAT23XX5ldav|Zb@(y3#wWi|jT
ze|Qefb3MLq`2;Ml+<+Rh8GPva-|fmgu<W|8x!1e&-k?m2T88<-+uTuTACmQ%`Dw@T
zV`|Eyt_5qe4))l&&UB!vKZLSY317+}E4bO&VmnAX<go(VrkNkbgE0Me#=^7NPRBe1
zFDKIeNGDD*G21Jf0c88Nz|KyqP-fgX`Ss}=)pS{_ZetS6blgQZr(#FZZ-~Po6}478
zKV2QH4<CGH=lQb!P*HiGY}54^wKX_T0O)`o?w}>%pZVpy;MPh9p`8}Z3WP(didTFn
zki$a-KG;6+km@2Dp&ifxpC2LzAkz>;bdyv)qh_?VCd%8;0xHq{FVnCBWEzGW&%|jh
zx_wQtkc;r^ymfj&t21ayoQRtYz%{n!3=r4AHE?@c0odU9rQVbdJY{{3Ftjg*bz7%k
z$IwT2sM{3`>p^V=Kh;9}`voHmpgGFhR<e_L=I%=~p*d&>W3q*F6e*c-LXprEgcf%^
zPy!&$pZ^+*^!#UeG=cak{lH#v*-L)qN?zy#@$pMEL;v&em5h=A;ya~^MADQ#3xu0s
z8O<5CD-*~GltLYI3g9^v%-NKjYWX@FbMn$X;;cryB$<`A`ZqR6IP1||_SZgur}7;7
zs9hi@m;XM?t6+ofsJ$DJ1W?7}VUTqp0kj`mAI6-_k?yys;!dLpXH)$?Lj>U=4uB6)
ztacL-`pz)msoj`IG)_hRC$g{7dmfa8<|dI055fd6DX^Cl-SBt7Z@Dq^k)LI7qXH=e
zuawdGvJ>YG!~8{9j^GP(Gdn6n;?23q$4q8)eCIofW}g4a0MOe9n)po4+@Ol3@Xrxo
zN96^6H3GnqyvJT8&|+hLy0wsxP==<vp&no<O1r}?LNI6QnBwRNFgHY1PTV*oo@{j^
zVerCm6kIvOZ>Dc)6ApizH{UU8zYRu!_Yf%6e1B!%gBAMjCgvY6aQpC()6WpK_idt_
z84t>*$GbPV&$yP|Nd}$b2>#ifB|jaM-hHe=#cU-a9`7B-|9j%_8|qHiL-ezjaWMSs
zisbGLk4GtgFHq}M2>IOwTxVeKLPYN`0ypl~FQRWC`CVm#<E&i3i~?*bwW3H62cz>f
z(mDjb=F*n>F7<pAnq0Olr)yQ$F>WwMy{lfw$U18Jth-;4njD?ET;2=js4rm#R*-jS
zt*IP&$l|^GR)bQxLB*b1yAUy5WMbm5@rHzP%%49ZXLdC(phD@Eg4l%Br-Kr*@_5fi
zR!_=SV{a*9hpG|oVS0v*UInf+E|Kg;-3Hul#U=zrsfox;yoKQk+s?>cd5pdfY4ASg
zA$N(=<;bH#oU_M;eFY$5)Q7eOe%IWC3p!A*M7C{y{OZWm@eaB%up^w_UddG?v)DRR
zIXhDmJQc}FA%nZjd2hFGj1QidFQ+l-)}4RTORJ$eAyaej;3jlr^+A>7<?lBFJSN#=
zZBa09J7?T+6yB7@nU1fNK#QYGVhqzRrnE&$w(%^=6G2V6V&UmrR)SL&wCeeqnvOWX
z1M-TyI#31M{8N^k!J1SAq-P1V05`d6Si0(3H7zjh3tEu?E*b-AY31!P9lG;to|Yxu
zAUYQqn{%SNVi;$RzeM0h7u<CpzWa#E9L8lX`k+Hg(>ZsY44_8LVjVsxz|_i2w2ZIq
zSYVkd-cW9Gdcpp6LN4j*ct^vNeDe+y+3Qo{ioaJRRU~)%IS7QIsTu2e%0LRlLaYp_
zX}VyeNJhCl=&&QNl~y&fP`je@IH3GXNPsdB8h_=*$F7mNhU1o(1&`6)#Vc>Zo*Ra&
zeGu}qUQIx4_=zZ-c0w+WD{Pi7Kko^YOL;Io20l^E4oWB`eO_Fm%$lRTB84MG9}r0e
zruV}~RC=pPt~&R=m0FG(#>hI#pVwpF)U)>feJ^IDapwqCHvCXCQwEQ8+@qO?g*AAi
zA?KD@`3(D99_IWZlm$i<IKndJO@{3+WK^w!lR8+-)F_=AIaJE9NOmxjN^ZZ6Nx+Q}
zqPr_8ahB}hnLST}#C37K%XlNpa%{aIA;T$&?v_#5VD((&rK-yu*k$_MMD=$P3bhZ(
zFKz8et^S}w#FaDA1*PCBMg1+u>OzZXWs^Xcm$e<>*dd8n^l_#j=cY?Z0f<7voYFa|
z1dtQsm5qo&FqGo5>H?f#Ne`d-Sz9Q}9SSq|6~(HESvNve#ht)^8(Ej5W#$2eH<I7o
zqL6a60`}}-dph7f@G?J6mS@i}qjsKHfmJWWb(wn4sJmWNH-Zr$aS(?<%fUS0#3Po2
zn5ejAf@Ibg^@q{_q9g-N$luqP{|RlyHL;*Rg1=ON$OpgPbVF7{b`>c^DY<5p!o$>r
z6~j>u#_5<FNp?|Pus6X@q0AtrHjLbovdq*AWd?fGS^6AF@1A1H6q09?lBaB&)7@4&
zV6vfyGU0Jch{NkiVk9#L9N0MV;B&i8ZHkG4Yk+7TmLqF2#!%2c+J?8tl?w!YS2mRx
zZ4`+IWYi+tn)})|x+X}kSD{Uu2(4Fr+RCikc!1}8+;HG%)~?ehO$VXg09RI|!z|z5
zl%;q{7Tes;t4?;is7_i|Yv?z39l3r7s7!jqs{FOj*8=oYDvpJkKR;C`+bJpl?@SVy
zt1HsIpi>8U(Uhg6mH;-OXf15gE#E^<n_g%B^f^^okgzKHWX#cGL>xy`ro`HsA4FxR
zkKV`{u+Y?f;{Fltr`X}vKmeav{k}ES&)bmwB(3_BlbqmDPdPFFtfDeyiF|h6y3`dk
zjL~*<%q?WWwzr>E2(p{;^tMtpD=Hcxn#)vDYb(krQ~QWh^zDPsOEu9Mb5EaCSytzw
zura@}`}8~>1j8e%o=~9mI<haN-~y|Gbxwk<j8Huq+_2=fXD@yyZuv9IpRUV!0Xj=R
z+v~HLN`A%2QB2O?JZ)lx#hy_-lGLZusgl52VR&bH&s%QXGAQh5^KE?c_K8mDn~KCJ
zLQvR!Kh_RnxAu}iRy2fl9P3;%+oE%@wQkzQ0jVJlSl~1w*S`jY$5j`4nqNk{i8(7X
zLGK9c5X!c7*gR6DNOyPtguGf$WUDsl6I<s)y8_zWn^RWM>WqirPUZm=Z`I<?Cg0n@
z16py;O<!Q|{<esLgDGr>J4#9>e~sNVJc5sTz-W-lUyrEY;Io5aJ&~a^<D);H^(xe`
zbl)$y_GCEoZ=;~_hiujB_k3<Y?#*3%bShl1B|oF94)Yhayf0^<$x_mI(0sE7-OO#C
z5COxE`4&Nvr|p~|ZLN~>uApeIc0{QFi_=@ou0TI?aLdb7n{KG0l#~UI+!%0)Q36;L
z+;0ziLNPVY3<d=4<wqEe$wWR#uVpRTVWX3JL}^VVb*A9%5_hMg+G8BPq&G70#7*ii
zu3;t;eBr<cC50eIOcVGEB4j+Bvu}xRc}X2shX4#7&B25&x4-h)_?ss>w>|@28H9nA
zIPS@dY@a^VKJR}%KR@3-n0uB7aLOkpR!t<I=h~0l8t4{N@1~BA5I=3r(ksUxP9k+T
z(P-s(^3+kO0#Cx1A$La{Si9~c-oNS~{!VrckvOEP%aY3MOU03V)AL@6N~J_<EKo-N
zU79$2gq>)MG=~li7{k<)ONkrmA@WWkehH=WR_aWwj!nlp$Q}{TNjO#Y4shABpwlBm
z=P3S%pz>l*OcHW4zrfSr+2tbH;a<E}TgS)J5@)Xx3RL94hK8bVio_-+P(HtF#Ac*^
z>hQiLO52@e?dqa<A<YLpHv`_GL<NPQ06nDbQhsQ}bbrvqXxW5RUVxgs{V0ftB^>Mb
zrrp)$Tg?!mLLHYOLr1CS3VwojA#id2>-fGbm#4Q3Vwd)J<n<8ao%R~HgRoeS!_x7%
zMm?P*FWcTPX~`-ZMHlUHDi-{!>e!9(5GhnQLlS*%<F4Uh$1B+se4!o~8v9~Pt%p3d
z%3HLst&Fg&g5364Ajh{SHKb}mmE)uu^z+JCVKV!-ex&ZQZ%OT_Q`-P2Y2d%oNVy0Q
z6$5p!*li6r(s6Wk0)WOC7`nzD%OJ3NZsCE1!3t_KmX9qLH06pE!HiuoZHlUv{n=(H
znzP^Itk1LPR>aK90onhSSXHpcplBwCc7cDmoDtjd_vA_8-mf=HYvyP~m<L*|VB}>y
z0Ruqq6&}!VF8MdGORW39e*)wT$e3oYXe#7?+mLxalaXXTJ#OoE3$P!KnSGs;WGbDs
z`$kLhDknhAn^!<MatZ~nBnRcOM>^o+Co~eZyO|xywQ2?l2IYm#DDo9FQp1_sg%P`k
zmG63;9RvL__9qxzHF|X4V>yvQ8L*g%6a4#=r8$y%=L7jpv=*8Uu7Vo9We>&yEM@2r
z_DHncBRSeb|0jMteDDj%htJg+g;%*o7|CogI--c`AELAb1qhR<sDG1<GlhFf#Rvld
z;}STK%50`=-DMmqEApKrJ(wldAheNVmbih?L*8FM&ac|a-hUO6x#&sw^m^i?Cu}H9
zHA28LXR+}l%F<87j$}10ItAg(Ug^piATCGwsFbt9TXPNhqTXIjz>aMas7p=d2ZUla
zz~5fp`3jX8WSBhB)VLI=Aq&U{NF{y~zyk{MYPN5T5d)KIpV3JJNcVxvg-OZ~ilWn5
z%r*x)(CH}E67&kc!WqILDK#;1{}nAiPX#MqSwL#1hM~PjD76dSA4}ArOra>d9a9Ia
z5Jfd^X&H-L8_f4@6Jn>Yp{ix2ccK-4fi-Ld_OPElH$6wY=GX7?M*HwS@aXy3MEm$y
zV}E$aXlNVrhrSwHUODBQgRTo1*Ot(*J_nC{uUlU|%qUh`U9Bz)U!~mm!gIK3x%E1B
z=2YMG)C;)nQaZojtZw%@WRH7!y4~#5c^pkZEx$0RnC?pK?yx~8`{<bNt`Q~kDoel$
zt{GZ3oo9!k9y?4M<fRx4{B&(6a53XJ<)4EP%voif8(>%&q&kH6!%(V}rkOUiN^aBH
zSV}SJ@=;G~<VfRVh1V;kp`i@$gr<Q2^|FmPFnJ>=*B_{bQ&B>}4l0<Uh2xoV{q_*8
z;ob`#<sm(>;y@5V_ka)=8IRgQc*u*8Dx*L(0l;us*czQd!<Bf|D{~c?#Z;nwYOIE8
z{g5IiqNIgX3c_)Oz+d8pYOn9*FS%5MLBNVA9=|;ZAuYP`r-9*&x{FD5S|icj6#9NO
z7v0+b3o7jXOzXJ9u-uq&K6-FD)U%n6mop-{(Qdd6$ATmxJ+mo6G~cu`KZ(8#4=n`S
zx$i3Tr(-?7Yk-k`Q(j5pV3zNV9tE5&B~-biLCtK(PGS5hB|N8!QgMLStU830^(-cG
zyGwX(ahqF8yoV2e>?|iv?VU>5j%ivi*R3WpVOWo+g_L`cWI5jxUUaP*)@Hx7rEhb6
zd2c`Nu@`%|ag?dj88ppzWOmQkV6r`Q%y+!sxtvfv?*$=wf$}K`ANRMrNm+nzCb;gC
zY5U}R9bq1vhY8d%dqb=B6&$KK)N%Bc_`fwm2Iv0=3TzLhZ;p!0V`wAK;g?;74Y5qe
zvX*RT07{ND3qpsnW1gE=Sb0URz(pCxhs4=Diu@6Qli(}}9SVUw#*QQ(fD1M5m`f^A
zha?y>HzQ+{rbao8Hey5jAM{UV7qdZC1dGd*fXVF0+-7ZFQm6{JVAC&nFz{_7eMg_O
zYp|HLHxLNwfs~J)1y?|^xFqgKCML*w9{~6(b5jdRvJk)GY*7VeySO}bI8Xh$yp-op
z_5E~!^y5$QqyO^0Yi)!<8u?Z|f8Y4re}5-@Q~c%#5qkf83uXTNa5`6h8l6o;18MFt
zx}D@7{7dQae(uRYIFTLz1pp>i8YTj4XH>Qnt?<5X84Y<(DY<vv%+a*I4TFa!`kAwj
ziCFDYDU2pv4mB1h^H`E5BU#(?W-dZYF8pXK1W7=$PLZfhQBaqe_DcBD?BxDoX3pW(
zdG)CNlM$7mH*YjOTJ~fyP@Kf3@+KtzS0O4a{$5b`@o6O?q4W@__vE}fb^J$qYe~gQ
zMlwycS}hv%<+id02Ma>}^r)H!M{7x44#0fSR{k@e0j^U{u{b)^6@d8|>QYwab`Nj?
z%%@_&bG`A!j;id`{!b~|(tqYdU8W6#x>PMB*o_6o_TR>`_vJhN2H=k59tUeQ=(9H9
zj;BYoIl{>ZADujfe;j|Zs`UZ|c$<1r6eBcIS^t>5Vd4&xE%h|(jG7(L4Wv<Wpe^|+
z31yZs02^PekcQe`d7>}SQrXKn9L7lokJu;^5gfSoP5tBIcJvTia<uCx8+wBeq_+rv
z-I1cvs5*bhpTdV)o5mNLE)YF~K(_^_Q9fQ)^}x)3ji5B_C`7-_n%a#q`kG1vTSX#q
zS+ScRk_z%AtCox{nvh9JGmOs6uwT7)C}g4$bLM#}a=GEfDw_SRLz>22Ji0}-t`oK&
zxAujq&E8(k6MVLi?FxpL*)3Gu?nOPVc2Zybv_?I>vZ9jlkXF|s<ph5>s$_Yxg$2_P
zETt@~Ud9TOeA1|Hd6HeIrfPY@JAIu(?F7H-s+HXSUo50<>=sB~r&meOR5fkL%+zaO
zZp`j6wZ@p3YGZEvdQ48I1@u-qs0<yWCjv(oEGjTMp$F^s%+%GIx-?eq-Qn;wg&nLb
z$8W+y8`^!H0GISe(tZ~YIA8J0^rb@k)sxP6VKG7kfshTR3B_&bQf^?R2qZmv{Nagr
zB_y~tti{zRelr=<iQUSJ=B7EA+jG1GgK^qTeX;V0H{yN_U@h??eDx+HFFhFW^eAOA
z%l65p;;t5?X4AMs)vlKUE9vy+Pl>xWW7^rle{c=l+3WY^Wgr>Iqhu^@SD<pnn$@<n
zt2N>vGg)vmi{^pXlq$NHE7*%To)=i}?w#NT&2p`Cg*Q3)&DkDiR{Sma&E0Ig7d+%u
z)#BO0pY@MroE*mhRG2uRB<Hy#6#IVlROWG7rutMSjYsMxoz4~N!d)$++pasSmcF5x
zCv%NDu{2GkY-nb1O6^-a9SMK2DY@J20-bE7Q@r8vPQC1=_(7|z1H;xP&P`_#ZqK(J
zW0br)jw4C2k>{#YYy|*Wn2D)W@C47590))E@(Q9+z?a2|pc=x{VAd`3K63TP)b^*s
zM>$E)Dv)@RveZzSr)=cuDqvd4*h^qj11i~$yl?+}ojGRU;Ib;2iE~q$0%lPmFpG9s
zmSAaXb)<P8YJ{2!{a#TCo3^X``-2Xi&Rr&PWs-xz6<aNFWg{E^I~K~C2Kf}xk5<%Z
zrn-z!n-Y21IheR!ft1fn)M$s(%9P;YI99&1ST1X@FI$bGW~;`$Qtpagfx;EW<v?sH
z{PtXTsrgZq2Bq_yyUi|NCJOK*ub=LYv{P|EZ}w908SzrxcH|B%&Z~#uFnYq$Mo3Fr
zCe>8(mdM)o=sg-d67w;I@*HM!z*U#G)@%oySi!J(wAq5zy&CwbsjfSW;-4l!fbFYs
z|NN)b^OxS(fN;jH!{BI`NK#~9W)SVMqTOOAbg$)1fAjFdC}aPWjZXv)SywGbmM%}0
z?OGd-LJ>xHOx{0chOQ|$t@8D0o@QqP?eg{Q3?(Oglod6r8KQ3usp%|jBf%C0tBP~z
zVzc}u?`Ns$E~ljmscE)YhtA@?tih>lHT(bl^t~%O1^Z`cu+tLMtS^3p35OdV3u;=j
zC2!-qOiF*cQ+pdWO1`!s)e-mgmZa{-ZoOIszmetK?$X+C(0&S`f8j~qe-mP+9~J(%
zfglKYzF`syyNmKLLAz=oU2qH9&m<HnsxBoRc`d}R1NYztw_aTJ^7+NWEDS?DJAB^t
z{yY2{ZGF9a|I8-myF6$l;>$c}B;(sWXe8n5JZKEf{liehdZ&qz3wO7UnoD=Lj-HEm
zw~m(E{WXi=PS>jdHBs&;>T^VfbDbc;>EMT40TKJB?7CKhUrdy4Z{hwNFim4M>~RxS
z`BrS*W0X&gAAkGJv8Oqqt<oozPIHLQzW3)yHjQPb<W{UBl-gvQ@HAD&CCi~1#Y(q$
z2aCaz8F#hoFBY341q$*B!rkWXxsSV3VwYeAa;>mvgIc>T?ZS!Q?>S7KbAssexmCj)
z!h?~9;I=`bBf(w=;K%%|AOchk!^H#~qHl!-94ZrK<f;ZX-H2t>^MtGn;#Stmb_^+2
z`6`_T2%IbFGjA*c;d&*6V|giC4P#gJT$#8m48}nmbDM}bQ~>h2Lr5DtjH7~)U-c5n
z%T7-r?IZe7&RIWye_#bR<-O-Wbjq)vwV&hN)qigOPHz7<Iz^piJ7x(cXM6+EWbvEm
zu{KoKr)`!n%*42dd!oz;P_2Ole^(&z@+Mash!p|P4BO&q;ps)qRMGe}`^}qRFg+6n
zM2CJJwKm@mdn5|2OkR?gC!kOuiQ<$n)pvY46-CY;xs(lejesgFv_<@3)C?I!J%)sf
zNep$oNJzwhbHwbkGtIVMGF2TeS7YMpkV0!a4|H%<pnn<40W*=pmlY}UyN<7Gc*q7E
zjb{t&pQ1y0-RYnG!S2qjmc;s};DpKen+2Gtyg~Bt|1e#I=f7z_NT5$$W-0KDE?#zk
zI0IRYXOV#Nhin6h-Ir`4gs#FN-`)8P`X5|0gv4I47p{ciJvzz-%rtfkgSLbf$tzAM
zKQXnzD{di)lUh^!dW&H|3~L&vjk|c3o^{Q;c!wHSsOx672f4h`p{I6?jkCL}4YL8?
zCH56gK#p#h&H1GN*CxOP;8|6TeO$S`E9q`AT4<MBX)~^^3bULx+m=gC$F98EOUjjW
z{=Cgv0bX{XFGnn(J6!J}yI`?<$$OvDBfn9QDILW?W1ZfI3$wJY&j+)N$V^r*LlWdF
z0u-csY*6QQsQSjw)$x_Y;Ixz?hS}STe9<<U?R)fYnVzPhCw`dw6@dm9Nj`|==_$Td
zC=Z?|gJ@{*)T@Ciu3rohlz1ESy}RNuS1GHMUh}4?RX1d+YqET*1~P_@swV{K3N+1^
z6mqk3s}j82LuI)0&u9nM7F%s#roR-K{=l8O>X5CFJ`gtJ7?d;O;*lc-rZ6+>a2}J^
z*YzJea*3pCzO~b##tFMla;hB)!qi0z9VVpXvJLP<N81Na)goJKN=2_3J@T&qnCi#a
zS-sDM2Sy@5u|%x#^RSVRK=33l82n*J<cyV&T*Ci7`5Yse%q|ZNvM10daAh4#D+4`!
zY&j_tjPI(@0JaOJgu5hL&Tyq@W~~1xC3QklfbQE(aTMFes1Uxd1b+Gok9A-5`h-f^
zN%$y&+7kK(YMFz8oXDbG#4K7t>g?x=MEwM}T}W2Gjv?fThy|9VN;E|T8VCeiAC*gt
zwZAKw8_-p(|IF|6-o>AKW-i!N6{lM1yI=Pqqv`VoiuogLDe5^;MV?=EO8iBY_}B%0
zLQC@2Qnd#CuT{||mLEky?o}8P!w+$+>=h5#_0vsAWcVR%D6CYcV;JEIOH!3s|I^$^
z4smvo{9j$AXa-q-jYN$qQtd9$bwu7*yY+UR+5mGvs2_(MM>pAP$v`n%nuACQ$|g)n
z7b8aI!~0dpHgd1|D$XE1wGjMiE%ZEfQN{TB6_P-wbDM&cTog{6iebcOhD;GN(d+k6
zeV;LkbwT3;))fO%GR~Aiv9agG1>@HFLD95*dpO7?mCR0S%Dy&Ac&p$y^qn_!V!J5<
zmfRGg>(=l#p)_sU<*4x`xGu0_a}Z)aVSsicQnSvhW8vmXuf__<fPvIL4%BEO6L&$K
zq^g)l=3UrG9a(G9?V-X9Tr#5)@k)koG%eds%AVjklqTmFSJOyO=k_IF!bP)v!Rkp1
z2<--6WsDW}+={>YdCkCZ1L-?{Zs5&Z1BW3?`nw)+aBG89u&oakfc7`jFbJ8&XPM%c
zua3a3DFEK4^S7r*aKk3nDKwqMAYDQa2+{&VwgV+K*;%mA-}5nP$yxHApUX?BPhW(#
zU<87*k|)46`Ab)o)=sRm6>Xgv^d~Y1VdzV(uYZn1fKVb}on4LR?1B@6$bgH}UfE9Q
z6@Kw-@tgr)DTnwNlIeVugvb7GG(#-@2X;&1)H5Y^0qq55GiPsK*=iaKNWW&ktqoL8
z#k$g~C!pGy&{zg3Eja)Y(xpUF#Gd;V@0fZHoWpd$Ruo?tgb<E?*D&T7C<M1%`wmxx
zcgEqfMVngl0;&jVFr>aj4H0zb@sH$0h}7fmvimU}sDn%qy2|w`UcC512Stu$D%u*+
zjqq=3q2n1|VcUSnkytmUd&tXW4gymo#U(J?{>1hFW(lCQ--CAm2%H8}G<3rkY4;w!
zbfFoIU=@hQRwMX86-fjMXZG-=hJt@333~Gfz6sseyYkF3Rp=1})78Z&x=~Uf;>9tD
z%7owdVkX%{n3$&s^Ux}j##*l9;q<{ucO^)G5iK6EKzUHTT3byLBBL3^FI)0=OkIn%
zc8Vov9L8mzrK~^VhQ1^DUi5wPBIY}nhLrtU-AX#GU6mP5bRUdWyd5Vxn>i=m^aLxb
zS+gWR78ws+p>%?6b6J3v>9j{ar{8zR!`8!6MaIK2D=2pfckbx$_DXi`PQz&>cP+z0
z_A1Qwo0#({?Q0m-A6d>8*_v?Ui${!V(OPqxtBYWC-h9zoejhrn36HB2;1)iu|3;eQ
zu)DqmM4$!1hRs~gF^gvj1Vdx9n5Z9{!XdX`VhV_(hrf8c(e489zllwYm)6+G)7)aj
zcvO*m30aa0)u~2ZV!izia<VBe^wL%9NP>V<PDhla9?(=*Igw!5J~i?4h_b7x`Ztrj
zDl{F4xm5Ax%qzSLhXuq*O%hUZg>X`ANve=;X-kR_Ce_}Gm!4H=<uKrdj-PgoYW*Nb
zWrJ#+lD33$KmOaGc!Vle9=qY)Y{Xr)dyKsSxNrz`3_{5wfT44lM=8jcopiUvkGJUw
zBUoXc+kn%wutaU04p8tD4lOm7QHh~gP0>GgqUabA!YC!i$LC=Z9!__iD?`SjDxTWO
z25wrl!c<?wTiIT&kJh~xTH9W3E^f>m558+{dK?kRT4%aBF+gHyX|w6(H`6t>%<5Zb
zdgW-TT6fNbJC8cIKDf7Uc5E(dKYP2hMvHcAisg51huyTaA(EfE*2dRwTcdVt1<|+O
zJ-W0z8Nuj{7{eUUIKC0S^yA`-S@(_X?3ZWxq>*KnT}-x@9tT`kqIK@O+*FNqSr_*P
zPpTnfC=8{gI+RarU8<yXkQe;?dlBi=fU3zc>t7FcX+K8VLz;(*V-uTlHWUem;09yG
zC&OQgnaYzsibi5A(_qoz0>xhg*S&#`@O6L?{e+K5+N1!U_YS(GI8Zz3Cquo|7nt`8
z!=V(2+owq1TBub{!bv-I`N%QQhMdDNZ}T!2gWV=)o}V&zl<mD3;L9yOz(ADXrJaXh
z-X6P;?4%b#xLGsB$m~2TXj?WyNv5=Gb_bf1CDDdibay^0spma216XvZ-ATM3>lyj2
zrXC`F9u5Gdwv9SB{Sa#BIICPK#DSwIaE%$l5?kIGy<Y_|=*WFm48z~kz=P|MA;w%R
zdF!JfIt18oKi&3KCF%9O*613tz?GJKK2;}=G$D(k@y7`>)6#+aUweu+h;DC2+-~eK
z^l0wwJ2;#A?t8EGPJ_L_mF<XPb_MN2Q{3T=2e6f9Pka5#EzCT-UpU*2erQ5~OU!b$
zPsOCdL*+D2IzG0@uea<;3APA@1_ni(eqnhCpijZ42YS1Q_l$bNDKYaUI~9wFok&q}
zX4BMPMd*YN_Dm%6oXMzyU>muMzm6@#^*VRIocAK|`OVtHJzv*S!Zj=O>-hTa2fvb0
zU521V=w|20&!i+a7a!YNrfUn{q$G5U1d*^oCW`e4BQkPLCp`=cPCy2-GC(V-B^5>}
z$w}E4g-J^xR}ElFMj8>R4&<kzp;NKoCR9m~qAO{X&e4&_D$CUTmiVWHTCv29jw>n3
zA@YVL5aW&$?0B^3p&`dZBJ7mIYT?+Az=l76To7wVT1Sk<qMw=><gp2kAm{+b(SCvh
zH8hg~ZOFO~z2_hlItT0NS=qR=hQ6U_jT%GU8Rp8`_=GksF3z2?Da?IxZ|KuxjQ=Js
z%zd8|0sysKD=eZ}hzGdx_%)Hd@HA6z)aO8(j~c{yY;D=589$})>ZcVpL!MZmF^-BE
zz-R6}xi}fEbG3daf}1m7Us#yh+-QL<#rtz<$rD_-%ioSMO|-E(1k2MO*9DibzXfU<
zeCK-|bss*6_iE?dwx#69jw1Mb)xntiNLys?LCXH0ejP~R!~a<u1cE!ruAB&i^JsBU
zf9Q?X*9BBQ__xBIm{s(z;#`|Qf_NF$G~PUgl?;F0H{N{}Dyp|VVv0@<2DF5p=8UI!
zS#vQKr&Dd)4oa;;xT{eZ!C$j7OgQbwjHg>9!!I2r=gfj@dNu=U$jxp5#{;@>r6|AX
zMwgVAJKbqB*+vX0XnvqXf>J}N2Q6WZzuI!W&}{`OZt;18WQbf9nnAQFXR5wl0tU&^
zzH<}=(dMetn?i@AOQeDhUjaU{`IH|p167FQS9<EXroSBX0Np60UGWduSB3q}aU(<X
z(v_r?fUl};H?oK8>HD{@N4pe>#Q$d%2ejRmZsC8MI7)9P?9HP`O+-eOPX>W$vI3xg
zog4yt{T_I>7qK}2ZUx%cv4@b(3^k4k&P3KA@MBg&?+CR1&`3B85@C<j-@Iftd`bhE
z{?+0GXkiB`7^e6{x>@YjL7W+evq^*J{e5zvsrZ7ykRtf6*dnO?<_=qXyq#0gyI5WK
z;SLl015f>_y-xA6Qb_Zuy{Y^<3ka#uKmUc){oEHBN=OW7KR`(R$AJ1htG}Q7Ur62W
z6%-wbvHUr$cWrI{scgM^v-;VLZ2Gwt`sii4_Ok%l<_LZ&TP4_fnWfib1)rN)yKRPn
zB@6&+%H;!(GnAS>ux#|0NcX^8oi~GyZG^d9xBT++@%nzh{i@vM&(iz${YEF5vxZ>1
zyKzIz)z9bd@%A^0Vc7M;MQm%bvzg4Ph4e#9swz>`!H+TTG3G|uyFKoPm~BI|6FSCQ
zW6#wML!@97*W=`qcuDfGvwy01Pg%x1%3fYbjBvEpIM7;Fu-&Ry){4I5m1Il_sI*zE
z#DcPA;56aP@?g97>4Fc9M^=fUOxMR7<_@F)jRy;7{*3Af>-l>Fbf?oAxDaWO@estA
zWV{UXo|mAzm=(i1DF}kozL60K;$R*wb<hG?%wrild++$2$`Ow1ZBPc|HWR0{Q081R
z^gbR1{#fL)o=WmKt42HI(Um3K{zTYX*A65mn5j6iPHqeetm#5`3p3H<Ch!jvwF~vU
zyZi|(EyU0n9JR!urp>=*f5Q@6hX{tH<s6e`i_u0L<%`s=u^K=YG2#KiHgkQoX!J1;
zIIk_UP64hT{lIe{TjDU|1&kB~6Wy3mGxr+<`}DNdVTM<}y23&4a;?jl>%?Pf%NFn9
zg3hal>tu!)&#82diN7s|GtA+$Ky^AhDq62pfsI0CI(u7<Ei-8p!wflFM?e$QFnbu-
z&-MM(&HQ$D$H#lsykb^*DNpM9;dpelR-S=@q~m-;katd&qI!9Jq-jyd)|DrFK*fYS
zX(5$`JZNy;y*{CR1a(UKvPk$kr%dEAMN2P$b=s-HF0_7OnVbUZi*EcSsE5mDtWx8L
zmjJDH&$$R8r33!=!%V~#4Gr@Rni_qDyUlWgg}d6AFZwO7!!qM;JF!vRg&88sW#49A
z#qN2%V>5A8&(ZxNyQrHX^{^@gMx%Z6z@-pwCi0c~E>Q`aNvr>>yS5(Vk%RueArICX
z;kt!ebcK5hKEBSTIXf073PhM<6MAUZQg%m*`2J<}F&De?8bpAJNPWjCXUH%)dP~6t
z`@9c91tisP%Mi#u9TIx4IbIDbK&ONNqvJ<pJ^1EF^75N|z4Uda5O8iTe*NcP9sl#M
zm)sW#fPZ!T=U*QT&OfvIF984YgxvnI@{Ga*0X=bWZv_hYFJ%D=xFHtE)BXjV2?UA@
z`yspi&8=|)z+JS?M4R?n{L0I$-@HWsB>?>EjL+xSUbnG&dQc)%sy(w95<=HKN9D$B
zc}TLGs~Cu7(WSg5vWv6WO-(RG%=XXEX6MRwiv#VapT7r$EqWvu<|uo1<h9I&%$zeL
zkZXrn#?5zFV}Q|QjDj|^NV}y!mO-v5fo-nIERjpTjZ)8?%b5yTh6u9g9e0<{rv$#E
zr7PXfIW4fazRG^V>=(%ObNPeebeXvk5~wNBvY((kE#&AE9IpQn*H@aPiKc`$r?{_o
z_usPlgwtAq%sa-TbuK&)wV)}p9*#UGOwO|};8+p-&Loe)n!S{%Im6I7W;d+A7&c{%
z-Ls!%niIHYCKz;$Yx-wvvuku>>yX_EafSDA<;yV3ju@(wC7xyTTOC&G-ki(KtMKm?
zrh1Rs%5<s6^@>BmR#YK0DwBZmyswJmh3lmaK4vvc@9Q-Dbo0*b6_Qo)XV0gx6=L27
z)w6h<c@m0ml%lJ7tmvDsJ$!Iagn%Cr7#}5FRAaqW>c??Tp9a$&zV&|KA0!wae59}m
zF_i;1!CI4z@dhQ+h7tQCa`SPzUVIkhp00q|j~>q0U+H1H<e{(KvM^>@H&PUqCcZ67
zYF`Yio!`6>w2A+4MjKDjdV{It^pzzmX+$ZMl|_+$i-V+yr>Xk(R^Mc77{!BY%gra9
zI<?qO>a>~8c=PenF$T@V&#-0$_7P}1G`B94v>53McxAq-iV;jGUuf8c4Y%CFUY%3Y
zY9q9Xp&gsx6Gsfgi4wi_-)-f;EWju4HVPBfm$)$UQ=$gu7zaroAEHkTR}a+R-$abi
zJ-OF4yUe#eITkq7;5~{ScAd47V>58Kg%Q(>7&GY*VPh2BU1CJ1+Lf-LMZ1U%ag!6D
zt~<7h9zDf(YazAkX%iB!S_g-9At7mA>>qHiM4d|MJ(`vDIl%b6WH@x20oYyKuZFe>
z)m*tDF{Z03;Te{*orT9JdWb;D@GlQsxLPD)=iZ&`Uj_P8?+s~O2IFwoHOj*v*zF|v
zXSu{Ami78`t401y<1V#%q03$YRC;th<$^9p55w*8M?s%alCI!|8W0^hdtZXsmaCO&
z)v<g<lpNOeumUkkmA8!`m&ACQ&Z9j40-0J5fzsMIGM@1skp%Es3S9SoRma9wOS8Zq
zP`9f*{y4I&@9ui6PMo1@uDNsE;`U#VO|xo=TP&;t{zw!SSsf;foA}dS-Lnz$%aJJO
ziBSKijTRSUtjf&<yR1JDw%fls-fhoEq!Abk!eF*FVAan?g6%#pTn>*nseCY?GI7yv
zQwp-IkF(X1*y6hNMAK=Nk|gsf|A;7l<AGP-m>e092<{sDy;KtLtPAd*@4gZc?Wel$
zbc`bUu1c{eA_^)|PCH4lFzH*yO!8jhl@CkxB%}H`GlU24B1`?8pqaWdLE^q%Kh5nj
zh7apKgU)sEafRDHu092Bwp``wBO7h%532^s;5Xshdj9d6l^H!c>9}hT^0<E7{#7C6
zjmHa~=#3kiC~+3iG<}x};>8RU<M;*(HhJxm01T+8`Kr?^6kMrGnU2F>q<_hPUM2NH
zcxn9od67U>j)iyHt*jF*IerUL`3{$w_9b1<w;9}u5{goe9p?Nn)FI}{h~a&oc>yPB
z#pv-t5ikZN`^Zthn)<7mZ?aFluL1%4g;aw=`DAlpzpng9I?eBJ3!ha>4|ncO?;r4T
zm~;d|!+`W=lT%@o8brg8`@Bw^;0wiU>peSkv%s*;3mqVLcXz>bH}o&EDF`M!@l;$#
zBfA!53#reA%tPUGX_ooVtU8`r0^^^3UxSwcFE3W=ulthCZeE7$9QeK6^KXyyE~k_%
zk2QLi&ad2#?TOFYFMhk9?dzTGuO<ZkS?N}YQnyzt2=HRtXYU`}H6fiqyG}33qAgs^
zy3WwZTok~@U{{XZi}2r;aiRmOa>gQ@hQxmeGPQjDu(Dyoub;SGsXZLE%$w$T_3rRF
zez{MXcb#>{4CNH3Ma15Teg6Bxknq86tXt!^<vJoGy_5+~t$Z75p&NKk8X^o%;XDU2
zgVqiL?;yUq`VtH;`4DcoY#cs=3a{j&W&yd%?0d~&i}8A1SVOSS8F`+we&lnDxF^@M
z2J1IeiEiWtaf4I|!Sd|WMlyR4A1$z0_070OtGwLi=|GJfg`_wXQJ;g5paRiJ-@(|G
zTyZt+T{@IrTUYMM;Fsh;)ZXJV#^4=#NKdig^xH2j{<qk0s7xVJ?GjflpB<N)$u-^_
z_`M_vh`yOznyy2*qB=6!Vfzu~iAEPkPx9Hc+j7<1E(H`1S8J$}Ic#oT5hgw+3{0ZP
zk<XXYaaFwO`AMI>N2;q`zAnL9{K~iJF1=of=YwO#j2b;z<#mzonDJ*{=rNiEPVAPs
z{e&woA=e1LXIVL_g*25QU*IlPeOP_Jsj-*g3`7q3i4eT)!GDW5^I~rlBJCI!_KYDT
zP8V%I5#IlNo%XJ<O_s|1x}0jkC%S0eF3QC2*gt#>c#^~TE#2>jKg4Um28&zD1)g&a
zy1aJKG*SK3>KVNW^Sy^&smD$G1sS0>@^z!f-C<m>ZLZpxEqMf|Oz@A97&CLGbmrSe
zeMCUDaB1lGnYnZFwGy;2<11)q!z-CDkZ$xrgoGIZD-o>!VN+`LcvtY~Lr690xJpR`
zPJp)mU})3W1d=pLQGW`d$|5McWs-pW_iu?P`(G{-_-})~&*@G9k3gh>yHd<K#lOfh
zdTte3ES8>LD-={l9J(-a`Hmr){<a&5vO%f;VgVsHg&Zc}uzwv_`}RkxgS!2bAb<)B
zEvm+7q|(D3Ft}4%qj8aFpuY9ZbJ1tyDe(xkb%=mx@D4WCQ65@)S3hdgXDdplojYz|
zRB@Q}O7h9+xM|t!6YD(H(ZN$WVC$}NY`DPccb`{{%WG^Ywc8;G*Ef3o#~_@_<sF%o
z1FKV1x%D?zT=h~uqH6jv@-SN;E{97223~Dw?m)#s+Zi5)HLQtTXzOSjB>$1v;4`1r
zb|lc1i4<^6$QTYG7~+gPH`JI7_QIkjj?0PTatZpMY5X~iTaY=`;${1mll~We<$Q<A
z)auteFz;thXRnnf)OQ6USj*x7GxD;bw6TNtacTt}+dR2Xyh>~a<+w*n$|JL_t$NS<
z&}N;aaLspLd32uzosw!jeBr6f*#>VpF;z2=o_Lg!X1(h>zQ-v%1Ul?T&_>W_<=_{>
zvJX+Da_+=30>M`1CaxmaU|%fPmnw=@0zRRt=)-aKHgD%TP>R*-<1x<}1wxWI+Ls7#
zn_dH%-T@8YCnj&RGID}O2JA`(ez93^876Xl)1>a3GcLcbA7<kl{>CkO+ssqgA#IHm
zc`pnCdUFhC&^ZVpdfG;JVtO}+Lh5;(Wwb*o&vV^|TlF42L87GL+EIAQljW@8zmH~%
z`m2(Dx)fgywW9T_T3|tV-C?()9}Nyclsj^*rnSH1@N3;UX4pvtR+IBCwel_<=Uhkx
z2&e@KtOEFw0{K{hALEf9<I&GZIL}A`3K~HI>j1u#Kt6Wh$8hAwaP%`2&NCDe0gj|R
z9IZSY$2mB_b8=p$R$itfpspm)nv|!lm8b1EN5?WIDLXA^<@s1tvPZ$j;(t2FEUQ;S
zY-YyDQcz+h5}Szx#z|sU2N29fVsnwe1WC*oSqn-mL}Ck(z$5`0fM6*STZ#mx2+*(<
zlvs(xRw99E0yF@@S|qj>3Cs|nVJ|4L5s7U?0<#2Y0D`SZY%3C&0}1vNogdt$6d%#@
z%(t2VU99>^^a|*d%aaxi-IU9)qW}sc0W}kWl_6h}F&`_?Lp<_BJo*U<=LrcwLBm8~
zZOE5m%*PJ&5RUv1j(&o|d4ht%$dQzWqm_o^I0c8oSSin8ZDpv2+q%vQ)VP85M;fMa
zK)VYoOXQlth>S@RsWB>LDXK49c!YI5Eg}Z1e>5y34vAMx3^geVvwu7+BMFIDO$@aO
zAWVj3q#^N|iJ>k5gz2!1EF@l6G1NzZFdLSUhr}BqhKd@E**_naQG~>sB8JKe5Ej*V
zMSNH&3UU0shMoM`o!Vl7JSQT2X*mwF7JhBf*a>Y<%`9MT9TZy??)1S~tnGg&(zh#9
zZ{<4;xt_5$O6wn1^LepU!UnSyoL_U_EsrV3*%*@S>Jr|iAil9f=Dw)>KHygt$lM_9
zS=+_@_&wToDnB^RdZbtF`?)_$;P=X}APoT-o9Ztt;Qs5^e<Z{T{|`Me=>LbFxG?(H
zFAM-Zv9Y5mfS6d-QpD8E($3P^@{isBOH!Qw|4&kUt$XgcIg;}2S9!zjd_F@LPfwqK
zyB=emg=%c-kc<&cHp)+%S_#EE-UB=biH$hD<*>{%$+N*To>hzkBS|F(tR$24X)lsD
zKiR)(&L8df^YusQ>MIn^j5@_Dc6f(&R{6vI_YqB?2DxK}QSuSUn^Szbpn;LwEIa~u
zXkejlMmbIO$zW-ELc8a~m58i!fs<`Qe<bn5Q|#TI{tD^O+U2|kOL|cJgnbnT*H{!=
zqBmnfk2P=Gh&pxS91^=7?1^0|b7K8OK2lR&ao=zsDGF~jeIJ?a?nSOC`oM5_RMkbY
z+sML2-wMv)u);dwqUDX)w>+MF@bq5_3^EsHP68PhKAMqWRjjBqlHfS@Cgkr{KX43}
zf&wB$7;;W;yOI(3QZ@Li<wqm=DVMa_yw%XrbMaSBWlyfj$z6S2QjGC#F9z8f{M}9p
zITEsJ<n)X(nIo|y7BX`3h$$TkWhOP0M5=t0%t^`t8u#6dvOZNF^tIKWui2l7Rgs<%
z*}I$OgB}OUkDfz}ahNV&RgaP+{f+d?Dfr&lDGjk79<JZYK&+wsVuE>9cpZusae}z6
z4pP9U&V0&@Pa5<FXb0P-MknEOE9g({W72&Ecv>7Sxt+x;TWvH-$;Zfbp_SsmmNcJT
zp2WJv`dv~jKr<J3wSxbkL1+C;>9@i*?Gx!`v?cE7S(#)CN$sCVWr(D~9iY5OtEJw9
z@fJ>~Q`Nuc889{wNM+__e)_Z3IXZyZlOUrTh?zKP$-*KO`iFxd_mP11WK`lZr{Loj
z1_IEqnS-S;O)g4>%;%ydlNeD3Br?+LAnzOE!6JYTz+tBsW#)y|P(<zySV~A=;=?h^
zFW)0r3CXHlz!>r+h*5MFu4%B)Sof0Q^Vi+yv+!X(ej}2NBJPrVkPkPa^ecNL22n?%
zzg|?bpHiohfrphCs@5qAbBsTXbO<L`kPewLT$gt}yT_K<$X=y_C>%hjA{)Fw>Vx5c
z_W=Or;mRi}z-RF+boOo_$#jgOHiUz5ZKS{8#FSIWL9Su@G&*ns>f3!}r1^C{&=#Oi
zRE+adaWiRxBZaNH*w&BN(xfA!4$CNRwgD4skvb3uE=W`z-mheOKluWAvcrC8)QjGS
zXK~McPD9ka0%x6L*3M732By-85xlOQ2ff2q3}l4>A~?t7e5ekuZfvKP;kKD<Yi}Go
zA&8POV3!F-;`V<vJ3>pvGc@v+9|fpRgN{e<WvjfDB)@oi)VZ@jrfsPM5MY)0-xdBA
zO@<$FJg%Jm)!T%N77RJ_*OL2H;##}&&*$k-IoqUe^hnDw;3{d1H04iT+6s{X&hRb*
zmq^g7oTpLEkP1+c6VtfNl-H(=VIbpB6{X~S+IHzk!E=qjZ4}9|=slbA3&Z2b6zciJ
zCz;*yAAVrt0IY#+9-0fhH~wvco<pg#)VVV0A5ax&9geEIw=>)Jr1z?O(TWUc8K}#C
z%1H5YUuYe67R3iD;{vDX$~6*r)_J4~`mqb@f4?|Q=}~LKHJgCbr&$q2Kn(?B!22X|
zd_dIA?f!Q6W+o6PyAUVKJZP2*4#~Os(_B5ncig^Y6n#S#S@gh@vIJHv?!4^gaKuAF
zYw#5!8G8GRm-cWP65>5STX*g|am=kUFZ-0f^Kx?i<~k$bxgfy384OzO-rkY@<M5r%
z@UJ}FIF6YjT~c14*rF+hRD##02OrK7RNagmS`)xY_yXeD$0p2>PZ)$Gtm1KkeMAl|
z87HC$hs-9jrVj-L!>mNnuG{ON@=7wHBhA2=Vi^jwzJEQx{>RS$>&9QiS-#Cx_wI;h
zf!qLcb9~zAjLGR`Z`#dkKwmqum!9>^{{T^$KW|)n*@1H7=LKx>)9ChYc*j@XfW@<d
z;+f&u6T^!&@yU(<T6py~)&9ac(>_^ziAt@$$dd%3=_SX@A3gD#_(5ZGB2z%C8?N)T
z-Fn_z*WjtIav}fpz)OC7MDQ4O-adM3O<K^)g3k@ubA5-cl0ckU<&=v8ScgTp4-0x6
zt-gbnS8Z%=c6roWv`V)Vurm3HqYS%-$4Ci%h6Wj?bCBt?M@v;*YJ2eVqorU=APMG~
zi}Gqu5_A(Dkq9_lC!hmt1ej)-Q5=q%O(GkAlD9HDBJ7q#;8}WOOT>gL4eFN~(1uQl
zQer=OPGHU%J9D}UFvDcn<3n&>Hx+sbA&qDWqxS0{%~G-6toB3$tX`u=7VH{^@oRqz
zyo)laXMvz@5J6u+ppHJ30UZ^!AJilJnl<v%;uG*^sy^qMa%!gUG3!VM&eOEodETV1
zawqYk%P0h8mg~5PHuKCquzq*cJ3N?=ySirXW7+Wyf3w)k;A|;rT2a$(Dgh;wQod<+
zK1>PPUvz={gYQ6NAn4NyK2JOXjmCthO3g_GJH3_WU-_eUzo6W-PvLxPKdNKYydXR3
zVhol|n)?Bu!5|X>I1GIUc}jWwtq~hJzbTl81AqRZt_Q=)auaexd8h<xu7$S&TR|9h
zVq0E?HG7M-vU0&pTt=`0Ts^RsY4b5rHCNK_mvan*=kM0RD+@11?%5*~VDxjbU#`xb
zzcOoqVT*vun(%ebNXGGierXlU2&fSwCmTcXTKra|G*K{!Pnd!v{zj0eK({MgV`7r<
zxGgHHTfz>iAh_k1zofVAf4Z2pxW3-4_^!gca;xCKG=H^T&UG}~RQJ1zs9AKjdn*sG
z`t=3QYEfr22Y}?F%)!<;k-liODuS{mODsiW^CqK1d#O}d68_Vkqo<DeK5vFWl;|`3
zutRwX95^BWe!qSrgy%c^H%@gP_2pPhAd&p35S!mr8|{AIS{|J>$2F|{tej~6pc=2e
z)Msr6d<SAb@_Z!H9=Dl{!jDD`(o8s%$}eb2Sf&_o<%{A!g*t*X)V?4LTOR<f<c2mI
z#|Lspi@}0c+=M_w6a0Khny^Uqqv21a5GQ+p8V?p5qGyB8M0?ggMEd1mXviA3#tOQ&
zDOom;0ol5GMrSct30s1&B4tI4M{97K8TM7By<qma$!kSWGAlPs3Clt{syugFA{XEV
z*1(%!86m<Mm}!kS){9Xk&JC_sTH4on3Km)46gDA}RYrqXW==GJ0!P_Z>R%#I%IqoW
zi~Y-iSRfppe!UDnEQv@-o!JFXS2nuF4m18z!xl&KMO$QnX6YSO6V2!DT3oLa6D@y6
z5CffJqd*5vI}|Vg5IEZi&En+!F!q0Sa#wLtFkJ({m!(5`fu#iLF6owz6<A88l~_PZ
z5EcZ1X8{rEUSa8!4hcaT7o@w9PFcF7KD>B;-*fZcymKyQ=H|@xod3+}Otfm~3eBa|
zZFb}o`9a|FL<0{FwBQz$;}>xaE4LxkPn6yfkOrHXW_>55K?+85Rz%_f3^YmU3bcPu
z8XR{Q=y!5blRM-XY*vdQ8&i46yKFTXS>!8imil3Cb<z1kt|=g6p%+5R#DLLf(xGcA
zk=)qYc~YjL>h4Q-0@bK=>?Td66CjH`)5?Leo_!X-?_#9}pNtg~vzLzBLo382G9uU_
zbTP3;Y<O6hOF1nTN3v4D>rh#T6jv-A^|-rjUv;{pKxVk0GT(Yp)HX&Ey)|#9>=7ht
zROJQVE5f6eWs5*zqc~Hi#$;eIKDf0-AFGtrf10SbnEKyAwt&~VSi5!$x-Urr2zyBp
zy`pEsW|6bA$?eD1hD*Mz;@^f;P}!v3`5bNApeChZpQi;5yY9Y~Vn@|Rl$IP6m&Xjm
zw81_f$R8_Ze(odbKc)+}#}{0{jinCdqohuY96;wY1E~xMsP^CZv;I(Rc?^Y^yMisq
zBtMk*h%7h|LRU{YhffYBhfkd1`3l8}wHBGy<PvkWc+@?JDxR5b>h^hp&2v;eGngUl
zHor*!Fb9*mC$)D+_I3xUwQc*XKn2?P2`K#dF|p^Y8r687$yo`S=&U2HP0$Bo&y#E;
zF+!AnKE}r6(+ywu3!Ab5C4WRCEZx(=F7m*ZD)eEeKWByr*fkY`C*~J*8QA0Yka#}<
zIkbtbqyWoai|GyXwy~qzwIxv8Mv*<V6dc8t#=&4KD&`G?+-J7&3xj6K4p&q_YF7aB
z%TC4(;d#t0yte9Q*+<bCLV^X22s%*0N7KIeB^u*xX-UO1{F(=B`;`67OFFoKmJJ%w
z>!#-p;W%)Gx2SIvD(F#(XHUQ}$-a9j4CqmY+2vpHk(beGG&-4LsS#4`{ynPYdl%;&
zJAJ6QT@ELiL{>uoPe%2EHLU?c8F6k7Qy+a(h+N~GY}CF6KjXS!^4!Ny&j{OiyN9%@
zAmy+5JqLY2N+uC%dS6bIM{cs%b3dADVf$lEt6$8u#yEH*sxuNLNHgdvxF9YsBBL0(
zAY(wsxjkaVhBHk<h~;zN$}KTb{&9m|&Uhn&0-0MtsU0T1`Oa|kE1vW%*pdlTF=UAz
z?KVs}tfM?~zPDq}!Wm>lj?L>Q`tD(iT;d_UHoq0TMp6`l<_Bzgl1;2Sb~MS92Da{d
z6U!g!osX4u-nknd1Qu^t2NY%X@JxP4PHDPBMUSUF7Nwl=1{XO7S}|fs>P<jQJ&=%2
zF$Y08CO}QJ9L=knB97@tsoAsd!UPKpbE(dxzH5(b6;x2Sol0-`SHFnUAhv3^@sJ~_
z)Af7#r{?LqN8z0rbO<M%+}sit)_Pel5ngA)95uHIF3tjBDD+P!{F`8%bCTzy98=ci
zsL%)J&c5@O!Nuv73V2;wu9PK=1*iNTM>}ZI&uqTK^=dai^0VLSES7cVLR=E3)-r-=
z-|eWpJm3u+9(#WGwJwDjWZbQM#jp;em54BN0H>B-mRnN-!0b93jvzq1f1MqRp#*_N
z)nHyYLHr`~f&^58=CD`<xRwp#3~z$YkpCuU8Dk)KsC3RmxdQlQDTsNgQgGB$3;Q#F
zIB^C8!Jku1)@?1cwC$=>U+G15@9=C?0sY_5%H+W%57q2lRdkEdiaSW}ye3YTksTX#
zA|!&8#Gffo8W&4Hn?;eqZx8%+z1A=97+R}jxb`ss$f2^El<obPWjX3d5U`+B96JU4
z9MMHz=>!oT967ARy6xV;ioS5|kTv25@%V_ARay#9&V;2>)|#QOX`4cQ2O1f*C}Kdk
zfl6uuu+Suh;L8ot9=hKu*P^(x&(0mo2m#g#Amc?%eSGD)X<eomHF6BPJboNe=W)Ds
zk-6Z4eFDz~K=?@gF;Jdvf=}Gtja+(H<Z_El;HbQYX!7JfEiB%}LNjH&g%>~?%H6yk
zP-BusELE+lX&$Llo{-r;%ASu8r9!ch_5GraEQP|8d~=VwmBN4%lb=Op0nXJf>lSOX
z*4{-Ut41N3xQ33w$XY3CNnRbwVkX{2J0Xc7b4R$-k_fT}JqMu>Y-%jkrRP`Thn!k|
zALZam9>-|8SdS-<=sc+*D!JTY7kC3ry|GQ_-TQ4-pFms}>@YeQD<~+<M>f3I&%}Dz
z!_c_ra=A2AFYxf%pe|oULlab?9DUi$N*?a-8n`#pdRD43Mb!4NE|Wl-p6l5j<wvUf
z|7F($AlCKBU1+enIIRNr{GQwF2ifdFU)~VS(0;@A0$wHTZsYCjcICJp8MQC3wV>FI
z48FLtM~P*xDz)OtEv}Qa)$zl#Y7%NZ?G_C8B_4k;NBq>tb$b47hi!7xzC8BVhal;J
zkMp&9F@6o%HR=sn5&2(YvXDE?5mM$L1E839oH-FI%VLQPAOT{R6S%P*Lk#6aM?{yl
zpSRg`eH<KT)OpF>-@G?)SadVs@fkUf!^!IzLP34{Ab94ALD++NuOp-A`5J}<T%e{*
z_~~@P;1{_O{cf4FmCs6ZPSB^2kmS|c_Y82A8~foDs_?JfQrH^|O)i}(O@wX?K2~)x
zO*Qcg=~yCL?0KR~L}3>{-0P`Wji0a9O$xP=7}J|8Oj&jES((LMpkAr$E*UkJ_m#KX
zZr%!0<g6siTc;2gas|nkTc^%W?@m8*7*V2KwO4)nq!;j(Ie<9dUrd2@i%Wr}=(e2q
zL;&?@95!BB(p0=&QC99e`1)M?_xyE8+LBQ6Bvyha7BZiULJR&8u)NbQVeU|`I;ZGd
zg)-Z~<6U>cF|P%qnBwkYRbXAU2d~3LVWvZ1$EZHZ<TuWdx6-JAVA&u~Y~M==O=~h~
zqIl(OD#W3W#%WLME{h6yTGmjM3DQ_kW|L7~4H=Dx)cLPuY+dA1Ykv;%-6swxmFiY;
z6Xn%tD|+K2`$yyEZ5^2OCK4yGv5NZcM~<tcOXbJZ7yK=!Yqw27!&hla+}{C5GFlP%
z)e`p48ThQQ?V4P1vd?`=V{3wSn^dtj$qw?LUZql~Z>Gt(v2;|?z;i08=HE7U0P1Cf
z$0Tx#jrNZG8fVv=`TxMaDr8rMD{6NWuYX;Hj`Ue5d8TDgx#?QI;u%oAjLN!zr>wQg
zMg}i`Ctp47vbNWvr%Z`D>WvxrGNLHCHcP@6k4OIsb5P>j(F-zbTR<>P$UZL`a!~Kj
ztH}KpCKb{ti&Zbd_HwQ~#;Np`hB8`vl@d{M;KLNPBPV=rvVsEGrWq7Xu#dXw8{n77
zLD(|u<!75w$FL6^BGUmno9hOX>AE7UU<+DMaZjjfd>UH{<ZA0_R?WaO&}3rsgcfXr
zhOF8I9M3>y;cl&ykHbjoGoze1xx33F@z0o$8*O0}Tas%YL@lwpg?%(-=i5rWC=Q>C
zATw}_CLP1iw!53tM@g~Lk`8xLtQX9?zw0|d@=E!S8i-|WsW`%goVu$t8(R(zYaT9q
zh?7`ZZT$}IiW3_ZPcmJt!li7j?6MCCgc{_?#k8S3xU9v3TJ-zQ_OaLu1`K_Xzw~;2
zlGb=5PN++80*In_|9SaZ+aZds3{jcD?kDr<LT*xN7COT-y%S_=veBUHZ{s<X^tQ3V
zecSz&>Fh!*YnchpdyVE|OE@~|{36W4wx7m>zoy&%tY<lTXCVRfZQK_78|C`wj43VQ
znAV;7=LpTtA6ov@IV|hn<tR!xSsCHm^M2987VPiUztXphy7wOW|9GyzlaU>_ki_IZ
zUYGEy*Eq)QDY}ZNiXZ3nIoD9!TG|Z0hV1^yGpZM>HL{0%gi*Omf|PlgpQ@RNQUo4M
zmzCV;LIaH$G2Gfl2y_amPv_$MORsuatSbowToQ(M=u5`78_IMUeIwP}DpsKK&c4%1
zqT?;?`+fC`oC#Q6MJ@@%fLU9gnYdCMvUT=PSmDH!>^#vWN%s$t2a+Q_N5u*2oDG`E
zPfxFPA>1ttTk@_mgpWH^CWSAPf2OG4vLA_gJ!|18I5c^2%`0H_N7+nnAbpU0nk3Op
z`i-XeldXch3dPV_JovRZst56&RVHB&on3;MLw+9&hOTXMfba$kzKnP9)zB{-l#>5K
z=_wt783^9p$`zl^^q5{>lBD$JC-CV`XO80X5+lk@lIY7Y;S#^>dyWcnE+?un5<?*{
z!R<-!wi%M76nZgBg`VY~s%oXeFL6p73ZkP^--m6ML=IX4w=73zNHGP@WLwQf>m%Z7
zk3RX^56{}^nt}|1#;SpLlFR2cN&#USrtBe0DD-)!!15IhX(+7x_-y(;CqhS+E<W4a
z1hG-!KEyH65a#y;|MNO*0z2YZIzBWe6BvpP6vM&NO=Mj1Y3T0n!jm!VL4w|6ga!^`
zO_R*G``P`6L#DjuEBUyz$DII;&a)auso}ra+o2ZctZ}X0B#(**STH&XClBmk7a`);
z)V@%n+kxMqbHp?63n_See||wdKp=r$+(HGUy2TxOc2yffF(mp{{h$E(6tCpZw@)*{
z%d-Ge#o<^ibJMq6CrJ{BhC(=e1<afgu9Gu_W5?1~A2~TkJf9&or0MxJQS!w`xyfVt
za06;%dP%1#y2(-Lj#;LfvD_nAhg7}$_pRn=OqF)f!$oo9t1WA`FFoI|r!&;))mWe1
zumepE9UGeMJa>9V_Cl=;0?QrEoS&u=Y3~f%kbyXy9V%v^4y|lUa`UQ!%V$Gq*YfQO
zm1@aA&9jH@K1PaP{&?KxUMnfk;W@@hTAo;fNw==3ULG2^rfv0apq>>l)pi(9f^|x;
z=Vmg$TwiXL1;Scov&4M;I==2ka9L%)nezCRQHh$D({S9yka<n-5e5nv`U|(6BY8&e
zOJqU&-tTs}D$PpoA5NZK9~?W`UXX?19x{w&U7*`4vgZP<lmjZNMDKFPV9+xim&wSp
z#qTURJlDtD`+--1f1!ap5eJS#2LSx#1brPWAT>5MfZ#r8?y2G52tjdA4gVQ+!GBjS
zHjb`Fb}sI(@A={X$)W4Nlf%E$|CNk?AN^M{{xj-=Gw<c&e{>Cf9bCM>iGcUfbw3lt
H{oVZ^LrN|)

diff --git a/Solutions/Global Secure Access/Package/createUiDefinition.json b/Solutions/Global Secure Access/Package/createUiDefinition.json
index dec8e52b06..82cdf541e4 100644
--- a/Solutions/Global Secure Access/Package/createUiDefinition.json	
+++ b/Solutions/Global Secure Access/Package/createUiDefinition.json	
@@ -164,13 +164,13 @@
           {
             "name": "analytic3",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Exchange AuditLog Disabled",
+            "label": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
             "elements": [
               {
                 "name": "analytic3-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies when the exchange audit logging has been disabled which may be an adversary attempt to evade detection or avoid other defenses."
+                  "text": "Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses."
                 }
               }
             ]
@@ -178,7 +178,7 @@
           {
             "name": "analytic4",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Accessed files shared by temporary external user",
+            "label": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
             "elements": [
               {
                 "name": "analytic4-text",
@@ -192,7 +192,7 @@
           {
             "name": "analytic5",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - External User Added and Removed in Short Timeframe",
+            "label": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
             "elements": [
               {
                 "name": "analytic5-text",
@@ -206,13 +206,13 @@
           {
             "name": "analytic6",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Mail redirect via ExO transport rule",
+            "label": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
             "elements": [
               {
                 "name": "analytic6-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies when Exchange Online transport rule configured to forward emails.\nThis could be an adversary mailbox configured to collect mail from multiple user accounts."
+                  "text": "Identifies when an Exchange Online transport rule is configured to forward emails.\nThis could indicate an adversary mailbox configured to collect mail from multiple user accounts."
                 }
               }
             ]
@@ -220,13 +220,13 @@
           {
             "name": "analytic7",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Malicious Inbox Rule",
+            "label": "GSA Enriched Office 365 - Malicious Inbox Rule",
             "elements": [
               {
                 "name": "analytic7-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\n This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/"
+                  "text": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\nThis is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/"
                 }
               }
             ]
@@ -234,13 +234,13 @@
           {
             "name": "analytic8",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Multiple Teams deleted by a single user",
+            "label": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
             "elements": [
               {
                 "name": "analytic8-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "This detection flags the occurrences of deleting multiple teams within an hour.\nThis data is a part of Office 365 Connector in Microsoft Sentinel."
+                  "text": "This detection flags the occurrences of deleting multiple teams within a day.\nThis data is a part of Office 365 Connector in Microsoft Sentinel."
                 }
               }
             ]
@@ -248,7 +248,7 @@
           {
             "name": "analytic9",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Multiple Users Email Forwarded to Same Destination",
+            "label": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
             "elements": [
               {
                 "name": "analytic9-text",
@@ -262,7 +262,7 @@
           {
             "name": "analytic10",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Office Policy Tampering",
+            "label": "GSA Enriched Office 365 - Office Policy Tampering",
             "elements": [
               {
                 "name": "analytic10-text",
@@ -276,7 +276,7 @@
           {
             "name": "analytic11",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - New Executable via Office FileUploaded Operation",
+            "label": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
             "elements": [
               {
                 "name": "analytic11-text",
@@ -290,7 +290,7 @@
           {
             "name": "analytic12",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Rare and Potentially High-Risk Office Operations",
+            "label": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
             "elements": [
               {
                 "name": "analytic12-text",
@@ -304,7 +304,7 @@
           {
             "name": "analytic13",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - SharePoint File Operation via Previously Unseen IPs",
+            "label": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
             "elements": [
               {
                 "name": "analytic13-text",
@@ -318,7 +318,7 @@
           {
             "name": "analytic14",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - SharePointFileOperation via devices with previously unseen user agents",
+            "label": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
             "elements": [
               {
                 "name": "analytic14-text",
@@ -332,7 +332,7 @@
           {
             "name": "analytic15",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Sharepoint File Transfer Above Threshold",
+            "label": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
             "elements": [
               {
                 "name": "analytic15-text",
@@ -346,13 +346,13 @@
           {
             "name": "analytic16",
             "type": "Microsoft.Common.Section",
-            "label": "Office 365 - Sharepoint File Transfer Above Threshold",
+            "label": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
             "elements": [
               {
                 "name": "analytic16-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur."
+                  "text": "Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur."
                 }
               }
             ]
@@ -426,7 +426,7 @@
           {
             "name": "huntingquery1",
             "type": "Microsoft.Common.Section",
-            "label": "Anomalous access to other users' mailboxes",
+            "label": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
             "elements": [
               {
                 "name": "huntingquery1-text",
@@ -454,7 +454,7 @@
           {
             "name": "huntingquery3",
             "type": "Microsoft.Common.Section",
-            "label": "External user from a new organisation added to Teams",
+            "label": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
             "elements": [
               {
                 "name": "huntingquery3-text",
@@ -468,7 +468,7 @@
           {
             "name": "huntingquery4",
             "type": "Microsoft.Common.Section",
-            "label": "Mail Redirect via ExO Transport Rule",
+            "label": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
             "elements": [
               {
                 "name": "huntingquery4-text",
@@ -482,7 +482,7 @@
           {
             "name": "huntingquery5",
             "type": "Microsoft.Common.Section",
-            "label": "Bots added to multiple teams",
+            "label": "GSA Enriched Office 365 - Bots added to multiple teams",
             "elements": [
               {
                 "name": "huntingquery5-text",
@@ -496,7 +496,7 @@
           {
             "name": "huntingquery6",
             "type": "Microsoft.Common.Section",
-            "label": "User made Owner of multiple teams",
+            "label": "GSA Enriched Office 365 - User made Owner of multiple teams",
             "elements": [
               {
                 "name": "huntingquery6-text",
@@ -510,7 +510,7 @@
           {
             "name": "huntingquery7",
             "type": "Microsoft.Common.Section",
-            "label": "Multiple Teams deleted by a single user",
+            "label": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
             "elements": [
               {
                 "name": "huntingquery7-text",
@@ -524,7 +524,7 @@
           {
             "name": "huntingquery8",
             "type": "Microsoft.Common.Section",
-            "label": "Previously Unseen Bot or Application Added to Teams",
+            "label": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
             "elements": [
               {
                 "name": "huntingquery8-text",
@@ -538,7 +538,7 @@
           {
             "name": "huntingquery9",
             "type": "Microsoft.Common.Section",
-            "label": "New Windows Reserved Filenames staged on Office file services",
+            "label": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
             "elements": [
               {
                 "name": "huntingquery9-text",
@@ -552,7 +552,7 @@
           {
             "name": "huntingquery10",
             "type": "Microsoft.Common.Section",
-            "label": "Office Mail Forwarding - Hunting Version",
+            "label": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
             "elements": [
               {
                 "name": "huntingquery10-text",
@@ -566,7 +566,7 @@
           {
             "name": "huntingquery11",
             "type": "Microsoft.Common.Section",
-            "label": "Files uploaded to teams and access summary",
+            "label": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
             "elements": [
               {
                 "name": "huntingquery11-text",
@@ -580,7 +580,7 @@
           {
             "name": "huntingquery12",
             "type": "Microsoft.Common.Section",
-            "label": "User added to Teams and immediately uploads file",
+            "label": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
             "elements": [
               {
                 "name": "huntingquery12-text",
@@ -594,7 +594,7 @@
           {
             "name": "huntingquery13",
             "type": "Microsoft.Common.Section",
-            "label": "Windows Reserved Filenames Staged on Office File Services",
+            "label": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
             "elements": [
               {
                 "name": "huntingquery13-text",
@@ -636,7 +636,7 @@
           {
             "name": "huntingquery16",
             "type": "Microsoft.Common.Section",
-            "label": "SharePointFileOperation via previously unseen IPs",
+            "label": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
             "elements": [
               {
                 "name": "huntingquery16-text",
@@ -650,7 +650,7 @@
           {
             "name": "huntingquery17",
             "type": "Microsoft.Common.Section",
-            "label": "SharePointFileOperation via devices with previously unseen user agents",
+            "label": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
             "elements": [
               {
                 "name": "huntingquery17-text",
@@ -664,7 +664,7 @@
           {
             "name": "huntingquery18",
             "type": "Microsoft.Common.Section",
-            "label": "Non-owner mailbox login activity",
+            "label": "GSA Enriched Office 365 - Non-owner mailbox login activity",
             "elements": [
               {
                 "name": "huntingquery18-text",
@@ -678,7 +678,7 @@
           {
             "name": "huntingquery19",
             "type": "Microsoft.Common.Section",
-            "label": "PowerShell or non-browser mailbox login activity",
+            "label": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
             "elements": [
               {
                 "name": "huntingquery19-text",
@@ -692,7 +692,7 @@
           {
             "name": "huntingquery20",
             "type": "Microsoft.Common.Section",
-            "label": "SharePoint File Operation via Client IP with Previously Unseen User Agents",
+            "label": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
             "elements": [
               {
                 "name": "huntingquery20-text",
@@ -706,7 +706,7 @@
           {
             "name": "huntingquery21",
             "type": "Microsoft.Common.Section",
-            "label": "Multiple Users Email Forwarded to Same Destination",
+            "label": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
             "elements": [
               {
                 "name": "huntingquery21-text",
diff --git a/Solutions/Global Secure Access/Package/mainTemplate.json b/Solutions/Global Secure Access/Package/mainTemplate.json
index 239fc11ce6..4ffc806cb7 100644
--- a/Solutions/Global Secure Access/Package/mainTemplate.json	
+++ b/Solutions/Global Secure Access/Package/mainTemplate.json	
@@ -80,102 +80,102 @@
       "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','57abf863-1c1e-46c6-85b2-35370b712c1e','-', '1.0.0')))]"
     },
     "analyticRuleObject3": {
-      "analyticRuleVersion3": "2.0.7",
+      "analyticRuleVersion3": "2.0.8",
       "_analyticRulecontentId3": "dc451755-8ab3-4059-b805-e454c45d1d44",
       "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'dc451755-8ab3-4059-b805-e454c45d1d44')]",
       "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('dc451755-8ab3-4059-b805-e454c45d1d44')))]",
-      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','dc451755-8ab3-4059-b805-e454c45d1d44','-', '2.0.7')))]"
+      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','dc451755-8ab3-4059-b805-e454c45d1d44','-', '2.0.8')))]"
     },
     "analyticRuleObject4": {
-      "analyticRuleVersion4": "2.1.2",
+      "analyticRuleVersion4": "2.1.3",
       "_analyticRulecontentId4": "4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac",
       "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac')]",
       "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac')))]",
-      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac','-', '2.1.2')))]"
+      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac','-', '2.1.3')))]"
     },
     "analyticRuleObject5": {
-      "analyticRuleVersion5": "2.1.3",
+      "analyticRuleVersion5": "2.1.4",
       "_analyticRulecontentId5": "1a8f1297-23a4-4f09-a20b-90af8fc3641a",
       "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1a8f1297-23a4-4f09-a20b-90af8fc3641a')]",
       "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1a8f1297-23a4-4f09-a20b-90af8fc3641a')))]",
-      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1a8f1297-23a4-4f09-a20b-90af8fc3641a','-', '2.1.3')))]"
+      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1a8f1297-23a4-4f09-a20b-90af8fc3641a','-', '2.1.4')))]"
     },
     "analyticRuleObject6": {
-      "analyticRuleVersion6": "2.0.5",
+      "analyticRuleVersion6": "2.1.4",
       "_analyticRulecontentId6": "edcfc2e0-3134-434c-8074-9101c530d419",
       "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'edcfc2e0-3134-434c-8074-9101c530d419')]",
       "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('edcfc2e0-3134-434c-8074-9101c530d419')))]",
-      "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','edcfc2e0-3134-434c-8074-9101c530d419','-', '2.0.5')))]"
+      "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','edcfc2e0-3134-434c-8074-9101c530d419','-', '2.1.4')))]"
     },
     "analyticRuleObject7": {
-      "analyticRuleVersion7": "2.0.5",
+      "analyticRuleVersion7": "2.0.6",
       "_analyticRulecontentId7": "a9c76c8d-f60d-49ec-9b1f-bdfee6db3807",
       "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a9c76c8d-f60d-49ec-9b1f-bdfee6db3807')]",
       "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a9c76c8d-f60d-49ec-9b1f-bdfee6db3807')))]",
-      "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a9c76c8d-f60d-49ec-9b1f-bdfee6db3807','-', '2.0.5')))]"
+      "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a9c76c8d-f60d-49ec-9b1f-bdfee6db3807','-', '2.0.6')))]"
     },
     "analyticRuleObject8": {
-      "analyticRuleVersion8": "2.0.5",
+      "analyticRuleVersion8": "2.0.6",
       "_analyticRulecontentId8": "db60e4b6-a845-4f28-a18c-94ebbaad6c6c",
       "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'db60e4b6-a845-4f28-a18c-94ebbaad6c6c')]",
       "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('db60e4b6-a845-4f28-a18c-94ebbaad6c6c')))]",
-      "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','db60e4b6-a845-4f28-a18c-94ebbaad6c6c','-', '2.0.5')))]"
+      "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','db60e4b6-a845-4f28-a18c-94ebbaad6c6c','-', '2.0.6')))]"
     },
     "analyticRuleObject9": {
-      "analyticRuleVersion9": "2.0.4",
+      "analyticRuleVersion9": "2.0.5",
       "_analyticRulecontentId9": "d75e8289-d1cb-44d4-bd59-2f44a9172478",
       "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd75e8289-d1cb-44d4-bd59-2f44a9172478')]",
       "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d75e8289-d1cb-44d4-bd59-2f44a9172478')))]",
-      "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d75e8289-d1cb-44d4-bd59-2f44a9172478','-', '2.0.4')))]"
+      "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d75e8289-d1cb-44d4-bd59-2f44a9172478','-', '2.0.5')))]"
     },
     "analyticRuleObject10": {
-      "analyticRuleVersion10": "2.0.4",
+      "analyticRuleVersion10": "2.0.6",
       "_analyticRulecontentId10": "0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb",
       "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb')]",
       "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb')))]",
-      "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb','-', '2.0.4')))]"
+      "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb','-', '2.0.6')))]"
     },
     "analyticRuleObject11": {
-      "analyticRuleVersion11": "2.0.6",
+      "analyticRuleVersion11": "2.0.7",
       "_analyticRulecontentId11": "178c62b4-d5e5-40f5-8eab-7fccd0051e7a",
       "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '178c62b4-d5e5-40f5-8eab-7fccd0051e7a')]",
       "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('178c62b4-d5e5-40f5-8eab-7fccd0051e7a')))]",
-      "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','178c62b4-d5e5-40f5-8eab-7fccd0051e7a','-', '2.0.6')))]"
+      "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','178c62b4-d5e5-40f5-8eab-7fccd0051e7a','-', '2.0.7')))]"
     },
     "analyticRuleObject12": {
-      "analyticRuleVersion12": "2.0.6",
+      "analyticRuleVersion12": "2.0.7",
       "_analyticRulecontentId12": "433c254d-4b84-46f7-99ec-9dfefb5f6a7b",
       "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '433c254d-4b84-46f7-99ec-9dfefb5f6a7b')]",
       "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('433c254d-4b84-46f7-99ec-9dfefb5f6a7b')))]",
-      "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','433c254d-4b84-46f7-99ec-9dfefb5f6a7b','-', '2.0.6')))]"
+      "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','433c254d-4b84-46f7-99ec-9dfefb5f6a7b','-', '2.0.7')))]"
     },
     "analyticRuleObject13": {
-      "analyticRuleVersion13": "2.0.5",
+      "analyticRuleVersion13": "2.0.6",
       "_analyticRulecontentId13": "7460e34e-4c99-47b2-b7c0-c42e339fc586",
       "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7460e34e-4c99-47b2-b7c0-c42e339fc586')]",
       "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7460e34e-4c99-47b2-b7c0-c42e339fc586')))]",
-      "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7460e34e-4c99-47b2-b7c0-c42e339fc586','-', '2.0.5')))]"
+      "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7460e34e-4c99-47b2-b7c0-c42e339fc586','-', '2.0.6')))]"
     },
     "analyticRuleObject14": {
-      "analyticRuleVersion14": "2.2.5",
+      "analyticRuleVersion14": "2.2.6",
       "_analyticRulecontentId14": "efd17c5f-5167-40f8-a1e9-0818940785d9",
       "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'efd17c5f-5167-40f8-a1e9-0818940785d9')]",
       "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('efd17c5f-5167-40f8-a1e9-0818940785d9')))]",
-      "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','efd17c5f-5167-40f8-a1e9-0818940785d9','-', '2.2.5')))]"
+      "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','efd17c5f-5167-40f8-a1e9-0818940785d9','-', '2.2.6')))]"
     },
     "analyticRuleObject15": {
-      "analyticRuleVersion15": "1.0.5",
+      "analyticRuleVersion15": "2.0.7",
       "_analyticRulecontentId15": "30375d00-68cc-4f95-b89a-68064d566358",
       "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '30375d00-68cc-4f95-b89a-68064d566358')]",
       "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('30375d00-68cc-4f95-b89a-68064d566358')))]",
-      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','30375d00-68cc-4f95-b89a-68064d566358','-', '1.0.5')))]"
+      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','30375d00-68cc-4f95-b89a-68064d566358','-', '2.0.7')))]"
     },
     "analyticRuleObject16": {
-      "analyticRuleVersion16": "1.0.5",
+      "analyticRuleVersion16": "2.0.7",
       "_analyticRulecontentId16": "abd6976d-8f71-4851-98c4-4d086201319c",
       "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'abd6976d-8f71-4851-98c4-4d086201319c')]",
       "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('abd6976d-8f71-4851-98c4-4d086201319c')))]",
-      "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','abd6976d-8f71-4851-98c4-4d086201319c','-', '1.0.5')))]"
+      "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','abd6976d-8f71-4851-98c4-4d086201319c','-', '2.0.7')))]"
     },
     "analyticRuleObject17": {
       "analyticRuleVersion17": "1.0.0",
@@ -199,7 +199,7 @@
       "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1','-', '1.0.0')))]"
     },
     "huntingQueryObject1": {
-      "huntingQueryVersion1": "2.0.1",
+      "huntingQueryVersion1": "2.0.2",
       "_huntingQuerycontentId1": "271e8881-3044-4332-a5f4-42264c2e0315",
       "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('271e8881-3044-4332-a5f4-42264c2e0315')))]"
     },
@@ -209,12 +209,12 @@
       "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('119d9e1c-afcc-4d23-b239-cdb4e7bf851c')))]"
     },
     "huntingQueryObject3": {
-      "huntingQueryVersion3": "2.0.1",
+      "huntingQueryVersion3": "2.0.2",
       "_huntingQuerycontentId3": "6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45",
       "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45')))]"
     },
     "huntingQueryObject4": {
-      "huntingQueryVersion4": "2.0.1",
+      "huntingQueryVersion4": "2.0.2",
       "_huntingQuerycontentId4": "9891684a-1e3a-4546-9403-3439513cbc70",
       "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9891684a-1e3a-4546-9403-3439513cbc70')))]"
     },
@@ -224,42 +224,42 @@
       "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9eb64924-ec8d-44d0-b1f2-10665150fb74')))]"
     },
     "huntingQueryObject6": {
-      "huntingQueryVersion6": "2.0.1",
+      "huntingQueryVersion6": "2.0.2",
       "_huntingQuerycontentId6": "558f15dd-3171-4b11-bf24-31c0610a20e0",
       "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('558f15dd-3171-4b11-bf24-31c0610a20e0')))]"
     },
     "huntingQueryObject7": {
-      "huntingQueryVersion7": "2.0.1",
+      "huntingQueryVersion7": "2.0.2",
       "_huntingQuerycontentId7": "64990414-b015-4edf-bef0-343b741e68c5",
       "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('64990414-b015-4edf-bef0-343b741e68c5')))]"
     },
     "huntingQueryObject8": {
-      "huntingQueryVersion8": "2.0.1",
+      "huntingQueryVersion8": "2.0.2",
       "_huntingQuerycontentId8": "bf76e508-9282-4cf1-9cc1-5c20c3dea2ee",
       "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bf76e508-9282-4cf1-9cc1-5c20c3dea2ee')))]"
     },
     "huntingQueryObject9": {
-      "huntingQueryVersion9": "2.0.1",
+      "huntingQueryVersion9": "2.0.2",
       "_huntingQuerycontentId9": "641ecd2d-27c9-4f05-8433-8205096b09fc",
       "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('641ecd2d-27c9-4f05-8433-8205096b09fc')))]"
     },
     "huntingQueryObject10": {
-      "huntingQueryVersion10": "2.0.1",
+      "huntingQueryVersion10": "2.0.2",
       "_huntingQuerycontentId10": "d49fc965-aef3-49f6-89ad-10cc4697eb5b",
       "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d49fc965-aef3-49f6-89ad-10cc4697eb5b')))]"
     },
     "huntingQueryObject11": {
-      "huntingQueryVersion11": "2.0.1",
+      "huntingQueryVersion11": "2.0.2",
       "_huntingQuerycontentId11": "90e198a9-efb6-4719-ad89-81b8e93633a7",
       "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('90e198a9-efb6-4719-ad89-81b8e93633a7')))]"
     },
     "huntingQueryObject12": {
-      "huntingQueryVersion12": "2.0.1",
+      "huntingQueryVersion12": "2.0.2",
       "_huntingQuerycontentId12": "3d6d0c04-7337-40cf-ace6-c471d442356d",
       "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3d6d0c04-7337-40cf-ace6-c471d442356d')))]"
     },
     "huntingQueryObject13": {
-      "huntingQueryVersion13": "2.0.1",
+      "huntingQueryVersion13": "2.0.2",
       "_huntingQuerycontentId13": "61c28cd7-3139-4731-8ea7-2cbbeabb4684",
       "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('61c28cd7-3139-4731-8ea7-2cbbeabb4684')))]"
     },
@@ -274,12 +274,12 @@
       "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('723c5f46-133f-4f1e-ada6-5c138f811d75')))]"
     },
     "huntingQueryObject16": {
-      "huntingQueryVersion16": "2.0.1",
+      "huntingQueryVersion16": "2.0.2",
       "_huntingQuerycontentId16": "e3d24cfd-b2a1-4ba7-8f80-0360892f9d57",
       "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3d24cfd-b2a1-4ba7-8f80-0360892f9d57')))]"
     },
     "huntingQueryObject17": {
-      "huntingQueryVersion17": "2.0.1",
+      "huntingQueryVersion17": "2.0.2",
       "_huntingQuerycontentId17": "f2367171-1514-4c67-88ef-27434b6a1093",
       "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f2367171-1514-4c67-88ef-27434b6a1093')))]"
     },
@@ -289,17 +289,17 @@
       "huntingQueryTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a8f410d-38b5-4d75-90da-32b472b97230')))]"
     },
     "huntingQueryObject19": {
-      "huntingQueryVersion19": "2.0.1",
+      "huntingQueryVersion19": "2.0.2",
       "_huntingQuerycontentId19": "49a4f65a-fe18-408e-afec-042fde93d3ce",
       "huntingQueryTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('49a4f65a-fe18-408e-afec-042fde93d3ce')))]"
     },
     "huntingQueryObject20": {
-      "huntingQueryVersion20": "2.0.1",
+      "huntingQueryVersion20": "2.0.2",
       "_huntingQuerycontentId20": "e8ae1375-4640-430c-ae8e-2514d09c71eb",
       "huntingQueryTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e8ae1375-4640-430c-ae8e-2514d09c71eb')))]"
     },
     "huntingQueryObject21": {
-      "huntingQueryVersion21": "2.0.1",
+      "huntingQueryVersion21": "2.0.2",
       "_huntingQuerycontentId21": "a1551ae4-f61c-4bca-9c57-4d0d681db2e9",
       "huntingQueryTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a1551ae4-f61c-4bca-9c57-4d0d681db2e9')))]"
     },
@@ -511,10 +511,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -526,22 +526,22 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountCustomEntity"
+                        "columnName": "AccountCustomEntity",
+                        "identifier": "Name"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "IPCustomEntity"
+                        "columnName": "IPCustomEntity",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -625,10 +625,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -640,22 +640,22 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountCustomEntity"
+                        "columnName": "AccountCustomEntity",
+                        "identifier": "Name"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "IPCustomEntity"
+                        "columnName": "IPCustomEntity",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -725,10 +725,10 @@
               "kind": "Scheduled",
               "location": "[parameters('workspace-location')]",
               "properties": {
-                "description": "Identifies when the exchange audit logging has been disabled which may be an adversary attempt to evade detection or avoid other defenses.",
-                "displayName": "Office 365 - Exchange AuditLog Disabled",
+                "description": "Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses.",
+                "displayName": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
                 "enabled": false,
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Workload =~ \"Exchange\"\n| where UserType in~ (\"Admin\", \"DcAdmin\")\n| where Operation =~ \"Set-AdminAuditLogConfig\"\n| extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(tostring(AdditionalProperties.Parameters)), 3, 3)))[0])).Value)\n| where AdminAuditLogEnabledValue =~ \"False\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue\n| extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n| extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n| extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n| extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '')\n",
+                "query": "// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"Exchange\" \n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    // Only admin or global-admin can disable audit logging\n    | where Operation =~ \"Set-AdminAuditLogConfig\"\n    | extend ParsedParameters = parse_json(Parameters)\n    | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)\n    | where AdminAuditLogEnabledValue =~ \"False\"\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue\n    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), \n                        iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), UserId))\n    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n    | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"Exchange\"\n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    | where Operation =~ \"Set-AdminAuditLogConfig\"\n    | extend ParsedParameters = parse_json(AdditionalProperties.Parameters)\n    | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)\n    | where AdminAuditLogEnabledValue =~ \"False\"\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue\n    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), \n                        iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), UserId))\n    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n    | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n// Combine Office and Enriched Events and Deduplicate\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;\n// Project Final Output\nCombinedEvents\n    | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P1D",
                 "severity": "Medium",
@@ -739,10 +739,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -753,39 +753,30 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountNTDomain"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIP"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -826,7 +817,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Exchange AuditLog Disabled",
+        "displayName": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
         "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
         "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
         "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
@@ -856,9 +847,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity.",
-                "displayName": "Office 365 - Accessed files shared by temporary external user",
+                "displayName": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
                 "enabled": false,
-                "query": "let fileAccessThreshold = 10;\nEnrichedMicrosoft365AuditLogs\n| where Workload =~ \"MicrosoftTeams\"\n| where Operation =~ \"MemberAdded\"\n| extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n| where MemberAdded contains \"#EXT#\"\n| project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n| join kind=inner (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRemoved\"\n    | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n) on MemberAdded, TeamName\n| where TimeDeleted > TimeAdded\n| join kind=inner (\n    EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation == \"FileUploaded\"\n    | extend MemberAdded = UserId, SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where RecordType == \"SharePointFileOperation\"\n        | where Operation == \"FileAccessed\"\n        | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | summarize FileAccessCount = count() by ObjectId, TeamName\n        | where FileAccessCount > fileAccessThreshold\n    ) on ObjectId, TeamName\n) on MemberAdded, TeamName\n| project-away MemberAdded1, MemberAdded2, ObjectId1, Operation1, Operation2\n| extend MemberAddedAccountName = tostring(split(MemberAdded, \"@\")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, \"@\")[1])\n| extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n| extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n",
+                "query": "let fileAccessThreshold = 10;\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend MemberAdded = tostring(parse_json(Members)[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName\n    | join kind=inner (\n        OfficeActivity\n        | where OfficeWorkload =~ \"MicrosoftTeams\"\n        | where Operation =~ \"MemberRemoved\"\n        | extend MemberAdded = tostring(parse_json(Members)[0].UPN)\n        | where MemberAdded contains \"#EXT#\"\n        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName\n    ) on MemberAdded\n    | where TimeDeleted > TimeAdded\n    | join kind=inner (\n        OfficeActivity\n        | where RecordType == \"SharePointFileOperation\"\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | where Operation == \"FileUploaded\"\n        | extend MemberAdded = UserId\n        | join kind=inner (\n            OfficeActivity\n            | where RecordType == \"SharePointFileOperation\"\n            | where Operation == \"FileAccessed\"\n            | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n            | summarize FileAccessCount = count() by OfficeObjectId\n            | where FileAccessCount > fileAccessThreshold\n        ) on OfficeObjectId\n    ) on MemberAdded\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where Workload =~ \"MicrosoftTeams\"\n        | where Operation =~ \"MemberRemoved\"\n        | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n        | where MemberAdded contains \"#EXT#\"\n        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    ) on MemberAdded, TeamName\n    | where TimeDeleted > TimeAdded\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where RecordType == \"SharePointFileOperation\"\n        | where Operation == \"FileUploaded\"\n        | extend MemberAdded = UserId, SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | join kind=inner (\n            EnrichedMicrosoft365AuditLogs\n            | where RecordType == \"SharePointFileOperation\"\n            | where Operation == \"FileAccessed\"\n            | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n            | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n            | summarize FileAccessCount = count() by ObjectId, TeamName\n            | where FileAccessCount > fileAccessThreshold\n        ) on ObjectId, TeamName\n    ) on MemberAdded, TeamName\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// Combine Office and Enriched Events and Deduplicate\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeAdded, *) by MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// Project Final Output\nCombinedEvents\n    | extend MemberAddedAccountName = tostring(split(MemberAdded, \"@\")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, \"@\")[1])\n    | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n    | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, MemberAddedAccountName, MemberAddedAccountUPNSuffix, UserWhoAddedAccountName, UserWhoAddedAccountUPNSuffix, UserWhoDeletedAccountName, UserWhoDeletedAccountUPNSuffix\n",
                 "queryFrequency": "PT1H",
                 "queryPeriod": "PT1H",
                 "severity": "Low",
@@ -869,10 +860,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -883,64 +874,64 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "MemberAdded"
+                        "columnName": "MemberAdded",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "MemberAddedAccountName"
+                        "columnName": "MemberAddedAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "MemberAddedAccountUPNSuffix"
+                        "columnName": "MemberAddedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserWhoAdded"
+                        "columnName": "UserWhoAdded",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "UserWhoAddedAccountName"
+                        "columnName": "UserWhoAddedAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UserWhoAddedAccountUPNSuffix"
+                        "columnName": "UserWhoAddedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserWhoDeleted"
+                        "columnName": "UserWhoDeleted",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "UserWhoDeletedAccountName"
+                        "columnName": "UserWhoDeletedAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UserWhoDeletedAccountUPNSuffix"
+                        "columnName": "UserWhoDeletedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIP"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -981,7 +972,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Accessed files shared by temporary external user",
+        "displayName": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
         "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
         "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
         "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
@@ -1011,9 +1002,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour.",
-                "displayName": "Office 365 - External User Added and Removed in Short Timeframe",
+                "displayName": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
                 "enabled": false,
-                "query": "let TeamsAddDel = (Op:string){\nEnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where tostring(AdditionalProperties.Members) has (\"#EXT#\")\n  | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(AdditionalProperties.TeamName), ClientIP = SourceIp\n};\nlet TeamsAdd = TeamsAddDel(\"MemberAdded\")\n| project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDel = TeamsAddDel(\"MemberRemoved\")\n| project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nTeamsAdd\n| join kind = inner (TeamsDel) on $left.MemberAdded == $right.MemberRemoved\n| where TimeDeleted > TimeAdded\n| project TimeAdded, TimeDeleted, MemberAdded_Removed = MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName\n| extend MemberAdded_RemovedAccountName = tostring(split(MemberAdded_Removed, \"@\")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded_Removed, \"@\")[1])\n| extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n| extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n",
+                "query": "let TeamsAddDelOffice = (Op:string){\n  OfficeActivity\n  | where OfficeWorkload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where Members has (\"#EXT#\")\n  | mv-expand Members\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName, ClientIP\n};\nlet TeamsAddDelEnriched = (Op:string){\n  EnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where tostring(AdditionalProperties.Members) has (\"#EXT#\")\n  | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), ClientIP = SourceIp\n};\nlet TeamsAddOffice = TeamsAddDelOffice(\"MemberAdded\")\n  | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDelOffice = TeamsAddDelOffice(\"MemberRemoved\")\n  | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nlet TeamsAddEnriched = TeamsAddDelEnriched(\"MemberAdded\")\n  | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDelEnriched = TeamsAddDelEnriched(\"MemberRemoved\")\n  | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nlet TeamsAdd = TeamsAddOffice\n  | union TeamsAddEnriched\n  | project TimeAdded, Operation, MemberAdded, UserWhoAdded, TeamName, ClientIP;\nlet TeamsDel = TeamsDelOffice\n  | union TeamsDelEnriched\n  | project TimeDeleted, Operation, MemberRemoved, UserWhoDeleted, TeamName, ClientIP;\nTeamsAdd\n| join kind=inner (TeamsDel) on $left.MemberAdded == $right.MemberRemoved\n| where TimeDeleted > TimeAdded\n| project TimeAdded, TimeDeleted, MemberAdded_Removed = MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, ClientIP\n| extend MemberAdded_RemovedAccountName = tostring(split(MemberAdded_Removed, \"@\")[0]), MemberAdded_RemovedAccountUPNSuffix = tostring(split(MemberAdded_Removed, \"@\")[1])\n| extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n| extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n",
                 "queryFrequency": "PT1H",
                 "queryPeriod": "PT1H",
                 "severity": "Low",
@@ -1024,10 +1015,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1038,64 +1029,64 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "MemberAdded_Removed"
+                        "columnName": "MemberAdded_Removed",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "MemberAdded_RemovedAccountName"
+                        "columnName": "MemberAdded_RemovedAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "MemberAddedAccountUPNSuffix"
+                        "columnName": "MemberAdded_RemovedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserWhoAdded"
+                        "columnName": "UserWhoAdded",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "UserWhoAddedAccountName"
+                        "columnName": "UserWhoAddedAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UserWhoAddedAccountUPNSuffix"
+                        "columnName": "UserWhoAddedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserWhoDeleted"
+                        "columnName": "UserWhoDeleted",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "UserWhoDeletedAccountName"
+                        "columnName": "UserWhoDeletedAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UserWhoDeletedAccountUPNSuffix"
+                        "columnName": "UserWhoDeletedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIp"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -1136,7 +1127,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - External User Added and Removed in Short Timeframe",
+        "displayName": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
         "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
         "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
         "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
@@ -1165,10 +1156,10 @@
               "kind": "Scheduled",
               "location": "[parameters('workspace-location')]",
               "properties": {
-                "description": "Identifies when Exchange Online transport rule configured to forward emails.\nThis could be an adversary mailbox configured to collect mail from multiple user accounts.",
-                "displayName": "Office 365 - Mail redirect via ExO transport rule",
+                "description": "Identifies when an Exchange Online transport rule is configured to forward emails.\nThis could indicate an adversary mailbox configured to collect mail from multiple user accounts.",
+                "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
                 "enabled": false,
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Workload == \"Exchange\"\n| where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n| mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n    summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n  )\n| extend RuleName = case(\n    Operation =~ \"Set-TransportRule\", ObjectId,  // Assuming ObjectId maps to what was previously OfficeObjectId\n    Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n    \"Unknown\"\n  )\n| mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))\n| where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n| extend RedirectTo = ExpandedParameters.Value\n| extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n| extend From = ParsedParameters.From\n| project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters)\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let officeActivityQuery = OfficeActivity\n  | where OfficeWorkload == \"Exchange\"\n  | where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n  | mv-apply DynamicParameters = todynamic(Parameters) on (\n      summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | extend RuleName = case(\n      Operation =~ \"Set-TransportRule\", OfficeObjectId,\n      Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n      \"Unknown\"\n    )\n  | mv-expand ExpandedParameters = todynamic(Parameters)\n  | where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n  | extend RedirectTo = ExpandedParameters.Value\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n  | extend From = ParsedParameters.From\n  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), \n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\nlet enrichedLogsQuery = EnrichedMicrosoft365AuditLogs\n  | where Workload == \"Exchange\"\n  | where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n  | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n      summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | extend RuleName = case(\n      Operation =~ \"Set-TransportRule\", ObjectId,  // Assuming ObjectId maps to OfficeObjectId\n      Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n      \"Unknown\"\n    )\n  | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))\n  | where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n  | extend RedirectTo = ExpandedParameters.Value\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n  | extend From = ParsedParameters.From\n  | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters), UserAgent\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), \n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine both queries\nunion isfuzzy=true officeActivityQuery, enrichedLogsQuery\n| summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo\n| project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix\n| order by TimeGenerated desc;\n",
                 "queryFrequency": "PT1H",
                 "queryPeriod": "PT1H",
                 "severity": "Medium",
@@ -1179,10 +1170,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1195,30 +1186,30 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "IPAddress"
+                        "columnName": "IPAddress",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -1259,7 +1250,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Mail redirect via ExO transport rule",
+        "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
         "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
         "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
         "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
@@ -1288,10 +1279,10 @@
               "kind": "Scheduled",
               "location": "[parameters('workspace-location')]",
               "properties": {
-                "description": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\n This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/",
-                "displayName": "Office 365 - Malicious Inbox Rule",
+                "description": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\nThis is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/",
+                "displayName": "GSA Enriched Office 365 - Malicious Inbox Rule",
                 "enabled": false,
-                "query": "let Keywords = dynamic([\"helpdesk\", \"alert\", \"suspicious\", \"fake\", \"malicious\", \"phishing\", \"spam\", \"do not click\", \"do not open\", \"hijacked\", \"Fatal\"]);\nEnrichedMicrosoft365AuditLogs\n| where Workload =~ \"Exchange\"\n| where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n| where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Deleted Items\" or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Junk Email\" or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"DeleteMessage\"\n| extend Events = parse_json(tostring(AdditionalProperties)).Parameters\n| extend SubjectContainsWords = tostring(Events.SubjectContainsWords), BodyContainsWords = tostring(Events.BodyContainsWords), SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)\n| where SubjectContainsWords has_any (Keywords) or BodyContainsWords has_any (Keywords) or SubjectOrBodyContainsWords has_any (Keywords)\n| extend ClientIPAddress = case(ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), ClientIp has \"[\", tostring(trim_start(@'[[]',tostring(split(ClientIp, \"]\")[0]))), ClientIp)\n| extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, (iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords)))\n| extend RuleDetail = case(ObjectId contains '/', tostring(split(ObjectId, '/')[-1]), tostring(split(ObjectId, '\\\\')[-1]))\n| summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, ObjectId, RuleDetail\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let Keywords = dynamic([\"helpdesk\", \"alert\", \"suspicious\", \"fake\", \"malicious\", \"phishing\", \"spam\", \"do not click\", \"do not open\", \"hijacked\", \"Fatal\"]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n  | where OfficeWorkload =~ \"Exchange\" \n  | where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n  | where Parameters has \"Deleted Items\" or Parameters has \"Junk Email\" or Parameters has \"DeleteMessage\"\n  | extend Events = todynamic(Parameters)\n  | parse Events with * \"SubjectContainsWords\" SubjectContainsWords '}'*\n  | parse Events with * \"BodyContainsWords\" BodyContainsWords '}'*\n  | parse Events with * \"SubjectOrBodyContainsWords\" SubjectOrBodyContainsWords '}'*\n  | where SubjectContainsWords has_any (Keywords)\n      or BodyContainsWords has_any (Keywords)\n      or SubjectOrBodyContainsWords has_any (Keywords)\n  | extend ClientIPAddress = case(\n      ClientIP has \".\", tostring(split(ClientIP, \":\")[0]),\n      ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))),\n      ClientIP\n    )\n  | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))\n  | extend RuleDetail = case(\n      OfficeObjectId contains '/', tostring(split(OfficeObjectId, '/')[-1]),\n      OfficeObjectId contains '\\\\', tostring(split(OfficeObjectId, '\\\\')[-1]),\n      \"Unknown\"\n    )\n  | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, OriginatingServer, OfficeObjectId, RuleDetail\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend OriginatingServerName = tostring(split(OriginatingServer, \" \")[0]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"Exchange\"\n  | where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n  | where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Deleted Items\" \n      or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Junk Email\" \n      or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"DeleteMessage\"\n  | extend Events = parse_json(tostring(AdditionalProperties)).Parameters\n  | extend SubjectContainsWords = tostring(Events.SubjectContainsWords), \n           BodyContainsWords = tostring(Events.BodyContainsWords), \n           SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)\n  | where SubjectContainsWords has_any (Keywords) \n      or BodyContainsWords has_any (Keywords) \n      or SubjectOrBodyContainsWords has_any (Keywords)\n  | extend ClientIPAddress = case(\n      ClientIp has \".\", tostring(split(ClientIp, \":\")[0]),\n      ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n      ClientIp\n    )\n  | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))\n  | extend RuleDetail = case(\n      ObjectId contains '/', tostring(split(ObjectId, '/')[-1]),\n      ObjectId contains '\\\\', tostring(split(ObjectId, '\\\\')[-1]),\n      \"Unknown\"\n    )\n  | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, ObjectId, RuleDetail\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine and Deduplicate\nlet CombinedEvents = OfficeEvents\n  | union EnrichedEvents\n  | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIPAddress;\n\n// Final Output\nCombinedEvents\n  | project StartTimeUtc, EndTimeUtc, Operation, UserId, ClientIPAddress, ResultStatus, Keyword, RuleDetail, AccountName, AccountUPNSuffix;\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P1D",
                 "severity": "Medium",
@@ -1302,10 +1293,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1318,39 +1309,30 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
-                  },
-                  {
-                    "entityType": "Host",
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "OriginatingServer"
-                      }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIPAddress"
+                        "columnName": "ClientIPAddress",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -1391,7 +1373,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Malicious Inbox Rule",
+        "displayName": "GSA Enriched Office 365 - Malicious Inbox Rule",
         "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
         "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
         "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
@@ -1420,10 +1402,10 @@
               "kind": "Scheduled",
               "location": "[parameters('workspace-location')]",
               "properties": {
-                "description": "This detection flags the occurrences of deleting multiple teams within an hour.\nThis data is a part of Office 365 Connector in Microsoft Sentinel.",
-                "displayName": "Office 365 - Multiple Teams deleted by a single user",
+                "description": "This detection flags the occurrences of deleting multiple teams within a day.\nThis data is a part of Office 365 Connector in Microsoft Sentinel.",
+                "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
                 "enabled": false,
-                "query": "let max_delete_count = 3;\nEnrichedMicrosoft365AuditLogs\n| where Workload =~ \"MicrosoftTeams\"\n| where Operation =~ \"TeamDeleted\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId\n| where array_length(DeletedTeams) > max_delete_count\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "// Set the maximum number of deleted teams to flag suspicious activity\nlet max_delete_count = 3;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId\n    | where array_length(DeletedTeams) > max_delete_count\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId\n    | where array_length(DeletedTeams) > max_delete_count\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DeletedTeams, UserId, AccountName, AccountUPNSuffix\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P1D",
                 "severity": "Low",
@@ -1434,10 +1416,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1449,21 +1431,21 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   }
                 ]
               }
@@ -1504,7 +1486,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Multiple Teams deleted by a single user",
+        "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
         "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
         "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
         "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
@@ -1534,9 +1516,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.",
-                "displayName": "Office 365 - Multiple Users Email Forwarded to Same Destination",
+                "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
                 "enabled": false,
-                "query": "let queryfrequency = 1d;\n  let queryperiod = 7d;\n  EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated > ago(queryperiod)\n  | where Workload =~ \"Exchange\"\n  //| where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")  // Uncomment or adjust based on actual field usage\n  | where tostring(AdditionalProperties.Parameters) has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n  | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n      summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n  | extend DestinationMailAddress = tolower(case(\n      isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n      isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n      isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n      \"\"))\n  | where isnotempty(DestinationMailAddress)\n  | mv-expand split(DestinationMailAddress, \";\")\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n  | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n  | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n  | mv-expand UserId to typeof(string)\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "// Set query parameters\nlet queryfrequency = 1d;\nlet queryperiod = 7d;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(queryperiod)\n    | where Workload =~ \"Exchange\"\n    // Uncomment or adjust the following line based on actual field usage\n    // | where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")\n    | where tostring(AdditionalProperties.Parameters) has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n      )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated > ago(queryperiod)\n    | where OfficeWorkload =~ \"Exchange\"\n    // Uncomment or adjust the following line based on actual field usage\n    // | where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")\n    | where Parameters has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n      )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by tostring(DestinationMailAddress), ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DestinationMailAddress, ClientIP, DistinctUserCount, UserId, Ports, EventCount, AccountName, AccountUPNSuffix\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P7D",
                 "severity": "Medium",
@@ -1547,10 +1529,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1563,30 +1545,30 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIP"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -1627,7 +1609,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Multiple Users Email Forwarded to Same Destination",
+        "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
         "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
         "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
         "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
@@ -1657,9 +1639,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies if any tampering is done to either audit log, ATP Safelink, SafeAttachment, AntiPhish, or Dlp policy. \nAn adversary may use this technique to evade detection or avoid other policy-based defenses.\nReferences: https://docs.microsoft.com/powershell/module/exchange/advanced-threat-protection/remove-antiphishrule?view=exchange-ps.",
-                "displayName": "Office 365 - Office Policy Tampering",
+                "displayName": "GSA Enriched Office 365 - Office Policy Tampering",
                 "enabled": false,
-                "query": "let opList = EnrichedMicrosoft365AuditLogs \n  | summarize by Operation\n  | where Operation has_any (\"Remove\", \"Disable\")\n  | where Operation contains \"AntiPhish\" or Operation contains \"SafeAttachment\" or Operation contains \"SafeLinks\" or Operation contains \"Dlp\" or Operation contains \"Audit\"\n  | summarize make_set(Operation, 500);\nEnrichedMicrosoft365AuditLogs\n  | where RecordType == \"ExchangeAdmin\"\n  | where UserType in~ (\"Admin\", \"DcAdmin\")\n  | where Operation in~ (opList)\n  | extend ClientIPOnly = case( \n      ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), \n      ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n      ClientIp\n    )  \n  | extend Port = case(\n      ClientIp has \".\", tostring(split(ClientIp, \":\")[1]),\n      ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]),\n      \"\"\n    )\n  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "// Query for EnrichedMicrosoft365AuditLogs\nlet enrichedOpList = EnrichedMicrosoft365AuditLogs \n    | summarize by Operation\n    | where Operation has_any (\"Remove\", \"Disable\")\n    | where Operation contains \"AntiPhish\" \n        or Operation contains \"SafeAttachment\" \n        or Operation contains \"SafeLinks\" \n        or Operation contains \"Dlp\" \n        or Operation contains \"Audit\"\n    | summarize make_set(Operation, 500);\n\nlet enrichedLogs = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"ExchangeAdmin\"\n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    | where Operation in~ (enrichedOpList)\n    | extend ClientIPOnly = case( \n        ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), \n        ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n        ClientIp\n      )  \n    | extend Port = case(\n        ClientIp has \".\", tostring(split(ClientIp, \":\")[1]),\n        ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]),\n        \"\"\n      )\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Query for OfficeActivity\nlet officeOpList = OfficeActivity \n    | summarize by Operation\n    | where Operation has_any (\"Remove\", \"Disable\")\n    | where Operation contains \"AntiPhish\" \n        or Operation contains \"SafeAttachment\" \n        or Operation contains \"SafeLinks\" \n        or Operation contains \"Dlp\" \n        or Operation contains \"Audit\"\n    | summarize make_set(Operation, 500);\n\nlet officeLogs = OfficeActivity\n    | where RecordType =~ \"ExchangeAdmin\"\n    | where UserType in~ (\"Admin\",\"DcAdmin\")\n    | where Operation in~ (officeOpList)\n    | extend ClientIPOnly = case( \n        ClientIP has \".\", tostring(split(ClientIP,\":\")[0]), \n        ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP,\"]\")[0]))),\n        ClientIP\n      )  \n    | extend Port = case(\n        ClientIP has \".\", tostring(split(ClientIP,\":\")[1]),\n        ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]),\n        \"\"\n      )\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Enriched Logs and Office Activity Logs\nunion isfuzzy=true enrichedLogs, officeLogs\n| summarize StartTimeUtc = min(StartTimeUtc), EndTimeUtc = max(EndTimeUtc), TotalOperationCount = sum(OperationCount) \n    by Operation, UserType, UserId, ClientIP, Port, ResultStatus, Parameters, AccountName, AccountUPNSuffix\n| order by StartTimeUtc desc;\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P1D",
                 "severity": "Medium",
@@ -1670,10 +1652,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1686,30 +1668,30 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIP"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -1750,7 +1732,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Office Policy Tampering",
+        "displayName": "GSA Enriched Office 365 - Office Policy Tampering",
         "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
         "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
         "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
@@ -1780,9 +1762,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive.\nList currently includes exe, inf, gzip, cmd, bat file extensions.\nAdditionally, identifies when a given user is uploading these files to another user's workspace.\nThis may be an indication of a staging location for malware or other malicious activity.",
-                "displayName": "Office 365 - New Executable via Office FileUploaded Operation",
+                "displayName": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
                 "enabled": false,
-                "query": "let threshold = 2;\nlet uploadOp = 'FileUploaded';\nlet execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);\nlet starttime = 8d;\nlet endtime = 1d;\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated >= ago(endtime)\n| where Operation == uploadOp\n| extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n| where SourceFileExtension in (execExt)\n| extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n| extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n| extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n| project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName\n| join kind=leftanti (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(starttime) .. ago(endtime))\n    | where Operation == uploadOp\n    | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n    | where SourceFileExtension in (execExt)\n    | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n    | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    // Uncomment the line below to enforce the threshold\n    // | where PrevSeenCount > threshold\n    | mvexpand SourceRelativeUrl, UserId\n    | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)\n) on SourceFileName, SourceRelativeUrl, UserId\n| extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n| extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n| extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n| summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000)\nby Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "// Set query parameters\nlet threshold = 2;\nlet uploadOp = 'FileUploaded';\n// Extensions that are interesting. Add/Remove to this list as you see fit\nlet execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);\nlet starttime = 8d;\nlet endtime = 1d;\n\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated >= ago(endtime)\n    | where Operation =~ uploadOp\n    | where SourceFileExtension has_any (execExt)\n    | extend RecordType = coalesce(tostring(RecordType), \"UnknownRecordType\")  // Ensure RecordType is a string\n    | project TimeGenerated, OfficeId, OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName\n    | join kind=leftanti (\n        OfficeActivity\n        | where TimeGenerated between (ago(starttime) .. ago(endtime))\n        | where Operation =~ uploadOp\n        | where SourceFileExtension has_any (execExt)\n        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName\n        // Uncomment the line below to enforce the threshold\n        //| where PrevSeenCount > threshold\n        | mvexpand SourceRelativeUrl, UserId\n        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId\n    ) on SourceFileName, SourceRelativeUrl, UserId\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string\n    by OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated >= ago(endtime)\n    | where Operation == uploadOp\n    | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n    | where SourceFileExtension in (execExt)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend RecordType = coalesce(tostring(RecordType), \"UnknownRecordType\")  // Ensure RecordType is a string\n    | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName\n    | join kind=leftanti (\n        EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (ago(starttime) .. ago(endtime))\n        | where Operation == uploadOp\n        | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n        | where SourceFileExtension in (execExt)\n        | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n        // Uncomment the line below to enforce the threshold\n        //| where PrevSeenCount > threshold\n        | mvexpand SourceRelativeUrl, UserId\n        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId\n    ) on SourceFileName, SourceRelativeUrl, UserId\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(tostring(SourceRelativeUrl), 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string\n    by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Office and Enriched Logs\nlet CombinedEvents = EnrichedEvents\n    | union isfuzzy=true OfficeEvents\n    | summarize arg_min(StartTime, *) by tostring(FileNames), UserId, Site_Url, tostring(RecordType)  // Ensure FileNames and RecordType are strings\n    | order by StartTime desc;\n\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder, FileNames, UserAgents, AccountName, AccountUPNSuffix;\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P8D",
                 "severity": "Low",
@@ -1793,10 +1775,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1809,48 +1791,48 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIp"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "URL",
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "Site_Url"
+                        "columnName": "Site_Url",
+                        "identifier": "Url"
                       }
-                    ]
+                    ],
+                    "entityType": "URL"
                   },
                   {
-                    "entityType": "File",
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "FileNames"
+                        "columnName": "FileNames",
+                        "identifier": "Name"
                       }
-                    ]
+                    ],
+                    "entityType": "File"
                   }
                 ]
               }
@@ -1891,7 +1873,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - New Executable via Office FileUploaded Operation",
+        "displayName": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
         "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
         "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
         "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
@@ -1921,9 +1903,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies Office operations that are typically rare and can provide capabilities useful to attackers.",
-                "displayName": "Office 365 - Rare and Potentially High-Risk Office Operations",
+                "displayName": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
                 "enabled": false,
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\nand not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n| extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIp)[0])\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\n    and not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') \n         and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n    | extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIP)[0])\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\n    and not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') \n         and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n    | extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIp)[0])\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by Operation, UserId, ClientIPOnly;\n\n// Final Output\nCombinedEvents\n    | project TimeGenerated, Operation, UserId, AccountName, AccountUPNSuffix, ClientIPOnly\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P1D",
                 "severity": "Low",
@@ -1934,10 +1916,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -1950,39 +1932,30 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "ClientIPOnly"
-                      }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "CloudApplication",
                     "fieldMappings": [
                       {
-                        "identifier": "AppId",
-                        "columnName": "AppId"
+                        "columnName": "ClientIPOnly",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   }
                 ]
               }
@@ -2023,7 +1996,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Rare and Potentially High-Risk Office Operations",
+        "displayName": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
         "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
         "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
         "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
@@ -2053,9 +2026,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25.",
-                "displayName": "Office 365 - SharePoint File Operation via Previously Unseen IPs",
+                "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
                 "enabled": false,
-                "query": "let threshold = 0.25;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n// Define a baseline of normal user behavior\nlet userBaseline = EnrichedMicrosoft365AuditLogs\n| where TimeGenerated between(ago(starttime)..ago(endtime))\n| where RecordType == szSharePointFileOperation\n| where Operation in (szOperations)\n| extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n| extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n| where isnotempty(UserAgent)\n| summarize Count = count() by UserId, Operation, Site_Url, ClientIp\n| summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;\n// Get recent user activity\nlet recentUserActivity = EnrichedMicrosoft365AuditLogs\n| where TimeGenerated > ago(endtime)\n| where RecordType == szSharePointFileOperation\n| where Operation in (szOperations)\n| extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n| extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n| where isnotempty(UserAgent)\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;\n// Join the baseline and recent activity, and calculate the deviation\nlet UserBehaviorAnalysis = userBaseline \n| join kind=inner (recentUserActivity) on UserId, Operation, Site_Url, ClientIp\n| extend Deviation = abs(RecentCount - AvgCount) / AvgCount;\n// Filter for significant deviations\nUserBehaviorAnalysis\n| where Deviation > threshold\n| project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIp, Site_Url, ObjectId, Workload, UserAgent, Deviation, Count=RecentCount\n| order by Count desc, ClientIp asc, Operation asc, UserId asc\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let threshold = 25;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n\n// Define a baseline of normal user behavior for OfficeActivity\nlet userBaselineOffice = OfficeActivity\n    | where TimeGenerated between(ago(starttime)..ago(endtime))\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | summarize Count = count() by UserId, Operation, Site_Url, ClientIP\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIP;\n\n// Get recent user activity for OfficeActivity\nlet recentUserActivityOffice = OfficeActivity\n    | where TimeGenerated > ago(endtime)\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIP, OfficeObjectId, OfficeWorkload, UserAgent;\n\n// Define a baseline of normal user behavior for EnrichedMicrosoft365AuditLogs\nlet userBaselineEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(ago(starttime)..ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | summarize Count = count() by UserId, Operation, Site_Url, ClientIp\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;\n\n// Get recent user activity for EnrichedMicrosoft365AuditLogs\nlet recentUserActivityEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;\n\n// Combine user baselines and recent activity, calculate deviation, and deduplicate\nlet UserBehaviorAnalysis = userBaselineOffice\n    | join kind=inner (recentUserActivityOffice) on UserId, Operation, Site_Url, ClientIP\n    | union (userBaselineEnriched | join kind=inner (recentUserActivityEnriched) on UserId, Operation, Site_Url, ClientIp)\n    | extend Deviation = abs(RecentCount - AvgCount) / AvgCount;\n\n// Filter for significant deviations\nUserBehaviorAnalysis\n    | where Deviation > threshold\n    | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIP, Site_Url, ObjectId, OfficeObjectId, OfficeWorkload, Workload, UserAgent, Deviation, Count = RecentCount\n    | order by Count desc, ClientIP asc, Operation asc, UserId asc\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P14D",
                 "severity": "Medium",
@@ -2066,10 +2039,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2080,39 +2053,39 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIp"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "URL",
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "Site_Url"
+                        "columnName": "Site_Url",
+                        "identifier": "Url"
                       }
-                    ]
+                    ],
+                    "entityType": "URL"
                   }
                 ]
               }
@@ -2153,7 +2126,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - SharePoint File Operation via Previously Unseen IPs",
+        "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
         "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
         "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
         "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
@@ -2183,9 +2156,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).",
-                "displayName": "Office 365 - SharePointFileOperation via devices with previously unseen user agents",
+                "displayName": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
                 "enabled": false,
-                "query": "// Set threshold for the number of downloads/uploads from a new user agent\nlet threshold = 5;\n// Define constants for SharePoint file operations\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\n// Define the historical activity for analysis\nlet starttime = 14d; // Define the start time for historical data (14 days ago)\nlet endtime = 1d;   // Define the end time for historical data (1 day ago)\n// Extract the base events for analysis\nlet Baseevents =\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(starttime) .. ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent);\n// Identify frequently occurring user agents\nlet FrequentUA = Baseevents\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n// Calculate a user baseline for further analysis\nlet UserBaseLine = Baseevents\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n// Extract recent activity for analysis\nlet RecentActivity = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | where UserAgent in (FrequentUA)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()\n    by RecordType, Operation, UserAgent, UserId, ClientIp, Site_Url;\n// Analyze user behavior based on baseline and recent activity\nlet UserBehaviorAnalysis = UserBaseLine\n    | join kind=inner (RecentActivity) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n// Filter and format results for specific user behavior analysis\nUserBehaviorAnalysis\n    | where Deviation > 0.25\n    | extend UserIdName = tostring(split(UserId, '@')[0]), UserIdUPNSuffix = tostring(split(UserId, '@')[1])\n    | project-reorder StartTime, EndTime, UserAgent, UserAgentSeenCount, UserId, ClientIp, Site_Url\n    | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc\n",
+                "query": "let threshold = 5;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n\n// OfficeActivity - Base Events\nlet BaseeventsOffice = OfficeActivity\n    | where TimeGenerated between (ago(starttime)..ago(endtime))\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent);\n\n// OfficeActivity - Frequent User Agents\nlet FrequentUAOffice = BaseeventsOffice\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n\n// OfficeActivity - User Baseline\nlet UserBaseLineOffice = BaseeventsOffice\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n\n// OfficeActivity - Recent User Activity\nlet RecentActivityOffice = OfficeActivity\n    | where TimeGenerated > ago(endtime)\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | where UserAgent in~ (FrequentUAOffice)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()\n        by RecordType, Operation, UserAgent, UserType, UserId, ClientIP , OfficeWorkload, Site_Url;\n\n// EnrichedMicrosoft365AuditLogs - Base Events\nlet BaseeventsEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(starttime)..ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent);\n\n// EnrichedMicrosoft365AuditLogs - Frequent User Agents\nlet FrequentUAEnriched = BaseeventsEnriched\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n\n// EnrichedMicrosoft365AuditLogs - User Baseline\nlet UserBaseLineEnriched = BaseeventsEnriched\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n\n// EnrichedMicrosoft365AuditLogs - Recent User Activity\nlet RecentActivityEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | extend  ClientIP = ClientIp\n    | where isnotempty(UserAgent)\n    | where UserAgent in (FrequentUAEnriched)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()\n        by RecordType, Operation, UserAgent, UserId,ClientIP, Site_Url;\n\n// Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate\nlet UserBehaviorAnalysisOffice = UserBaseLineOffice\n    | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n\nlet UserBehaviorAnalysisEnriched = UserBaseLineEnriched\n    | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n\n// Combine Office and Enriched Logs\nlet CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice\n    | union UserBehaviorAnalysisEnriched;\n\n// Filter and Format Final Results\nCombinedUserBehaviorAnalysis\n    | where Deviation > 0.25\n    | extend UserIdName = tostring(split(UserId, '@')[0]), \n             UserIdUPNSuffix = tostring(split(UserId, '@')[1])\n    | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url\n    | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc\n",
                 "queryFrequency": "P1D",
                 "queryPeriod": "P14D",
                 "severity": "Medium",
@@ -2196,10 +2169,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2210,39 +2183,39 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "UserIdName"
+                        "columnName": "UserIdName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UserIdUPNSuffix"
+                        "columnName": "UserIdUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIp"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "URL",
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "Site_Url"
+                        "columnName": "Site_Url",
+                        "identifier": "Url"
                       }
-                    ]
+                    ],
+                    "entityType": "URL"
                   }
                 ]
               }
@@ -2283,7 +2256,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - SharePointFileOperation via devices with previously unseen user agents",
+        "displayName": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
         "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
         "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
         "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
@@ -2313,9 +2286,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "description": "Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
-                "displayName": "Office 365 - Sharepoint File Transfer Above Threshold",
+                "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
                 "enabled": false,
-                "query": "let threshold = 5000;\nEnrichedMicrosoft365AuditLogs\n| where Workload has_any(\"SharePoint\", \"OneDrive\") and Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n| summarize count_distinct_ObjectId=dcount(ObjectId), fileslist=make_set(ObjectId, 10000) by UserId, ClientIp, bin(TimeGenerated, 15m)\n| where count_distinct_ObjectId >= threshold\n| extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\",\"_\", tostring(hash(tostring(fileslist)))))\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let threshold = 5000;\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload has_any(\"SharePoint\", \"OneDrive\") \n    | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n    | extend ClientIP = ClientIp\n    | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) \n        by UserId, ClientIP, bin(TimeGenerated, 15m)\n    | where count_distinct_ObjectId >= threshold\n    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where EventSource == \"SharePoint\" \n    | where OfficeWorkload has_any(\"SharePoint\", \"OneDrive\") \n    | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n    | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) \n        by UserId, ClientIP, bin(TimeGenerated, 15m)\n    | where count_distinct_OfficeObjectId >= threshold\n    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;\n\n// Final Output\nCombinedEvents\n    | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist\n    | order by TimeGenerated desc\n",
                 "queryFrequency": "PT15M",
                 "queryPeriod": "PT15M",
                 "severity": "Medium",
@@ -2326,10 +2299,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2340,55 +2313,57 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIp"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "File",
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "FileSample"
+                        "columnName": "FileSample",
+                        "identifier": "Name"
                       }
-                    ]
+                    ],
+                    "entityType": "File"
                   }
                 ],
                 "customDetails": {
-                  "TransferCount": "count_distinct_ObjectId",
-                  "FilesList": "fileslist"
+                  "FilesList": "fileslist",
+                  "TransferCount": "count_distinct_ObjectId"
                 },
                 "incidentConfiguration": {
                   "createIncident": true,
                   "groupingConfiguration": {
-                    "enabled": true,
+                    "reopenClosedIncident": false,
+                    "groupByAlertDetails": [],
+                    "groupByCustomDetails": [],
                     "lookbackDuration": "5h",
                     "groupByEntities": [
                       "Account"
                     ],
                     "matchingMethod": "Selected",
-                    "reopenClosedIncident": false
+                    "enabled": true
                   }
                 }
               }
@@ -2429,7 +2404,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Sharepoint File Transfer Above Threshold",
+        "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
         "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
         "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
         "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
@@ -2458,10 +2433,10 @@
               "kind": "Scheduled",
               "location": "[parameters('workspace-location')]",
               "properties": {
-                "description": "Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
-                "displayName": "Office 365 - Sharepoint File Transfer Above Threshold",
+                "description": "Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
+                "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
                 "enabled": false,
-                "query": "let threshold = 500;\nEnrichedMicrosoft365AuditLogs\n| where Workload has_any(\"SharePoint\", \"OneDrive\") and Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n| extend EventSource = tostring(parse_json(tostring(AdditionalProperties)).EventSource)\n| extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n| summarize count_distinct_ObjectId = dcount(ObjectId), dirlist = make_set(ObjectId, 10000) by UserId, ClientIp, UserAgent, bin(TimeGenerated, 15m)\n| where count_distinct_ObjectId >= threshold\n| extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat(\"SeeDirListField\",\"_\", tostring(hash(tostring(dirlist)))))\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let threshold = 5000;\n  // EnrichedMicrosoft365AuditLogs Query\n  let EnrichedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload has_any(\"SharePoint\", \"OneDrive\")\n  | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n  | extend UserAgent = tostring(AdditionalProperties[\"UserAgent\"])\n  | summarize count_distinct_ObjectId = dcount(ObjectId), \n              fileslist = make_set(ObjectId, 10000), \n              any_UserAgent = any(UserAgent)\n    by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)\n  | where count_distinct_ObjectId >= threshold\n  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // OfficeActivity Query\n  let OfficeEvents = OfficeActivity\n  | where EventSource == \"SharePoint\"\n  | where OfficeWorkload has_any(\"SharePoint\", \"OneDrive\")\n  | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n  | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), \n              fileslist = make_set(OfficeObjectId, 10000), \n              any_UserAgent = any(UserAgent)\n    by UserId, ClientIP, bin(TimeGenerated, 15m)\n  | where count_distinct_OfficeObjectId >= threshold\n  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Combine Office and Enriched Logs\n  let CombinedEvents = OfficeEvents\n  | union EnrichedEvents\n  | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, any_UserAgent;\n  // Final Output\n  CombinedEvents\n  | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, UserAgent = any_UserAgent, count_distinct_ObjectId = coalesce(count_distinct_ObjectId, count_distinct_OfficeObjectId), fileslist\n  | order by TimeGenerated desc\n",
                 "queryFrequency": "PT15M",
                 "queryPeriod": "PT15M",
                 "severity": "Medium",
@@ -2472,10 +2447,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2486,55 +2461,57 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "AccountUPNSuffix"
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
-                    ]
+                    ],
+                    "entityType": "Account"
                   },
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "ClientIp"
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "File",
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "DirSample"
+                        "columnName": "FileSample",
+                        "identifier": "Name"
                       }
-                    ]
+                    ],
+                    "entityType": "File"
                   }
                 ],
                 "customDetails": {
-                  "TransferCount": "count_distinct_ObjectId",
-                  "FilesList": "dirlist"
+                  "FilesList": "fileslist",
+                  "TransferCount": "count_distinct_ObjectId"
                 },
                 "incidentConfiguration": {
                   "createIncident": true,
                   "groupingConfiguration": {
-                    "enabled": true,
+                    "reopenClosedIncident": false,
+                    "groupByAlertDetails": [],
+                    "groupByCustomDetails": [],
                     "lookbackDuration": "5h",
                     "groupByEntities": [
                       "Account"
                     ],
                     "matchingMethod": "Selected",
-                    "reopenClosedIncident": false
+                    "enabled": true
                   }
                 }
               }
@@ -2575,7 +2552,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
         "contentKind": "AnalyticsRule",
-        "displayName": "Office 365 - Sharepoint File Transfer Above Threshold",
+        "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
         "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
         "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
         "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
@@ -2618,10 +2595,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "NetworkAccessTrafficLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2631,22 +2608,22 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "SourceIp"
+                        "columnName": "SourceIp",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "URL",
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "DestinationIp"
+                        "columnName": "DestinationIp",
+                        "identifier": "Url"
                       }
-                    ]
+                    ],
+                    "entityType": "URL"
                   }
                 ]
               }
@@ -2730,10 +2707,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2743,22 +2720,22 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "IPCustomEntity"
+                        "columnName": "IPCustomEntity",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "URL",
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "FqdnCustomEntity"
+                        "columnName": "FqdnCustomEntity",
+                        "identifier": "Url"
                       }
-                    ]
+                    ],
+                    "entityType": "URL"
                   }
                 ]
               }
@@ -2842,10 +2819,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -2856,22 +2833,22 @@
                 ],
                 "entityMappings": [
                   {
-                    "entityType": "IP",
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "SourceIp"
+                        "columnName": "SourceIp",
+                        "identifier": "Address"
                       }
-                    ]
+                    ],
+                    "entityType": "IP"
                   },
                   {
-                    "entityType": "URL",
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "Fqdn"
+                        "columnName": "Fqdn",
+                        "identifier": "Url"
                       }
-                    ]
+                    ],
+                    "entityType": "URL"
                   }
                 ]
               }
@@ -2941,9 +2918,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Anomalous access to other users' mailboxes",
+                "displayName": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 2);\n// Adjust this value to alter how many mailbox (other than their own) a user needs to access before being included in results\nlet user_threshold = 1;\n// Adjust this value to alter how many mailbox folders in other's email accounts a users needs to access before being included in results.\nlet folder_threshold = 5;\n// Exclude historical as known good (set lookback and timeframe to same value to skip this)\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated between (ago(lookback)..starttime)\n| where Operation =~ \"MailItemsAccessed\"\n| where ResultStatus =~ \"Succeeded\"\n| extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n| where tolower(MailboxOwnerUPN) != tolower(UserId)\n| join kind=rightanti (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime..endtime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n) on MailboxOwnerUPN, UserId\n| where isnotempty(tostring(parse_json(AdditionalProperties).Folders))\n| mv-expand Folders = parse_json(AdditionalProperties).Folders\n| extend folders = tostring(Folders.Path)\n| extend ClientIP = iif(ClientIp startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, ClientIp), ClientIp)\n| extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)\n| extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)\n| summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n| extend folder_count = array_length(set_folders)\n| extend user_count = array_length(set_MailboxGuid)\n| where user_count > user_threshold or folder_count > folder_threshold\n| extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n| sort by user_count desc\n| project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 2);\nlet user_threshold = 1;    // Threshold for number of mailboxes accessed\nlet folder_threshold = 5;  // Threshold for number of mailbox folders accessed\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between (ago(lookback)..starttime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    | join kind=rightanti (\n        OfficeActivity\n        | where TimeGenerated between (starttime..endtime)\n        | where Operation =~ \"MailItemsAccessed\"\n        | where ResultStatus =~ \"Succeeded\"\n        | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    ) on MailboxOwnerUPN, UserId\n    | where isnotempty(Folders)\n    | mv-expand parse_json(Folders)\n    | extend folders = tostring(Folders.Path)\n    | extend ClientIP = iif(Client_IPAddress startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, Client_IPAddress), Client_IPAddress)\n    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n    | extend folder_count = array_length(set_folders)\n    | extend user_count = array_length(set_MailboxGuid)\n    | where user_count > user_threshold or folder_count > folder_threshold\n    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n    | sort by user_count desc\n    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(lookback)..starttime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    | join kind=rightanti (\n        EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (starttime..endtime)\n        | where Operation =~ \"MailItemsAccessed\"\n        | where ResultStatus =~ \"Succeeded\"\n        | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n        | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    ) on MailboxOwnerUPN, UserId\n    | where isnotempty(tostring(parse_json(AdditionalProperties).Folders))\n    | mv-expand Folders = parse_json(AdditionalProperties).Folders\n    | extend folders = tostring(Folders.Path)\n    | extend ClientIP = iif(ClientIp startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, ClientIp), ClientIp)\n    | extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)\n    | extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)\n    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n    | extend folder_count = array_length(set_folders)\n    | extend user_count = array_length(set_MailboxGuid)\n    | where user_count > user_threshold or folder_count > folder_threshold\n    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n    | sort by user_count desc\n    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders, AccountName, AccountUPNSuffix\n    | order by user_count desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -2997,10 +2974,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
         "contentKind": "HuntingQuery",
-        "displayName": "Anomalous access to other users' mailboxes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3111,9 +3088,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "External user from a new organisation added to Teams",
+                "displayName": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 7);\nlet known_orgs = (\n  EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated between (ago(lookback) .. starttime)\n  | where Workload == \"MicrosoftTeams\"\n  | where Operation in (\"MemberAdded\", \"TeamsSessionStarted\")\n  // Extract the correct UPN and parse our external organization domain\n  | extend Members = parse_json(tostring(AdditionalProperties.Members))\n  | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n  | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n  | where isnotempty(Organization)\n  | summarize by Organization\n);\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated between (starttime .. endtime)\n| where Workload == \"MicrosoftTeams\"\n| where Operation == \"MemberAdded\"\n| extend Members = parse_json(tostring(AdditionalProperties.Members))\n| extend UPN = tostring(Members[0].UPN)\n| extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n| where isnotempty(Organization)\n| where Organization !in (known_orgs)\n| extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 7);\n// OfficeActivity Known Organizations\nlet known_orgs_office = (\n    OfficeActivity\n    | where TimeGenerated between(ago(lookback)..starttime)\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\" or Operation =~ \"TeamsSessionStarted\"\n    | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | summarize by Organization\n);\n// OfficeActivity Query for New Organizations\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between(starttime..endtime)\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend UPN = tostring(parse_json(Members)[0].UPN)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | where Organization !in (known_orgs_office)\n    | extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Known Organizations\nlet known_orgs_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(ago(lookback)..starttime)\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation in (\"MemberAdded\", \"TeamsSessionStarted\")\n    | extend Members = parse_json(tostring(AdditionalProperties.Members))\n    | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | summarize by Organization\n);\n// EnrichedMicrosoft365AuditLogs Query for New Organizations\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(starttime..endtime)\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend Members = parse_json(tostring(AdditionalProperties.Members))\n    | extend UPN = tostring(Members[0].UPN)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | where Organization !in (known_orgs_enriched)\n    | extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by Organization, UPN;\n// Final Output\nCombinedEvents\n    | project Organization, UPN, AccountName, AccountUPNSuffix\n    | order by Organization asc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3167,10 +3144,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
         "contentKind": "HuntingQuery",
-        "displayName": "External user from a new organisation added to Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3196,9 +3173,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Mail Redirect via ExO Transport Rule",
+                "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
                 "category": "Hunting Queries",
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Workload == \"Exchange\"\n| where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n| mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))\n| extend RuleName = case(\n    Operation == \"Set-TransportRule\", ObjectId,\n    Operation == \"New-TransportRule\", ParsedParameters.Name,\n    \"Unknown\")\n| mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)\n| where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n| extend RedirectTo = ExpandedParameters.Value\n| extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n| project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, AdditionalProperties\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"Exchange\"\n    | where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n    | mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | extend RuleName = case(\n        Operation == \"Set-TransportRule\", ObjectId,\n        Operation == \"New-TransportRule\", ParsedParameters.Name,\n        \"Unknown\"\n    )\n    | mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)\n    | where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n    | extend RedirectTo = ExpandedParameters.Value\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, AdditionalProperties\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload == \"Exchange\"\n    | where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | extend RuleName = case(\n        Operation == \"Set-TransportRule\", OfficeObjectId,\n        Operation == \"New-TransportRule\", ParsedParameters.Name,\n        \"Unknown\"\n    )\n    | mv-expand ExpandedParameters = todynamic(Parameters)\n    | where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n    | extend RedirectTo = ExpandedParameters.Value\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, Parameters\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = IPAddress;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by RuleName, UserId;\n// Final Output\nCombinedEvents\n    | project TimeGenerated, RuleName, RedirectTo, IPAddress, Port, UserId, AccountName, AccountUPNSuffix\n    | order by TimeGenerated desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3252,10 +3229,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
         "contentKind": "HuntingQuery",
-        "displayName": "Mail Redirect via ExO Transport Rule",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3281,9 +3258,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Bots added to multiple teams",
+                "displayName": "GSA Enriched Office 365 - Bots added to multiple teams",
                 "category": "Hunting Queries",
-                "query": "// Adjust these thresholds to suit your environment.\nlet threshold = 2;\nlet time_threshold = timespan(5m);\nEnrichedMicrosoft365AuditLogs\n  | where Workload == \"MicrosoftTeams\"\n  | where Operation == \"BotAddedToTeam\"\n  | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n  | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n  | extend CountOfTeams = array_length(Teams)\n  | extend TimeDelta = End - Start\n  | where CountOfTeams > threshold\n  | where TimeDelta <= time_threshold\n  | project Start, End, Teams, CountOfTeams, UserId\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix\n",
+                "query": "let threshold = 2;  // Adjust this threshold based on your environment\nlet time_threshold = timespan(5m);  // Adjust the time delta threshold\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"BotAddedToTeam\"\n    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n    | extend CountOfTeams = array_length(Teams)\n    | extend TimeDelta = End - Start\n    | where CountOfTeams > threshold\n    | where TimeDelta >= time_threshold\n    | project Start, End, Teams, CountOfTeams, UserId\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"BotAddedToTeam\"\n    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n    | extend CountOfTeams = array_length(Teams)\n    | extend TimeDelta = End - Start\n    | where CountOfTeams > threshold\n    | where TimeDelta <= time_threshold\n    | project Start, End, Teams, CountOfTeams, UserId\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(Start, *) by UserId;\n// Final Output\nCombinedEvents\n    | project Start, End, Teams, CountOfTeams, UserId, AccountName, AccountUPNSuffix\n    | order by Start desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3337,7 +3314,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
         "contentKind": "HuntingQuery",
-        "displayName": "Bots added to multiple teams",
+        "displayName": "GSA Enriched Office 365 - Bots added to multiple teams",
         "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '2.0.1')))]",
         "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '2.0.1')))]",
         "version": "2.0.1"
@@ -3366,9 +3343,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "User made Owner of multiple teams",
+                "displayName": "GSA Enriched Office 365 - User made Owner of multiple teams",
                 "category": "Hunting Queries",
-                "query": "// Adjust this value to change how many teams a user is made owner of before detecting\nlet max_owner_count = 3;\n// Identify users who have been made owner of multiple Teams\nlet high_owner_count = (\n  EnrichedMicrosoft365AuditLogs\n  | where Workload == \"MicrosoftTeams\"\n  | where Operation == \"MemberRoleChanged\"\n  | extend Member = tostring(UserId)\n  | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n  | where NewRole == 2\n  | summarize TeamCount = dcount(ObjectId) by Member\n  | where TeamCount > max_owner_count\n  | project Member\n);\nEnrichedMicrosoft365AuditLogs\n| where Workload == \"MicrosoftTeams\"\n| where Operation == \"MemberRoleChanged\"\n| extend Member = tostring(UserId)\n| extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n| where NewRole == 2\n| where Member in (high_owner_count)\n| extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1])\n",
+                "query": "let max_owner_count = 3;  \n// Adjust this value to change how many teams a user is made owner of before detecting\n// OfficeActivity Query: Identify users who have been made owners of more than 'max_owner_count' teams\nlet high_owner_count_office = (\n    OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRoleChanged\"\n    | extend Member = tostring(parse_json(Members)[0].UPN) \n    | extend NewRole = toint(parse_json(Members)[0].Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | summarize TeamCount = dcount(TeamName) by Member\n    | where TeamCount > max_owner_count\n    | project Member\n);\n// OfficeActivity Query: Fetch details for users with high ownership count\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRoleChanged\"\n    | extend Member = tostring(parse_json(Members)[0].UPN)\n    | extend NewRole = toint(parse_json(Members)[0].Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | where Member in (high_owner_count_office)\n    | extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1]);\n// EnrichedMicrosoft365AuditLogs Query: Identify users who have been made owners of more than 'max_owner_count' teams\nlet high_owner_count_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRoleChanged\"\n    | extend Member = tostring(UserId)\n    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | summarize TeamCount = dcount(ObjectId) by Member\n    | where TeamCount > max_owner_count\n    | project Member\n);\n// EnrichedMicrosoft365AuditLogs Query: Fetch details for users with high ownership count\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRoleChanged\"\n    | extend Member = tostring(UserId)\n    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | where Member in (high_owner_count_enriched)\n    | extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1]);\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize by Member, AccountName, AccountUPNSuffix;\n// Final Output\nCombinedEvents\n| order by Member asc\n| project Member, AccountName, AccountUPNSuffix\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3422,10 +3399,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
         "contentKind": "HuntingQuery",
-        "displayName": "User made Owner of multiple teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - User made Owner of multiple teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3451,9 +3428,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Multiple Teams deleted by a single user",
+                "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
                 "category": "Hunting Queries",
-                "query": "// Adjust this value to change how many Teams should be deleted before including\nlet max_delete = 3;\nlet deleting_users = (\n  EnrichedMicrosoft365AuditLogs\n  | where Workload == \"MicrosoftTeams\"\n  | where Operation == \"TeamDeleted\"\n  | summarize count_ = count() by UserId\n  | where count_ > max_delete\n  | project UserId\n);\nEnrichedMicrosoft365AuditLogs\n| where Workload == \"MicrosoftTeams\"\n| where Operation == \"TeamDeleted\"\n| where UserId in (deleting_users)\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n",
+                "query": "let max_delete = 3;  // Adjust this value to change how many Teams should be deleted before being included\n// EnrichedMicrosoft365AuditLogs - Users who deleted more than 'max_delete' Teams\nlet deleting_users_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"TeamDeleted\"\n    | summarize count_ = count() by UserId\n    | where count_ > max_delete\n    | project UserId\n);\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"TeamDeleted\"\n    | where UserId in (deleting_users_enriched)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix\n    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;\n// OfficeActivity - Users who deleted more than 'max_delete' Teams\nlet deleting_users_office = (\n    OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize count_ = count() by UserId\n    | where count_ > max_delete\n    | project UserId\n);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | where UserId in (deleting_users_office)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix\n    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by UserId;\n// Final Output\nCombinedEvents\n| project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix\n| order by TimeGenerated desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3507,10 +3484,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
         "contentKind": "HuntingQuery",
-        "displayName": "Multiple Teams deleted by a single user",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3536,9 +3513,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Previously Unseen Bot or Application Added to Teams",
+                "displayName": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet historical_bots = \n  EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated between (lookback .. starttime)\n  | where Workload == \"MicrosoftTeams\"\n  | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n  | where isnotempty(AddonName)\n  | distinct AddonName;\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated between (starttime .. endtime)\n| where Workload == \"MicrosoftTeams\"\n| extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n| where AddonName !in (historical_bots)\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = starttime - 14d;\n  // Historical bots from EnrichedMicrosoft365AuditLogs\n  let historical_bots_enriched = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (lookback .. starttime)\n      | where Workload == \"MicrosoftTeams\"\n      | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n      | where isnotempty(AddonName)\n      | distinct AddonName;\n  // Historical bots from OfficeActivity\n  let historical_bots_office = OfficeActivity\n      | where TimeGenerated between (lookback .. starttime)\n      | where OfficeWorkload == \"MicrosoftTeams\"\n      | where isnotempty(AddonName)\n      | distinct AddonName;\n  // Find new bots in Enriched Logs\n  let new_bots_enriched = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"MicrosoftTeams\"\n      | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n      | where AddonName !in (historical_bots_enriched)\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Find new bots in OfficeActivity\n  let new_bots_office = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"MicrosoftTeams\"\n      | where isnotempty(AddonName)\n      | where AddonName !in (historical_bots_office)\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Combine both new bots from Enriched Logs and OfficeActivity\n  let CombinedNewBots = new_bots_enriched\n      | union new_bots_office\n      | summarize arg_min(TimeGenerated, *) by AddonName, UserId;\n  // Final output\n  CombinedNewBots\n      | project TimeGenerated, AddonName, UserId, AccountName, AccountUPNSuffix\n      | order by TimeGenerated desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3592,10 +3569,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
         "contentKind": "HuntingQuery",
-        "displayName": "Previously Unseen Bot or Application Added to Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3621,9 +3598,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "New Windows Reserved Filenames staged on Office file services",
+                "displayName": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 7);\nlet Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated between (starttime .. endtime)\n| extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n| extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n| extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n| where isnotempty(ObjectId)\n| where ObjectId !~ FileName\n| where ObjectId in (Reserved) or FileName in (Reserved)\n| where ClientUserAgent !has \"Mac OS\"\n| project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, ClientUserAgent, SiteUrl, ObjectId, FileName\n| join kind=leftanti (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(lookback) .. starttime)\n    | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n    | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(ObjectId)\n    | where ObjectId !~ FileName\n    | where ObjectId in (Reserved) or FileName in (Reserved)\n    | where ClientUserAgent !has \"Mac OS\"\n    | summarize PrevSeenCount = count() by ObjectId, UserId, FileName\n) on ObjectId\n| extend SiteUrlUserFolder = tolower(split(SiteUrl, '/')[-2])\n| extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n| extend UserIdDiffThanUserFolder = iff(SiteUrl has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n| summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(ClientUserAgent, 100000),\n    Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(FileName, 100000)\n    by Workload, RecordType, UserType, UserKey, UserId, ClientIp, SiteUrl, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend IP_0_Address = ClientIp\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n| extend URL_0_Url = SiteUrl\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = totimespan((endtime - starttime) * 7);\n  \n  // Reserved file names and extensions for Windows\n  let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\n  \n  // EnrichedMicrosoft365AuditLogs Query\n  let EnrichedEvents = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n      | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n      | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n      | where isnotempty(ObjectId)\n      | where ObjectId !~ FileName\n      | where ObjectId in (Reserved) or FileName in (Reserved)\n      | where ClientUserAgent !has \"Mac OS\"\n      | join kind=leftanti (\n          EnrichedMicrosoft365AuditLogs\n          | where TimeGenerated between (ago(lookback) .. starttime)\n          | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n          | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n          | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n          | where isnotempty(ObjectId)\n          | where ObjectId !~ FileName\n          | where ObjectId in (Reserved) or FileName in (Reserved)\n          | where ClientUserAgent !has \"Mac OS\"\n          | summarize PrevSeenCount = count() by ObjectId, UserId, FileName\n      ) on ObjectId\n      | extend SiteUrlUserFolder = tolower(split(SiteUrl, '/')[-2])\n      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n      | extend UserIdDiffThanUserFolder = iff(SiteUrl has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(ClientUserAgent, 100000), Ids = make_list(Id, 100000),\n          SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(FileName, 100000) by Workload, RecordType, UserType, UserKey, UserId, ClientIp, SiteUrl, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIp\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;\n  // OfficeActivity Query\n  let OfficeEvents = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where isnotempty(SourceFileExtension)\n      | where SourceFileName !~ SourceFileExtension\n      | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n      | where UserAgent !has \"Mac OS\"\n      | join kind=leftanti (\n          OfficeActivity\n          | where TimeGenerated between (ago(lookback) .. starttime)\n          | where isnotempty(SourceFileExtension)\n          | where SourceFileName !~ SourceFileExtension\n          | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n          | where UserAgent !has \"Mac OS\"\n          | summarize PrevSeenCount = count() by SourceFileExtension\n      ) on SourceFileExtension\n      | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n      | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000),\n          SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000) by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIP\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;\n  // Combine Office and Enriched Logs\n  let CombinedEvents = OfficeEvents\n      | union EnrichedEvents\n      | summarize arg_min(StartTime, *) by UserId, ClientIP;\n  // Final Output\n  CombinedEvents\n      | project StartTime, EndTime, Operations, UserAgents, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url\n      | order by StartTime desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3677,10 +3654,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
         "contentKind": "HuntingQuery",
-        "displayName": "New Windows Reserved Filenames staged on Office file services",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3706,9 +3683,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Office Mail Forwarding - Hunting Version",
+                "displayName": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
                 "category": "Hunting Queries",
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Workload == \"Exchange\"\n| where (Operation == \"Set-Mailbox\" and tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardingSmtpAddress') \n    or (Operation in ('New-InboxRule', 'Set-InboxRule') and (tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardTo' or tostring(parse_json(tostring(AdditionalProperties))) contains 'RedirectTo'))\n| extend parsed = parse_json(tostring(AdditionalProperties))\n| extend fwdingDestination_initial = iif(Operation == \"Set-Mailbox\", tostring(parsed.ForwardingSmtpAddress), coalesce(tostring(parsed.ForwardTo), tostring(parsed.RedirectTo)))\n| where isnotempty(fwdingDestination_initial)\n| extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n| parse fwdingDestination with * '@' ForwardedtoDomain \n| parse UserId with *'@' UserDomain\n| extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.'))[0])\n| where ForwardedtoDomain !contains subDomain\n| extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n| extend ClientIPAddress = case(ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))), ClientIp)\n| extend Port = case(\n                    ClientIp has \".\",\n                    (split(ClientIp, \":\")[1]),\n                    ClientIp has \"[\",\n                    tostring(split(ClientIp, \"]:\")[1]),\n                    ClientIp\n                )\n| project\n    TimeGenerated,\n    UserId,\n    UserDomain,\n    subDomain,\n    Operation,\n    ForwardedtoDomain,\n    ClientIPAddress,\n    Result,\n    Port,\n    ObjectId,\n    fwdingDestination,\n    AdditionalProperties\n| extend\n    AccountName = tostring(split(UserId, \"@\")[0]),\n    AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend Host = tostring(parse_json(tostring(AdditionalProperties)).OriginatingServer)\n| extend HostName = tostring(split(Host, \".\")[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n| extend IP_0_Address = ClientIPAddress\n| extend Host_0_HostName = HostName\n| extend Host_0_DnsDomain = DnsDomain\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  \n  // Enriched Logs Query for forwarding rule operations\n  let EnrichedForwardRules = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"Exchange\"\n      | where (Operation == \"Set-Mailbox\" and tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardingSmtpAddress') \n          or (Operation in ('New-InboxRule', 'Set-InboxRule') and (tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardTo' or tostring(parse_json(tostring(AdditionalProperties))) contains 'RedirectTo'))\n      | extend parsed = parse_json(tostring(AdditionalProperties))\n      | extend fwdingDestination_initial = iif(Operation == \"Set-Mailbox\", tostring(parsed.ForwardingSmtpAddress), coalesce(tostring(parsed.ForwardTo), tostring(parsed.RedirectTo)))\n      | where isnotempty(fwdingDestination_initial)\n      | extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n      | parse fwdingDestination with * '@' ForwardedtoDomain \n      | parse UserId with * '@' UserDomain\n      | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.'))[0])\n      | where ForwardedtoDomain !contains subDomain\n      | extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n      | extend ClientIPAddress = case(ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))), ClientIp)\n      | extend Port = case(ClientIp has \".\", (split(ClientIp, \":\")[1]), ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]), ClientIp)\n      | extend Host = tostring(parse_json(tostring(AdditionalProperties)).OriginatingServer)\n      | extend HostName = tostring(split(Host, \".\")[0])\n      | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, HostName, DnsDomain\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Office Activity Query for forwarding rule operations\n  let OfficeForwardRules = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"Exchange\"\n      | where (Operation =~ \"Set-Mailbox\" and Parameters contains 'ForwardingSmtpAddress') \n          or (Operation in~ ('New-InboxRule', 'Set-InboxRule') and (Parameters contains 'ForwardTo' or Parameters contains 'RedirectTo'))\n      | extend parsed = parse_json(Parameters)\n      | extend fwdingDestination_initial = (iif(Operation =~ \"Set-Mailbox\", tostring(parsed[1].Value), tostring(parsed[2].Value)))\n      | where isnotempty(fwdingDestination_initial)\n      | extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n      | parse fwdingDestination with * '@' ForwardedtoDomain \n      | parse UserId with * '@' UserDomain\n      | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.') [0]))\n      | where ForwardedtoDomain !contains subDomain\n      | extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n      | extend ClientIPAddress = case(ClientIP has \".\", tostring(split(ClientIP, \":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))), ClientIP)\n      | extend Port = case(ClientIP has \".\", (split(ClientIP, \":\")[1]), ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]), ClientIP)\n      | extend Host = tostring(split(OriginatingServer, \" (\")[0])\n      | extend HostName = tostring(split(Host, \".\")[0])\n      | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, HostName, DnsDomain\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Combine the results from both Enriched and Office Activity logs\n  let CombinedForwardRules = EnrichedForwardRules\n      | union OfficeForwardRules\n      | summarize arg_min(TimeGenerated, *) by UserId, ForwardedtoDomain, Operation\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, Host_0_HostName, Host_0_DnsDomain, IP_0_Address, Account_0_Name, Account_0_UPNSuffix;  \n  // Final output\n  CombinedForwardRules\n      | order by TimeGenerated desc;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3762,10 +3739,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
         "contentKind": "HuntingQuery",
-        "displayName": "Office Mail Forwarding - Hunting Version",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3791,9 +3768,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Files uploaded to teams and access summary",
+                "displayName": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
                 "category": "Hunting Queries",
-                "query": "EnrichedMicrosoft365AuditLogs\n| where RecordType == \"SharePointFileOperation\"\n| where Operation == \"FileUploaded\"\n| where UserId != \"app@sharepoint\"\n| where ObjectId has \"Microsoft Teams Chat Files\"\n| extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n| join kind=leftouter (\n    EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation == \"FileDownloaded\" or Operation == \"FileAccessed\"\n    | where UserId != \"app@sharepoint\"\n    | where ObjectId has \"Microsoft Teams Chat Files\"\n    | extend UserId1 = UserId, ClientIp1 = ClientIp\n) on ObjectId\n| extend userBag = bag_pack(\"UserId1\", UserId1, \"ClientIp1\", ClientIp1)\n| summarize AccessedBy = make_bag(userBag), make_set(UserId1, 10000) by bin(TimeGenerated, 1h), UserId, ObjectId, SourceFileName\n| extend NumberOfUsersAccessed = array_length(bag_keys(AccessedBy))\n| project timestamp = TimeGenerated, UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n",
+                "query": "// Define the query for EnrichedMicrosoft365AuditLogs\nlet enrichedLogs = EnrichedMicrosoft365AuditLogs\n  | where RecordType == \"SharePointFileOperation\"\n  | where Operation == \"FileUploaded\"\n  | where UserId != \"app@sharepoint\"\n  | where ObjectId has \"Microsoft Teams Chat Files\"\n  | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n  | join kind=leftouter (\n      EnrichedMicrosoft365AuditLogs\n      | where RecordType == \"SharePointFileOperation\"\n      | where Operation in (\"FileDownloaded\", \"FileAccessed\")\n      | where UserId != \"app@sharepoint\"\n      | where ObjectId has \"Microsoft Teams Chat Files\"\n      | extend UserId1 = UserId, ClientIp1 = ClientIp\n  ) on ObjectId\n  | extend userBag = bag_pack(\"UserId1\", UserId1, \"ClientIp1\", ClientIp1)\n  | summarize AccessedBy = make_bag(userBag), make_set(UserId1, 10000) by bin(TimeGenerated, 1h), UserId, ObjectId, SourceFileName\n  | extend NumberOfUsersAccessed = array_length(bag_keys(AccessedBy))\n  | project timestamp = TimeGenerated, UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Define the query for OfficeActivity\nlet officeLogs = OfficeActivity\n  | where RecordType == \"SharePointFileOperation\"\n  | where Operation == \"FileUploaded\"\n  | where UserId != \"app@sharepoint\"\n  | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n  | join kind=leftouter (\n      OfficeActivity\n      | where RecordType == \"SharePointFileOperation\"\n      | where Operation in (\"FileDownloaded\", \"FileAccessed\")\n      | where UserId != \"app@sharepoint\"\n      | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n  ) on OfficeObjectId\n  | extend userBag = bag_pack(UserId1, ClientIP1)\n  | summarize AccessedBy = make_bag(userBag, 10000), make_set(UserId1, 10000) by TimeGenerated, UserId, OfficeObjectId, SourceFileName\n  | extend NumberUsers = array_length(bag_keys(AccessedBy))\n  | project timestamp = TimeGenerated, UserId, FileLocation = OfficeObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed = NumberUsers\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Union both results\nenrichedLogs\n| union officeLogs\n| order by timestamp desc;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3847,10 +3824,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
         "contentKind": "HuntingQuery",
-        "displayName": "Files uploaded to teams and access summary",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3876,9 +3853,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "User added to Teams and immediately uploads file",
+                "displayName": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
                 "category": "Hunting Queries",
-                "query": "let threshold = 1m;\nlet MemberAddedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload == \"MicrosoftTeams\"\n  | where Operation == \"MemberAdded\"\n  | extend TeamName = tostring(parse_json(AdditionalProperties).TeamName)\n  | project TimeGenerated, UploaderID = UserId, TeamName;\nlet FileUploadEvents = EnrichedMicrosoft365AuditLogs\n  | where RecordType == \"SharePointFileOperation\"\n  | where ObjectId has \"Microsoft Teams Chat Files\"\n  | where Operation == \"FileUploaded\"\n  | extend SourceFileName = tostring(parse_json(AdditionalProperties).SourceFileName)\n  | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = ObjectId, SourceFileName;\nMemberAddedEvents\n  | join kind=inner (FileUploadEvents) on UploaderID\n  | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n  | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID\n",
+                "query": "let threshold = 1m;\n  // Define MemberAddedEvents for EnrichedMicrosoft365AuditLogs\n  let MemberAddedEvents_Enriched = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | project TimeGenerated, UploaderID = UserId, TeamName;\n  // Define FileUploadEvents for EnrichedMicrosoft365AuditLogs\n  let FileUploadEvents_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where ObjectId has \"Microsoft Teams Chat Files\"\n    | where Operation == \"FileUploaded\"\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = ObjectId, SourceFileName;\n  // Perform join for EnrichedMicrosoft365AuditLogs\n  let EnrichedResults = MemberAddedEvents_Enriched\n    | join kind=inner (FileUploadEvents_Enriched) on UploaderID\n    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;\n  // Define MemberAddedEvents for OfficeActivity\n  let MemberAddedEvents_Office = OfficeActivity\n    | where OfficeWorkload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend TeamName = iff(isempty(TeamName), Members[0].UPN, TeamName)\n    | project TimeGenerated, UploaderID = UserId, TeamName;\n  // Define FileUploadEvents for OfficeActivity\n  let FileUploadEvents_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n    | where Operation == \"FileUploaded\"\n    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = OfficeObjectId, FileName = SourceFileName;\n  // Perform join for OfficeActivity\n  let OfficeResults = MemberAddedEvents_Office\n    | join kind=inner (FileUploadEvents_Office) on UploaderID\n    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n    | project-away UploaderID1\n    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;\n  // Union both results\n  EnrichedResults\n  | union OfficeResults\n  | order by timestamp desc;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -3932,10 +3909,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
         "contentKind": "HuntingQuery",
-        "displayName": "User added to Teams and immediately uploads file",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -3961,9 +3938,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Windows Reserved Filenames Staged on Office File Services",
+                "displayName": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
                 "category": "Hunting Queries",
-                "query": "// Reserved FileNames/Extension for Windows\nlet Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\nEnrichedMicrosoft365AuditLogs\n| extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n| extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n| extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n| where isnotempty(ObjectId)\n| where ObjectId in (Reserved) or SourceFileName in (Reserved)\n| where UserAgent !has \"Mac OS\"\n| extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n| extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n// identify when UserId is not a match to the specific site url personal folder reference\n| extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n| summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), ObjectIds = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(SourceFileName, 100000)\nby Workload, RecordType, UserType, UserKey, UserId, ClientIp, Site_Url, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n// Use mvexpand on any list items and you can expand out the exact time and other metadata about the hit\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend IP_0_Address = ClientIp\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n| extend URL_0_Url = Site_Url\n",
+                "query": "let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\n  // Query for OfficeActivity\n  let OfficeActivityResults = OfficeActivity\n    | where isnotempty(SourceFileExtension)\n    | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n    | where UserAgent !has \"Mac OS\"\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000)\n    by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIP\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix\n    | extend URL_0_Url = Site_Url;\n  // Query for EnrichedMicrosoft365AuditLogs\n  let EnrichedMicrosoft365Results = EnrichedMicrosoft365AuditLogs\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(ObjectId)\n    | where ObjectId in (Reserved) or SourceFileName in (Reserved)\n    | where UserAgent !has \"Mac OS\"\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), ObjectIds = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(SourceFileName, 100000)\n    by Workload, RecordType, UserType, UserKey, UserId, ClientIp, Site_Url, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIp\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix\n    | extend URL_0_Url = Site_Url;\n  // Combine both queries\n  OfficeActivityResults\n  | union EnrichedMicrosoft365Results\n  | order by StartTime desc;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4017,10 +3994,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
         "contentKind": "HuntingQuery",
-        "displayName": "Windows Reserved Filenames Staged on Office File Services",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -4216,9 +4193,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "SharePointFileOperation via previously unseen IPs",
+                "displayName": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet BLOCK_THRESHOLD = 1.0;\nlet HighBlockRateASNs =\n  SigninLogs\n  | where TimeGenerated > lookback\n  | where isnotempty(AutonomousSystemNumber)\n  | summarize make_set(IPAddress), TotalIps = dcount(IPAddress), BlockedSignins = countif(ResultType == \"50053\"), TotalSignins = count() by AutonomousSystemNumber\n  | extend BlockRatio = 1.00 * BlockedSignins / TotalSignins\n  | where BlockRatio >= BLOCK_THRESHOLD\n  | distinct AutonomousSystemNumber;\nlet ASNIPs =\n  SigninLogs\n  | where TimeGenerated > lookback\n  | where AutonomousSystemNumber in (HighBlockRateASNs)\n  | distinct IPAddress, AutonomousSystemNumber;\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated between (starttime .. endtime)\n| where RecordType == \"SharePointFileOperation\"\n| where Operation in (\"FileDownloaded\", \"FileUploaded\")\n| where ClientIp in (ASNIPs)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIp\n| extend IP_0_Address = ClientIp\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet BLOCK_THRESHOLD = 1.0;\n// Identify Autonomous System Numbers (ASNs) with a high block rate in Sign-in Logs\nlet HighBlockRateASNs = SigninLogs\n    | where TimeGenerated > lookback\n    | where isnotempty(AutonomousSystemNumber)\n    | summarize make_set(IPAddress), TotalIps = dcount(IPAddress), BlockedSignins = countif(ResultType == \"50053\"), TotalSignins = count() by AutonomousSystemNumber\n    | extend BlockRatio = 1.00 * BlockedSignins / TotalSignins\n    | where BlockRatio >= BLOCK_THRESHOLD\n    | distinct AutonomousSystemNumber;\n// Retrieve IP addresses from these high block rate ASNs\nlet ASNIPs = SigninLogs\n    | where TimeGenerated > lookback\n    | where AutonomousSystemNumber in (HighBlockRateASNs)\n    | distinct IPAddress, AutonomousSystemNumber;\n// OfficeActivity Query: File activities from identified ASN IPs\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between(starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where ClientIP in (ASNIPs)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIP\n    | extend IP_0_Address = ClientIP;\n// EnrichedMicrosoft365AuditLogs Query: File activities from identified ASN IPs\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where ClientIp in (ASNIPs)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIp\n    | extend IP_0_Address = ClientIp;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, RecentFileActivities, IP_0_Address\n    | order by StartTime desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4272,10 +4249,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
         "contentKind": "HuntingQuery",
-        "displayName": "SharePointFileOperation via previously unseen IPs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -4301,9 +4278,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "SharePointFileOperation via devices with previously unseen user agents",
+                "displayName": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet MINIMUM_BLOCKS = 10;\nlet SUCCESS_THRESHOLD = 0.2;\nlet HistoricalActivity = \n  SigninLogs\n  | where TimeGenerated > lookback\n  | where isnotempty(ClientAppUsed)\n  | summarize SuccessfulSignins = countif(ResultType == \"0\"), BlockedSignins = countif(ResultType == \"50053\") by ClientAppUsed\n  | extend SuccessBlockRatio = 1.00 * SuccessfulSignins / BlockedSignins\n  | where SuccessBlockRatio < SUCCESS_THRESHOLD\n  | where BlockedSignins > MINIMUM_BLOCKS;\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated between (starttime .. endtime)\n| where RecordType == \"SharePointFileOperation\"\n| where Operation in (\"FileDownloaded\", \"FileUploaded\")\n| extend ClientAppUsed = tostring(parse_json(AdditionalProperties).UserAgent)\n| extend SiteUrl = tostring(parse_json(AdditionalProperties).SiteUrl)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientAppUsed, UserId, ClientIp, SiteUrl\n| join kind=innerunique (HistoricalActivity) on ClientAppUsed\n| project-away ClientAppUsed1\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend IP_0_Address = ClientIp\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n| extend URL_0_Url = SiteUrl\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet MINIMUM_BLOCKS = 10;\nlet SUCCESS_THRESHOLD = 0.2;\n// Identify user agents or client apps with a low success-to-block ratio in Sign-in Logs\nlet HistoricalActivity = SigninLogs\n    | where TimeGenerated > lookback\n    | where isnotempty(UserAgent)\n    | summarize SuccessfulSignins = countif(ResultType == \"0\"), BlockedSignins = countif(ResultType == \"50053\") by UserAgent\n    | extend SuccessBlockRatio = 1.00 * SuccessfulSignins / BlockedSignins\n    | where SuccessBlockRatio < SUCCESS_THRESHOLD\n    | where BlockedSignins > MINIMUM_BLOCKS;\n// OfficeActivity Query: File operations by matching user agents\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIP, Site_Url\n    | join kind=innerunique (HistoricalActivity) on UserAgent\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIP, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;\n// EnrichedMicrosoft365AuditLogs Query: File operations by matching client apps (UserAgent)\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)  // Ensure matching with UserAgent column\n    | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIp, SiteUrl\n    | join kind=innerunique (HistoricalActivity) on UserAgent\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIp, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, RecentFileActivities, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url\n    | order by StartTime desc;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4357,10 +4334,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
         "contentKind": "HuntingQuery",
-        "displayName": "SharePointFileOperation via devices with previously unseen user agents",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -4386,9 +4363,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Non-owner mailbox login activity",
+                "displayName": "GSA Enriched Office 365 - Non-owner mailbox login activity",
                 "category": "Hunting Queries",
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Workload == \"Exchange\"\n| where Operation == \"MailboxLogin\"\n| extend Logon_Type = tostring(parse_json(tostring(AdditionalProperties)).LogonType)\n| extend MailboxOwnerUPN = tostring(parse_json(tostring(AdditionalProperties)).MailboxOwnerUPN)\n| where Logon_Type != \"Owner\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIp\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n| extend IP_0_Address = ClientIp\n| extend Account_0_Name = AccountName\n| extend Account_0_UPNSuffix = AccountUPNSuffix\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  // Enriched Logs Query for Mailbox Logins (non-owner)\n  let EnrichedMailboxLogins = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"Exchange\"\n      | where Operation == \"MailboxLogin\"\n      | extend Logon_Type = tostring(parse_json(tostring(AdditionalProperties)).LogonType)\n      | extend MailboxOwnerUPN = tostring(parse_json(tostring(AdditionalProperties)).MailboxOwnerUPN)\n      | where Logon_Type != \"Owner\"\n      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIp\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIp\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Office Activity Query for Mailbox Logins (non-owner)\n  let OfficeMailboxLogins = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"Exchange\"\n      | where Operation == \"MailboxLogin\" and Logon_Type != \"Owner\"\n      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIP\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIP\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Combine both results\n  let CombinedMailboxLogins = EnrichedMailboxLogins\n      | union OfficeMailboxLogins\n      | summarize arg_min(StartTime, *) by UserId, MailboxOwnerUPN, Logon_Type;\n  // Final output\n  CombinedMailboxLogins\n      | project StartTime, EndTime, Operation, UserId, MailboxOwnerUPN, Logon_Type, Account_0_Name, Account_0_UPNSuffix, IP_0_Address\n      | order by StartTime desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4442,7 +4419,7 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
         "contentKind": "HuntingQuery",
-        "displayName": "Non-owner mailbox login activity",
+        "displayName": "GSA Enriched Office 365 - Non-owner mailbox login activity",
         "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '2.0.1')))]",
         "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '2.0.1')))]",
         "version": "2.0.1"
@@ -4471,9 +4448,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "PowerShell or non-browser mailbox login activity",
+                "displayName": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
                 "category": "Hunting Queries",
-                "query": "EnrichedMicrosoft365AuditLogs\n| where Workload == \"Exchange\" and Operation == \"MailboxLogin\"\n| extend ClientApplication = tostring(parse_json(AdditionalProperties).ClientInfoString)\n| where ClientApplication == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n| extend TenantName = tostring(parse_json(AdditionalProperties).TenantName)\n| extend MailboxOwner = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n| extend LogonType = tostring(parse_json(AdditionalProperties).LogonType)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, TenantName, UserType, UserId, MailboxOwner, LogonType, ClientApplication\n| extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n| extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n| extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n| extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '')\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n    let endtime = todatetime('{{EndTimeISO}}');\n    // EnrichedMicrosoft365AuditLogs query\n    let EnrichedMailboxLogin = EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (starttime .. endtime)\n        | where Workload == \"Exchange\" and Operation == \"MailboxLogin\"\n        | extend ClientApplication = tostring(parse_json(AdditionalProperties).ClientInfoString)\n        | where ClientApplication == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n        | extend TenantName = tostring(parse_json(AdditionalProperties).TenantName)\n        | extend MailboxOwner = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n        | extend LogonType = tostring(parse_json(AdditionalProperties).LogonType)\n        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, TenantName, UserType, UserId, MailboxOwner, LogonType, ClientApplication\n        | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n        | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n        | extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n        | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n    // OfficeActivity query\n    let OfficeMailboxLogin = OfficeActivity\n        | where TimeGenerated between (starttime .. endtime)\n        | where OfficeWorkload == \"Exchange\" and Operation == \"MailboxLogin\"\n        | where ClientInfoString == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n        | extend LogonType = \"Unknown\"  // If LogonType does not exist, create a placeholder\n        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, LogonType, ClientInfoString\n        | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n        | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n        | extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n        | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n    // Combine Enriched and Office queries\n    let CombinedMailboxLogin = EnrichedMailboxLogin\n        | union OfficeMailboxLogin\n        | summarize arg_min(StartTime, *) by UserId, Operation\n        | project StartTime, EndTime, Operation, TenantName, OrganizationName, UserType, UserId, MailboxOwner, LogonType, ClientApplication, ClientInfoString, Count, AccountName, AccountUPNSuffix, AccountNTDomain;\n    // Final output\n    CombinedMailboxLogin\n        | order by StartTime desc;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4527,10 +4504,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
         "contentKind": "HuntingQuery",
-        "displayName": "PowerShell or non-browser mailbox login activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -4556,9 +4533,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "SharePoint File Operation via Client IP with Previously Unseen User Agents",
+                "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
                 "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet historicalUA = EnrichedMicrosoft365AuditLogs\n| where RecordType == \"SharePointFileOperation\"\n| where Operation in (\"FileDownloaded\", \"FileUploaded\")\n| where TimeGenerated between(lookback..starttime)\n| extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n| summarize by ClientIp, ClientApplication;\nlet recentUA = EnrichedMicrosoft365AuditLogs\n| where RecordType == \"SharePointFileOperation\"\n| where Operation in (\"FileDownloaded\", \"FileUploaded\")\n| where TimeGenerated between(starttime..endtime)\n| extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIp, ClientApplication;\nrecentUA | join kind=leftanti (\n   historicalUA\n) on ClientIp, ClientApplication\n// Some EnrichedMicrosoft365AuditLogs records do not contain ClientIp information - exclude these for fewer results\n| where not(isempty(ClientIp))\n| extend IP_0_Address = ClientIp\n",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = starttime - 14d;\n  // Historical user agents in EnrichedMicrosoft365AuditLogs\n  let historicalUA_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (lookback .. starttime)\n    | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n    | summarize by ClientIp, ClientApplication;\n  // Recent user agents in EnrichedMicrosoft365AuditLogs\n  let recentUA_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (starttime .. endtime)\n    | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIp, ClientApplication;\n  // Combine historical and recent user agents from EnrichedMicrosoft365AuditLogs\n  let Enriched_UA = recentUA_Enriched\n    | join kind=leftanti (historicalUA_Enriched) on ClientIp, ClientApplication\n    | where not(isempty(ClientIp))\n    | extend IP_0_Address = ClientIp;\n  // Historical user agents in OfficeActivity\n  let historicalUA_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (lookback .. starttime)\n    | summarize by ClientIP, UserAgent;\n  // Recent user agents in OfficeActivity\n  let recentUA_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (starttime .. endtime)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIP, UserAgent;\n  // Combine historical and recent user agents from OfficeActivity\n  let Office_UA = recentUA_Office\n    | join kind=leftanti (historicalUA_Office) on ClientIP, UserAgent\n    | where not(isempty(ClientIP))\n    | extend IP_0_Address = ClientIP;\n  // Final combined result\n  Enriched_UA\n  | union Office_UA\n  | project StartTime, EndTime, ClientIp, ClientApplication, IP_0_Address;\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4612,10 +4589,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
         "contentKind": "HuntingQuery",
-        "displayName": "SharePoint File Operation via Client IP with Previously Unseen User Agents",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {
@@ -4641,9 +4618,9 @@
               "location": "[parameters('workspace-location')]",
               "properties": {
                 "eTag": "*",
-                "displayName": "Multiple Users Email Forwarded to Same Destination",
+                "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
                 "category": "Hunting Queries",
-                "query": "let queryfrequency = 1d;\nlet queryperiod = 7d;\nEnrichedMicrosoft365AuditLogs\n| where TimeGenerated > ago(queryperiod)\n| where Workload == \"Exchange\"\n| where AdditionalProperties has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n| mv-apply DynamicParameters = todynamic(AdditionalProperties) on (summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))\n| evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n| extend DestinationMailAddress = tolower(case(\n    isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n    isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n    isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n    \"\"))\n| where isnotempty(DestinationMailAddress)\n| mv-expand split(DestinationMailAddress, \";\")\n| extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n| extend ClientIp = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIp\n| where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n| mv-expand UserId to typeof(string)\n| extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n",
+                "query": "let queryfrequency = 1d;\nlet queryperiod = 7d;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(queryperiod)\n    | where Workload == \"Exchange\"\n    | where AdditionalProperties has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(AdditionalProperties) on (\n        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"\n    ))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | extend ClientIp = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIp\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated > ago(queryperiod)\n    | where OfficeWorkload =~ \"Exchange\"\n    | where Parameters has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"\n    ))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = ClientIP;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by DestinationMailAddress, ClientIp;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DestinationMailAddress, ClientIp, Ports, UserId, AccountName, AccountUPNSuffix\n    | order by StartTime desc\n",
                 "version": 2,
                 "tags": [
                   {
@@ -4697,10 +4674,10 @@
         "contentSchemaVersion": "3.0.0",
         "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
         "contentKind": "HuntingQuery",
-        "displayName": "Multiple Users Email Forwarded to Same Destination",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.1')))]",
-        "version": "2.0.1"
+        "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.2')))]",
+        "version": "2.0.2"
       }
     },
     {

From c02f23865fa0ac6bc158b389aa612fde71247236 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Sun, 6 Oct 2024 10:04:15 +0300
Subject: [PATCH 15/27] workbooks update

---
 .../Workbooks/GSAM365EnrichedEvents.json      | 822 +++++++++++++++---
 .../Workbooks/GSANetworkTraffic.json          | 442 +++++++++-
 2 files changed, 1097 insertions(+), 167 deletions(-)

diff --git a/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json b/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json
index 461ba0feb5..39b4440aa1 100644
--- a/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json	
+++ b/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json	
@@ -4,15 +4,17 @@
     {
       "type": 1,
       "content": {
-        "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+        "json": "## Enriched Microsoft 365 logs Workbook (Preview)\n---\n\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps."
       },
-      "name": "text - 1"
+      "name": "text - 2"
     },
     {
       "type": 9,
       "content": {
         "version": "KqlParameterItem/1.0",
-        "crossComponentResources": [],
+        "crossComponentResources": [
+          "value::all"
+        ],
         "parameters": [
           {
             "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
@@ -20,24 +22,25 @@
             "name": "LogAnalyticWorkspace",
             "label": "Log Analytic Workspace",
             "type": 5,
-            "description": "The log analytic workspace in which to execute the queries",
+            "description": "The Log Analytic Workspace In Which To Execute The Queries",
             "isRequired": true,
             "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+            "crossComponentResources": [
+              "value::all"
+            ],
             "typeSettings": {
               "resourceTypeFilter": {
                 "microsoft.operationalinsights/workspaces": true
               },
-              "additionalResourceOptions": [
-                "value::1"
-              ],
+              "additionalResourceOptions": [],
               "showDefault": false
             },
             "timeContext": {
               "durationMs": 86400000
             },
-            "defaultValue": "value::1",
             "queryType": 1,
-            "resourceType": "microsoft.resourcegraph/resources"
+            "resourceType": "microsoft.resourcegraph/resources",
+            "value": null
           },
           {
             "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
@@ -106,7 +109,10 @@
             "multiSelect": true,
             "quote": "'",
             "delimiter": ",",
-            "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+            "query": "EnrichedMicrosoft365AuditLogs\r\n| summarize Count = count() by UserId\r\n| order by Count desc, UserId asc\r\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false",
+            "crossComponentResources": [
+              "{LogAnalyticWorkspace}"
+            ],
             "typeSettings": {
               "limitSelectTo": 20,
               "additionalResourceOptions": [
@@ -128,7 +134,7 @@
         ],
         "style": "pills",
         "queryType": 1,
-        "resourceType": "microsoft.operationalinsights/workspaces"
+        "resourceType": "microsoft.resourcegraph/resources"
       },
       "name": "parameters - 15"
     },
@@ -137,21 +143,38 @@
       "content": {
         "version": "LinkItem/1.0",
         "style": "tabs",
+        "tabStyle": "bigger",
         "links": [
           {
-            "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
-            "cellValue": "tabSel",
+            "id": "e841bafb-6437-4d29-84ac-ba16c5a6d901",
+            "cellValue": "selTab",
             "linkTarget": "parameter",
             "linkLabel": "Overview",
             "subTarget": "Overview",
             "style": "link"
           },
           {
-            "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
-            "cellValue": "tabSel",
+            "id": "ac5f2082-50bc-4739-bdf2-20c93b613671",
+            "cellValue": "selTab",
+            "linkTarget": "parameter",
+            "linkLabel": "SharePoint/OneDrive Insights",
+            "subTarget": "Threat",
+            "style": "link"
+          },
+          {
+            "id": "dc2778e7-739b-44ba-9ae4-c81901277f57",
+            "cellValue": "selTab",
             "linkTarget": "parameter",
-            "linkLabel": "All Traffic",
-            "subTarget": "AllTraffic",
+            "linkLabel": "Exchange Online Insights",
+            "subTarget": "ThreatEXO",
+            "style": "link"
+          },
+          {
+            "id": "666111e2-54ff-4fa4-a648-11a5c8c0235b",
+            "cellValue": "selTab",
+            "linkTarget": "parameter",
+            "linkLabel": "Teams Insights",
+            "subTarget": "ThreatTeams",
             "style": "link"
           }
         ]
@@ -159,77 +182,179 @@
       "name": "links - 7"
     },
     {
-      "type": 3,
+      "type": 12,
       "content": {
-        "version": "KqlItem/1.0",
-        "query": "NetworkAccessDemo_CL\r\n| project \r\n    Timestamp = createdDateTime_t,\r\n    User = userPrincipalName_s,\r\n    SourceIP = SourceIP,\r\n    DestinationIP = destinationIp_s,\r\n    DestinationPort = destinationPort_d,\r\n    Action = action_s,\r\n    PolicyName = policyName_s,\r\n    TransportProtocol = transportProtocol_s,\r\n    TrafficType = trafficType_s,\r\n    DestinationURL = destinationUrl_s,\r\n    ReceivedBytes = receivedBytes_d,\r\n    SentBytes = sentBytes_d,\r\n    DeviceOS = deviceOperatingSystem_s,\r\n    PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
-        "size": 3,
-        "showAnalytics": true,
-        "title": "Log",
-        "timeContextFromParameter": "TimeRange",
-        "showExportToExcel": true,
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "gridSettings": {
-          "rowLimit": 1000,
-          "filter": true
-        }
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Exchange\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
+              "size": 0,
+              "title": "Access By Location",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "CountryRegion",
+                "locInfoColumn": "Country",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "Count",
+                "sizeAggregation": "Sum",
+                "labelSettings": "Country",
+                "legendMetric": "Count",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "Count",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "turquoise"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Exchange\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n",
+              "size": 0,
+              "title": "Access By Location And OS",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 1"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Set-AdminAuditLogConfig\", \"Set-OrganizationConfig\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Audit Of Critical Configuration Changes",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Set-TransportRule\", \"Set-AtpPolicyForO365\", \"Set-MalwareFilterRule\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Changes In Email Security Policies",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Add-RoleGroupMember\", \"Remove-ManagementRoleAssignment\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Monitoring Role Group Membership Changes",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"New-TenantAllowBlockListSpoofitems\", \"Remove-TenantAllowBlockListSpoofitems\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Spoofing Settings Management Activities",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"New-SafeAttachmentPolicy\", \"Set-SafeAttachmentPolicy\", \"Set-SafeAttachmentRule\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Safe Attachments Policy Changes",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 6"
+          }
+        ]
       },
       "conditionalVisibility": {
-        "parameterName": "tabSel",
+        "parameterName": "selTab",
         "comparison": "isEqualTo",
-        "value": "AllTraffic"
+        "value": "ThreatEXO"
       },
-      "name": "query - 6"
+      "name": "group - 18"
     },
     {
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Transactions\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
-        "size": 4,
-        "timeContextFromParameter": "TimeRange",
+        "query": "EnrichedMicrosoft365AuditLogs | where Workload == \"Exchange\" | where Operation in (\"Add-MailboxFolderPermission\", \"Add-RoleGroupMember\", \"New-TransportRule\", \"Remove-ManagementRoleAssignment\", \"Set-TransportRule\") | summarize Count = count(), Users = makeset(UserId) by Operation | order by Count desc",
+        "size": 0,
+        "title": "Permission changes and security policy updates",
+        "timeContext": {
+          "durationMs": 86400000
+        },
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
-        "visualization": "tiles",
-        "tileSettings": {
-          "titleContent": {
-            "columnMatch": "snapshot",
-            "formatter": 1
-          },
-          "leftContent": {
-            "columnMatch": "col1",
-            "formatter": 12,
-            "formatOptions": {
-              "palette": "auto"
-            }
-          },
-          "showBorder": true,
-          "size": "auto"
-        },
-        "mapSettings": {
-          "locInfo": "LatLong",
-          "sizeSettings": "ExistingClients",
-          "sizeAggregation": "Sum",
-          "legendMetric": "ExistingClients",
-          "legendAggregation": "Sum",
-          "itemColorSettings": {
-            "type": "heatmap",
-            "colorAggregation": "Sum",
-            "nodeColorField": "ExistingClients",
-            "heatmapPalette": "greenRed"
-          }
-        },
-        "textSettings": {
-          "style": "bignumber"
-        }
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ]
       },
       "conditionalVisibility": {
-        "parameterName": "tabSel",
+        "parameterName": "seltab",
         "comparison": "isEqualTo",
-        "value": "Overview"
+        "value": "ThreatEXO"
       },
-      "name": "query - 2"
+      "name": "query - 13"
     },
     {
       "type": 12,
@@ -241,24 +366,62 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
-              "size": 2,
-              "title": "Usage over Time (GB)",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Teams\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
+              "size": 0,
+              "title": "Access By Location",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "barchart"
-            },
-            "conditionalVisibility": {
-              "parameterName": "tabSel",
-              "comparison": "isEqualTo",
-              "value": "Overview"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "CountryRegion",
+                "locInfoColumn": "Country",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "Count",
+                "sizeAggregation": "Sum",
+                "labelSettings": "Country",
+                "legendMetric": "Count",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "Count",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "turquoise"
+                }
+              }
             },
+            "customWidth": "50",
             "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Teams\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n",
+              "size": 0,
+              "title": "Access By Location And OS",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 1"
           }
         ]
       },
-      "name": "group - 5"
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "ThreatTeams"
+      },
+      "name": "group - 10"
     },
     {
       "type": 12,
@@ -270,12 +433,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project  createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"OneDrive\", \"SharePoint\",\"SPO/OneDrive\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
               "size": 0,
-              "title": "Locations",
+              "title": "Access By Location",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "map",
               "mapSettings": {
                 "locInfo": "CountryRegion",
@@ -286,6 +452,7 @@
                 "sizeAggregation": "Sum",
                 "labelSettings": "Country",
                 "legendMetric": "Country",
+                "numberOfMetrics": 19,
                 "legendAggregation": "Count",
                 "itemColorSettings": {
                   "nodeColorField": "Count",
@@ -296,88 +463,190 @@
               }
             },
             "customWidth": "50",
-            "name": "query - 0"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 19"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| summarize [\"Event Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Event Count\"] desc\r\n",
               "size": 2,
-              "title": "Top Allowed Web Categories",
+              "title": "Access By Location And OS",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "piechart"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "filter": true
+              }
             },
             "customWidth": "50",
-            "name": "query - 7"
-          },
+            "name": "query - 20"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "Threat"
+      },
+      "name": "group - 20",
+      "styleSettings": {
+        "showBorder": true
+      }
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload == \"Teams\"\r\n| where Operation in (\"MemberAdded\", \"MemberRemoved\", \"TeamDeleted\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+        "size": 0,
+        "title": "Changes In Team Memberships",
+        "timeContextFromParameter": "TimeRange",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "ThreatTeams"
+      },
+      "customWidth": "50",
+      "name": "query - 11"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
+              "query": "let RiskyExtensions = dynamic([\"exe\", \"msi\", \"bat\", \"cmd\", \"com\", \"scr\", \"pif\", \"ps1\", \"vbs\", \"js\", \"jse\", \"wsf\", \"docm\", \"xlsm\", \"pptm\", \"dll\", \"ocx\", \"cpl\", \"app\", \"vb\", \"reg\", \"inf\", \"hta\"]);\r\n\r\nEnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"SPO/OneDrive\")\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend [\"File Extension\"] = tostring(parse_json(AdditionalProperties).SourceFileExtension)\r\n| where [\"File Extension\"] in (RiskyExtensions)\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, [\"File Extension\"], Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], [\"File Extension\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], [\"File Extension\"], Operation, Count\r\n",
               "size": 0,
-              "title": "Top Blocked Destinations",
+              "title": "Risky File Operations",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces"
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "OperationCount",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ]
+              }
             },
             "customWidth": "50",
-            "name": "query - 5"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 1"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
-              "size": 3,
-              "title": "Top Blocked Web Categories",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation in (\"FileRecycled\", \"FileDownloaded\", \"FileUploaded\", \"FileCreated\", \"File Modified\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Bulk File Events",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "piechart"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "OperationCount",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ]
+              }
             },
             "customWidth": "50",
-            "name": "query - 6"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 8"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"SPO/OneDrive\")\r\n| where Operation == \"FileDeletedFirstStageRecycleBin\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by bin(Timestamp, 1h), [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n| where Count > 1\r\n",
               "size": 0,
-              "title": "Top Allowed Destinations",
+              "title": " Bulk File Deletion Operations",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "gridSettings": {
                 "formatters": [
                   {
-                    "columnMatch": "Count",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "magenta"
-                    }
-                  },
-                  {
-                    "columnMatch": "Recived",
-                    "formatter": 4,
+                    "columnMatch": "FileDeletions",
+                    "formatter": 8,
                     "formatOptions": {
-                      "palette": "turquoise"
-                    }
-                  },
-                  {
-                    "columnMatch": "Total",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "pink"
+                      "palette": "blue"
                     }
-                  },
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let baselinePeriod = 30d;\r\nlet detectionWindow = 1h;\r\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\r\n\r\nEnrichedMicrosoft365AuditLogs\r\n| where TimeGenerated >= ago(baselinePeriod)\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation == \"FileDownloaded\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by bin(Timestamp, detectionWindow), [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Bulk File Download",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
                   {
-                    "columnMatch": "Sent",
-                    "formatter": 4,
+                    "columnMatch": "DownloadCount",
+                    "formatter": 8,
                     "formatOptions": {
                       "palette": "blue"
                     }
@@ -386,33 +655,328 @@
               }
             },
             "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 4"
+          }
+        ]
+      },
+      "name": "group - 9"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n      | where tostring(Country) != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n\r\n",
+              "size": 0,
+              "title": "Access By Location",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "CountryRegion",
+                "locInfoColumn": "Country",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "Count",
+                "sizeAggregation": "Sum",
+                "minSize": 20,
+                "labelSettings": "Country",
+                "legendMetric": "Country",
+                "numberOfMetrics": 8,
+                "legendAggregation": "Count",
+                "itemColorSettings": {
+                  "nodeColorField": "Count",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "turquoise"
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
+            "name": "query - 5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| summarize [\"Event Count\"] = count() by [\"Time Generated\"] = TimeGenerated, [\"User\"] = UserId, [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem, [\"Workload\"] = Workload\r\n| order by [\"Time Generated\"] desc\r\n",
+              "size": 0,
+              "title": "Access By Location And OS",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "rowLimit": 1000,
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
             "name": "query - 1"
+          }
+        ]
+      },
+      "name": "group - 19"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "let data = EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| project \r\n    Operation, \r\n    UserId, \r\n    Workload, \r\n    SourceIp, \r\n    DeviceId, \r\n    TimeGenerated, \r\n    Details = pack_all(),\r\n    OS = tostring(DeviceOperatingSystem)\r\n| extend Workload = tostring(Workload)\r\n| extend WorkloadStatus = case(\r\n    Workload == \"Exchange\", \"Exchange\",\r\n    Workload == \"Teams\", \"Teams\",\r\n    Workload == \"SharePoint\", \"SharePoint\",\r\n    \"Other\"\r\n);\r\n\r\nlet appData = data\r\n| summarize \r\n    TotalCount = count(), \r\n    ExchangeCount = countif(Workload == \"Exchange\"), \r\n    TeamsCount = countif(Workload == \"Teams\"), \r\n    SharePointCount = countif(Workload == \"SharePoint\"), \r\n    OtherCount = countif(Workload == \"Other\") \r\n    by UserId\r\n| where UserId != ''\r\n| join kind=inner (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId\r\n    | project-away TimeGenerated\r\n  ) on UserId\r\n| order by TotalCount desc, UserId asc\r\n| project UserId, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\r\n| serialize Id = row_number();\r\n\r\ndata\r\n| summarize \r\n    TotalCount = count(), \r\n    ExchangeCount = countif(Workload == \"Exchange\"), \r\n    TeamsCount = countif(Workload == \"Teams\"), \r\n    SharePointCount = countif(Workload == \"SharePoint\"), \r\n    OtherCount = countif(Workload == \"Other\") \r\n    by UserId, SourceIp = tostring(SourceIp)\r\n| join kind=inner (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId, SourceIp\r\n    | project-away TimeGenerated\r\n  ) on UserId, SourceIp\r\n| order by TotalCount desc, UserId asc\r\n| project UserId, SourceIp, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on UserId\r\n| project Id, Name = SourceIp, Type = 'Client IP', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = Id1\r\n| union (\r\n    appData \r\n    | project Id, Name = UserId, Type = 'Operating System', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = -1\r\n  )\r\n| order by ['Events Count'] desc, Name asc\r\n",
+        "size": 2,
+        "title": "Activity Log",
+        "timeContextFromParameter": "TimeRange",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
+        "gridSettings": {
+          "formatters": [
+            {
+              "columnMatch": "Id",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "Type",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "Trend",
+              "formatter": 9,
+              "formatOptions": {
+                "palette": "blue"
+              }
+            },
+            {
+              "columnMatch": "Other Count",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "ParentId",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "Operation Count",
+              "formatter": 8,
+              "formatOptions": {
+                "palette": "blue"
+              }
+            },
+            {
+              "columnMatch": "Exchange Count",
+              "formatter": 8,
+              "formatOptions": {
+                "min": 0,
+                "palette": "blue"
+              }
+            },
+            {
+              "columnMatch": "Teams Count",
+              "formatter": 8,
+              "formatOptions": {
+                "min": 0,
+                "palette": "purple"
+              }
+            },
+            {
+              "columnMatch": "SharePoint Count",
+              "formatter": 8,
+              "formatOptions": {
+                "min": 0,
+                "palette": "turquoise"
+              }
+            },
+            {
+              "columnMatch": "Details",
+              "formatter": 5,
+              "formatOptions": {
+                "linkTarget": "GenericDetails",
+                "linkIsContextBlade": true
+              }
+            }
+          ],
+          "rowLimit": 1000,
+          "filter": true,
+          "hierarchySettings": {
+            "idColumn": "Id",
+            "parentColumn": "ParentId",
+            "treeType": 0,
+            "expanderColumn": "Name"
+          }
+        }
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "Overview"
+      },
+      "name": "query - 6"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<br />\r\n💡 _Click on a segment of the pie chart to explore more details_"
+            },
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
+            "name": "text - 2"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
-              "size": 2,
-              "title": "Protocol Distburion",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| extend \r\n    OS = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n    OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\")\r\n| summarize DeviceCount = count() by OS, OSVersion\r\n| order by DeviceCount desc\r\n",
+              "size": 3,
+              "title": "Devices Accessing M365",
               "timeContextFromParameter": "TimeRange",
+              "exportParameterName": "Parampie",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "piechart"
             },
             "customWidth": "50",
-            "name": "query - 3"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
+            "name": "query - 6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend \r\n    [\"Operating System\"] = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n    [\"OS Version\"] = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\"),\r\n    [\"Device ID\"] = coalesce(tostring(DeviceId), \"Unknown DeviceId\")\r\n| where [\"Operating System\"] == dynamic({Parampie}).label\r\n| summarize [\"Device Count\"] = count() by [\"Operating System\"], [\"OS Version\"], [\"Device ID\"]\r\n| order by [\"Device Count\"] desc\r\n",
+              "size": 2,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "$gen_group",
+                    "formatter": 1
+                  }
+                ],
+                "hierarchySettings": {
+                  "treeType": 1,
+                  "groupBy": [
+                    "OperatingSystem",
+                    "OSVersion"
+                  ],
+                  "expandTopLevel": false
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibilities": [
+              {
+                "parameterName": "selTab",
+                "comparison": "isEqualTo",
+                "value": "Overview"
+              },
+              {
+                "parameterName": "Parampie",
+                "comparison": "isNotEqualTo"
+              }
+            ],
+            "name": "query - 1"
           }
         ]
       },
+      "name": "group - 19"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "let BusinessHoursStart = 8; // 8 AM\r\nlet BusinessHoursEnd = 18; // 6 PM\r\n\r\nEnrichedMicrosoft365AuditLogs \r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend HourOfDay = hourofday(TimeGenerated)\r\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\r\n| summarize [\"Off-Hour Activities\"] = count() by [\"User ID\"] = UserId, [\"Date\"] = bin(TimeGenerated, 1d), [\"Operation\"]\r\n| order by [\"Off-Hour Activities\"] desc\r\n",
+        "size": 0,
+        "title": "Activity Outside Standard Working Hours (8:00 - 18:00)",
+        "timeContextFromParameter": "TimeRange",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "Overview"
+      },
+      "name": "query - 14"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "EnrichedMicrosoft365AuditLogs\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc\n",
+        "size": 0,
+        "title": "Microsoft 365 Transactions",
+        "timeContextFromParameter": "TimeRange",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
+        "visualization": "unstackedbar"
+      },
       "conditionalVisibility": {
-        "parameterName": "tabSel",
+        "parameterName": "selTab",
         "comparison": "isEqualTo",
         "value": "Overview"
       },
-      "name": "group - 4"
+      "name": "query - 2"
     }
   ],
-  "fallbackResourceIds": [],
+  "fallbackResourceIds": [
+    "Global Secure Access"
+  ],
+  "fromTemplateId": "community-Workbooks/Global Secure Access/Microsoft Entra Internet Access/Enriched Microsoft 365 logs",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
-}
+}
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json b/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json
index 46e0e43e6f..92c9d904ea 100644
--- a/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json	
+++ b/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json	
@@ -4,16 +4,16 @@
     {
       "type": 1,
       "content": {
-        "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+        "json": "## Network Traffic Insights Workbook (Preview)\n---\nInformation in the dashboard is based on log data\n\n\n"
       },
-      "name": "text - 0"
+      "name": "text - 2"
     },
     {
       "type": 9,
       "content": {
         "version": "KqlParameterItem/1.0",
         "crossComponentResources": [
-          ""
+          "value::all"
         ],
         "parameters": [
           {
@@ -22,24 +22,25 @@
             "name": "LogAnalyticWorkspace",
             "label": "Log Analytic Workspace",
             "type": 5,
-            "description": "The log analytic workspace in which to execute the queries",
+            "description": "The Log Analytic Workspace In Which To Execute The Queries",
             "isRequired": true,
             "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+            "crossComponentResources": [
+              "value::all"
+            ],
             "typeSettings": {
               "resourceTypeFilter": {
                 "microsoft.operationalinsights/workspaces": true
               },
-              "additionalResourceOptions": [
-                "value::1"
-              ],
+              "additionalResourceOptions": [],
               "showDefault": false
             },
             "timeContext": {
-              "durationMs": 86400000
+              "durationMs": 2592000000
             },
-            "defaultValue": "value::1",
             "queryType": 1,
-            "resourceType": "microsoft.resourcegraph/resources"
+            "resourceType": "microsoft.resourcegraph/resources",
+            "value": null
           },
           {
             "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
@@ -96,7 +97,7 @@
               "durationMs": 86400000
             },
             "value": {
-              "durationMs": 2592000000
+              "durationMs": 604800000
             }
           },
           {
@@ -108,7 +109,10 @@
             "multiSelect": true,
             "quote": "'",
             "delimiter": ",",
-            "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+            "query": "NetworkAccessTraffic\r\n| summarize Count = count() by UserPrincipalName\r\n| order by Count desc, UserPrincipalName asc\r\n| project Value = UserPrincipalName, Label = strcat(UserPrincipalName, ' - ', Count, ' Logs'), Selected = false",
+            "crossComponentResources": [
+              "{LogAnalyticWorkspace}"
+            ],
             "typeSettings": {
               "limitSelectTo": 20,
               "additionalResourceOptions": [
@@ -126,10 +130,41 @@
             "value": [
               "value::all"
             ]
+          },
+          {
+            "id": "527af4d2-3089-4aa4-9fbb-48ec697db20d",
+            "version": "KqlParameterItem/1.0",
+            "name": "WebCategories",
+            "label": "Web Categories",
+            "type": 2,
+            "multiSelect": true,
+            "quote": "'",
+            "delimiter": ",",
+            "query": "NetworkAccessTraffic\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| order by Count desc, firstCategory asc\r\n| project Value = firstCategory, Label = strcat(firstCategory, ' - ', Count, ' Logs')",
+            "crossComponentResources": [
+              "{LogAnalyticWorkspace}"
+            ],
+            "typeSettings": {
+              "additionalResourceOptions": [
+                "value::all"
+              ],
+              "selectAllValue": "*",
+              "showDefault": false
+            },
+            "timeContext": {
+              "durationMs": 604800000
+            },
+            "timeContextFromParameter": "TimeRange",
+            "defaultValue": "value::all",
+            "queryType": 0,
+            "resourceType": "microsoft.operationalinsights/workspaces",
+            "value": [
+              "value::all"
+            ]
           }
         ],
         "style": "pills",
-        "queryType": 1,
+        "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces"
       },
       "name": "parameters - 15"
@@ -155,23 +190,286 @@
             "linkLabel": "All Traffic",
             "subTarget": "AllTraffic",
             "style": "link"
+          },
+          {
+            "id": "5ae54b5a-ac7b-4b7a-a1e1-1e574625caa3",
+            "cellValue": "tabSel",
+            "linkTarget": "parameter",
+            "linkLabel": "URL Lookup",
+            "subTarget": "URLLookup",
+            "style": "link"
+          },
+          {
+            "id": "68c566f8-957e-4a3f-8b66-730fc24135fb",
+            "cellValue": "tabSel",
+            "linkTarget": "parameter",
+            "linkLabel": "Security Insights",
+            "subTarget": "Security",
+            "style": "link"
           }
         ]
       },
       "name": "links - 7"
     },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let NetworkAccessTrafficData = NetworkAccessTraffic\r\n| where SourceIp != \"\" and isnotempty(SourceIp)\r\n| summarize arg_max(TimeGenerated, *) by SourceIp, TenantId;\r\n\r\nlet SigninLogsData = SigninLogs\r\n| where IPAddress != \"\" and isnotempty(IPAddress)\r\n| summarize arg_max(TimeGenerated, *) by IPAddress, TenantId, UserId, CorrelationId;\r\n\r\nSigninLogsData\r\n| join kind=leftanti (\r\n    NetworkAccessTrafficData\r\n    | where SourceIp != \"\" and isnotempty(SourceIp)\r\n) on $left.IPAddress == $right.SourceIp and $left.TenantId == $right.TenantId\r\n| project TimeGenerated, IPAddress, UserId, UserPrincipalName, AppDisplayName, DeviceDetail.deviceId\r\n",
+              "size": 0,
+              "title": "Sign-ins Outside Global Secure Access",
+              "timeContextFromParameter": "TimeRange",
+              "showExportToExcel": true,
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "rowLimit": 1000,
+                "filter": true
+              }
+            },
+            "name": "query - 0"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "tabSel",
+        "comparison": "isEqualTo",
+        "value": "Security"
+      },
+      "name": "group - 10"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "💡 Type the URL for detailed analysis"
+      },
+      "conditionalVisibility": {
+        "parameterName": "tabSel",
+        "comparison": "isEqualTo",
+        "value": "URLLookup"
+      },
+      "name": "text - 10"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 9,
+            "content": {
+              "version": "KqlParameterItem/1.0",
+              "parameters": [
+                {
+                  "id": "ec8c38c8-3064-4921-8dcd-a69d3895599b",
+                  "version": "KqlParameterItem/1.0",
+                  "name": "URL",
+                  "type": 1,
+                  "typeSettings": {
+                    "isSearchBox": true
+                  },
+                  "timeContext": {
+                    "durationMs": 86400000
+                  }
+                }
+              ],
+              "style": "above",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces"
+            },
+            "conditionalVisibility": {
+              "parameterName": "tabSel",
+              "comparison": "isEqualTo",
+              "value": "URLLookup"
+            },
+            "name": "parameters - 9"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Web Categories"
+            },
+            "name": "text - 11"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let CategoryData = NetworkAccessTraffic \r\n| where DestinationFqdn contains \"{URL}\"  // Filters logs based on the provided URL parameter\r\n| extend CategoriesList = split(DestinationWebCategories, \",\")  // Split categories into a list\r\n| mv-expand Category = CategoriesList  // Expand the list into individual rows\r\n| extend Category = trim_start(\" \", trim_end(\" \", tostring(Category)))  // Trim leading and trailing spaces\r\n| extend Category = iff(TrafficType == \"microsoft365\", \"Microsoft M365\", Category)  // Set category to \"Microsoft M365\" if TrafficType is \"microsoft365\"\r\n| summarize UniqueCategories = make_set(Category);  // Create a set of unique categories\r\n\r\nCategoryData\r\n| extend \r\n    PrimaryCategory = iff(array_length(UniqueCategories) > 0, tostring(UniqueCategories[0]), \"None\")\r\n| project \r\n    col1 = PrimaryCategory,\r\n    snapshot = \"Primary Category\"\r\n\r\n| union (\r\n    CategoryData\r\n    | extend \r\n        SecondaryCategory = iff(array_length(UniqueCategories) > 1, tostring(UniqueCategories[1]), \"None\")\r\n    | project \r\n        col1 = SecondaryCategory,\r\n        snapshot = \"Secondary Category\"\r\n)\r\n\r\n| order by snapshot asc\r\n",
+              "size": 4,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "snapshot"
+                },
+                "leftContent": {
+                  "columnMatch": "col1",
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "auto"
+              }
+            },
+            "name": "query - 17"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Traffic Access Details"
+            },
+            "name": "text - 15"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let NetworkData = NetworkAccessTraffic\r\n| where DestinationFqdn contains \"{URL}\";  // Filters logs based on the provided URL parameter\r\n\r\nNetworkData\r\n| summarize \r\n    UniqueUsers = dcount(UserPrincipalName),\r\n    UniqueDevices = dcount(DeviceId),    \r\n    TotalAllow = countif(Action == \"Allow\"),\r\n    TotalBlock = countif(Action == \"Block\")\r\n| project \r\n    col1 = UniqueUsers, \r\n    snapshot = \"Unique Users\"\r\n| union (NetworkData\r\n    | summarize UniqueDevices = dcount(DeviceId)\r\n    | project col1 = UniqueDevices, snapshot = \"Unique Devices\")\r\n| union (NetworkData\r\n    | summarize TotalAllow = countif(Action == \"Allow\")\r\n    | project col1 = TotalAllow, snapshot = \"Total Allow\")\r\n| union (NetworkData\r\n    | summarize TotalBlock = countif(Action == \"Block\")\r\n    | project col1 = TotalBlock, snapshot = \"Total Block\")\r\n| order by snapshot asc",
+              "size": 4,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "snapshot",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "col1",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 2,
+                      "maximumSignificantDigits": 3
+                    }
+                  }
+                },
+                "showBorder": true
+              }
+            },
+            "name": "query - 14"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Bandwidth Usage"
+            },
+            "name": "text - 16"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let NetworkData = NetworkAccessTraffic\r\n| where DestinationFqdn contains \"{URL}\";  // Filters logs based on the provided URL parameter\r\n\r\nNetworkData\r\n| summarize \r\n    TotalSent = sum(SentBytes),\r\n    TotalReceived = sum(ReceivedBytes),\r\n    TotalBandwidth = sum(SentBytes + ReceivedBytes)\r\n| extend \r\n    TotalSentMB = round(TotalSent / 1024.0 / 1024.0, 2),\r\n    TotalReceivedMB = round(TotalReceived / 1024.0 / 1024.0, 2),\r\n    TotalBandwidthMB = round(TotalBandwidth / 1024.0 / 1024.0, 2)\r\n| project \r\n    TotalSentMB,\r\n    TotalReceivedMB,\r\n    TotalBandwidthMB\r\n| extend dummy = 1\r\n| project-away dummy\r\n| mv-expand \r\n    Column = pack_array(\"TotalSentMB\", \"TotalReceivedMB\", \"TotalBandwidthMB\"),\r\n    Value = pack_array(TotalSentMB, TotalReceivedMB, TotalBandwidthMB)\r\n| extend \r\n    snapshot = case(\r\n        Column == \"TotalSentMB\", \"Total Sent (MB)\",\r\n        Column == \"TotalReceivedMB\", \"Total Received (MB)\",\r\n        Column == \"TotalBandwidthMB\", \"Total Bandwidth (MB)\",\r\n        \"Unknown\"\r\n    ),\r\n    col1 = iff(Value < 0.01, 0.00, Value)\r\n| project-away Column, Value\r\n| order by snapshot asc",
+              "size": 4,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "snapshot",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "col1",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 2,
+                      "maximumSignificantDigits": 3
+                    }
+                  }
+                },
+                "showBorder": true
+              }
+            },
+            "name": "query - 17"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Traffic Logs (filtered)"
+            },
+            "name": "text - 12"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where DestinationFqdn contains \"{URL}\"\r\n| project \r\n    Timestamp = TimeGenerated,\r\n    User = UserPrincipalName,\r\n    [\"Source IP\"] = SourceIp,\r\n    [\"Destination IP\"] = DestinationIp,\r\n    [\"Destination Port\"] = DestinationPort,\r\n    [\"Destination FQDN\"] = DestinationFqdn,\r\n    Action = case(\r\n        tolower(Action) == \"allow\", \"🟢 Allow\", \r\n        tolower(Action) == \"block\", \"🔴 Block\", \r\n        tolower(Action) // This returns the action in lowercase if it doesn't match \"allow\" or \"block\"\r\n    ),\r\n    [\"Policy Name\"] = PolicyName,\r\n    [\"Policy Rule ID\"] = PolicyRuleId,\r\n    [\"Received Bytes\"] = ReceivedBytes,\r\n    [\"Sent Bytes\"] = SentBytes,\r\n    [\"Device OS\"] = DeviceOperatingSystem    \r\n| order by Timestamp desc\r\n",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "name": "query - 13"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "tabSel",
+        "comparison": "isEqualTo",
+        "value": "URLLookup"
+      },
+      "name": "group - URL Lookup"
+    },
     {
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "NetworkAccessDemo_CL\r\n| project \r\n    Timestamp = createdDateTime_t,\r\n    User = userPrincipalName_s,\r\n    SourceIP = SourceIP,\r\n    DestinationIP = destinationIp_s,\r\n    DestinationPort = destinationPort_d,\r\n    Action = action_s,\r\n    PolicyName = policyName_s,\r\n    TransportProtocol = transportProtocol_s,\r\n    TrafficType = trafficType_s,\r\n    DestinationURL = destinationUrl_s,\r\n    ReceivedBytes = receivedBytes_d,\r\n    SentBytes = sentBytes_d,\r\n    DeviceOS = deviceOperatingSystem_s,\r\n    PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
+        "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| project \r\n    Timestamp = TimeGenerated,\r\n    User = UserPrincipalName,\r\n    [\"Source IP\"] = SourceIp,\r\n    [\"Destination IP\"] = DestinationIp,\r\n    [\"Destination Port\"] = DestinationPort,\r\n    [\"Destination FQDN\"] = DestinationFqdn,\r\n    Action = case(\r\n        tolower(Action) == \"allow\", \"🟢 Allow\", \r\n        tolower(Action) == \"block\", \"🔴 Block\", \r\n        tolower(Action) // This returns the action in lowercase if it doesn't match \"allow\" or \"block\"\r\n    ),\r\n    [\"Policy Name\"] = PolicyName,\r\n    [\"Web Category\"] = DestinationWebCategories,\r\n    [\"Transport Protocol\"] = TransportProtocol,\r\n    [\"Traffic Type\"] = TrafficType,\r\n    [\"Received Bytes\"] = ReceivedBytes,\r\n    [\"Sent Bytes\"] = SentBytes,\r\n    [\"Device OS\"] = DeviceOperatingSystem,\r\n    [\"Policy Rule ID\"] = PolicyRuleId\r\n| order by Timestamp desc\r\n",
         "size": 3,
-        "showAnalytics": true,
-        "title": "Log",
+        "title": "Traffic Logs",
         "timeContextFromParameter": "TimeRange",
+        "showRefreshButton": true,
         "showExportToExcel": true,
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
         "gridSettings": {
           "rowLimit": 1000,
           "filter": true
@@ -188,11 +486,14 @@
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Trasnacations\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
+        "query": "// Unique Users\nNetworkAccessTraffic\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\n| project SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessTraffic\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(SentBytes + ReceivedBytes) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessTraffic\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Transactions\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
         "size": 4,
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
         "visualization": "tiles",
         "tileSettings": {
           "titleContent": {
@@ -243,12 +544,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend BytesIn = todouble(SentBytes + ReceivedBytes) / (1024 * 1024)  // Convert bytes to Mbytes\r\n| summarize TotalBytesMB = sum(BytesIn) by bin(TimeGenerated, 1h), TrafficType\r\n| order by bin(TimeGenerated, 1h) asc, TrafficType asc\r\n| project TimeGenerated, TrafficType, TotalBytesMB\r\n",
               "size": 2,
-              "title": "Usage over Time (GB)",
+              "title": "Usage Over Time (MB)",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "barchart"
             },
             "conditionalVisibility": {
@@ -272,12 +576,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project  createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
-              "size": 0,
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\r\n| project  TimeGenerated, SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
+              "size": 3,
               "title": "Locations",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "map",
               "mapSettings": {
                 "locInfo": "CountryRegion",
@@ -297,19 +604,21 @@
                 }
               }
             },
-            "customWidth": "50",
             "name": "query - 0"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"allow\" and DestinationWebCategories != '' // Filter for allowed traffic\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
               "size": 2,
               "title": "Top Allowed Web Categories",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "piechart"
             },
             "customWidth": "50",
@@ -319,41 +628,79 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
-              "size": 0,
-              "title": "Top Blocked Destinations",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"block\" and DestinationWebCategories != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+              "size": 3,
+              "title": "Top Blocked Web Categories",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces"
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "piechart"
             },
             "customWidth": "50",
-            "name": "query - 5"
+            "name": "query - 6"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
-              "size": 3,
-              "title": "Top Blocked Web Categories",
+              "query": "NetworkAccessTraffic  \r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"block\" and DestinationFqdn != ''  // Filter for blocked traffic with non-empty Destination FQDN\r\n| summarize Count = count() by [\"Destination FQDN\"] = DestinationFqdn, [\"Destination Web Categories\"] = DestinationWebCategories, [\"Policy Name\"] = PolicyName\r\n| order by Count\r\n",
+              "size": 0,
+              "title": "Top Blocked Destinations",
               "timeContextFromParameter": "TimeRange",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "piechart"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Count",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ],
+                "rowLimit": 1000,
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "$gen_bar_Count_3",
+                    "sortOrder": 2
+                  }
+                ]
+              },
+              "sortBy": [
+                {
+                  "itemKey": "$gen_bar_Count_3",
+                  "sortOrder": 2
+                }
+              ]
             },
             "customWidth": "50",
-            "name": "query - 6"
+            "name": "query - 5"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where SentBytes > 0\r\n| where tolower(Action) != \"block\"\r\n| summarize \r\n    Count = count(), \r\n    [\"Sent Bytes\"] = sum(SentBytes), \r\n    [\"Received Bytes\"] = sum(ReceivedBytes), \r\n    [\"Total Bytes\"] = sum(ReceivedBytes + SentBytes) \r\n    by [\"Destination FQDN\"] = DestinationFqdn\r\n| order by Count desc\r\n",
               "size": 0,
               "title": "Top Allowed Destinations",
               "timeContextFromParameter": "TimeRange",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "gridSettings": {
                 "formatters": [
                   {
@@ -384,8 +731,22 @@
                       "palette": "blue"
                     }
                   }
+                ],
+                "rowLimit": 1000,
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "$gen_bar_Count_1",
+                    "sortOrder": 2
+                  }
                 ]
-              }
+              },
+              "sortBy": [
+                {
+                  "itemKey": "$gen_bar_Count_1",
+                  "sortOrder": 2
+                }
+              ]
             },
             "customWidth": "50",
             "name": "query - 1"
@@ -394,12 +755,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where TransportProtocol != ''\r\n| summarize Count = count() by toupper(TransportProtocol)\r\n| top 10 by Count\r\n",
               "size": 2,
-              "title": "Protocol Distburion",
+              "title": "Protocol Distribution",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "piechart"
             },
             "customWidth": "50",
@@ -415,7 +779,9 @@
       "name": "group - 4"
     }
   ],
-  "fallbackResourceIds": [    
+  "fallbackResourceIds": [
+    "Global Secure Access"
   ],
+  "fromTemplateId": "community-Workbooks/Global Secure Access/Common/Network Traffic Insights",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
 }
\ No newline at end of file

From 70cd17e40be7a9eef97a8e509737a2b3b6f38704 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Sun, 6 Oct 2024 10:46:22 +0300
Subject: [PATCH 16/27] updates

---
 ...repoint_file_transfer_above_threshold.yaml |   4 +-
 .../Global Secure Access/Package/3.0.0.zip    | Bin 42645 -> 48426 bytes
 .../Package/mainTemplate.json                 |  12 +-
 .../Workbooks/GSAM365EnrichedEvents.json      |   2 +-
 .../Workbooks/GSANetworkTraffic.json          |   2 +-
 Workbooks/GSAM365EnrichedEvents.json          | 822 +++++++++++++++---
 Workbooks/GSANetworkTraffic.json              | 442 +++++++++-
 Workbooks/WorkbooksMetadata.json              |   4 +-
 8 files changed, 1109 insertions(+), 179 deletions(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 82243b34ae..f9a4994748 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -78,10 +78,10 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 5h
+    lookbackDuration: PT5H
     matchingMethod: Selected
     groupByEntities:
-      - Account
+    - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
 version: 2.0.7
diff --git a/Solutions/Global Secure Access/Package/3.0.0.zip b/Solutions/Global Secure Access/Package/3.0.0.zip
index e33be3976441c5ae8cd76bcac237e6867da12c7c..6df173c9523aba092dc9c606146005040b430f97 100644
GIT binary patch
delta 42377
zcmXt<Q*>p~(x_wGHaoV}F*>%@(T?pMbl9<NcCusJ=-9Sx>-IVK{4Z-gtXkigRW)kP
zQJBdS5Px1Fkd@^jp|HTfz~I1c)TL^XBk_R$-a4PlZUOU!U|=s1FktBazS@~s+pGVy
zbF?*a{mE?O;$VN?dFH+*Q^)-LRq3_~uD4Jxp^=EuD^Q_(nZndAH|H+9rh36|sUy5f
z7MC<l1I{fbr@8RxAFgu;tWLK~gB6HnMfU>75Dk*KE<l9#sIG%Ir(vh0q~M_J0!BUW
zb${{nFTbc6Z^hL%-UZjXaAf`nB1J)2PW-4n&{;B9=ve7`c=MHev;&TBLBmG3tyC}Q
zHMV(e$BmA34?E+U3*zf=)P2SFJaw&=&!R4O@dSH(NtFbi`8*T5bjN({T@9OC@GT<w
zT*C?nNH6-j?<v(D!!G5#28v|i1Gy;ElxRL(ADe4ELy1kJr>CN75y2PvpQP{beaF*o
zQ1HcpHt(Fbu!|$SwA@HTymfXMPy*U-gl8iI8M@Q>$EEYh@eX>+>i2LYlb5tm-I(Jg
zRUS-j0cK8}PXp~a8$Eg)-sf@oT%;4969g01ol0sL&v)fN{4-wfWPdss0euhZ*EJ)V
zJ3u`-ZJ3*-*+%c_Y^dRCTrhX(JLtP;!)Y%=0|*fP88LwR6<jiLR*ugPp)Z+>_o3X_
zECO{<Crx86sNC#L`C{t{d5_1m#gLUUB^X3dPiXr7mM!vup}?3qFTwM*(bDd8LD-Ls
z6sEAD_q^|T8f$&?BrT;43{=Ja@-_Q1{uL@#lsRAMkPsI#`T*a8F08%sAyY*k{0w7e
zM2RLyc}T-*)8hiw3V{zdOv{fLD?Km-ywIeqDnE~WYWMNUy&EPWybX%~>5{n^2gKas
z5Im+!{`K_P=(Mj>_?8ZUWle?JCr@Z_L8Dxvq|Dk37(Yx55yyW9e&W`L{$Sw=neouL
zweEN*>9OuHCe6s^b{8DM<@qs+J}+8@O*u+zW9A~>nWo#H4-n}iqo(!*{4fBpQq-Y9
zg<QoP!{OR&SJbSR)+GOB_G>}BMZ>{N2=(iqmFvv<#sngruzCo<DCmg@zB-n}c0{o_
z)BN#X8Bx#(cpVJ@`p^7*CIcvu$lXhk#O8gw%A?oh<<Qtg)`M3f(mgD_qujUd-F9#|
zIZdwYM+{>aicniYezE!*KwLk|)Nv$>gl*RlKXrN?Q|F=<p;)}QgRgbcRM64*i@-c@
z(C)La5nM*<dbz&hx176SV|cN;k=LY`?Q<z|^h;Jz^7J_wSa;;Sg-xAsS8PKm?75m5
zOKz=}6odES`rVi~;H6P&hfI7TQhf@q?9Z^Tv@7>Rb}O-a7N)I*A32-ch`yHHQoL*X
z!bW>9^G8@Oo#!Oo$l6GyV#ViBdoRHVCI4Gw(4U|!%)127jcK$n7~C+U5u`0Ap)$0P
zA%4mHd}@SfAT1q2w7!aQ=Olh7j3svtqb2t(ABQZ>?<-H?N$GvpYt-eQ^jbH4|6KLM
z9p~Wr1VraZCvy9h50j14MBR!5SHLwunb0-tVYSB0O=jZ+*+*R7M%Lb{wm`{gVJ2L`
zQd^0YvF@#E@~JpN$#q911sssE?>C_$qn61=&p@vY1hjDyhUo#$5do483g^M?NjuA6
znC;V?h&;F2E%{S@4OZ;{<j_vVdW%(>`zA9Fo6g5P6+lzw#%mscd)tWykw??gB>U>D
z-f=HpTiXE(TD#@unX!_qgj%~LeYj8CxD=e}(OD-A$L(Bm?YwENF^9`)QTM^UoBMcS
zjcXQY)4ZK*#t+i`2h#c<=<feOFaH72O!g)1aO$)q5BD(*^&R?iq=s0}q|E)I&KIt9
zgE1&wtQ$9(pjfPt$`G<#wsw~tuH(>YX$+12HT3kL)AFEA2oF-hGTvFlT$VYGqBl1&
z=KX<Ve^l$JSL4W#8UnOdnL9<Ekm}Y0aDp^JT$N7%%|hX_hcg^o_j8NVpB7gkYZdi1
zlmB6T$S_v&L_#pG`}^W75+n}vG5x@~+^=<%&JD3v*<BWI7dve%S@{*it>+HXx@xlV
ztG8dhu-LFp|4_iWteouQ-&(TVnWU_(*`!0LaXh-w(FQ00<!c;yVnf<ZS=L8?n&{4-
zu5H9@xNPU?gdG$po$CU@07E_a7_&|=KaSmL5Iz3SL{I-`qPPE=$eLw+#(c++1o7$q
zKbD5c=C?-X=c-t;>35zvUSO<;?X-*U?WrT;4gaT)4}f>l+Se#I#3$A*3pht03666q
z6u6f)nU-R_<NuEVjo9q+A55FwEa3i?Yq$Z{3c@xpt#_xM&9<?!YsIdit@EEo)qx>g
zUDZ>4AH$|5|26R^rm;yjn=Iq{qPa<Z&e>Yo*_nxElQ3skbl?gI`AxBO(V0MV;twh;
zR|NpQe(o}n2Hza$!*g0uU#kd<(86;XJ233sPq({OCL&A;K(>K5usswwDf59{J3r)L
zzdLsGaW7@FTFBxKbSo5w3MQ+CX}p|n%J%NGOSpvK*&uj#<tL`=8Hqh8n<JD$m-2_m
z;RlJyMy)UW+}GD4X38HMX|SzWX&}77vE70d;th2V-OvT*+V7j7iV!vQwk{jw#V>7x
z=1xSxrTiH^vNu^HS#L3~m#mR(@TDf*mS-^9^bmEM)`GHq>!Ix>+qbG4+qN}{Tra#Q
z?73v>S4dYc3~4j}A?p8!DE&Xg>OVv}NU~}zCIw8&{+N}WNj@}YrE#racMW(BHd!b<
zKuLeHbShN8<gn1*$(_Z|j_-w>Ban@PWxPM^{4b~r;V4DGx3U-WzW@83!@24%CS`g<
zce-xEyM8V7LlHDrZ&w4lU)%n6rFUJwY0Y<`Sh_OFty4pzX=eUE%J%;#s5y&yDJ#1B
zZP!-t22v%!pP<0G6AuAJ5YKr=qh__;;;RrLw}fKnlJ)#V$;uQrX+4dmYoL{D9vG!a
z3Zaq%o+RE2{PRr%Od}HI5&!K!h%FnFd`2(|nGCwnYJ&}k8~l9(ERM8fjtB`vQoa@q
z9oEV9eCx`u91u@BmR`yeMG^H5)#0TZtP7E4eF$v3`|mn_?(DC)@N2d&Qhku0AK5L#
zJY=~~5OKoz9XsF}T5#MF2zvj|xwHRsuCNeDjH!R5RZ&RyduqJ(ieW#AZnjwWB8mHs
zEB`UF=rIA<$QfrCvdeU1TTJ@I2;lnc<o|17_CGB=9~)qR$zvltE*<UOAJs1GomvLE
z30q^SDUS8Caii3@QAWBpu0Lka9>#U+H@`Eg)vMI6ia%==&RCO=l*3EMlu@_lOSiJQ
z-c4aao*;=Oc0>!_hDv#Jq;{NNMz46h4m1F8c+sZW7AuhnCj2MdVVGu#kxZtn0SV1F
zGW!eoK{Q^#Os{>rQx_JdRs7YWXn|~Suv_D&IT%hj(L#V<`+^;JFSk{rYisk%|K#=l
ziJv5<;#@qvT9hu;+0f*_{ndn>=6bLIt=K%SS<I0vZ?w^P>BUMIW|LbbG-pe1Hg!4Y
zNxqp+TR#wj2*jvJdPGjSdbYW2EIQ|`Gl6!Fc^-Nh`*tEYUR<GhvYUz|UIMS{^1qwb
z0yrH6P<mW%JVjW4#IYUQ%r%@5*Q1oV6pVFdOH))&qH&I{O;9>$<#sgCjr(+OvV+&D
z^Ym&c5-FRQ!{r_0oX_defS=`6U0w*MTrS}KQ`X08|KdN3Cq`-~o~?Sa`H(^dE`^Ze
zmD;XVHeN_=*z*tApcTk&Zc@f;S;A%PUmV3ZS1TFnHbBk+1dvM?k5~W2+amZexZbdC
zwTi>iTecXn;O~EOA_Px|sA5mrDpNvQ^N2)@Ryw87TUQ>dT)&Yr!PrQHRQ@>d)o?Dm
zBc4~8Pm>(yFrLOrm}avbC-4Hljy3nsrN$o59Br?3J_tnl!Q7X)-nhoVd9A02?q#}H
zthqr|%n_t#_az)K1{g;qTNH80FcH=(C38-v?wuOJ6TIGbcD(&-#zr9<e4DuToNL6=
zsROZYL38-Q%n>fJj_B{w!2{=LmaEY@7p^z_*c5^pG^UqrjiEw#V2?oi>7bAHfBXxq
zQnvr{_n=rMkMer|LU1(uY(tl&gP8H8wsDs=Ko+14dz3Y|QU~sPkYKD^!vFZr=;q&p
z2O4afXP_KmiCBK{Hul@tVoaN9!g34HY_4$sD6ROhJIp_E5+#;8&^p{Yl3txpw;a7*
zG8bS_1POekMN|?eGx8+t(sXb??evGNIkLMrxU5xl<u{wAcDjs@d7<HwRTx7doKVD_
z%CI1ekz^u_lj|hG@58BIunkO{seH<8qw=p*%bvt@mCf?0G&AJ*At^St2->XqxwxaS
zMc9*%De-5qT0j#7UvtOY(kcq)Hi3b<=c^v4Z3#qbqnZ?2Wdp|0;Lg>7x)uoBS2gY6
zsDhA{Q16$~dZr#U&5nCYX02D-ERVvRe$&fT{&PdM)aA*)Es%<hLEanZyvcY|FI$s1
zi`nfO746sz(tNV~$?kgeIOkG3I5z(`*HE7P?)u!n13=zXcaeR~ZjJ)9isqhLqrQxj
z22@(D3G_HsEVbkhhDjsglzrDO7070zlO=l9N!;9^_HFOAvfiqKqsc{)OaI0ITc`lT
zeAr7@tUP9t=Y%&!%YEpoe1eKdIUPEHibA9Iwdl632b-l&t}OcasiaRI<6MXmBS_HS
z&7Gd0m%1)1>6Hffi8YfH8fAu5ly)hQ3ry<32=$BAavk~QspxnriIqPk5?{?qaqf;)
z(Odwd$XGHP#M`+YV$|~*1kLpJ+wI5Ns3{cv?c0%+Ijg{QZ92p7g680vCQJyogueRT
zWcG%HEVBKIIzg@Ha>GLHfwyVGE~#%o6zWbG?+jJUTLWuM%>Y7_RqZdNtz8zgK;U1@
zE35?S&jFcua_bZ2zMGhXzhUg#4eA~`;P8acyWZ-EFg%M%ypa&}VmtujU)A!2^Wj=a
zf&2A%_q#*M&+!b|JvB(M8BWpzY|62CpUQG{0r79rpN)Y=<pdHE_od?sUi)XZ_R&a7
zgs*dK@-?h?`RmaKD?JDH+bHYkGC<0tfTOzr1>~`u)@J6vi6&k#Y&Y?n%$(oN+RRo~
zCX%%4jYX2AZfGYN5Q{k|f(XGfw|<8|l=J;gAfr1%)D2J+e_G#)a2dDiyc<41!QCFq
zCS_)ehwZgM0Yh|cRqI@L5}Snde1J!wi0u>k;W-|H;NR<##IO6-epRFZFAMCG$JFFA
zi}b&`ovm1~xi)(K8bpq;kW|T>a<&bs3>3+wMxdmY>N<eZpuCRu0opI)9M0tt?bL2>
zCcz(Pg>XowC1fU`w>Ea*Px^Hj0NCLlSv<OWkK+eidqy~=Cakvi!bLx*0?iS=K5`2=
z*c@m@*W+fNLEF(HInN~OSU`ECVxfkB6+-{#UV><54`J~gtJ9bD78E-_UMSbp1(-b3
zYUsmmLqx~lk2PA5b4Kk8p+b|>=0<a;s=Sl`@;k89kex&8h<GkCN)@W{Lz4kSr@Drn
z+ytUIUEY(^jG+k2cd5H}{pX>zYSte$i^fjtT0v2)mq@}1z)6E?Vc_(tEkErw61V1@
z&#Grx01HcLkMUQpOO&xkRKNJ%?X5E{0_aLwzA4kNuC~$&8V}uL6(*tMxMQbzY82^d
zSbI0NED`tmFk2vq-gv6fX9y<77JvQOW0-LbR*=}#2HscDW%ySWv=N^Gzsuq#Y~^||
zCG6)5jf@AnZ0kCY9B`&gZFk{eK4YCoBFQ3%tYyX)HIu0nmd5HD1%igCgC2!^dkyAI
zwb|hb>}NX^k6}-Mu<oW?0`yHQdgr$7(%<dGd-WP${+7sDbNcTMru#O|rqsDl966bt
zQMkqyV`VcoKRc|s2=N^XWEC10?aUwYW-cuom&%*#Y|@b(Pk<JU%j_JPNZp!Wp+R66
zJ6oOUupB@}ryAi3)n3)4cwtHxQwK1FX-?QicTDk1Zh{Bht-xSoOe6`=W8Nk>J5z5&
zcV7^}$oS%jaTD7}k&ohw{Gxiz>a4rFH6aRqt68cw*ehAd#K2#ID!Cdu;t67p&~)!#
z_6Uc2Z0ArwTHp{NY0S<Lxvkyy)!!Vp7M_}B+8DZ1rJbzMSRL8<aSg+P8VG^%i!vEe
zpGt`Z&sbB~?wx?>Qmq?L+!S%%)M@S;Tz8boVi-b!%JVQ74TYCKcc=>mcTDops())^
z^`Cjs-OSlxN5rv9t=^KDh4BBTkABTqNes(Hd<tD0sRAP#bLejEPh-X1Rgc+pUKVi~
zwmPuI5@PpR%des9-_QXryD?IgecrC!RD?4)(As^r!_6`lHkkB?n?6f#7?>?({dqa9
zJvza6*C#!lT~Y<R&R}ksnG~~tbTC`ud448W0Rd#~P~8**LTw9JV-Rtv5f8oyhSy~v
zF>|HZGVnNrtCObwdAcuEo#41#4G+$qOQ-t?vRwCFW7(^c)QE@4(Vy!SOv7dg*0}Pt
zuZ_<UY#h$2*xzNEZ3a}+gp#{=axosJHql!y9m5t+a^8ujMGxa7ro`DQ?szWMyhdr@
z`0&J5uncx?XXRh-L!(T%iM+Pah`e*5MW|@K1RUUf*bb3;+WL&0TSxzwK+JK%D|`op
z3(HhMds;0kWtJ>7`EYB4R)ZU(w}Z6z$hx;0(%O!4&HAK^!S<^%(b|V7YB9q^GEmu*
zIsxz4HsBBh*d8)EVf_}9E3`C=(6~HJen;|2XZXn?$FFa8sEh1oPj4H`^`6CB&-rmU
zz}|@tWBhjy?G%D%qCMK(+#Yhwls|x7qaCk11WXpg)<gzv711r|WEYG3%yWEL*dZ0L
zF=j?dV<6t7P)0m@hBG9uqAAMwi`6gWnP9-K{5dVj#7PieXPCpJuYLXD2G||0AM|f4
z^>^RU5+2DNFr$IUuHHG&A01B;hG&u#VA2Ya;&Nmk<tMXY?^9JhAUxG)G+SamV3~8|
z2YawuLv7Dxzf{m?ZjA2xHdZi6FIEo$;z2JnO9{9Y$-!umkUXk7UkcTUs(LK8vETHn
zU+s`5W^JTGUOs`*OTLGGlb7Pq(i6GK^6Hazdt@<>t+6oVUdEdMDWv~W#x%_i@M=JD
zvN=A`id>N<g(kWD$KxaNa@%kvxtN?gjycDeJNgc)ZtN5bkLIs#-jibCYnpy7>7^w#
zXX1x<U*Q;(oD=T?hJ6C6cS!Kfdd%oLEuD!1)sUT+IbI#XE%N&tfz+rhiQn8^BQ|k>
z!?A2aZ84~om+q-bbl(sM(4iVHFutXQ=L;r`)+(7~%HJh>1(|7DG0UIMp_f7}mW6%F
z8$Mj(8B^GjDir7&gUI1GiUYp4uYiSC@jbay1SXTR<7kphS>fmjJjx)+qPo9%_vfx_
z$~jEVTx10@YYpGf$&1T8i6rlguazPau^+is;QV3?(K1Rnf#_*IVg;%%Z~zTjv2-bA
zxY6WZxKVZ2yeCLF2dsI!8%ROok8)?L)+8#-qZk7%9&wOVJ3bO(B0oM#Lgo^hy{OyV
zr${IK=RIW?vK*Xg2FHjKH;u)45W;eRmzcnzXZLD#yVRuNsMLKASp&AW2~l>>8g6uO
z{uV-EKdO0QZ`X-4GwX#CxYPwaQc}v_cwR$YJVuGB9M@+4mReV@v$9hcXqeudCZ9?D
zcc>6Lo8IGXu;k_0)McNyG4?Zj8uAsEodnE8eCAnZ=#vTj1nn4}5nfvDX|>;|IL_8T
z@MYWQa(uYIByfP|SP<W~Ac)Z8R#h`?aqstEmi;PsF~RHoV4<yUpbzrV5X)6Bm5cDr
z2YJ07H8pLwXX}WqraxZeP2NCkmsHV2R3Vye{l)H_Kf$gG3hPzj%6Oea+^4NL&Q=6A
zlZyQ!$zfiwIuAu1tZl6OmugCGjAK~9JRIzGcgV94jd(r>%#5q-Ffy3pPA7x0o&EJ=
zu5qVCcip~D^h<&%a1!^FO$;F6a2I4-G_FUqLZ#OnHK_L&wI-MJ*=Xy9a=U?pow&UQ
zFwox~w;%GR*f#rT%9%iKRz{;}b(sT4n+8vvJOI}03=uwDluS8Ml2f7a*&IQU(=%9w
zB|I34Rw3pPvj?^0pbV_-RAsO%Pknrm5<5Sd*(vUuU&41BV7f=Mt4s>Y=q$MoKb3sg
zzPyV}$pi2t+V^sEBupU8(KhXsDj_c1d5YRxQIw>(UM4)OXzIAIeh!UL=W^=rhfb>q
z!;>XygUB9BCm(@<V%RxXXV~17M1o|e*R6IPtPXxX68gtc>yL4Rx~LF<rm2!F%M+mz
z)KSW5)avR6aM`edP`x9kO;O)4Y}b&klU57vObs|KWHt1N=|g_WNL8i38Bm{mE6Ujx
zmNZhdASf7gz&DbHO@y>J5Mdr8WUlFO!p7~bAj(%4R*d`7n<ppZ1rNOO6*5Bg4VV|+
z$(Y*LhwroWbq!{Da*#wKbtUF|Vx?HBnr;m9P1c+TI&Djdz~n9Wkv?iC*ycIhQ`S&d
zFAosQi9m3?Itj$((SC)0=$-Z$kS%!l>b*`bsgQkSC|Jz0SaL@CKR;@fS74q*bES_E
zM}8t_b{&VE$@;aV>!_<g`S0IKf3-*bK^Du?5lAZLmVcMR&Xx-Z#h}cxu0@5frVEsT
z+D9k^rl^Ysy0r2m7FM5M)PEp1VQ?oL>mORy0N|y3==^dQN@2l#ai8xIlpUk12Q*{P
zse>lt#4-^oVAkplif){WwpqD5nI3vGRur<s%wiP%Oo&O?f<I!a#^#b~__vUcXK#?3
zQj{JXpQbI_-AL!^xN}AtNF)3lV)vP7goPe~SAyqaw=dP03v)a&9sA;Y!B;Kf&FiJY
zP;zGvzV{&~WH`pv^CEghKoYRm#?{AfvyAV@@)~dg#a%9?V17B^R=)umOUwq=x%(dt
zfoB>;6TiIbpA?w?M5G%}8TBS47qUjlm`z9Yjrv5arN*iCn~b%mZsJ(QKCE-~iC^^q
zgQ{9dz|9NK%<hXVHg;%veJ^_Gta>81^rvpFwmZEjyASmc&Kc8ArItnCq>)<Cgl@u2
zYQd6X_g2T@h$Q=|jAjDp5p{R^%@o@4s!@>7R;vewn@s9oC_wmYo<gwH>1mIhOsnz{
zqn>=H%2C>WX=^ZU%W{J}7&#%I9JL}q`$<{tA;xcJI83DV;e#P4lzRw><>4UncSOB|
zeK)%mGU;0&q6D*7iMKByBuTWvRhGc^*;#1)HoHcF4o-Ev%KM0e((bBNZ}K1B>t8Ug
zC{JSr>WehGt-+g6?jc&(v`8x4ub`l&vZ32uQ$Bj07PYTSA*rju553M9gSjDKyI@sM
z$nz!Vrnk^EyEoLZ0(98W;Q%{viVA-!Q{)2Ovry9-Trq?9kU5<p4|%_{iNbc^q}O&j
zi`Jr*`bveIfj}y8tK5mgWfWz&lDdlE*tg$=X?*T|Fqq=hLgow9dKMz#LZel9yHOOs
zl;hMStwA!T3z9!=uG7E;Bm|m)Eqf$7h{|ATFi?SL*IK$i<mV2iDpgKl?C%Yu_%#QJ
zHF0Jb7Qv`R4KI%U6`~Hl6YMX<sxd6W6>AuN#O3*@PN?fYq@neFdU<GdyukXd_7w4j
zRl!!qTF}qPae~{5#H3~b(m>FT3b<<K6IO1n+EmV-syxPA;h96*h-yVZ$Aehqw=Xb@
z^pkVFg*Xzi-#4&JYGV(gDpaBU-u)U96K(Z)f}*;^+Vs<`hMK-!5ni`J<A~Il8s$S?
z72llXxcDA4tO+WjY{}Jr5AeYFK2HZwA4Oh>F*w!IL7TXVm4#LWR66&Ek4~u)6tFQd
z;f~U1CdOIi`-$rGUf{n2M{~Y+70@*V9*aB@dzjZ|^V*B;^x9jIZH6#CGAjv4x3|di
ze9p>P$6C{)zhz^WLSvdgH;naF$WxpD^<9m&qD+-lIiF)LPM@bt53PABSy|k^iRkz9
z`U*@Z3B<v0_${f`E6wio{l|!GqF|n&3&O&<^7q-{;{BF11?4_%Apa7$RTiBfivg|>
zB{|UtC4K?mU*K^U61wJ8LK}5{MBd0U`{t2Eud!HWd8brC#!VG<=lz&s8V$0g^Oh`U
zmQA@hYbRHama{EhLGHE97^EED{A-V;ahH#TV?&H&pH=MI-9O-oOqxDkny7MUN##}(
z>M+RsyIgn}HRPlms1Br#_XuYGTgAi^M6C!>g=HAq<3>n8sGQ);h;jWk1nr)_%JbwD
z=t4ZIIOgT>9bd(pWN&;W2~H?*i`<Ad1=d^n+vGX!JI+SossKOgh3(iR=SynuJg?_q
zO3>Gb(bv+KnSSqP?`O~(3L-b_5~nE{8K$Tm9%iaBXDR&z@B|Ku<i$~#a1W^6G`$^Z
z<n4*I`$tX2e%3Sduh94CZ%wEe_{$P@>L!PwMx87qyqW(FeAH=YOu?Co^;uH^<mwt+
zhYXQuF&2v7Pym@74}PI)DL<JDx_uj)OaMnyi17hr@QR_+T*yh>Z+jZJ4W_JO?J!~R
z65rL!Z^vZVz>E;wpqwOOZ)cR)q&yXA(Ub}kE^zZ7xns9?UfFeN?^sWn5-r7*EZMvf
znuBK0Z8qqB1#7xMIPlk|=BWhWA7X`$--tpAe`7V0=PUofR6RZvb$1+-+}%BG@8@uQ
zLUnC3v^|zSI?`-7{X8!%+CaaAwnD7F(!ou{{ad?Z1%%HN`q^HN2)xZ%pM@lp-_V{f
zln_Uma{}p=(`QD3P|KxEjIf*JWuJKM%a>fVaZQ}w@mpxXJmAl(P@+jfLLZ|FQR5TI
zHLsbtHqtBghk4)fkYTwN^CN0eOZ&}O7l{dYt{s5K+E2-8JIwj<1q479WPD-#WY1&*
zK&UA{kQfD^ErDX4ou7*nDBc?-F@P9&mE>zf^UY9a)JdpBQzzYT_D;nmaqPqw$2i74
z4<&83bUZ(FHCc6_?B2g@$=X=|+2@LnzlQV+%|ckl(a%7zcHDu-2fo6697~DG<F_+y
zcnsb&W-tt7)A^BaEqP~gj?cDFO*fjQu~;`LFgN*nJVGc$!-+E>CZac+*Vj`d`aN(^
ztrN|kz%;nuH|<}4AN(EP{-7-V;GIr_9`9y_h+N5J=@YAGtyXeuYuqAnJ1iKor+8x=
z_KmeDxMs0;#vJ0vORg<rBvMx#p-`5b7f*B;WeBJ8Z4PpgDx2H4b;=fMOZ2Cgz{1xj
za0{=G?Ui!h><HEjcHp~?L>%~-ZyWUY!gz|Z^Uz9k6&sJM`a1Yyf!4>;r)7zNCo)0y
zRoRp`9N;z6%rxoft@>f@V4U(>zJ0S4tu=};*i;`A-M+OWSciGO5!1#RF<|%B4zp>a
zjEA7HE#fOz!Gu!&5=$d4mCh|7m`&aim~^gFFnej}#*;DU7tcm_eq^7#w29532iZIX
zSJH^lb3gSBe%1`$5j1V#@w6QqbT5#2O(Js7A}K}}fVete{P>-yck2`F$5-|`DFo)8
ziqSQji^O|4()r#6MABgYS<fn}eKnA?C<TSZem$VdeL10blq7&HawScaDlWkam>?Gc
z<L04>OksY60tMm9wBSaz!0EtvnL5)Jgu{r+IO^Eef{YFGuS({!{!M%5^ao_Bw1;CK
z+93x*1L`BNC|5EYk0=rTJSIF$Ckti8-uufnfTUb0SBGu7gXI0bl<y~Be^wL-fB_do
z|JMm$5DI*q2grH+%@Ge>s@Q`HxDn*q{}bVxGxmKv8QNn?mQFq41CeTD0I~Tkn&0_a
z*ErfY6$=>sMs7GAc5%d-5I%z^Idy+ZIrFB#PmN0EGzO*e^0tvdfjdHl%yMX{(>^|;
zv$_!~dgz7wpX#Ht4O-w|SaUTeZL$Wkdi96(guo0wq?vBVOAdbMu?PV<;6u1D({#GA
zu-KcCg@dR}ZH4E0W-kqWSV_EN$4%)pvj(i!2dpgb5nzh%Y+|dR6P2+A|6xWTXkidR
zh+=VmEp|bW%+QXc2WY8www*D_1IFpt1;EL^g3P@Vvhm<qtUQF_(x5lc<xf}~rJ`FK
zpLyBhdp+Pab0j;hQE0^hCcPGY%hPsW*!8^^hzic}9jO&4UcE8=m`Fn+9y?WM^Ou8M
z*qcJoJ+PzO&sFtHAIjT2XUVJj>JlB2#J5h(!_xc|&i^T4r;o^9u{##!-MT7P)n9s?
zWsgw&$!$^`VfUyxGf{B4g<Ez=JRI^P%8fLJzg4mi!2<a}pzxs{SbjBrAxW%&qwp|i
zkZ&JIEjhpYPP5E_RiyC<>d4)#A!njG@dMOrI?z9XX8bkSFlO#wel7FrMdMLlL!hWN
z{gEx&07X#TL@HQAmm2CXock6m(w)1zMwNw&e|vY)N|me8nOyb=KCtxY9nu>YN@TI6
zm2W8;{UC~F1jJ?o*Y)~e?-0{Xy0-;Ih}zs6#7i>uYyB|a#3-4HYm&T7gAy`~h-eQQ
zBZXE-!|1~vndawQCrqz`f~7XjITZN<_y}H}v=x1S*<*G8W^g8t|0<!zaQfWIP*A{(
zA@3Tv_{BuO3Eu=aJC;0o!aBrxf824*Sc<1w1~C_`E6b}295W3F$B;g9M4+7`QOGW^
z@*G&;f1bfyGk6_1#5X+)D&=C0#^admuo}vXLZmtLX-M{tYOPRqg!4hDaY10f5J;G5
zCsbZT+;+pxcpNrHrx4?E;>EPAYX~$>zXJ`m%_)NfOc2Sz=6fd)xDx^|;4UIVY6!Rd
zEFD1s7Q%8so!-)T|FSGL;u!8hT@cKdP<%`;D|q<1W97ERc40Pt2}Yq9FB}-Uw9Tn@
z-q(_t{=Lh2S^glKg|dMaaZzXssXrKwsZ_lc4R5)=1s@@bPjKjh{nEH$g%RLES7@08
z)rZRzc@^Xyd>@w9o&RU0*fHzd8dW!Eq@tSP0NPJrlqb0&&M$4*p#E`?sJGjXsMgmt
zWTJNP2n0MeZ4c2_vl}3EV&Ta82@L6|$WhHtcMLSSe}&qc-59*{n1EcsngjL>Z`{7*
z5ps8SOC3#mk`9UUqyARi__PI)miIX8d44dv{gq}>GN9otx{bXyt95ys$<ROvG&&(B
z0iXdQ1d&cW)~q;tH<DQMHl}QxFL|SoH-cLuy=`=DoN0GbKeO2v$EL+?MnxGq4gr2T
z%6YT*Fr#q%MqKLN8Gzr3M6Vo;NcP>F^0a?sH{=x1;nD>~@qjES_kJW1vo7d1$1ems
zUd~nXKWJ())vH`tx^>R{E4U`{B1?js_x;QN#SM-yP|uD;vAQD8bH<{U2?Jm_C&WM-
zM4SMSRH5OSK#2jsop3_aNBIgYImKAwlqkgu6yFOlLz8>Ts!Of>WBgEfaX!mU#QwdK
z&O@>{IE{agftVxc=0K4l0mA(j=@F|5QCa5{@^4Ix+K*Jt4dVRW-p-NQK8-ygIZ9v$
z#4!rNJ~p+x$>^_Oh_Kr$RY*qdU1TW|Z7)>hKOLGb8O6n!7^!|xA9{@U0ob7z*mlxj
z#vu@v1iMz81z34^w|?PIES0|Wlp+}-sxr#XX?5!jga&|RXM#qHPFO;OF`I?g{$8*q
zoPo>x_Q^aIkCeE~t&weH7eGX@pek_pdQzq%=@+0sXkdp}97%6PAP_AUEn=ucc9;sR
zt6)Dm8mgtWt^KL|(+gFF{zyCJatd5T(IdS<N1XS*;TO+hVn`6-)g45BG`0e~?Jh`H
zdx<F{_FKrTu9ghJi(hXUsxuF%qOQnqU%ZBi2!UN5%*E%I<$PLxAF@y?^l!ic1>!~X
z!D|v0`4I&2Q=ap-0z~WxwI62FHN-BW#-sKP0H%7AC2x>s1$X7rntR3C8R{yMsvTxJ
zb)Kv;mPz5PP>dtoj{G+$_#((h2jRFsgGM0+!>>1X)pk6xr2@9|q0z53i#A+mwrgke
z?Hh-AMjo&4Rt+&I!Fb_w)dj$*Ywky9vFbG(>t+}`#F!|9>FZ$T_c1Dq391YGiaD#b
zlm&ggYT(B+iEG4H$R6)rc4+EtJG9^B{keN7B<;F?yS%ZV4GN%BtW@oc`%IkBy>Q~u
zv8G8F@yyc7T-ntiN##iprKG45<@>xJP5u$uuX0^Muj4Suvu^_4Va>qSVq;_1KvziA
zP_CTu%em(E!UOa&U#_MunjO=vxe(PhNCiPe<mhrb?4!%ZBkz`=8xm>M-48)N0cWD=
z)ZT)a(2&SS&PqHtjrF;q5O@A!G^mD*VJWmLzt`RSa3pXBK9>WAKAn1MBYZ<|o8ygh
zksZq?%Ai1#10^-Am=9o$q-_W`W`D9=g!CV>Jd6XX40t(uMVx>K{utX74S%r!gC$7E
z&=#f|yr4+es$O=y@5&3yjix>!N1jJov>6HPCeBW_6-BXJ;1TgT3-W52*5V}|pT`@X
z>-l?iP(wR#0O-x!8NcmFTd7Rqq=w7#^KsN%9}hk?_Y}8`Wg%euO1+O`+WEi14Pjnm
z@0g4EO2sYf$JYz@ZV~MvxVxK9UpdZXS|lD`*z*X#yVWn<_4TA>Gd;-bGh5Tx51Di9
zwV5Y3=pzA2FIBDEbMM*G?OP_4V#FrGh<`nPzK;zN;@I!xy@*j-qN4Z^d|fj?QBcpu
zA4yoJ^pC*`QvHGHB2)Qo<f|k@$S~;mo9&JRVRNoA`2o@^eLXz!pa4A>G#A-U{}i^M
z#eveHW-fPR`XZ>%n;0P8n)euj$yO~t0HMFUpA`)n!CS~HSc}_DVdDln+E&~wyFR9_
zRGIyeG3w?o05T@UeH#LS5bVKuI##xw9r|aa$S)r1vpwLYqxO!PSHAPy_QndUxek>1
z8=5d`dtaFx1ppDkaG`O#BJ^G58tjj7#^%AtX=_jZ3{npmYuB`fs0I2D{~{q1KIh|T
zXYWj3#R@r0=Bs;isi_Wd1U=H@A-^EcMOT{*qv&uCq4sjBw`R)@_S4x8>aD_^$oNOx
zWuXCkjS`^v+sfz2uUMKka)V1GK>)-W2^NfPBrcLA9fh?;Kqe>gatxOw;yWZE#B`3l
z@_@bsI!7=?C8hNrnIu^^nS$sbVG}3lkY{PN!|odRpRAdSDf;f|y;2IcEr~itCr#Pn
z^2>?)Au3{&O@cdY<|a;Af=!)yfqynt^1v7n-erMLeFmOqV=CVZvIE6!x1F2l`d_Aq
zr-rXe&TnUGeJ%<Hx5HrCxibE05&j@LXFcTTNGk7YT39g3AFLY*yfWFwIFReiDeF#%
z7hPk{YgYVf>H9wM$?yPBiIOXUE^|Po)MW?wp0>~%nOky6)P&W<xH=GjQUw_Y{fsG*
zMb8J`pn(zngv@tHd^)i1TmlPzP0)$$T2R}VWjz2(f$toUo0)S*g6VB^i!4&$purur
zoh`e!t_<$5;VLwHce5R7^JCydMdT-FOgyFb`$?rozdUHFma`$L%U<}~dPs$Z;{YPD
zwWnwo9ZT2IRD<wEtnZnicBc57w=^g=uca5LjoW2!QE9%_P({e1+icihzJmh!EnpM;
z-fk$UF{g}4uf|vfe&~(Q^ExY*;dyH5iDP+-1~)c#faa2EP}^ASM$LdXBSfNpC^y=3
zVq8sbxgNFJ8f==6h`ex<BtW)eX0<x(tBfFeoS9Y+F05cdjyJ`eV}>mG!o0d*cDfGO
z-jPQLpTWmk?P&qO=Qs4dZ?@T5Jit}6z=j&hJtmCATQk+09vVK@gZ+kLarhZVLKLnj
zcEnsJTA1tDRxuu@Sfb3;%X2oem?%l?<<EB!31mjTXmbp5^J|D`YB<_v948$q7gha2
ztJDw{^V_>dqS!`TnoraDr!&WZkS_>e^Q@(h+^0$Bf#hFk|4~fy)*cr9?Nr{h*#N-+
zzCLOU@xwCQ*N0!6<3@{f%hDS)qUCmC<LhI821uwg<U8~%nrn@V|Be&VXB*#4b|Xxu
zhcBjNL(^g}GMzW5>w34f{KapP!%n`wDX_Wve0au{<f6({|B;oe&M+|^R!EQzyyaNT
zQNG5iBC>w?PqpIVORALr<+&p-I*`{ig8TF8i-q6)pizvYILO*t&f<=KT*#hm#hsWh
zJY{eukBv|eK1K<`!2{;eYTEP$oNQ~*yU-9oXFc^E57?RuSPA-b9v{i&xf6RAPc#uL
zG#IwspfnG+q}}!#i_27R4C@QH^Gd=%aw*3FfmjC@mQJ5WF{VJVjh2`uDOQn_Y^?#R
z%S7F;nsOFG0Cpn5`lSEqQeP`x^~Y*t^18XgmbYAY$S#u)t|0#d{~qu;9+q8iMea*!
zNcU%!m~0_Xg?cB%FH&Ce2D<vX4<nX@=_<j<69NG=@1JSVZ%+3BQz!%MmtwhextXt6
zk&|DcS*$%!lj;7s5DqPeN|O=d8t`YgPXt*XM~|Aafkg?1!Dx0TcdPUgBf$8Yv+oZD
z*>8^P{TbW-zckx?9XKzJ8j=#b`iwNrd*8+)Qlr#mQSq}g#4m|4brOFTeCy<<NTl_c
zki}Bvd-*O8(>Xqghg>EP9L;tu9Sw+5V040z=)j__gLx(^cNf0#|4w-^?(xnSfQh@D
z-K(xArU$wa;##@w#(Rdnr-EBYYG7W3y8qYkx0@kNx99ei6^UNFtYIiu{PSUX&w;I*
zr5G}cJUr>vgMAD8WXe%rnnC;+jj2qdhWd_8^y_^(F)1&VNSCV(*jOS7(pF!DzL)cp
zPE}{^(@T1ZQ&m1zuk1T2kcWGK#zuZNoS%i+m0#A4Hs-QoMMBJX4^Nq#rnO*LfL`3E
zR)Y15Z4=De(zd^CHVQP@#vNnB-KP;yI$+V_%A3??&JeZYPP_iFhWMaz|H%`;jHR;^
z82ZUsK|bYS3<(bn+-x=9H-8Lm_MlP0TczBT?wC_7kJ6i#xc)WWC<tc6<|cbrN4S}4
zJwW4+(p-^~KS9xD#nNbQS-C*^{5|{LOM2`uY=FO$EX`9xSi2;~{FFc3E#lw)Ri>z(
z7+YPNb4X24L<S4_lEyvi`wM!?M+v8kuLppu@|r8X0KIboEJ^}r_lj+u$2eQWAmqmy
zqGqR0n0n8m130jOodlI=LcyQ2lj_Jo<C`Vf`A4Fpt`+<qAhF&#jGa5CY%N*%v!h3!
zT#!eJXwXNac~125uUV=@O>6lq-w2ADHDX>@*tNTN6`D!j*W~zMUva!&iTY7uI)=BP
z)3Ty&uY|1!9MfK$ROtMm==?5dZV;oCVOaO~otrLdV*@Ti2DP){oA#WS=-;pvTH%{A
zehwgn-YjdS;%3POL?o#b`yW#ryTG>jzw2oji%>{qSc@%NRV_8Mf2>V5Fv{gxI`Vi2
z2a;49;g1q-XB%phoh9>~6|!)~Fa>lxyR-^T6r(tEfC|A+h~zV~#h8dPIfRD&6S;LR
z=HW&{YVSqW-L6+I_PVNWm#>;#JKmy9xNW1mka+}Sx{>5eq61%wmxT>w#@4L`#I2@I
zZ8e+^UfY`?D?*y~q8^yj{wo5HBcCq_C@hE%cp_7@jzXuuh2aM&&7?TUSR&3uLvbpl
zoVe(8fGW=37K;#T4)@mOfkCILpwWieh`&Dfs@XyT{Qa(WV2Y(Nq>}ADBqPLQ4MZFm
zWveAbtqNn9IGIW-bhlS?Drbj(Y&P^YK$%k#pwjIyTiUY5<jg>6Fn8Q!bwVF`U4%Yi
zqTo`uQxq%3EL?jkPr7ZdP;r?SKV5*5er9qU@YiF-xGv$Fngz&!0$^v>uLIcgYHHwE
z6b8LZPchSikRB!{r3iBgb0WCYP?u@Blan;FYb&&O`-dQ@iYMNs(vvhx{ymx$<SJg(
zXo~&vWvvM_<>c119aL9`5M-^@+z=V*r#R?AgG!E`n9&zM#y2|sUaZ*-Ksq!P2J*nV
zRm^3vz8Iv~R%!9L@LZEH!s++T>ub5JN)Y;_7}}vQ(z0Zqot$OnR1n3}otmsmrktZM
zXApjBh$PPy$opLDc28N7HY}I^6S?@g^l`RDkoOwg64T55Hwo*>NnE<0=z+=mch~CW
z^Kr>)lnMLF^qn<Pul^%G-0cpTxjJA%{+UTngG@F758aQqq0#Xc@<MpG`6$1skiASe
z9w8!~rKR)XPPV7Re^(l6*_A(+mxdOFz6v1kkR@k61kzxyxp<>yl+>-qZHu5fVieN?
zWgvnrJ%ZwSd+_*7a+dX$EXxIg{0{i2YAr}055VhRr6@v1_{c$|FdC$PAH#uR<DqJb
zY6j(z%6)sotmDMUXVKi!FblBuL!`+YBA;NMbkAlx!=o=J%?|B8B6U&pj(D0lz%#y+
zzFDeTuw5+~>9V!A`0onW=!&*B?9p;lystH>_RzvCtE@Vd*E>-({6qNM`J7DB7AE+_
zwn%x5<c8D~W1n4kw>iIRdf|b*#3YboL<B(yT4emjExob96EusLhWDLihemZHkn5Pq
z-fm??UqJ$}k&JZchkPV<wAj*N!@cNUs;uRaubb@y1;!^)a4yb67@l1}$Fi}I;3f#H
z2$VXMN(<E2sOXluGBKXl>gnHd4AMj_afKi=<CQeFRwN6HneouH74m_E+NYMvm#5#2
zU#02zqwdp6gS4OB%HP*~O`!I^9=OukZ(r3imUCc2a}C$EZRD=M;TkVNY!AR?Rx=1d
zJYVwJ>}MD1jX@_}htsWP-p&^dv$bn^*O~*dPP3c(8k<Fawm(s>%T6Ps@P!WD40fKL
zHP~CFjlI$_JuE`Paa00LNsH*-rCqME@&Xx?H?lrnD!sF6*yfz&zVAVpSi0LBL8ahL
ze<{?SA9EvAp?g>Jw{IZUZ(fu~Kwphps6FY~PQCPI1c=<VT}Sm52s+<>W3dY0?&~Nu
z^-?PfU@XaN?B4*#Mp~8Av>q(7n2{_%cFvw>`+0VAu}`VYRHX()M2n&wSw)*roSffR
zWwpFjIXT!d%(*TK%lxv{Qu-{1S428<1*a#*h%hVH8S%*D`V}M`qJgSD`$ET!E=hzU
zPio~=UrhPEMCv5mQ$boHCnE(Y$N!Pp_lpT>@Mzus!#VnFjG??}Mo3K>G!_{L2wNhR
zU;dSDnQPQJ!DR(Jw5vVhaXx>Ep3UjD_xa=_+X#1=RDACpYdWA^QEC}C3}WhzFJDOP
z2ZA^GqHIFU@nZg_8;f9NRITsmQ-|mFp9%n9HG;tTjW}++r2McyzRgBX7lX74v4dah
z()5h9{RhlXV_+Hu6v?^Za2%$+R;s%8y-tg}IT(~t9=!wflfkvvMk#l-+IE9$?Byr1
zV``W*3mr9Y$>{v1J2<#zKI?>J(;Hn^`<|pyhAhe^{b-cTm;Qi@+})sscY$qI7UEY2
zK`01@Hwa7XJnGePPw`E*cW+Wz_}z;v7W^m8xk!ukxX{n!aJmMFuXG(ja}7h`0$HgL
zPKoR#^=V}wC;25&gc5OyNOclcYf)b)2^X@O&p}IgK2$$ne0fp<Rj1efdT^J^#a~)?
z<g|&ru`Gu?p&QpJw3H6+NjhIj)@A8^CEAluIn#JN7shRHK8S785`EShoBJJQ&H~eS
zF<Ut`|EOyet}zmV01p<aaehU5`P6T#3jpyMopKOx)>@VShg_-b2`7Cv&ArkI=cudv
zNfxld4#&}^W}2bG#WBA$B?LD08f<Wb<gW{SXMf#xS(Bc@igkiuPT$OVel|@sb~a5U
zdF44Ly}R>9)SSeeb5AByHVr%1f3Yjxr4dyLx(n8IMUqzVOR|gM1&9cP2DFlE`oaF2
zK%6C6j$yZ1Mgv-aQ+8GXUm_mZCgc(P%ir@LEgXm!sZTCA>c+AzTM@YgTrbIV=;p=P
z*>Uyz(H)0m(gP~zoPe98pTWSf;{LqZK&|}~;!r}wclrQTo?kWU`3RzBC)hCl;^3#A
z##Yk3H9cIxPBue{_(L=Q@`7zJqPEq1;JER9`&$I`SvKlc)-E(+P>Kf=4?<`&T8lm<
z&5Fquv;?krHml_*0TKPV+Ac)$O*Ll>(nE0#kAnl76LgyX9`v5I!?HlfU*20L*3Pfe
zz;YJtW)_bq*BBy#`>lu1xiWo-CX97vPU*AB+6ka?qA)U(=V^4n@iW%R*bUD)u-PsI
z6E}BB;%I<i^wmw#g6kDqOcBfjY2$1xTf!!r1Aq|I#A<`&7PDQ*pe~<${9;&OSZNod
zhg-fOUhh_Sqckz~CfM&;d4)*OU)#}-ALCu+X!F5ekNei>2_6DqDAHq(LVY9p1lQ8g
zj%>xy_J?`L<;T@tO-!u+a}y5*yqiISES{PHp`mnS2n|pf;Mb%H1hf7Sc#})2^?GtJ
z?v;_S!WIhjSVu*B5Pp$fIi!BqnP&9sd>S1{S?TW-avKH;y&d?XIN!RhY|c5HUs`Z}
zjSbeu%DZZwdGD3oIk4vL_4z>5{Xv5k|5;mOku_M~Ff=P?R_KgMOF*IwJYm#Nd6fUD
zEP+2z#s2dIT1V$_remI5Njt3LW*Bk_QxD1p9Ily9-=Jo>Z<0v2{{u&jzQeFcb^jv#
zSa@s-cS-nUa5}@#Xa|9gB~oMWO$d7UukYVi;E>Sal|Ga=#Ip-~u7UT>W`t5GJf|6H
zB+lw7jMmt6?}YF3sAOpdFw5*?Eby>)aib^7^md{Lb-?Lp@7CVfi>Ib%qsPoW(%T0x
zQ+UG90^1}IZRrCZM;{HLwY)hYjkT5N7Y1r;0z}*&wN+78RqN$*Gfp>`O(J%%&}$am
zmYAR1E3K*a#yn3eejP?C0teAF-CuDz>g|V4s;v(XCsGuF=>)~Vxo+22ht4@8Em@|E
zd!q$l?XNWvfPx9;#IF5UfnAlDxWn(Y?&Q5khh+P&hxQM)_$w?XHBXX(H_<fjF&^e{
zt`c`H4?&nh#Bm7EnVudP_s1T*Hp<&N6>wS21MHtD8@lSE3@+3%D8M&+EvYVV9&ijW
zEq3$*PHB~(*?dl*jzUh)R}>J|6Eb#V9pQS29jl09FdtGoKF5F+Zd1rplTDGLM1}2J
z_4q3ZC@c=@5lK#Iba|LjMbI4R7@P`5J6|Iw&J}dwxs|s;O349c4DK^F1MhhNfNQ!m
z-d(*%NrxM3p*Rj8?%t-4VKjy;-V@8-RzinIFI@Vo4AlU9*=v3__<^2)T!^`tPVH|d
z6QX>1d`=@23(vFrZ^AB)zNLtDPPH$ZqBHSBE8#6J8E#s(4mG9t*RX08skZ^MN0-l=
z2y@qOVH#KltSvbx=A?Bb)y(m^>$PYW8~9<!7(IRW0hafESYZizVOJq5%y&@!l)mKJ
z!EvViUaSI;dG|o8$W_Irl-^$<U@s-lOI_*5gHXpT6Ngq5$39DUq=i2+<|F$3*L;4J
zo5E|Wcra_0m=A|SA3BO07hwE1!>rXiKe38nGUt}Q0mLirhh?6$^C3xh?16tVAvUPo
zav<q9Q{Etjccn~X7CO9JhQ?1WRT|=)8C-1q7Ci8O^Jk(ZS?k&6kk#sc`2NUwX)V~}
zsFkW~YaCuf%Q4U^#$yQ)m>z&@#fF53cXs+!-Q^ta*6pWBJUDV9?(3PM{GQwk)haKx
zXgIDE9-wH-S^07L`+m`U;h=`>cV!KKm6<`sH=NJ|xNI9shYgqJt^-C7<fW_uY+C0N
z>TIQB;9W-B!w;j{4Y(~9Dr!F_frO~0yT<XMM_MH~WZLLxv7HnWb@Xt3-IYP74R~9V
zN~Kf*AY>d%KW+(O+|2?32n>ULhSqBYQ2@I%dYwTM6S1w>mbTs~>zQ8&@kn;2*^}d?
zQ@)A%!2wdWAY-}m2&0M3>=Z{y21eEto1?4|7&wlg!-q!oyzld+Xizd<LH0#|_f1gL
zFvPv|&Ne?W;hUGuvuxv|kDT&fXzvyYjnjB#!=xMnNQ=rMr3gq|&<QmnP67GWrl1Oq
z!qr#~8KK2Fn!MC}p=kswOaI@Wd(L2qx6^QUi;-|H{~}N-4LA7Q7RICsK7Ds01<oZM
zNI>1!A(7@F)Tgf{YX@f1g`jN*zwWgt(@&#2=ydd-LuzvqXWdHx)?<^|=_s>5dyhW+
z{{gN*QNNzVIS%5)qprc14KGh}B(Eql;?}~;+nLKia`@W}FCUI9z?&h=+qYS&511@O
zYR5t57PA^)Nko*xp(Kep=V);+i4yn0iHzCHSAUKzCtn|7;1m2Lmu5hj8|M^{j*h({
zl5s6SZ>l5UYhXO#-8nQWr;{I;19I;V^f0D@nnf|jO7O<%M1IBbRTSS)31L$_q0IQU
zM!rsv9K0BNEZnkZzsOEgUL=HRg@LP}n6mYZobz&on6qD^;4qPgRG3UIy>H-uPmnX5
z=6^Inb5S$;xHt{UE{@(L(Ak=VkH_HBYkKb~%+{*-9A(t3^u&ikloG5;0&}VuP9c~l
zLes=R7l1uuQIx`-%Hp2g(-2Xq=&L?(QE0Guf3pFM>K;P}C5ckV*;AvhW^bPujiuf)
zW?;QyfTrX`WKdWSn5;oU(V37lQ=O40ntw^YY;r9^zersY!@l$scu3I=3T6A#h`^>U
z#zcq4pQgCA+mBDTmkXdRgzCA97+@)^PqdP$fMKF_U4WP<p9vI8G^hs{OSMV?P)`vw
z_LKo*C0vS3FK#R~9e{|}*Z7{pSYel3R~pr6JV0tQyS3aAZn>51App$<3)rzWD}O`H
z6$v#5c)Y+3K!$9xR<M-W+zPOiP=!woF0gpbcuJT7jm4-04(O4x1W~QTi6w|?-3Xwk
zrWH#NRf48!%9UX{H$bhEGj%*u#U?2EC{d=&%~?1%XVUuwo|lIPQMFeDQ7MM7GKi{}
zV`?)XDow{AZ?*(c$<!!8R3(UN>wiI1x=LyzVLDfF1up@k${K6fM7ubQs%V>Q(A?Vs
zqw3_qs5&K#YW*;(4`9c=0#hxRYwg+9t!rJq{d#&en_6A~z{T0s6ei+jW2usC$t%j-
zxV2cSPUdQm9R5}(@U*-rhV-d7!uT1Xgcv9x7)8^j+1!9XDSB$?Pw%X$V}H<1W3Uh2
zRK#b2rFG<F<n_dY1OIEH9Wbc?)o1jrF`W8iV>}<t+zEU$2H;u|hJ|VX7FwnT3{V3w
z;8Wuw9AxInqbTsokAbRaJTzs%%q*zYVJbym8VbZS^!-BaYT*cQ04!S{rr}FGj!-|~
zxftCW$M+x}uAN8*=dh=8=6_9eeutrfq6jC741Qzl3%MFt2*R<yMDUx`m-ad8CjEkC
z=M-_OV%Q=a1$VF7RzSiYDH0H-2ojH)SIwxZq-AoLwC`aHmpi|DUp)UV3~7|YR=uTv
zB?zUYvpmn~TJ*bO)?b5oI&b{R{e{owTX6LUFcZK!f{$4YTsQE1ntw|7zM^O|N`@Md
znYVP|W4OMIDzO>@UqIjB=-~Mje1KQhXjJ*z?&amDzgB+uVF-VI*!yecuV;TbIpZ1Y
zUsWzIoj+e*?x+9S`;Slm>+<sR=RfbkfB#zfRQusGRy~86c}3sv{S}Ngf{LFmcfv*)
zL9pQE4m#LH_t4)S>wot<R5XX_3C8CO;b;+wsz&%(*;5~<2=nt}hZdBPQkzz3&tk|H
z!TWNSy4YB9;Rh!P*g-7*lOF0oY65x-*ck@sAzarYzEP;UB|wl*K<8<v!rTg#7>4b_
z{Le=Li~@6Yi^tIM2>_=3j6kMOKy&KPR;gGwsaPjVC{_tVb$@gXjVuY^4eRec1ASdA
z*KRnpr=aGgka`0jj={Lug&tpe46W$~!};&O-yhDVbE4Y&R?}+);^@@D@}zlV0rMhS
zM)R0NQ07fGo6dq0mXqrh``}N(fP|flb;7`t){l<^$19V+mWaH<h`cxK{EdbIrRNzo
zW<z%bn|fMgt$&z3QyB?@zN<It&lb;D=8Y}$#%`R+!sV?1C`#1G#6*>dl(==5nsygj
zcS9>P7&XD-Sy38qclQ7tvcR6bTjjNPmqw%{ZTMinerQBWXGKJcVhAfEQi_@PH-kvg
zbg%GcOGJuHjS`VkB2u;<k)o@lHh@Se>J?i8gOWA6uz!h8aSTe)HrJr5w*`aJ&B35_
zOAN{;FeoFIJM!wp0}uEW68>dlPLgcME6UurwV0D`roK-Of2%Mjr$ZPd&9xdB7W{ik
zgZH>Bem=lJ#?au{4G4W~&A@K;1uf_Hl%N2(C^!^~LOoLsy%EI0CoHxP&&_4n&?)@;
z3%Q4(IDa8D1)~RHOrO9vEZWA%9lJBb8n|$}y2l5AXYr(tI6Q$YZ5=vwzk3Tda6)2b
z_KnwM<loVpv_@b7ZxCuCzvtD^R?a$%fs5dwiyit%hTz@wZ1RI4<nr$BZXfKI;2WT#
zI6VmN1Iq!+I4loil)vDh`{jO8w+>*fhM!jxXn*Pk3<_63D|GS)SL6FDaG#-h9$E$t
zbFS{74+pCPXSnV%sP0-HQ0DJ^e!vqUd7N&@XabD$g*luolsfj$C;>0~Jp|_}``1|X
zko^>N;ngPAnElJ~4S+)!HWdC6djf3iu?IKqKalGj_UoNBvqtFdS~)rHqOeMl-<vvY
zGJi7Rp_7%;pE+15yrc4w1OSyfr+3y_u?z6Rz*~Q6q~D#-;n+^(5Gw3Tl9!6*pb}9l
zPJpcf)>^8}|2g-*7;jPfG77LpI3z{*^tmT1q|^c^4D|$xl5{Qno{oWP&^J5{A5hZ4
z9;zN2yWe)dU)0uX_;|9R)U(`H_@_^&s(<FPUrO!rgkY*604YI??~RI(l`xwakUZVy
z!r}}1qOO<1_(aar7~mibpTs79AB893S`<Z4s(uju$&C7+V)fy_<Evn1O=o~6`t<4Z
z?!vY|^S1ZWt*amue7G<mcQ~v_XerfXfJ0UFxSFh+A}>@-J*zI5jzm~36!>ETuYX4=
zq(=;$5#^=?yI+b*2@o8X+51#OM|N&&m+(iUL0T-)W){vP^8WHXbwCfCWAvo{I<pZv
zlk^Bfk++^B6|lZ03ea44Qm`=Y?oDuSHKrM>f(O7MJaw;K4=Q`t=VS`|?G$oQnu^sN
z^UL_+V_!`5RsC(nkZ_e@-4M?G4S(kIRY$wa1A1+Gy;}xsA|qnei=?D!*Yknc3cL2!
zwU+0lz7T6lxvEKg%09K9p>JaVmh`ffZbzkiV~s3W1T%Z3QqfDS-0~diEWySDuHBRT
zwR^H??VhZ*c25?s-IHxxyY*J>MeDWpO1(vE^pjYMld!nu(#d8glU1SPWPj2Na9lni
zMNjk6#zug;_;;e&tgbR`(PZVo>I&fI%wsLsTt=}HHOJ^s#<5#N96L3J?HEjaUH}4b
z1?vXR)%(3{;9R#?0_WBm<>`qAx+|mFEl0P+qE*7@iutPHkY_ny7~d}VT+$s0uDFMW
z&vjRX&nbqmGJLL>r*bp!Ie$%0F>khn&&kv%;d3Q?ZtLN5x=Lyz@VUjl@g?ALS)&P?
z=oW{|6>W13x_MjRa=je5T(5-7Z2&IE1HgzB9IzpL;py&@Y{)Ch+_$xGxn8DzPY(Y@
zrn{p^IE>y9hE1BG*oZ84mf=|U0s@BzH-=P$5n!kyc{u||h6f)5cYhO93#S$iEnwB~
z$Y|C0OQLsFs5yR*W{?Hg9CV+Dds-P;2G;I#Fux<A!2RHk=VQa0V@iOKRv31Q_5p)f
z0ac9%S!P%vXbWxl(7+X|az#x*V8w6#xM`<(ktA`M?sF`|J=9Uj$g2=q`4@X}lrEgA
z!5d~1$)lVEWR??@Lw`!RX4dO<>cL=+g!o9T>D0Qv8WHb$c2ki*wP(Ca&4{S_!0w;b
z(169$EIzGyj<QQ_!$f9y@r3rG!Dxg=V=}7c-dp70%W?4u{~qh{k6Io)r4KKh;P_ld
z4!oQg7Z2}?d+*<=%giURd<VFyAJ2Ixf`w5rqVjL^7Z08tihs$LPtEr~QPg>vP%25P
zh09llzay1^V4aS*lQHbQW@~k?wR+0n`uttLbgxB|Si08~uD>YJ)Mf%La7A6_|9CWa
zQSvwrN709N7xh+j7b%9Yvb(6*NqsZ!B27yPZ?<$7#ncR<jZ@})`V?&%Y5IN3+I#ua
znVQvc4d!YRAb-O%IBaArwZb+O86w{JQ)rj%{c`#bW(Z-nIA^{2+c;DRV7bevKPuft
z+wU&YRZ^R97ZtaGE#X1R8erH&ueb-PXq#(L*W2Pj>gRZn`lSbH{T?Lt;|jx@ykmI^
z@S^mKb|EGCkXMx1Z);sh{Y;&o9R5~k`3OBkm9dW(;eT!{&+t96$Ko99iUb`Pp8;O0
z(|y1{(YF$yWfndMdo0@FeIu3tWWZ8?@E{H~B=;2Kj5>0i;t4^Lu^HBu97KEo4Wj|O
zb!TwJ!8&!0<2{c0zAir%3l$MD1G6sEr$b?51?#ejX5jD*hIsJt>QmQwKzCF;%<(J3
zy7ntlcYpX@bDcY%H0u1X9*=8*7u+o8AM=2D?S?S@{vA3rX&Rb=g_8};0#?2`9Excu
zO_+SVwkVoXB@4h@0T}!K1LH9k(IIiGR3r|N9wkPh9ke^Thj+Qd87G;ZL;Q{wr1SA?
z62?~#zr5Lm1rM9DfZrygo}F8GfeS0Nel_=K`+vy}R1JpJ4!{>Z1V7B|aCZu;A!x=c
zwzll<B^*VPNa9S(@!f%o$g~o>b!W&aQP`)h+#&hu2D2bNaWE$^LY-n&%?~75A?pi@
za=M?$;I8Ov@~zCvod62`fUk?U6m^I_h)a&tN%b7b{LYg;Fw2{|IDYm=NlKn)ngm79
zSAWk%uy(&MFo5gXGh7VcaNL8#E`c(~VVM0u_6iH1VxwK>y^cAJSqy&mlCD0YWq!L9
zPr;G8QFBam<1o%^=?=d#Ozyd51C>^*a9LF_ARiU(abQ*RhZWYJy=M+HD7JDh4pQ{I
z*6(;&qK93ev$Cj_D{#32mn-mNWq>PJ;D2%j-V%J6{&s0y7&7(7Jc_`U+K5F^GrA#^
zw|)<eKI@i|AYjtaK&2#C83|%Z09u(psmz}w^FtX1LJOx>edHuvV$mw&Ka}ww(#}zE
z3_diVufHOoPcej*0e!{%rkeruY5J{svn8NUrbY?qE8{<GJ)lolNo^9)w-jz*34d%~
z)>y+P`o*z*McZ71=H3=;pIOfV_nGw)-M4;pA4@ZSHSxg|cR#bn=*D{K@V*o)@|rOY
z+**Ji9ld%HND*LLA%5-<jL~2f7V;1#Jc4D20PiDQ4v}5P$iD`A>%|!?PD6rs9;)<T
zM~K$DLB@o)(C8WF(W#<$_joihn18S#%<l+%xekht1<19rb&p6qn%Bq(Z&%V!-dYZk
z0$8Az_||v97fidt+N&}5u)|`d#xf%XQEDW|w}buI1&)IWf_s7+G8!F>VVN3{1HxU@
z2hceS>N~aB4PN4f8TEM|4yI)6-;$aIqoY}ZFrCz2ak>vh?b>8jEFu4KMt{d=T!`6N
z2VjtT{}G9q2irpr1mQ(aC-1>3p9l3b(tZay!gN*;0?DcVk<ymA-@p%m153H%ql#hB
z^2?o&*Q7iLH0r&wbevPQtGov`541`Hvul;3q*Dc52q7<0#O!vx&ccSvGehZK2!i<$
z)EeLxK(!i&hY~E~2=jy`Lw`l!o|G1Kz5m1s;)Uq^*!)N4{Lnga7RrKNoq7O;;Nk5h
zx-FYpAiIe*XBSB37XYjxK-uDB<lw6Wh;W&q$szZ1MyBY!q6q}ur9hSn2-woG`lXQX
zNvu}Xi*y)zWVv*Rc&IG%3-bpi1I8zSG@AI<M*?S2mujSullUtXbbq!_4Ha+#%T;RJ
z2h+H0BDlU?gp`vN?0+t+V72wD%pc2XSFNOL3zh52Y1bC(*0UvbYmtE|RjYbjij;9L
zO|?Fzx)fNN7+{7%X!x!<RE})#!vHdFFr5GX`~Bf;3MUJB^Hh}t`_jvqBKeVOhN1`X
z_QIc8qtqNh`<3`ZF@ImWbCowaxuBT;0PP57F8p9@jCd?8v!|3no1RC|rYD;{rQK<i
z;hm!CF2g%LweU_QY$ic1K=9~ls^p_YnIvs>Y}zk8ZA!}Nfadmx2F{o<_stT>8RaNe
z#?BOVNo)o^qwN;r4VU;CnHnX2ro_)|J$^=CQEdQ0qv0)E0)HlxIi#?S<j8b@GR0e6
zi<;gVu#A}pmN84P%*H}t{R*fPaL7AXZ@<E3YDQ=2g(GIn44ISJaC;FmX13N(5@4%?
zVv$fDjG>F!Q(zic0IWF|8AP*ikpgq>E&LsTDcHU-z`<~S10~OV7wp5-jO~%*se4NR
z$U>cdEK|!2Tz@#OXOHI475rWmehsU}_3titckMCQhX>Y-eVtn6k;sUJi9DZZ)^`&f
zw~TA}lE(sJ0s4k@7lA(jumMO8wnvkkSRRAiV8LCeEC?&I!XSo+1?+<P!pp4`t^;Ty
z13W<2G?D|K0qW@-TO+`?5_HqCcHu!HeaeaunqSDB5r3&E<JPsr`*$!Vp~)hP`(}f2
zA&e-v@kbc#q`|{*F<PHa;L)z!r(GV8E1X3PvIeYy0dYXOpdn1vvv0u69x%WR3#bOO
zFhYI-j=J~fz-BmoGY%I4N<f1cghkwU--TyzOy31I!oQG_@NZxx{0o?Am-<|=Hg)37
zSg@C#h<_pmjvxMr1{T{`q>)1!YJ`6+(-#V!Rzc5rk#nj%k-i~8Bg7FWOVV#DdvL+2
zW`PXYBno5|y+&u~&ad7V&%g7cr{J)nAxYkP0a_fS)@a%!)=KiSbZpdBP9Svq#6zi6
zrRJ*H{-VE=dzIq|pB!CNbl$l;g9Uv$s&Wc_B!93LfG&_8A<<CKL|6X-D#}28d^jS*
z83N$sfF!CZ&7Rf)ncWdkJQbYWkiYhf{r%W<hateU=6uO{XVoOfUy>kl3?c=!FoO*s
z1r`M~3X7b<LU#@WS41vS5j_<r2czS#m^ftQ-%*UD2MQI`8omkDj9fd6V-x%ID^+2P
zOMk<|7%9dnC+LaEi;7^Ow4`3jgbGXXpir{hz+QqmcxHS(#f2mNsVL?W>lqD{6Q`w;
z$K&aS#7ICY;4Qv;2b6(@DT)HeY?+bVpo#KRtr5k};%%^oqbA<@(=q7ps38%KZc47n
z*N{ba|Mnl3@Mj;j?-lIcm8~AT!{G&>Nq=G;glA#5C}Lsv0AvJqx7O%jm(nLatbaMo
z=qCnun*+t@f~Np3#KoAiI<7l$c!I?8s|6AZRaOxDn54<V4+)(aFBxgls7Fa|h}T#o
z;)12(H4@A&3h^{$nBNNd`VCmbr3OHD<)r}K|7%qBl73H4el>IIvzY8L@g9#6mw!}q
z&vBUAbHo&4eDMjx3S!7akn;*gC)z*w{O7$tA-u?x5Js?j49FFpPZvk%+}qnvFdSE)
z>_dsuK>of6Bc^3+i9-EyxLh|G52jjOv~U!rg1p9LPDqkzm#6j9+ccs8twDRhfihID
zOOh(Azqf&%riNT^c;lHA{O2P4#eWsRgNo~u+=#DJS(MxPaywsc=QX$U$&GxGE&RgM
z=fiB~*Rv3B%{E@ZwhM+lR0lRxV7gVY5sSn>45u<&K4jvnwsG=yEn);5n6!CAt1YV<
z_9_j&7Rc+hL|A-+$45!h<O6*UP<{PS^j?`fxQyMnZX7yDC^(^=BhPumGJn)$0K?y7
zE@*4?0sJ*+$z3ZP-K=M48*X>&B^*7P^%9Ow`J#lQKffrBkB!?Gdx8Rl!qS@|(yt%i
zKTRryTb%-AqIEYzC+tpnyW#O}HzWaK2#tF1+YRQbw;NQWSp9ZGLHO8)Za3&c_;|zR
z?S`1LDbsy_kzuJLVokk7oPR0e)#d^G7wqx}*Hm0<0TtJpMaA_1jsyS+BzLtt0D9Hj
zpr$INN}Zl}8%_QxU0wU8xI-ZD_~-oMfa;#Xi@n{Tt*AC|yI~a|<1*JC%-jnK<`UN)
z3b(oz{k=8U9vXSq9vbDfhxK23_y`*$_8{bnmww-&ks)j{|84Jmhkr))I*=s5w%&K(
z0^)}P5uwvzGEgi=_r?@|q9??*JcFxD`1iybxNu^^X66AI&PViS0Z;I~YRt@!;+tna
zPKir9@-y&2?V}rf5oIGmUI*ZREqM1tKrakZ<~Sl}C3r8!Za@(nH0q-CiuqQO1(f+N
zKZIK2qdy`?Q2g3sp?@#+GGdBH7gNg%CO(s=Ffthu-SdU>FG5-G{&Ha){d)29>Bp0c
z|B2Yv^Z$8%@%DpJiKJD;Mgy^>mtuYfKieK6U<*{GVbYE!?*1=i_Qs!*h4t^6cN1E`
z0RbEh-Qb4i;p8_~cq;f^IfNFwlT&1lVpFh}6O=9VEUrK4aDQfY!(>jwmBSxO)WSbc
z9`0F+Tq$yoCUTRfCUQ?EJ7ogS$`Bd}<bn)SKoz<SY$AErD*c6pz=U`Q){auhC>9Vn
zOu*&=%e?pR)Me%q*jdu0=y=Y}0ode)`Ey?RxA{9C;HK+qGG*lQspF!ImbW$0@}wM;
z4;3lTG+QM!A%B|c5}H8yqJ$=-pb5CnJb8G6LTlvtC(3Afh5gA%100&39^9YYSk<4b
z8pZ1V<bvk84f&IGO{Bcx(w{6-qx2`2{^afVCu=LJ4fvB+v6C<3Pj2LTej7{plMA=H
z7X7_7{^Vw!Ke<`@lh^N0jsksM9s744A~%Ao!9Dn2PJhl`xL>)MA#^eyZm(atnY|t)
z39zkxWy|w11{`$_W4JgPk#0b4tXtQox8(vd!?<ULB?VK%h(PGegeJh#JTsU_Fu;54
z^!huyrGMaXVH2_C@GHZqKQ=tTR-K#~7CSGKVBa{I86-fY6?g`*R|Y1Rqyd-wp>S}A
z-KrWOC4YG8fiKR`mpvsm#!L_)?5cE~9gZyUT%o^_JIu*fn-Cgg&%&&g)_f!fh=cDm
z+AI3PrHFzE5|jL02p_|%?-*(i*8N|-0D~c%oUQH-PldT_i|BE`N8Q2RNO2U<S*m__
zxf9lowjy%)x=V^|7iyF^%=Icm;?U`$2w-Qn7Jo&sJ0?Tw3W?3ThxZ#t36{)C*oLKE
z^U8cuip0C)@hKAFDfagj!70=U$1=&i&;=@!InlfufO8*o-0VKOrmYAJr3j=TyeX1{
zCAwD{PwpkRbaZ<y8nbS%D?CY(ZhK-Te}cK-@<=C62xaEPvBGqS{P_~o_i91ppr<iU
z>wm~R1|xyS7tDBc$9UmfiI`n%8B|3(3`eq@fNJEpmE|?mrYi)GT2X)xmtl+yzK~)~
ztS6YyW`jaKgu0omS=~&u)QtukrnS#Hm{C_9m0b7il;;FqhiY?y!W8HZrX0DVV{s}{
z+f~@y+H-oq47aOn59>s*5XP?fnb%y?(tndGc$Z-`>CI0%q?hXfEsRRma!ccP7TP&5
zkV!?U$hAH!N^5_5lGKF9f?TLX20=xh<65X;_Kbt@-w|$Q1ZS+&NhUfjTzV>6$3;2%
zd@8J~B3KBprp%_*#f+zl36fl|v)6A0V^*W?LhD=%B!Z>lq_8r0bd(a7TKFqk1ApmH
z4nT!}KT@Qdbt8dV`B0z_aFU#lOEl0MAEes`SW+e!CF>5jEow4z_7R%DsAeF??v%dB
z^u6z3IyRJ;XNCrP`xVS1fPGv)+NW6t8<D1~MD$R;C=oqnu#xQyHd11q9wLTD(m8}~
zkq5^-HCM$vsYbCn=Bc3TXhWDMU4Qo-Z@9!f#dJ*>L!*qLvGtfIZAG;K%+reg&}Cpx
z&0K&|a|zf};a1n8!nX$Y)XIZBwMy92L&Bayo8SvaKeaMsPiDvMML)H&SB4}3wjcfE
z4rwMgZ$2J?^&5QKj&IMA<3w^!Slhr?ARtZfiz1oOUtp6;um{%fz_-D?4u5Z`)L7sE
z2-mkcTi=+6lDdQ$7zvS15qPH}P)Xp^Y433dknk|bFB|RuV{dIxr8qVS7iKo7fQ@6(
zDAtc&dY0g&L^zU~f$lIv+=0eg_<+#g%R`flr;bg^BnNlGFz=<og3vR%h&R6;g>*@h
zD(wt@_v=xH7nl3FlmYnT1AhqHcy*Ze+<_1Q<PltVDW`5~Xmmuv`zg6-;mLa$h?YO9
zV!(>^z$r3^#oU5?zG7%C_GSx_TC7Nf*`bXk`Ex_igt#|XOryhCA^tK|n&zsOGA^Zx
zheJ}NU5cVv0HZ9(Tfqe@p29*731OsN&`Bm+9ARdm(p)1xY-uf8LVtA@>HNIO)mZ|h
zSx!&=lUfGyMw_!L6ddSdt_*o2)m<n`P~C$-IeDv*T0TqxFqc{i<&`i*ZEa{R%vc4b
z^)GAX+t`{1LXw7KC4qiI-bE@Zq?}-XSSUk?pM=6nM1IPK_=Wqd^yV@X=%?DL<st2I
z;B^YJE<o934Mx%hDu1o0IUrr|;97@NIH6hwUNd`+<KW6g<VzqKu_HX?Ig82lkpy5a
zfc`A%OE#XdzTapo0PQEvVl?0G-*(lJ(s=T+d}JSO0dRc@9A#}v7&37&o>G$9__Qv{
zww8iED!78-AS0!iKt4u|F&tzGNyNNcn2&B}K}@p?vF8F?P=8(Nv7TA8IokDhj&3ct
zOrsY5DItj)%q7Icx&Q>~-F!6KI3zJrzXf{sK)nj}dJ)`MSZ6cnF%Bkwn(3;_>}Q&U
zDglX0c=y4DW+6si$BRc@cniIFp+E7llX@lnwdkpQa6n>fRY0O@6srRg3wm=m1W45N
zsPl$PK%z{I5`U0b0ur|$kf^PwHVQ~w7wTadjAAPnP1srjqgc4rwP^LN!6>%#FpBLG
zqqu&IVt@iUp%_Js9CbCrOgBR^y|M=WE&LSrp%)HRY-b3d%#+&-RBUIj7)b(bD^QUM
z4a&@UC@~CEf59aNpoAzg04TKK8^Gogt`2@!hS{!xLw{}#;z0py6MEl$|I#}f5ky{~
zKak}VV^$RKt5JIg4Uu3?r`A1yBm*o44!;Q|qrw~>fsd{O{1)>n!gnx?945@PMsq^H
z?6K-q;|}F?G%_Y&En}Zzg(#8|(U-Iw*w3R@n1=vkyiI(lhQf^nc^Ba^?@OxFV15QU
zWve-K;(r|9dt|h4M4r?Ubcw@0*@vO~V{n<cv{z2lU)P(=!Qd}-2DpXgYJtZ2j=@5g
z4Y)`#57!OSg$@whF*bbvnl*&P^KFonb$~Y&JYXDA7Kp6sYlmmn>-7iC7$x9DBD+~d
z27fa6=BY=Hr|vE0MKiLHVNvZY0O<L>XGhP`o_`yECjg@HHxX<!E8UpF10VUzseSTF
z;7qQB16%3!#^o^>Ww^Ynh6yuMm-DAd_>RcoHArXsG27#W<3FocDvS&tEv1qLiXJ_K
z?r>P40(CVa-u3LJ5_WwLVN_-{^8AHwn9C5JqJ;=kxe;tKKo|czG`=#DU*TV2WfZgs
zA%78l1pllWh-8gvp4O7AkQO?pD>TwDE(J-pj{)(XkK|;_MGVro02!&4kwmDR4N6M9
zpQXI4losu2q(Mt^#v1aTrI{@!?OCK<t69of;{6nuA&!H^J*GZ9;lgZx(2ALqS+ES6
z#OQ!zb*IER2DeNZH0enMO=^@ulcGOm(0?Sx7bQla#3&R6b3_aD+K@RbAz!dR+JTdl
zj^}wW^T)@4B5+3;#wsWk9?|fd;r>HSf*oO_plC|0kg=0d^joExcAyfaC#<DI_d3eD
zs_v>iMLgmOuLH$q)49s@0Y$H;{v2&cS`E{M9jtoZn~@(7NBTgPaV7f3>w9V>jen^8
z>2pr`H;HM<t}ycbF9UG-$?0g@H#<4)zeO%`bD}CPf>kZxP+<xCKxQ{=&v;HS@u|wx
znzB^kY-#dy>QR~eaAn+0(*1yj_Xo$_v{%L5s7A3m?xvt~VnetaT?Y|wxWwJa)F^Q`
zCGKYXaW~qEYE!tIf)1-?kTvaG41Y{}31m&-R@b7pw+30$$wSt3N@UFgB5Q^qXE4Df
z!e$|p3PF^4b9)gso$R$CNr0D(u;D<DFfarYCFYY^4t`^l=$jIKQxJV)7`o^i!&nY~
zvmE+HuKC~qg2h?aRN*r|UG9WsG3*;_WjSz80xqHl)=5_bI$g>AN4h1$bAKp&(h|mK
zA#kB6z~^bhdmcQ?5S2SMnuiHmE}lmV%@Y%&C7?WyEQYJ2c=UuxiRxLKNG&Bti{U?|
zG^M2}AM3*;D;MpPjrCa?=~IpKj_7h6_+uox#=f`-;7@{yqmE@_f@sJi3uMP8l}y;s
zLLQbOb!=oMs3;Y~gy~qH`hRqPqHe}A?8ytx#8!fe<moCiu~EJ#K}98~i2W%+MJ1@H
z1Qn$g&JtAg;)3}kJuc{LcyLfrXH`&<Y80!3iVFH;HUuit^@;I@OHh$ajS^H;f{L~u
zRHUt_o-wGXlMDapECDJi-0E8N_SS%kx_O|YZV4({3#jP)x1TT~`hUQ~*y1DOn0WWb
zM<DbIkI2)_kTIF<wihqd%~tzK0&FW@$Py9(kM0fh@X$y(0q7qnU>j`m4Dim+e7tlG
z{uSnlg(m|mz;uE%Y>vU3u|PzCqp1%pn8AOoshs|AM64-znG6Re)w@QR5x<@U&jgm}
z0)x@mmKTMmnfN#>E`KynB!hPq3IH4eKT1zURm^Porcvc?O$^vG0|WXOSW3ai0b_*`
zkgp&|F5*#$5um62c0NMK*1(06-aU?GY~lSLOr^-i<xj6I&;6Zse=w(s3kL){KY&U3
zf+?Bq!M!vkch+cROi_nug~b5_68hHC8i~@Md)1-G$1$3(C4UsoFZ1!~@O<V3;obs#
zY)zgS@IB5D43AxkN4Sp28TcAB9M2he!ykQsM>4W!zaG614ZWTNm8iE<WJQD>4sL)b
z#OKiXh0Ku8*~yl_lHJpYJit5`hsG|@$R*CM{8q{UBT?#P!tzc^Zy815MPi)iQ~P9s
z#HX}BlshMXXMaH!t^~#YY?#iTvA<6f#KAw+fC82PNpwo-r|0wr?`3Rc$>zl8v21KG
zN4M8JR}%A%LPMElfg7M~Fat?dmyTvp*?mP18QoNEyi%|SpB1XzQ@vYiTFe_d3!Z;h
zNzZ}$JBk!l8AF8bs+(XRijuyJ$Z+NZTykoJd=e{9^MAf9q$7t1g@lykZEStL@`sg$
z9PnqAxPQNp6RI(}j$uU>(d|{bk8vD9#xSdkT9vpk>^=M`68ht3y~rPp_RrfM`NMn(
zxk*&($z%EFPuK>9^(Es*dCZ5eE&|{jI4C$ro&$uRP5qIsub<tg&rA96fcYYX3Mdd@
z06?!OCx07?F#uaCB?D9+nNTqeS%6x<PF2jY4ody{@x691hUBC2^7_htrsPQ-&!`XX
zXX>u%XHtz~bw5+VbNq(<OuDud-f-z>lBrSpnMyy?_WPN%71h#yrq#_#%lMYMxn7{|
z627Ivt*%8^Z;fxMm*-pRmA<7-_?FHvkUNMNuz%^yhh6;(cQN%cL`~+t?R7ErvNe8^
z0Nd(fvcW=i9XV7cTr4mZkrQ_|$^IowhX5`eU{>fZ%~t?*VWRM;0d5v(99$9nCcE$|
z4S4SI#Xh9417kOUKA_h~c%j&*d54R*afGZJZ}?zwT=E)=N+DQ__a^0_=?VwU$9d?W
z5r2<pmg!UtrPqSj7XFd9o)fi)6%y~m`Y^ByKOFxdy}Fp^)5$Q~t9lD2{HQB?`K}-A
zPs-dcTe}rTe);urFry0mP@X<~68DEl1Ezo-WLNR5s<w2$`={e2-5l$ro-|_#zeizu
zh5b_yD}1+rQqlO9CQ}B9H2f>^3e>^!Cx0xqpYHjg@h7m7-^}(^9Doi)R#Eg*st`Vk
zN+rf16;8ZKOv-#Tin(y4o=??0_b-QO3ddb7$)PHyM9t3&CMD*MIyqxeJZY@Wdzjv+
z8kSAGOtrLb?@jNx^xbTM@8-!}uskM1;sxaGtwpzFr3VKbCbDdoew@6R+6iS?x_@%Y
z{NKqFF`fk<+?CT?)s>?f#p<q{g6HK8xpH)E7QErol_OK5bmf$;ob7kzXe+8!T{*=~
zOUrn0dbz%q-Vz?1!mX}FMQ@D<r=RD+>6adyHF|Kkcl6|pxp2<Ge*D6HH~kDDllg9Y
zeK-AV6`v%)w)$=?=>kvy@_^<-mVaFuqiABrAm*q+BdhY*@s8h&QMqKmS?b!ZKM$g&
z{UL7;49(I7o~kjM-t(l@KuZFjk-n|EsYBCN<JSgw;bIIV0B;ZXH^r|F6>;-K8sc2^
z_=6w@EFtT3^We~~kS<r$({*Sx>*A8c*!8aH$gkwEx+aaPtM(nJJqNGE6@QhefOOgB
zXf*Qg=xrO>Ge8GO2T!Enmq~v@?%kI7=%fzB+JB`QDwa*(D3I$_<Kxt~Hk-#<#^#J-
z<wXHThtk-*tg+b*Y#;Uz_v;Pi*Xoql1zv)gxil@8rsd>@9k;3vZd&fIYFbu}Vs+DU
z!R`EpOv}1QD&BBuT9&C%ntzr{)AIJ4mbDets;1@Q$Ju2}%l%v<aDNHYa^Y6jqN1Ot
zY54}>vfee#^1;UlLzJJUEX$=~c`b(JBhMfEBQSB%JO^~U1SCHNbJY}|1RnskHSoV)
z{T$5&n%($MmX~F#jLiA0D5UMFn3z@a8(6o*IS2S8P$|$0XlvGihJOoe(QIdZ#dg+L
zj8z0%Tv5VYnU7)|CKuK<w*I}2oisblAxeUUlEBTbXv+0b4)7kpG}r}eFck$AJ&~(`
z-L4T}2p^H91N)t8OAQcL&dsPZAE1Z?e^hq=_=6(O(OP(Ne){d(t^l_K!c|!uAlB)^
zB1t_hjU|EXUZo=1sDDMD-!r~98loBwJ8r=J5qo}c5QTiC)@pA)9srfVG9FThlMqdt
z*b>X%7i+8iqfSe_rrcg;ZYZtHP+Ea`1ikk5_an;0Yexy64*%1*+(9jQ0tzr-Vu5Lz
z;^jY*0QN2CG?EFcaz2Nm#7P&OfjYh;(+bzTr+3iDU(bHoLw``Uc*io_gnf$8<`m9t
z0rwdd_7eZ7$e=-raP0g0oK^S-mmx$!Vyr|Eil|SN7FmJfw3cohyknde(sX=VBVR#I
z90QbAK(25lNfqK)bHSxjeluQj|IC`*B#TS=<Xm@HVLz`<&UhdZCXNAJR4;cvVGb~;
zI0f5m1;_(`K7Um{{V)9c^XKpP@U1CQ9Yt;IDISSlM81+xxv)@8aUTdY!L<p#O?pT$
z%^aDDB)4+LF#d?A3aj&ie9Yd^Kc@teYb4*PtDY&UoF$6#N&ji?I&x|0vATlb5=Etm
zfq2Czhn12Gu2`1RLnD^EPoh<l8>pJitR!_kp@O7(uYZ!d8gyx_H?LAEIMIoZ!~*`t
zdo)%+DvO#%iO6XibJo3vrIV70R$$T~Y5TWdg}hhuTB8j}J^D+cM>InoYoA>PQh$YI
zp;W$%Bm+?uFul^(aJwvCbEjTyN?3X>k!LI_9v_U7#o|1z7LJ%~C1&bDvM{Q@c~!sS
zpOre1S$|aiV6qRe!_dvGx?E<}C%w*dQl)iII4{zYqe`i|x1U@KH@$_>Ao#P`QEZI#
z55Hm2@3GjmDE2n|6%atTl?`ltPA1E5c}^zbRtNs6{+hh$(5G6ma<cLGUZXJo#8&ij
zOIB{l$}L&BC42NOS$?8mtu(=l5(TSM1&2q`tba7Ytbg&W!0DX8@)h%k*`DVl7Z#lg
z6Z)pk7CG+vh8n0<JXor*<H`<zEKJd@HJa1H?_rC~E_6^MD7VAKF}6w@DIP%;g~fIO
zHk+0w)f5%?*MMFU0~Kht+(EwaN8p{yNKw1=*CXg#ZU-(*(`@b6>y0vg>8g41BtO-C
zB7c0TaI>5^mE8i~6KEvYJ#-~Mj-26p8%H+9{cvVJuIUkoP!JeZsPV<HD47|GprV%c
z0rF-`Oq5KG5))NoqP7eZwY-i>BBHWX)TaH`YMc~bMQ7jxsbmqe+6L#zF08G)H~)nH
z;37Mx8y&VeuJAT8tJA9TuvsI^QkV5$w|@bX*TA(_iPYM<aY+joEwMGYuSO2;t5M><
z)`I(b3$}qN%shpCIbbLMNX9;F_)Y+zWsMoIhtKRw#(pK)kyn(tkgr289sAXI`q(eQ
z^UN<zxt?0MIO|iRgmHd@PGGb|4Y9xL#d?7S>ttx$`*Y(CJZ!j9qYu)s7}(0NXn&W6
z^C?}vXE&B-bPdP4ho$}6hqwQj2bdYq4Gd~Jpcb)2dn`08y>2`cV?aRFjelqSbMD$-
zM)$Z+K>Jf*c;F$!N&~RNh18gGYJ@FCpF`UpwtD4|(aaKg_HulK!gci<%=yT-z*%yL
zZaq<$svC6DDg1x5AVEwRoh(+0TYojP-FD$KrT=AbpSt3Jaz_D}A#v)kDHvoh^QVjp
zR28ERVsX?XpwI&7;CFBT$HjN7Yr^t~+{4)GFzyPiMxz7&o^bO0cH@iE!e)t7NxJw8
z3{g}E-x&ULfsab3CGM({oy4vOBVyYl;U+HNlh0!XxvY{MxWuMh>JQHpa(`E|7=x9O
znd6v%C>3CjsQgoA5bDOJ-4+ky7yHF1{$fxp8RPjsOB!WQDMVGdvO;W<REmfb?}!$F
z1{*Jko{_3hKh2Xi=+ht<d`ANd0`B0#{9FMg5nUnKawOIX8mj`Vh<ufR6~m&GrRxPO
zHD0)A;BF9P#RnJC4eV<k#ebZChNKQ)u5I#o_WY*mPJ5Y)?1|g*8=2?v#zWik8;@qo
zUqpnJZTSlte<)kN=9!K+TiWtvYLvG8(w4vVwtQV3wX7|FRXfD<vfVGBrexzbpPlV~
z>2W1&_vY5v?wdKb`(|moU%T!8-P9ldLheqd*Hn*O_>uYkg_`V>Tz|+b%FM@?o0o2~
zZ$5pKeYV^CZOl|L1Tla`(<660%4Wc9hM~cNip6$c-0otv^!4b!d;XngoJz4rIg0lS
zzPJK%1y}z6-`>|Rw~Z_L{(r0PJ8-i1mgO1wL;iM7;u%lusd4QjR>jUaTNPzhv_;w4
z(4<O~<M@0`-DlZH+kYpy-3@>MNr0k6S|TM*ofBFl0HPZWpxM9fMxQwQR@ic<4xG*$
zPelz&`|qFA*nj_w!vW}I8hcJ{T%p^k@6iw#t;86Al7=-jrJ;}A55OWwc485l6Zgqh
zd7QKpMy!QhW-Y`&|Bc%kje$ODvzmwz@F`YHfEiXR25jj^Pk&z6E_C9MH+J3}-Sskq
zpV{=!M{ivW-vURCQ>DJ~2hjE#iK%FC_kTH~b>`rLW`QA|S(YY8tp4HRlsEV@>smD%
zN`=FjSV;`)QX-^`Noq72FBO2<6vDl}l51Rs2;#IQukg6y$!lP4=u^M?6)rg@xhVJI
zDHe-mSw0sQj(-({rCCUp%6h_Kr;o`>G%;=XRAl(=(#KB`+?o!v2C<J65kw9iJotDm
zuzKL&3xW<U!2}^}l`J&i@(a#90Y=utQ&tyGv8+MY3}<b|Z^g>QG2&T2?6o#I_@uUR
zpt61FgF!C!gpSZQSJeQjU85m&ciy1u?!rLVG$!N*U4K&=pBLzw(JIHAtwC3n8#U-!
zgRV;tx@KLYiVvX5Ye}va9Gk-DN{3R-OxMzeQteHEWA|z}wh%ZLGl+D-NqjH@rgy&$
z?C$yZ%kFq&djXvyHhOd&A(^WT%*N%BS5(E2Z%L~T%<fegn8oP;u1st?STG%6gT1t_
z#dM$}cz+6ys+vnG$*Ar2{5y+~ngj)a?Rg`l9*Jjwz?CzO-&XVU*~1|icg~(cY6iFM
zaJU(6%<k&Vy0R>VV<<Tsl`|62M%;_EN@;IzYy{43ze>w-q63>eY9#sKuW0iU*5tTJ
z6ba<UP|7eXdlfTsYuM7X*!pqNYZ|L*nH(pR`hTvp(RuaBBjd3cLQR6ibGpQsm3;`J
zqLFNjy2J(LR~J;;cmDAC+GipnCeeFXAz<Og+v{WlRxIV3CfPv52Y|PA?W4>aD#hxE
zELijm>E<~ZySD2#ep%~uKL6Z!{kjkTy<Y#h@pJo4m}~l^(dqPl>U1`fm-T;QCdV&d
zet%kre}8U#-gx~5tKvZ}C-i*%XHeDze?NC#g^e<%V8PC-FKX6Du-fZ_tQ7mTq`qm%
zJll#{KT0Zt0qBfna~ZJv3y>@lw<ScqnHn)R&uqSCe}Jix|2TwSj)ib3*F55Mc~`!A
zk(=it*DmcMC*@!fOWO+|ugE+oBKa5cvVV-2tQ-i&oarIixD<sAYUPPZjFgG#(A%if
zL<RC+DksgurUqlh_d4s+18ogZ+VHamzw!~Hg|FiN;0`|R$XE!@Cr|dMXORg%*z9=h
zka_>nMV}EmLB5By+VJ%+&b*1XaLbZY(o<%f43lX_f^-+0IkS2Gy+3e)9g9w**?+ul
zZSQQ?!MD}Jf%l9S+`W0@z<UeBfzz0f8wXBld|o(kMk63^w#I=~Zqzt%jRP+|4xDw3
zDjo-()^J@d+&6`<mBxK%rfX?&-~9==?|zN@7K8iZcNltu{OXTa8P|==8?UH}8Q)@7
z9oOBjGOi0!uDGg)Mu_pt1lFo&1%L0bvw}~R{Fn0a4Vcz@X!U;v8L=Gi+hF8-DC0`H
zO0}^tjCTKFJ=QKunQ5`)mdZ()F9n`V9sdYJphWr0!m;DS%%`~;PI6_j1IpQ_GJ#$z
z{mfH3ar3e-8i*WUN;l&cTAs>}vWH@aHdvRVWJg*(QHMe;C7U{7!<szZRDakw=^exY
zPHZ#sj`&%76}Mo|@pR1`;cO;h7J^bxg3Ef2usQOko+BlSuj31ndeqtU$W6voZCa3q
z?I9HaXEeD??;Up-h)}y{>qf7$u#JV%Y{7N`#FCzcX|gGFcfm<Zn`JnU?C=19lveAw
z22!dAr0g3_BKz|OQuY@Hq<^F_Avchc()hf9l#E~9yxAH^QMpkADK(I?^gv41HL7?Z
zC99>VS^!E4KP#QbbY{AiHjnAS1OVlr22hFxQ0VaORfbUF62~j5g2p$ORfkXxstln}
zzV8RS2L>mUcr-Y?G>!s5K-Z_~#m=06YwZH+L8c}ZPoYnL<@_)_E`JQ>#53y_*h$FO
z6be%BebM_H2OL}xF#+oW_RENsytcR}?K97L^mOlA_aH&g1i018Rs&)RHcH2zt;PDk
z#yZ68a`zyJ>cgqhm==_b@}uuM?}%rnq-+_pQd+UfADky_n`#fdv8gJSiA9-(H32yz
zfQx?ZfG6<?mVu$~^?&G$*v=~wLLG{P<dY>4-rghDhKLXuELjI)XiQk=BrbGuyQQd}
z5}5Sb`pp^N-lJrp<1{7l<AQ@50ggPEm;1pG{iy}sH%~aOU<p{b0I=G;&lt01m|#<7
z*JI61i<8A_g+Xi?K&|;KHM!D~=0E>#Dw)$~@=TGhN#NSN7JnTP{q_QjP9{N`aSd7!
zpt@|LF?l(fDcxtW3)0*X#Be4|fc3J#i3;e)*-RNV<CA70fLJw@P)WsU+#-@1I?chw
zfP*7YUtH(TIS+1a_~=|DGPr$sRAYkG!vqhER=$IIV}b_@!vxcqkQ)<BX?$LoU`8_%
zZ??t+Rc_RnV1JDXE<Glgb&V<>6P(KQSuJ2Ng{hT}teTmwrH!mQoB#|S*1%wKz#yy)
z^u-14%b;kl^pS>fx#Ja8apU{Us>6eaRfY$J*o(6~Nbq}TodG{(ppmD1c^Qz9y^Z68
zS<yk(QShPW`E0^2GhFb-!EOw^TlWzUEt+h1WqJa$$A5^nVitOKdyT!CS=Z<m$^aR2
z7G|2qGHkI@EU(gV$4r)(432EunwToqDlf+j+Kk$`En8H}Zp&V%VOq-=R+3Rd)?LFW
zt}jVY)`YZMu}}^EDsAIh)U=S9Ggth4Vbi4?v79qaidhbaT%9RVuFQPdqq>UVKm^RG
zT$;UfjDLpBidgiPglkNCk{aNJab11X{1$@WTs(l5IbIlKvv;)L#DD8xt_lJ-hej*R
z;k<#H!-WAiX-vos+@v%<FW@HQ2R?7M25wYt)WA&*+$=qClXZ=HfvkAb8>OlR-=wg%
z((uj9bS*7>b2I_IIjZ5CLf{*4_>3m^S!wVlE`N2rqAF~BuUU2Q=BUcxO<Nwx{>h_5
z*<lWVNya)I!sj9DA)W|iI7GA<ASb}oJ(R?bj%tCX@JD0qAOE1FK4=%ZxVrq;zt+$c
zYFStXjCtA$=Uz`&-1YshH=q?kdHJ#ptF?!gE&`5z9|U6`I0PS)lzxZKESLy1upkRj
zvww><RUjt=P!UZGC(U0s&iDz3qY-v}b5r)6+cl@dIaE7nug6r!8S|8d^%EUY4*Aj*
z0>K2?0Gna>Fm(Wuwrm~8LjXW$`YwpUx+A2_Y|hCGFueBYEMMXT7zASmVa5h1@FEf?
zX9#eFPqgw1oNW0A7Hy%QjY_>aA7Z8-QGdN;heMiAq%)1+3rKXP5s9Ediy99Bx<HTa
z<+wx^eVS_o$LPmO;2}(JL`WtvAtj9rnTZXre4G)S2|25rn<T^w)=i%yHCDWD@<j&7
zCed)F?0eNdBx!OUJ{Ybh3BVA99&Xt#s7a5WJ;V<|AkvmPQh+)W$q@4%iJrS&=YQs_
zbMsXi&N(t#Wsc?z=Nv5z&PiiJZa62U@p-{H89(`Xvo)Nfa-)WGYB*=<;hd~%RPk_5
zPBT@tpq&&pR~p)xnXaXUc8(`NJI6J&Qxvq*{TnPs{!{SLf$v*T`hFX*1A~K0kF7L#
z;|d<ZpDPXg#AT9KR7H{RN~;e19Di3C_<<>5@hM@6IRR!Q*FgpZXb8V!2NdyIeRyOA
ze123M0vh|_aY_x*%7$Y5w|=w^Sw(JM3mHUQU>rib5Lqr!tXP^Q&QI~iu-03v_Y9Q=
zw~fzh?=C;!PS^fOm(x%GftL@T{=mz-%l9pQ-Qm|=e%<5OeSSUQ*F%0i;(ym;y#CR?
zrgq>;?ZB1Vfh)BGS84~Y)DB#!9k^0Ea6Ml865&9mU>!#GEa5tNE!y0KEEe?{L53?@
zmqa7U=HIykAPEhmr+4tjjBkmxl6=k8VC;Mvxw8_%YNr8nVS=&*B)}h7Kl~Z;(pUy<
z`$ELmQ5O%nA9)h5A7|nZ_kVVP$b)@rU0$h(!+-hE4q7?hx=w#=!-66LeAs`P#43Ym
z*>`@30j}#oz&Qxn90lzKg)OVVWfi(21aAi6i-R)w`FRDxA`<;6!Cj(P5;%#|uui)u
zFJ_wTSot^KMJxqJ!u6k=5jW}b60k0Vo%Qp^jtFW}8ey-NZT#ks9)Iky($WZYMbJIE
zBj?Wf9>QX4zx=ZU|83%$-vu4p(C*ow-@m@My+|M7p6Ho{OkCRnsQ{6&-K{m+8<T|n
z@Yc}LrZpZt0?O34-9TM-l`M;qsmqW2a{*Y4<79O3AAH)f<Dl@N;qXANB^VAJ43*3v
z^0M%@@}f|fqD5nprhinp=tWE7NQj530J4SRql1~#z9B1PeF+6GY&ra<i4+uf!-6Qb
z0`_f!mU0Ui-Zkjij28LVzdO%Tsu?{OL*T5CN7;kKST~I$Z4#-)z`=>PUbMU0U0Cek
zBL%rAs5bR3S0EuU<KrJ#hL&H>LxJe(!#$aXl_B7>7#9I$34fQ{*11r66UC!j8?NV?
zTINb&k>m;=YdKZHC_uH)bF@fZVk-X5%;Oi~^HjW^Vkb?ZgSOCAS(<7$?Ur{trNyA$
zPm}wpZYO2aG`^pTyEE;oiN_PS*XWdqY_d@gt7*5|HrrR3uxf;V`M2HnoVH#3Gwv8>
zj>eCAf2G9Zr+-J}r<|~gn@cnvUkXLk<Lffv@fCkX<kVHxFjsw5Emu`zn~~AT6vnTx
zRO1;YRq?8Lg(*?|Ub>xB8c2n0)N%)3VYj^phm<y^A!i<ho^v*W1qF9hJh6QU9y`{d
z)w7?2P3r>6xPi~lBca3rm;!*30X%|@-^NViVAy6xSbxeoZiC(c8!(kwgBrrP+=R*?
zX|Oy!!>f9Tj5_cGAW}q6Et_jJ3-Lz-2?c1Qck1=t0VFZ<-NhXfyS-m0gRY(v+OZKo
zKAyJ|+VR4i(9)QY+X*eD@p(C+WrQDjv$YeNO`TO#9NQ9xad!*ufnWiGI|L0*1|8fr
zxZ5B>f_s4AgG+FCcXxN!!7>E9oO538LwB!l{awBKsk&-c?dp-}71Rp%&$`}>b^kaI
zWvdX0gL!9J1!K>G^=XjBTj;tz4P3>4dOOui0%@?U?Ls^qu=O~mgqOjT-h@sQl{Ggy
zpW(d5!?z&MR`ctVz*UWVv0X7oG;L?BE_j-YAX7pYp2!D<YU;1NZqw4`>|ZEEg1ooF
z7@C?M2`oosKM=Bhta^MBQpn20Kuj^>XYtyP;&bG7c)HBg0-4>WcjuZ>z|c5gD7@n*
zkSl5OCdO_Sa8}CTAANz3VSW~GvcasYi$=%x4$SD)Cl_LHC<iQ(_TQeb81{bLvpWON
zl0_Lof)}`RaO;1FVlR`a)J=mv^JWR8Is|CXQ+TRkN0A2zWBx6XT#kxgT%E(hpoVSi
zz^w5;?Mo%o1U22~sy?OBQ>G>aiIII75@#D+9MdyeGKZO?ZeNQqXN{2?u#GVbn3WHW
z!L3O5pSF0Rg9)=W!F2UDeH|MdUyaZ@d`M0f^b8|ZzM}SQ+a7PLC(WQX5@y=@;u=aA
z(p)o4qxKg-!U|B^f?;V@wo>(dN|1WSiSS$MmD=211)WS&+(^uFcdvy@$>O*$sF|am
zoDbznV@K`zR`iSEa+A>*^%$ap*Sz|FS=>1~bzFItP_mml!?s%~l%FhMkzbs<aPB44
zk)-iPdCdfdDq!bYR!3yh5pHjWePmmSHe3(|z0{<v9KGB45EI^%O`j9(6$0@7cJj^E
z#DPad9<-q7e&kUs2L7|XZ{;WpK-HvuBBeUkT{KOD<_{Og41cWjK0w?iNN}^payy?M
z^0%MrT!)z=WSsdhfeaJ$Ye7a~EQX%iQZBtB!ku55pcu>O2pSc)WfZ<#%`}%ktw~Xj
zr=ZHUrwYK+vsdM($MeB@pG1>VcV&4(917w?2L;B1V}P1-02c7?LAuzy^bKFG4l}^j
z%N(=k`PCzB(aOE0MLXMhvL4wiQJTSE!nk6Q3XchzMvxmS1<H5OO=Y+;!#sFWXh*Gr
zTti!+#>&vZ?Yvk-N65yu9_%i9Ui@t;W+kl-ELW-2{!QtuqEL1?J+Yo{LGd%B`@Sm#
zG@mm(Cy(<%qCP88WfC{W>8OJ{k0<<40Zd?%+pch+kjNZg2KmL6+BmoB#NLwMkaY0n
zr*liRW*AoEnRD4mM9;4|XG_QRM+K`I?)|t~F5&l=tA_FyJ02^&Spju9uLe|_a-$uv
zvVxIojJzg5q2^T)XwF7A5sKW$4+}lfAgq(#u2_n#m9Eo7FdHVma-h&!WcTBw(>koD
zMvol~>_AEHFY&VNb}r&>Dvt&}sF22b-Oyv)VII6)_j}*K20EuK94|x@*>3&;mvIOs
z*s4Yn9l~%+ss%FdHBcmK@#r`WlA<%6=!B;gwQw<Y>Ht-=AGq22Shn87lxHD>sJnx`
z$2#go9H_)8UU(T9yIe*0+~F0!`5VLpq~#iIIG&>wJA>U3%k^P@ZV+-j3Tm`*ZLz+f
z&tE?(?AsTJygI8kw7os_%iFQ?rxIsVY()8oeQ!4-+J&<>%Q<B6Q?XZR6XcuazQ_wu
z;~q*Ee+V0m5kx$@>}&P0dKrXFRJ$Yc?(_z^u!5_IUGe8wQ;_EXLagAypTUSYd_yEE
z;lQ&Yafb_4LYZJ%{QQD=4z2Mor`pI05s0+FI8*(ATUR40;uk!lQ%O6Kg&eumJ^)v^
z!3`Jg=K88B?}xl}xjY;tI5q9`GS3Z64xS)37R5Hs<gi_Ja!nSQc0>@#ugNDy6^`^A
z_NGD62S^NWw;bs!UF9!(4DMrEAO{SDUbsTrCS59`qzaS!-HXkp!~@ym@5pqasWCDc
zlZR|Mw<Z1!Y|vGF;=NmUs$sS?DS}mV_a?kH(K;IW_V)A+3GUDn*8QGTPoYniB<eBX
z6Pk1%<L8;M!7wsQ*JaS4eBcr0ZHU)yQ;Y{+hXZxJVdh~DP3tI(w)K1wd7SB^F^U@|
zk-zUNl`lkUGOEgFWH0;>6vu9N(n?BWVV}j5_VoiXnsPvxBD&pLJffDm`xU04N@CW>
zeV{o0u=uCS{1SBimS7bP%?6#c-UVh8i3LIyy)Ou!y!)l}DLJ6q{^2Slsn&F3^Soiv
z?7I&O^}=O%b80P}QMPl8aPg=W2T->`0AX7UV}M1o+;%(8aT2^bViLfmEjeK!KU;Mm
zIqLl;QiJ);G5SVeQcwQw+jh~D_;BzJ*2YI($zQlk{WWhpOC0?u$x^%&_*<-7KO#--
zAWcK0Vw>b1{l-9c*G8?W<=;alKUc;D<ci2}xNs65Ai7+b0t)Ck4j`OesR5?6sa~Gy
z!D)mDT)Gx4X0{hb7Pd}C7R*%F!D-gxlbB;;Hv2o6i$;Yb(WGPL-DCU6TwIla{@}FQ
zGz%6a%R)%wisQjq5*vF)GZ*T_TFLg<=PgBf@|9El$6HXl=gD2_cr?yLG7_%`26HyE
zr!P9t%gCi@q>Eu9U@363&IOB-GGhZ~4^;*8&`WQ+SdF#qhvpqb#P`?w<3}I_h)rt}
zOt!x%WVHb9<@BoA!8l?>UyxHj4<#Q;ikHd;(3gvs<E5Af6B-@|u?|;&w8fC6m`Yu^
znglk2k3rJlNG`+({AAOyl$_qWwwT3?_<2ANGS_ZWn#4~5n9-A^>Yq1Y{ThsX+}+3y
zxhR)a660cINzYH%zd!T^`QcD-sIW=I_r)Pm#u@QM;eC#ap#LZ+jwY#W(k<8|#}vES
zNBK&>n7kxjC{DO`|8l`e{D^&66%&mcAD=l|#}9gs`{~)H@29cfm@jbdQGr#0I93Qn
zyCL1t+WOi6IUvdoj+*9O%sWH3TSY|_H3rIwrqZzpT;=9A0^UEhJJtjJ;*&1!eBUl=
z@s=$`S;RWMCI#Az#g->W$aMQF(FK!~{~|e2e!@_VMvE5KmhX!(wpaNh3Nsp`&i73q
zL|hZ3hrycEr9ar4J8;R0Q%sZ<jFg2EUQ^vAv48?l%B6u@!+DhC!z!P^ZAE@63}aqO
z=huKSfFDPQ?XJR*MVEqU2{CqlL`LSp(vl#zAG8x)O%uXutmP;Fn2i14)KqtH7}{&j
zGjbJbORl^x6Wu${zjnRrn6_B5<J2Ua(iZ{Bb+Xp`%}dHBWIh@>aIXA$*WH%;Hx749
zwhC<wBWi4U+pXt4eUnpvEWM7ktNmgQN@>s#UtzNBp?g`>L_x-q3!zvwGFA7X&UIgw
ziBU@xx<kbVm#eYkDzxqX;u_u_^*q*9;Q5xy^Wo|kyREI&cXMZv!hd~#QN(}!a1kEl
zFS55t=PxpFN_B4g|A|k*|7ApryY=j+Ju-}dwZdhgetqjdinSb;f@rN<wdGt{Ci;EH
zGwd!6u1v})n!S#Bp=Nifd!9?#{OUTCSm*`2+ksaZRMisS{8WUK8JA>Y15%ivJ@4AP
znrB>u6w^VRE%J==?6hv44YT=N$RtV>76jReOht;Lgs#j`Z8rL!^NJg=E&*G~_2CtT
zwe^$>v3%seO}OsUhwodQHgUT)Te^AjHjGaw3X3U1N7d{0xP2m}N?h!jYV8>$-MG}+
zEK)p?Nm8tkagS3`nFcE{wD+#!HUDTru9Mp7L$g2%^W~q8nuC58`TiNk7IhLV+sEn<
zv_WAlsJ_pr#T{#Zi=OS90<nEzq=*ao>@X-{4w53ZmQ0i7w0ic9bpy|XN6IBIAsTOi
za~CKzXA(}qV=GJ-iI~C+ZS0fC)wVzKK~ntX$B%7pKAoX6EGPw+>EAY6UBYHO-XRwh
zUDJTXlCl<_)^cvkiPSe7F$>DpigRyC<qiEmh};Nj2qzhYFL#=xdXu)6MVCw}FJGIS
z_#|@NwUYwa5dfDDu^cG+Pj#m~KLwsZ{na-j!3RZX<eNV<DTOv!#N7R{uE(TOz6hct
zP?Hf1pDQpPNq^rhI~4QcZ&kNzyBWFbsObZR{00raTv-EaIwc$*;r*!&`f@H2Oz+WC
zBVb`OwGe;+=FLmbPYJW9HT)4nx;rIUB{K-><|jiR4u*=P$uJ~Re^pJ{eU`Q$>^o5v
zC=V-YL*lkkO@P*AmC%3s1o+Z@tQgX-YR1eu$P9oua{SO(<7EzfZS=H7;QcLgIDZIw
zU3<EwgWbPfe3h_XN;$Bu5Bw?7^A!N<kRoOmBGSTVC@OrB@<36Fmts(b+}k<xW|k|l
zIRHl2Fr4|4&-!avWfKb<%BgUuqCRq!wiTF}@Y0*a92#p<uqpmf{59gkJ)A~|oA4zJ
z?JisjK<x@p771yQQ&uy*22A79GLV4knZVq&eU_FZ?r7M(^i>hrlKHJ@Bs<SYRX@a{
zdz5zUNjC^8<-!3a+ey5S#jsMJ?fw#9Aq&l%?-KJ!#<-@=Bf*#o6RHKGhH+t<q8G_i
z{jI|Jus3!LPcreq_e;i9jeqFgp5m*vG`ZQNUFFg*A*`B4escPMyhGfZcL0S3n>~{r
zU@r29zkNNBOPu2N2PHmL0%~`t9~Aisg9T=qN&;XjPP)l!0Yt$9z)^UYGnF8Ld)rhn
zPHL}9R*U=FKOmOJSk#*GD!AvW9aJyWb9aA@k4REH?uQAA@~bQ`jWjv7hp;3%L%+ji
zPjtpR9Bg(yy>wI6>UIX>*MqR#bywXCVg8^@4HC_&$4?g{D{aRPtcbnfdT$!&>A##B
z+S0^q-_`YdWvJIxojw{mh@%J1TuYN(NiXdpUP$hI7HyLrwK_<|0>l2he&)4+V%XNq
zv^h2johECV?A#2(hh|EGd&gILP&28l`l)hp&(Bg`<;W4<GkME`b{`k=oa{d|C@DV<
zHHQ?4&t(3x8aByEj|F@`&^a=0R|LP8m&FUJlAy1Uan9Gd=eG#Z9IsxxC~f0kISA*5
zKQ!imFXv=CtQl4Kl*ff$WGWnIH~B857$cEXJr^NbYL_K$a}1ekL&#s9ZD#ri8RK9t
ztZrKq$;Za1;u+2xluOeEn}y24v#th<s+8KNI3CPK_5#$+{ymE_Q^2hl>$NIx+wxN{
z`=MBG&u7|QPU<0;JPYZ!?Yhv#l=nRq+tRkZ-w{=L>Lk&Tqmk<1b2N*Su{bQYkY`W@
zTbF?B4_JYP!HXfn9>0w<&!Rkm1)NGGHZWp#kwu;TH*5<|5Hak!1iK=ez*PtA5N{Kh
zjCeO(M4=Gv`?C{G;qyJp#)Y8AgcnR*%>#78Ltp!e$mT>$xCg(z3s`n8aeeR;TA`ih
zS%kkneuIi)lYvQRZ_C}#$GC;%|9UJ6i%(wmyBoCmwBI4-5&ZhHgYi=0JLGVsV(V{@
z^jg08y={91v{mU0=7laIz3%ftEe(n+c%bjBhKf_~#G>ox8(#i#IlxzJ2Ax;zw^?z<
z3!r28^>e4o=^US%wRWpYZX`#esXyw|yN{D2rZC9+gD_*9!AOj@g7|@&990HJNCu7=
z-=A;uC|D^duTH6cUcR*ZJU<TJlx?!Vc7eYFf31S9>}*F{j7oU2DrN_(FCVb2hMT>y
zj8<G6R=R954E#_QmYt1)MUF2vS_0#rZF2RK)+F9WAtLFe850{qg$Vu<j{1J5)z18y
zx#k7$kN|<w=Q9B1QLE!b%qh&D=khDi+e_G2gpbj+;VYjx?Ls6Y2#t~S@0i?3MWae8
zwL?J>7=KeuaTHBwRNFh-+dI(@EH;eF;kfWlg-Az{=$5#zmaFV^#Rhz;3B6>K*yZmM
z8zF&2(#E9$ZE$Egm$-@FW3fI+U^N}fw0S(zy#_K${D>8fVIi}Jq8BP%a4!6biF!s2
z1gcCCVVQCzk6AHLG|abKRQJpT4G&?>P6U87{+_`9#)#5eKoCo05_v5kB1uCe9`@eS
zZEE2Rr>FchqnOb^;8QtNDtouwWMiQzN{(n1>`|qf9Jd>vW;%3kIRrC=#7kJ2Zk-_=
zxh=<zfcNWW2wQ>ky4NnPb!jLvU&nV*wu*KRVK1vsVR%}-sM=GXJ5BR8%`8Zy<&+i#
zq2Wqjh{bI-fBuV^VXt?3?Ii4rP{s4tf4aEKGP#f+{cg=hMw<r6N&kmg;LOb}wuC&%
z2rtFeR>8MGdvj}-Ob)ii(T4^RfiE|Dni?v<I$0P(lz2tMjvY6r6~{8xkN9B$Y$+CV
z*)4VLfn_GJ*&Xd1m58X`lm$Z9FcJq5!2vVF^mVMbN8B-$HE=QnImlA54zQFdSg|tX
z_a*%unJXTe0|7eGgl*fT8DE>#f&o1I^-o*s2X3X%a=m6&J3{!<nI*k*JH1*!L)&r_
z79*@i7?0}Rj<`mujb8zzR5BQ?Se|+_L6fplu$;pnxgqVIJY_LMN~F2=>jB6a=WXgZ
zD@Ewt%T90qqsnC~f|DMNX3coEo}c%hi>DLjAct-Sg5E}g4Wo^G-I_U_dz?7x7`x^d
z{3Ynosk`Z!!*@AkaTcUF77}v+`AD)byEJD{jln(D`mp#sZ=gD07f4GK(t^V^aJ_gM
zS7tWZU~(CQmtl9J<Sfh+{u4yMPtQPtuSRJ|`4N#@bZK|hCj&Xcmmv5$X>LhO4A9~H
zIpU#@d76zRocn6)z2d6$+9dI2e&X0QIWru6VJ6+o+s;Y3Sy$kYdcaSKy?GvvnvHTi
zs0I|G=^8WI{4S@0+l=QM=QTwmin=GnJUO!(FeRXEo_hGik^4UDpcnKr{a~Aw9lMFd
zu<sDjc|fP!ytJnqHOJ~$MVK@Y7;cNi{PdLtb{(hiyQv6lsla{rdBJ8_GPW!K(-NTq
zYq~~`HWmDPktkou?};5Gyh0lxmg~U)4DN%RpYP_}WF!N=Qb2G1sV0994lQ|t+MZKi
zIY8cv{ATn?5kU&LVF4u>DdA6{*$T-OzJ?QuPf-TTu2#^@L*ME`hRrndlC`L}ju&w!
z+dI_r>Y{sL>a*$DWclgySp#IhX*Ay2HS&RyrK8v-76wIVVd{~5a9S7^N~V7G#tX|#
zx(2CtR(NCH>b>RtUFD)#LpxC|m*;^#yC7urx8ZKq+IK@aNT5=@!N!8*FpXGdj4~jV
zuS2jI)fplEV?cM{Rai+9QB*2$K|PhJ@e@m^xTroS7k>7dCmBsmD5D%BxX@-@>t|q;
z%!{yvzm8Uh3YF3$!`WZKQBgwm$1<V=8DP_;k3JIBn3;4DQq_xh-nW+%g+01d3QJ#!
z@?-=<0yKZ|AW%t;{4qLxt%8!#yHiKNac<oWV=9j<`m-5Xdx=N0;=KvhH4g(Ck7Y(k
zxxFveN!)=61BGpKT#2lBUr@-Mv#X^~aOW&LuWRiOht|2BRev=I;nhquHjr}im9Y;H
zATXfxxt-l-*oYz8?sU(Db|vXkKoAm=!~=Oy&FymvJ4i(mY@)C&g*x(G@jcyrDOoLY
z+XZ6E&#3|^CxSTE`%(nAbvF);d_)XCVgy&$IfesvQlXCl?W~RY&SnHd_@26fI6Ihn
zB4A^mxxb&U=+h)?bRw+UHEk=s)>k%4Oz%sHYdy?(U&zNPj0Az?T}dNhPcQ)BjSGBg
z4UovQ7sS(*?+ivtwF$6(fGr$5Rfll;%%=7-hf)+c)vq+uTNc@QxqP8i>4}N4JuAjJ
zvpN#%9$FXry?Q6B4@GDrc~H56)iV9UphiHN%^c{94D@0>ZW_`4N><cEsEio(UeXpN
z8{ND=rBLQ4Ei^&2=lfqevPB)lT3Y#svDHMi_n=Rl=0OPrTr9PnSy<iFI9Y(oVBb2q
zNruJ^Z@+9Ng!By?g8&NC#?28wt*Po|EUm3h?QPRj2l&ffpN-U%INQP6#DTLP1Vc9Q
z9kyFlCFwjgMoz@+i2bvC8GRQK->JDR-IxYUhReQCBQ#Q#!F;EMCAA>%S5G>|M5H9)
zK?mV-QBj!t>g3AG4Qp@`>5}RqB{qfO&al|bD}>z@>ORsoQ}_0th7d8hWqBC*U3cWU
z;N228`%Y_7{_%BG=%K5~xP+mEq2zbQ(XC=z`t6YEvl%iO^Puu~88V3SMC{z0^|YV;
z1jmkf_c>i(k*_Zq#+|mA=qNxA-oNy#2^>iE4o?(UB3Z3g{yB=exTR8w<>FXK|LfC(
zYh;uoo{qzStagkNIr0KsH}gAYQd&=>Z0W{b>icSm=BWOJa^E~VV9`}39wjs^>=E|D
z26I5pbMkmK;DN7#3}apLC?$ET0%L&L%4gRzSjb_T@i`NOtQsj*9KDO%RoCez?*v-d
zeBu0DJ9zg4G%o_VT(UD3$r2LxY2y#zeG8FcSKdNoq$vxYMM$V^fabmo=F|er`89mq
zKM6GKiZJg%1Z=}w{_I}0`L@3Dt!i`P9-+(KvK7e=9oDY?L0yY~ft|*y%|dDmid1(3
zWre=eBF@&BNXkX<oQCnX@a%B`O~`Gme)|4`kDe=Qo8krx6)pwrHsHIIBortf=tk~I
zBYrcX)r(|r!Y%^|o`=$LXhd{LXF8jU13#z0PT^g%X2E@=qRvQ}(hz{kn=%uE2fh}J
zbDPkWwy=Ve)8(%Fky)_wlbrGqN2nP|w=ux^FdSe9B3zu1mTcu*Thu_1oQ0KZ<_mGu
zD|}gQ=4DbYXGqGC9GvGOF#>CSb#Yx5=itts2Fs61h7_g_v3$nsin-E!UC|Yc2%2dn
zL*83f^!~hvGkJX?wCqknO%(x$JJYU<fkLL%G_Qo3of86$Rv{;w1}<f#G1yXZhemSy
z-N1aP;#;-dl3)$Pp)eN|&!nKpT~~8fOhKtp93f6yTPQb#5y2!Q&Ma?7m8|V9Xo5o-
zt4*bo3ay-|)Uk1m7VWw_sLDL|0^7E*uL<PZ9{UbO|1RJaV|Qh%tq$SS1KTq5*|=87
zET&NEk9H`x@5P5m15wICS_`f_XPR`eMpE8+*edm`19>hqQ7%CDlpTJ^l2wLA?!R25
zPC+-aD!kD2``^zjTeoTWT_57Umvd9Tt>K23QeU&#?n9b1lOg<^bXJ=ftm*ig{7hHE
z_!&egpV%V?*N<dDdtLLb{oudA9V-cMIA3BYN+kLHC#p(~+b=qdMx@td@*XDclec4j
zc}ZB)RTt+uwmzUqGkbI2&ik~2ySGA4K$;V)|IJ|6YFQXWHJ>e!VJXakj5l>FtD@F&
z$@8uMPW6IVbok=LiLg$VHy^&EZum1@;A|xK9gMv6pMehBuGiM$+L5*NAAAm9x#hT)
z3&uP1?v%8-3e@nUon0NV>Yk6(P9Yz;ADHyJg*H!v`<*~f?wD;%92>=>QE;|SWF@p6
z#E#Sz1*V(QmcIuoDEQGHMyzAcG}a}u;WC2uK6JyVQuYn^r;`}sP<hOfaqri3^ia!R
zf8)r&*8jB1=YQOWmNRARE9|FGBk36&>uz`dL4Q6riFs$@4-N1lO+e9*-0<b+-WTT{
zZsmk9@LT;^b}N6eUcV7C3M{&LI2<@#^n+gB{hf@?UUm4m($<|QQ#AWnGP|s3u<-iu
zASRUg*0cA2Eqe{m)6nl(m9H3r6{$YiLX~ghg%hic4hdzrLbg^9&)NTGVQb`b%VVO4
z_Y8a;`CwT@NEqgUWWsS}KiK3Kp4vtULLb>RuAoKu!b%=U2X1!1LjUefQ5*{i^^~)1
zWLQ!8DB%6$M^P7HP0HETkNKUjM$XU4^`dJ@+;BrBK@@mmTu-6_dh*;4zW6EWv6|yv
zCMWrR?37!7Ek`bj&S+dVZ}!f;i^@D&yo*@+l^1z0UElDRf01ovmvRxva)J(IF#eIC
zK=5Eb|BQJ<8<G4`@R&`{Ffo3=L}Gg<dVZ|LZyG)U+3!g)OkiIJy9YSqd1V|LEiu^*
zHeA$cIpe{7h3|*$?aDxU?xxVbw7R%WW00IZ+Ng$0TFlzJE1ZY??gpT^>All0n!C~C
zn+o9T;Xla&GDh)5bR4H3>dk@x2NMMMWMknR_t;zNeP4aUx)0ruE(L=<>f!r_Exw7T
z09`zct=T3*-oN=neeId_>|f{#n!Z7NdaYH(YsLE7Ht$mQJ&cFjlnF0;60p_FQp@B?
zv&+s)KM9#fI%-(grtyJ`M#=-~m+y9TSEPuTy9ufCNfv{lQF9+GrsqM&kO2w=BMN~?
z&7?Hk%?EJqBsN||+n3US&R8nF@>>hfYov0*4iArO*sZcfhXyEn*}0&RdA*D>RYw){
zj{%kF$P?onjsrQA0AXqr-gDdyg5`(ptSrven;3%}{W|&j=x|CG4ag6;8)&%5J#NgL
zvfjhWP@{AhlHDU{mj*3$l4(I9Cju7>o_qYdTLN%&E${g$?Kth9H#5HtutS5L>`uXw
z&$4+z<6#De^QfJs(-nNW_h0f87tQRwtFj?wJj+6lEYR8jyip&zBa{zCd(<c}X+c_3
z?2*rXd|MFpRNOddFza^})9F8jJc`axn&GAKs$T;JoD3XT9H8r5c0qwWQ3)zL%#f+H
z_{IkuWqop#!BtO;h9NITdXXnnI<p?6F{ahK%a;mSrkg$ZBcxVBEa5wtaTVhUrK*eO
zSdlscVO<d`<Z~Fxay`+mQ-0<o4cztjxr8Q0A0(~L;WOTgpN8!J`O+0?*NKXb*rkf2
z6Y@i^qx(4F1Q`Ucanft@F6y=XI9@sh?*(m41DPzx7an6BjEp|2<*n%cF0#^2q{gqb
zok#?t|FlSvF=Xw7b%49t!tYay*toq-#6tJ@G#p$%<0oUCQ2(3r2e~KAT5cfn7>x)f
z&mwL|U?*WJMf|twFCv=hHZva(UxIVU=#w=N;8{A*iXuSpE<|i5A1cS92@eD~?8j0=
zPerg7df?oTYGFH#;)^E41q|)+IF<s2I%96aZE?{i&jS=4z}=V(!)=gG0h!-4RUW&K
zhVbT2tJc6B2vgg=mvB?PsAvymX_7U?=x0t3>iU9(y@xOOa*AZB_@FIy(@%){AaWKk
zQ;JYJ<147HhKHo4;BfOK9s8$3^GU&RjP;|AdiHDyGbG5?JH)!MR5gINqPsVfFv^~=
zA?mD1sUbK=I*!k5LlG((L?RVj(b~0v(XsAk5GZNp;EP>Bd4b*8JL!Y`p8v@&K`C10
zK`uO1xkh6ebXRmj`9q!D!kpH(yH9jj&_+2y>kLHDFZHMIQL;Oxo%?3dXV1KQ7w0w|
zve%f#O?@|hwNKZ#9Z~<NV0IHZ55JEy?2AbKL`;ruqGAkwDfRA3=L2}|4{fx7ot9Co
z^mvyZ5_PM>qa6{~JzE+F$%2g}wMP2L+`cJugjZB?D_1IuW%N_nc0Zwxrf0q{iHZ}d
zE(Y1K#vlBE^s%&~*Qy^s%V08atLf8!jgptopu0JGRnB_3+&k`Es)t*vFQn-?AgrdG
zqzyF;Klzp>WrwzNdtU0%UzHqmL_s$#)EvGsjo%JH%kzkqx;&uu)>65(XA0lo!fXE-
zc_bn-?NdPQy(xF=|1s~+oz&&epd)y?X=G4yxabtVpDJ1&cC-}L0qtK^m0M$`aM4eA
zeo2u>bRyHT1=N3+<Zhil=EdGgQN39$H0TH|PZVX@k=-VqJHL%qNZFqoRgBOP;I2*4
z;j!JH9WOSg*xsL-09xFYC##5oQ{2A)l$5kh)2P!FrHBSD;2L1DRhVne0v~R<Z9qD*
zo&wzUDLNW&mh=BvE&wguDw0(U|FbkTwNyAooh+(V8x`ys&8@E{KlkprIsP_R6LUqL
zuG`|Vs%}Y^3Yb-qsPE8UFJU&%@ftj{jgLH_2nHLGSZ(mk2uDxkIcQ1V*uN3i8@2pP
z25-bS0}_rd{1^R6tVB89#DsrI;*Gf9$p2q5expxsWb-enky!CkQE)|T{zEPTu6QmR
zze}RNgr>OJ47)QODXR@Q+n6%Al@t6W=6Zj8JW&+?_U0`Lxrv+#30W7uK$7}$a4Uf~
z2^amF2r5eZPyNLy^pCpopZb@Ci|!xO-2X%{C(FO4r2m<ca?$=Hmi#A{Dfwi5;|!bo
zm~~;z75y$zv<<;kg(M58IA$GXe|PvUc-9!ifj01sDAsu(A=u>m1f}#5xwO8abg|0X
z=vP$;ZgQhJP<@YlbhOyT&TJYnT^LRH6gETGCQtH-2{j?j{w5^0EO#82ePwDh)?mWQ
z7ZGbEZZ9bF{!i!YyQj-ncvS^hI06^~7#J877>K$|B3j{RthcMq%aU8b92f@X;YT8{
NkOwKQ?d=Yj{{cRHSfKy_

delta 36536
zcmZs?18^Wg*Df5}wylkA+cq|~vq?4++fFvNZQJ(7*x1Gf|GwY%-m1Uq-m0mds#87B
zJWqGeneINPE8f6Troj-E<-j2@KtMoXK)_u^>k%Vy(Ei<Z5+AYfgknHIc)+1RP(hMF
zyU~G*ZhOxS&K0KjkE+La=vd2{hE3VnGSB9NCWovhKdSPdqcc-KHM0tTq0#<Ak5~#<
zCum)Ky|i@fiYI|h%rmsl$k1t403)fZuLr$29~im*+WA^&3hMPL<g>LQ@GT|WeEppI
zdo>LI_Q%VHd!(A9nc!>f#h#@#R_ZFb``!>>KlAR@bX-1rgI~;4*o2n%v{$f1A8d{N
zI&GiHMXvY*PQH4(x3yE<ZrO?CCnZ#K@U`~0{1Crn&kWIT6#8aN`^EE$AgQNO%5~Ls
zv`2HXYuN5+=7YHO9al3POH`0;n9eKxd?K5{_a*(P5zgAov*v@}Ic!9{vq5qW=h6*e
zZ{WWMas3jZXJtErQinRDRX5*{MPQ)wg+TrY%Lv)IeQ&?qyrVPLvpcRn+<f!A(L^Tx
zwX&uy|K5wA1Udff?C|5tRItG>r!z|D@FX2LOw!gAWvXIuWN)>sQiSg9=xMoOXskfQ
z?m5y<wa&=AwqYB*XEzh9e*LsW2|5OBzwT3i7J0ZIGf`O}HmvwH*!1GKy8aPu`Qlk=
z0<<$Py?V^kwJVNxbk@H%JMU+=r*L#Q45z>5udXlVvn_lwt*0-)-HhLEW+(n}RB9#x
zPhk4|8}um(i5Me|RZg|jMgkvoPHsi+Tj%n!-9ZVrZ=?Q`BkmmG8ege0U`7Wh!z>eC
z6ExKE;;)x{*)ZW)%A6nt057)(+TP0qD$6DYgN@|OcjQlj>43<@gqxM_Wko`>yWI_P
z<hO;uTa?%)dK}3XGle=Ifk~q&)?ch{TeIGXQHC|}gVz%yrBCY_K_vl!-L@X<+RopA
zHriMMCd4J(?ZnLzPR`Y(^LBuRXrqvjU6nb|D7xJqfjZR+ynlBCePKWzo*!o6CxUD_
zL1I`KGg07o-y)MO=H?|PYE}4qDYh&D5=bQ{hkZU)wIA|9r(GHcz>3$xI^%1RRF74W
zZ+t2>C#5fWOPE}WhBC56n|P#_8x=p7OlEGaqDpCdVDG1>MXeW6DmReMGBZ74k|#BK
z9Ba9={kjdGv&mOwBN~%rL{&oji7M!5G+l-I6v>n+JKqP{a(+|h{X$j+eag21z?`{i
zPfr?j60aat!jFEg4iu1=lBxTWRJUt;%0zkr;}hYWIZH=BN!Ejl#3Xvtb(oQbzwnas
z5(3O6%1hbRHO*ScI)JRsBU23ZEZ8Y7K|NHNa9u6?RTa0e<-xyuq^}Z%Xk7(p-_46G
zsCB;jD@5SO(0M;1#Vho8%s$Y3wv=&@5IG6_ntgpoFY><Au&?l7;K_>R-@=56l6%t3
z=^i&3im>6wX|mzJX5wNe^=tB9W22v&z9?z;ohJOy_szALQUP>LMX6Xg!}SV3+Z-OM
zbt}z1Y;RWUI4@$)o1I5bwA~xIu3`}LDeCj=#B%2<79%*GS%|f?)t|*uuHgxZD+d%y
zK+T9&e-3NH82nnGrN`Aa>uJJ+mb0ybXOyT`cnAs;-?IWYtDGx><GNFC%dZ)ru<o=)
z80}VUEQxa~vj;4f${*JUC98isc$^Q`Z2OOv(`{-SglP2C)(pfDme=Xh!<9LiJ=0Y!
zl~Ag;Wt0x2@8*G0KDlV5Q*cOCw`|+D+6tJhRW+Yo`q{5lw%Te|ZUt(UIJD^g!_ogQ
z&h-Dmas3YtRmp((9)?C+O6dS&1u*dD%%&A0vyl2bm^NRq#y!-aafS84dAcszdD`Y_
z%DMD+Gw%qEMu?uRwls~ekwJ)Fr>-<jbAdlxD^b6wXt6>7T+je*g%h7r$cBE1UOSz9
z;+dpl71!IAZlQIPO|^5k5gXp4NwpD|aXp)jhpzXVZd-Q;T;+eDHuzKllV(i}<-MmX
z4efG;K)BX_ypl=>2;DKMWEfr9i8!jftIN6a3#M1fRw_O9ntKdar7kVD>`p(_F|Vp>
z2IzLQwDx9V)wQcJA=TR&eK0j`7SZT7r`7hDjNm>0r;*+Y9W0mFObT_vP754kY(7Y*
zaK&8hbO>G7f^AAG04Gm(OwHGx4meNGq5+#~n!JInt;#ypU%|~zQYs-nKj=2qv`iA0
z2t3X-ZP&_iyEXAkq9kiAP6W#AC-IOF2ZLj*{wZn=z04YTUe;)9t-Q=q{ZE%&quL#-
zuQvt5J>RRh&1$q|R}N5=|F+lbmaH{mdz?ox@MpxasCxzMqV*UHYd!I+9lmLV{Iyj!
z3AwJUbON;gbyOr6-6jA*SG7PT60#9VSGDR|AJfr6SYmx{_Hz^GY-_#E(ZhzZ(PSz5
z%}blDBed9a{b!{$;^KVF+nG(3Y5>@c<WDK@s+DN67s;Q`kyT4&ly>zw$P1`m(32NO
z^sEvO9o>LRDU03mR14(2<WB@7kx87Dj)VEJs@08-<!S%Z75~L@^*n#FYq&BsTS-(2
zKM3h;)j|k~s|q?7CUq&*GCEe74I56W7!UZ=>p>zrF}?$bY9*|@x=>=|4G<;|HikRA
zIo=dF4COxt{q8o?GzDXEAhl{XORSMu@M{Se6><Q4V#`Kgif<!i-G13lZF2_*JyK_(
zxBZfh_Ou1SZ}ZH18rcOkrC1CGiSa`#FI$%_lID(F_%a!<d1`?SyM>%qI02t7Qhq_#
zOzk>${Xkdm8f3OmaD=gZxpvvdyLP9-)5m_zy@>7(FP`sziHLaqmq@3YjXIDwhUhLa
z19>eCw_FS<vr)y>X|H{~#M?a&<4ga+DSY@7{Ikka*P?ULx@FM-t0{aLL+5|FfaLs_
z%guke43N{RV`da_gj$sDT&6c~w^gp{cDERwKTFn;u%34-7S?b*`gQzG$EqiTC{PXn
zi|nGuQ39%QB`{u5cfDj|bR`p91Naj~Q}q6+nKpsODH<cP$7|Ny0Q=lRNhj|3O%NNC
zqe0BU%IRa<cc)ILES%s8c~s6(7)~Yx#;#PZA{Wp0sLvf&q^$8h5z8Y-pwX<!R-sZT
z^zj`gRYaiCU@<Jlg!pVDB<(*<Dz5ZDG61dk|LW*__@^V9>^RVyBBX*Wsi}L!%FZqH
zL)T|BWb3q!D_CR|MAWd9$KhnKW}f5GO~Meoru5$!`=`QK>3>C#_{hdgX#DAf%rWTx
zs14x&;t6%pcA~;ko$41*hAF9{iF9q;+$&elPn#{eL-b253N4y|(Hp(Od27<~a#+3C
zx_@pqI}4}dua;<ldS)KYwq%YMICXapy`lG$<n^zga>UCBASfs}wkx4A7QLLTVT_f0
z1cRBbMKs$Zu|t&$5E8eX_d^@%tA>e9Y(zTt`lkp1@z9mIoOL4pcn0Tjx?2|LzCn_5
z8a}`H&}wDTF@`sQ33Nv}gDwi|-qlsU?o^dU#)cX@cYgyl$Cb=#i{5H3sX>+28k+5u
z|Khj&!`I|OqOjh<^U(c}th69SM?N8b#B;jA<LKT#ZF=McIoV1r@Y?7^s}=pv3&znM
zr3`#z7Ci9NkL(vAGMOB%!#a@65GvM}q#k1p0qB+X;)?EU!U(Nm*vS3Mqlnf@Cc{LG
zw{9cHQ(>KobC480s&r;sgrXCysztpH$ZZjgjg768OAV{Q0xzE*`<LZWX%vL9orIMJ
z*UN7)L^JSaPKq&--qiv&OHvAptaz!#G~3(%W&iY#y%zR2ne~7x!VJX5m6KQiM3Z1O
z-~?1|RJT^earJMu31Pg1#O;%3N%yOQ@|Nb3>oevf7(RUBie3Nn-)xWRx)FuE^tgW7
zWiI)2Jjp_=7lUdOpR$g|vTNxfI(ubI=g*buvF(_m%T<$&ZMHX#JU5Wbn#yO}P*}Hx
z9Kj2n4~x>@>>U+k+sju9#fTLE+00f?2n9VPYEqLzquGkoqb4HOLHK&CF|rWY7hToN
zZI@Hw@2m9xJb<M5?}2~y2SOf*AyF3<vIK1&BrUMx)JO*l%gK*x^lYO;#dfz5_3Hez
zFmGo(oZ<e%=ZZ5HT}_=6kDZamwG)~~Si#Y~p9KsEFj}@+S-%91+6=h<dW&sMHdbb5
z$>OU^WOb&%)1t$XQCWA!P{s2Z`;-sX5L%dRf$>?m8P^vcWY`;Ubx!=F<M3ZPGa<%3
zf%$pVF25|mH4~^_auGHW`(FkYZ<@Uu)vh1$`ve^6l{`Dw=gXT!G=|#scq0|)BGZcq
zxiYhvt^kflPP-^wa$~wj?-iWX^lA%uVae`o$BIZVtxnz)&ay~uPdzCWHVHA2g_W4?
zw&GP2r5*f%67*2@f4|fiU39Bs1OIkol!^|@7H~mX@u~$V4b)?YOPZX*vSAAQO2?*=
z>=qULpm5{<MQ}b&s5{s0Wt?AiW$eGmm%Hyhi~*L2aE<l6NSi-bSJH42sEbXSv;NCi
z4?dNP72qeT(7t_vyqv~U8IPYZ%(%;2gp5wuE!z42(+yky{P(|BLhRmJL9EokA3Q@V
ziA(^!O5$YLo$mO3dU{j`S_3VCdTrxbx&T!k4xYskd&LxR>77(uZ$Kn3h?~rsposuT
z;v(x$1**X1rv?ch%;m&2O^@d-T(gqTK@B_`P90rgZv;Db8}Gw~gOR-nHHL6c#PEXr
zpa=!*Ia_<yR=VSpL)ud%Q5CeuXhwy@PyKFGD(FSlo~<MoGj(E54Y>2g$L`}+w5(7y
z`J$Kg640p|ijz@Gv6WvCmXGPIq6Go`)}kzS2^6wk08S688yxfAo~5RR!LXH`rfKA$
zz~;FHz&5nG3Gpb#iU?DX&BkjP<fDD-XWV>2@ePMnm}`s6a1Msl$P<myAG?uyFsD%d
zagqJ~`z?T~QWV|voo3H!*kv?~eYYvz^EW6O#?5b!aLk9R=yr2iGzzE=LvVoF*FZZj
zw1W(hBDW-O)w3lpZtBD<Ge1K)TA*GY@iP1<HUu7$+2w1fd-;Z5V|pL;BZ3v3@b&Cl
zbc6+;nWtbeHp2^3Q72m#s#W{tZ!sURLR8hh`w+`%4zoWSMs@^BnS1H$QxZQmlwl%H
zW34|r+s$9Lotg1od&_FR$IbxCFfGtFpMB&j)Nc%35F+bF%3$hv6_#HX8J6lR(7ihZ
zb)dekH(Q8?e@skRzWKwuxhi+_)R|=Y+?<h9h!chwxqD4PVZKAoIxi(`0-vsb-uy|H
zzNTZ;DwlVAZ-A~xk>vWzcs)@0!A|^+k<FpML{v{0J#r2x)+>9<L7u=raA;qw4auJ1
z?&4*3LgFxv^HEzW&P&IyOnsMtY_ZBfs!-GKmrV+ZCj3w($@5SPMzxSNO@{E?{)Nu9
zP!3HVm5Apd^@{MyZ?eknC?M1}kog-jkr6CSRQxhdY@t{RL%QpsMj<RBE(Sq3D*Zf^
zj9s9RA@bL<A~BzE69B9Selb#1JkJUKrS*09V{Hf`Ij-#eF+6<E-d|`{FXJf(hoiZu
zFN<e)WA~;c^vk28BN7C)>(IsA?5s~_#&3{rL|WB&ky*`G6L-$9;n}x7FI%==_aiy}
z>Zh)Uaq}&CcQ_^1i*CN3JtPC<TS(pE*x!Ah3CotKr7yPHp8?B<BLpvj5nH@Egq<AS
zp&CDPJPW3i(H#?70qvdxA$eNEP7w;6)LBR$!dUA13<~!(!Ot@fhp8*W;16Mr-1CZU
zA}&1(<g9N0LD0W=PVkEjAQDhYimgItpt<g_2Hl}YJzQBEZGro)jK2NJ4Jic@<A%jt
ztGm7ue+Hoq#esAMs)?6-zX{jwv^y{YU0NR9>SV5J3-UvSwc&_`j+iDq_VtgZJKjf4
zU8Zi(U2EM4MuFzBUE4<?<)oPLp>Cl0#@CY$0m@y1%9~z>+*fjGXd7j!um;)ok_xKT
zp8c%32Uf3!s?AjQ(xe;QR96&TsBh^oVq!&FrG*xO7x)`_l4dn(Y)F1ckjN?@rO09>
zKNb{TeQ>^Qd<h~Kwg`!XoV7GlRep|W*nNmKr6*rn_w+WsVAx)FyR2x;0xCo=wSFTq
zsGIvMsL!gybq#+HJ`;=4i$l5ycbmomd;G?q^+#sK6BaZne?Sc572Y6r7&GxetbcMe
zU}A0}1(d1i^x1hApt7Z!T15z3t=nQB>S=Li<e5xaC0>*!$yh!1kml-5WUiRWY)@@j
z=TV~FQ>-s}w<t{iVuNUo<4TIAodwe8SS_Ev?_+YD{>Y7Ea345?W%62|$BfI-j*b{S
ztG@J&MJTP?Hukk{&WFl1gU=nQV_|*FhXlv20~kTtB>Rp*B=6e{9l_N%&XG5i5#Q@5
zJvcC6-_S9<?WY_Wh1P?2Dd$b^uE6M`quh0Shn2^$eqyQ<-b-2b&X-xccl15sbDe=;
z2Y|=S_*rys*dz6mZdz8Bx~t<X{i=1LbPsJ!NW0YqA|Du01>J19)+?v8-0g~##5#u^
zfSP<yt^91XDGV-}2ggl>-Q8PXGhVTzkWP#S+Pa(DzS_{!xdCCc%^Ur|UYqZ;(Xb98
zeMi9&HD&03(9rITLRu|vNH<9FloHbib{eI5L?`4tucQ|DlLBaq1Swm0M94P7+ZBt7
z<UCE|#tdP%X9I=Etn*3<kgw6eOLMMc0sW>*zjqye=qJWl>&(=zl$A*2>m5n_TN5J2
z+is4Ao2!9bqCOcYndAMPgq8gmFMdozs#JMrs4F(+d96QDf3$3@vNkHAk=-Q8NL=7f
z7*J3JFeozWMD6=!qRu$wz2$Z0d!S2|f<tmI*)GGz!)N%;jtC}wKQMjv*MELs0+J4P
zdJUX%0AK6$TFGEH5Vc5(r>(ssoXN7|9sjsU?B;vdetR9@=x>2s1x=^Fx!}(RzrEo*
zY3Eb>1?d2t<q{%8Z6ifS71Ts1FKNk0bubKn34SY)WP-GHH5LO?26pS0xjvifgS6o}
zm##NSxU1;r->Qmq@f$=Feh%Fb2+{K=M~nm%8g-y91Vw6=cEEIk^cd=4Or&V*+1h?q
zzbn$cjG~qmdAv-U{LvX2fP4yL3K7<3RyGI)uUik2OXwOnOo&sImqDBJ*a?KFor@!<
z2g?~eZ=Hh!Ok|_d>pat^+#MDdZ_}jeDJd`U7beh?YUp(eV}}H93Cy5?LC9%JhniXg
zVqfL=0*#g(ED8uog;5T3Z7&X*Kwj%IUE$;SZBsnaYWTCUUerGSR!j?7RW~T3>b2@7
zm=$@`o0;rffQ*%W3-W@PK9F*$Cq_?cPPn>Y6`%1EU*W~MDBmKGFi>Pa$X)CgTuy@C
z-xU%7f*8psa4b1lRuCEZMknHqhMDpN&9Q}<nB@jDjdqTKNEdjfj4I@Xahgl6Lp<-8
z6$F~jmpXe@yD6eIOd)BZ&CBPrw<0ZLXu84>LD^GC$6$4UP4G9Miew%#_qxU_<z`)#
zxhe+{oyP9B?+w$U4k}a~6eLva<cTk?x=1>$9^cmN8qpNnlOqLyo1L6TYbS@;D`6?j
z>dFQZAP8#xtz?F8ka#O$GXYA~lgU0bc5!(K?{CKM`ujv3{Qe-PTp6k**riy`b?p~s
ztwdTJEf^uxh%h;DsxuNoZ-{6eyUO#}xr>F62+&UNFeXLj+ITbqP^0|Sy;?1FeAGIU
z`P0kG%??D$AI%`ZDxCErW7$0)eAQo?W{^ypYM6)CUNCs(xJT&gdp_+lv7j|ou!UmG
zKW$WQBotm|dgyG;oK;<NA_K}fkSL|&MbQ;__uG)aGV_0)Gn9y3_}eo?4j|^c$t;Cm
z#^CGNlEu2kPtFFV%rkysA~3__1u0IjQ+x;i+oU1S%xLl#NHX6<P36%la3)w+q-;N2
zdf-bxA@ivi;-nCu_MSCuH%H=-IXYotQuWEyYubw$YdH#nmTo=@{5}R1F>?hSH#vnI
z^9lo^J2$r#H|IS7E(%4^74f$@=W%Uoj)<NY?Yr1s#C7(N!!F_rx`A3`o>|ExQRS2_
zmNcm~)EUb)0JUQy&`>|C1(zX5vNHC(!Z@ypxZOi$%gKTm1Zq8d^N9X8=#SaY{vxz@
zN<IAqvimgk6HkSs1C5ApZHeCwAj5JMbZlg>6isrbDAU{$sC0~9qj*46IYn83IdgQ8
z<4==cf(8VwX1i%tf|YTb!7PR#W2f7hT5V=e;YkoM0A55d%1HDs_D2|pFQnPkO12OJ
zL;<`nuH?-gX(mtPR}vvEEfg-<loVETu9?r(YZv>xm2iEFk;*F_iPiF8VcetAP@kcR
zpsLx;J^B&EYcQwjj}!*EB2E6V>lxz|OyR&E@UgbieiQ3R?yK6)S%bIX^0QMdL*`)x
zp`N)tKqzv*w_mFD%daoqzs>2qmKACRf68QGc~f{D^Ep3)mqV1`(}$Vd%flO*p0#x%
zGsIM<8kxhU)giZ~T-ScE;xTz+84ie2N_~7`Xnpynh)}`*@c)F^bFC8rLBRaLxiHwQ
z?r(XxYu$<Dm~E*<yHngA5zeY1jtEEr%LzbF1soF(uGXE%P(PZheLXKR2q<D5QNHqu
z^jBOblL>SrCMT%6d*sL2WS8TyB6-{7GsN~uU%|VGB}RHbzmN0=bBb8f6}R_6&mx}K
zOQ=rFC(<AKFE~RfUhkRCJhv$MDO$M@uRG}f*fd!ku<3*Mhz+~)`7J`U_O!zo`e#$I
z56Jg*<_*#Se@t3>`JIX<G`QF8UvB(jY6CLCX&Lr2FzDMKZDe00@67}vTjN20$eEN}
zU*poI?_uWB)FGA~3rI>g%ZNO8fzSd3wu$_!s6SDJj`Ce@q+Y`foGc{w{wRRYu8zm9
zQO2QFA37b8UhDA3a|bw>M=6Z+P`U`iMgr!R=xIDS=mLZf2iILEy*kL$3xjq$2QskO
znsZpO@kx5K+)q85ezmZa+5GKdk~>MW1@2(<ah5oY%qOXyqT@!R5B@i!O6<66!qA^?
z$2`^<16c>+SIz-43-v5sqJc0#EvlF=8r+d3&bG2;0W*Qis#mVnnn-XR0`6~}9^e`4
z4YyZ2Efk=>7Bj`F3v}ZTCjNV%tq${B8ET7)`d}e;rZ_tTJ`SDg9tmT13l{pg&E*ic
zSri&e$HQj&54dC*n2;6&y%;lG!<F24qJ=g2vD)B4xsKHSTs-4DpJ&cGf?;powHh7d
zVuZjyr@+ssjEk&ETgNR^jfkLH1)PEYi}gVJO{ZFOa~rn1(xefMOqB~o2h(#t>(8&h
z<J5>64=9YsiJRS)T@JAx%{WsW!%vno^1pmz7%<#S{H#GmH(N$n*!hNXEUu^A*~|8x
zdAa<(T;1FnPLo<A&rL_-?Q8d8wJ~|5UpdTrf-~{h?p4V8bbQY@ax^AE9e5w+Z8Rx_
zG4hKC*jPhn#9isEg%ScTZmA=x?yxZSb4C4BMvS+|KyQ1^qn&f84z=A_9r~zsu6AiE
z80i0v%rslVA^xhUny~`qGRM2VSGbmp;}5-1Yr{{Fs{nSd;Htm~K8StF-}HYNnTv1q
z<#*b=1?J~aVp!RS-bBTi0Z%ZY(+`3HQSnDhr2$b2{AO$u(yJss&M@Vs7YD>XPNd{r
z!)fwJ_?&9!6D-8BMQveBv{>5Fw7;$=sR;C9*#<Wqa1xzrPG{O6@#0*TddTl{UYY^K
zXXh~Q{$dk8klW0w0nwYFLo+Q4=+)+S;jEnExcCLph$<tYG-hJ)z&{6$7$B|p|Fb36
zlTNIm{9je=SU4g0<3_mh+b4EW%$>qnxy5k_3J{P~pu%W^#FG0-|JPg%5k?~>o=i$M
zfr4rt9?mK*j!Ra6fT|K2{{J)s|Hr-t8~?BFEedK3Vpw=Mk&PM>@@*RuzCb$&%6@+S
z!yNK_kBJF!*KoX_sTwNDpV5QJY*q(5QZVr|t_c{F0``A}IRwn_URJOnwiuB4HFb#a
z5pQx~cFk~*gfTs1*&msxBrk`@UJ0ZIzfQuWM)w!J>|hMyfw_gS9UX4`>w$=zGocr0
ztLU{X=05$9Fc5zuWQ}5I+ds+Sc2XLb%;XgKtFXLRby?Hmq1<7Z6jfu);(Mn!bg%I2
z^W^<*yL<jSNY?Uo$X&bMK1zeV&vYK*J#crz^l_9W;-Z#{)N=>>#wv)cq>g`ueF@S}
zyzbS)0CGMjzyxIiL2R%edP)JJnWm$kqEig7VUY^lEE@D((rs1(XZACD&-Mz2qP87=
zCrG``h=LTgs{T^DgbD(4`O1l%(Dt~;!&1QlLO-)37IA}XlXKt0iJ!&6@st>OeL%;!
zNrj02Ccw|$hQIDx=G;#Fl5_UD(_a6oF`J~IN=TvtfL4NTC})aj>Lq21v<zLq)y=B;
z*R-?ED2S6#?wPcn=N^GVXdvA(pN2{MFC=^!>OCprtc&vRy2){g{RRs0o0s~CL)#q3
zsh<dcWgQ2=>_>#?!g{}u#B<u?*!%A*ql7-W`QJWA`VoxBipP!kELiL3WWeu=K_^h}
zo_eVBfrVRC54!@kW?3b^pPtDKkb<+5bJnCcd&y+H>y%ii5jT_9F^Fr5+NZgU&}>1P
zh@{o#JSoZyqoZBp%Id;hqeyKyxd9VdR{C(@IJ~=U{c(f*Xtd8X?}q93wbuKfm#}Kx
z{0S{aT~#!9<#arrI1yR|`UdQkk`BLOKO?ZE0j=NF^BNu&hXj#)Nd~F<nCcIk7!a<0
zuaUuLKNU(lcSmeru-rfz@=UMMn-yTq<eHwQHv@BL!pp7?n?L2e7vyem+lL+u47qgg
zf^#5~Xw|{hKEOr{a;#Xu@6Ym=1<dl1SbLd@fNUY0kM^HFw$tB&wf%&WDoc-6Jwx@;
z0ES79m*y@$&%oi;VoXq~Z7{~W{!{G19Ak~5!+iNm9z;L%x9){~$P#h*A?w^D1|r5A
z5~rzRXxd=)jCn{^GI-fQ7}-I@P&wYcAVEcx!X;V4tU(O$r(DQ)b;c#Utpxg@#mVlK
z^DRSJ?onF<M^24iiPfy@=-&v1zp*b>fb?W)3&W#mFlkbDasJ$G3MvwTV2a<<^~<2R
zI7P`#OA9!OF6}T4BGu@0RE!2#`L30!QR_=!V0^{Td-l>6$7wFkGRbVH$CctgXeQ7v
z9-MA-kskkCXBv;zDZ)s@Ne{IYdy`%Wm%~D`glKT74}8)rph|#*6>~LJt)YdZ0L3a`
zsGSgGcT-I-mbivG^X)xd36XqTYW7PVT`=u_UXLxo&Z+nB_myewP?KHXKHnu{g?d%q
z?pH5od&v@fYfoZ#e71Yu+uoeVE_hz<@XIv?w%;vxCoTUlI>juS<Rc;?XFn<KYEwA;
zh^R#KeUF7gB>4F>c9~7?6tpF}0^G~R7+lX>z4dF%1Yb42TKa22UR09BdeEfUCpK&S
z5o@}D&$kn7(DG;vs?E%dxfLV9KHEhqaw{+?!)hPo#iO9QnGwq=zf>={I->I)e$_j$
z-DmWi*vBp%v9#UQ@e2{62>T)SRXdd}e;yTUq)LB7V3t#-7|I0(0fP4q2k^O!`*k^s
z(!#PhGCBLU!7JH;$7bYxf-Ig$EimLOOG7<b+T00i=)5UY(c+>N?DJ5v{*h2tCwX6z
zxw~ITAS+3JnHwy~w}mc=A&_;-(kn<tOQg_>%S1N5zEC+N@19A0%2Vj)s>^BXEJct@
z#rMJJ*|UBi-!DCI0cgvl0dXEyH{oc#<mzNx#L7@&q)^H9Xn}AyYp_w6D@e{G*8`JX
z&<<==3&Ku}YY?PK4SF$Eo%|{^c3P37{}!ZQvU3zK&%TaI26*fdj!GuBE%tLo^<-9L
z)&moHGWFT#7Q*Nfv!L`X5DMbf$$2ucnHRq!f)8VsD)PpGM527kyrd?q5NM1@F=~lP
z{h*)Q*e699;MweQC*K+8#vwb{7+r9E5xW?dzHu|hk8wFWnkb{io!yV9?01Z@M$)yl
za?7$U&yD`-)#9G`0h8l@pKSQ`k{N>(6OF`ArZmI6iR)hqB4=<AR1Bx%k0%$)T!#)9
zKME?vhlBtQ<lzpE*6$x|C9GhBdx218Tslqp|8;+1W;5<_-TURrZ)}o(Yyd0y`g*2*
z(527F+7Q&?8d>8pV$+F465<z0oVV}^Z=}Ky((~g3vM6Fqn4J_kSZQnVfsn{Ns|~7c
z`>Sw^;KpW$z-oTz#98u)9Ogwx_YkTr1*CJ6K%I0J_#OTsqW^~1(ef<|7KSjlz!&!`
z^izN}FgEJRw#vmfw&<~=;T`W44x2ijZ{+E6TI52~U(O6kSkI}L8dU0L9%NdT($^1T
z5}Wqd?aG&fJXY#SODy(h{p)Eu1#jevKq0f;B>u%--4UAdd63Y=NV7H=Y!l`fBT;^;
zAJP{nppIEo0YxYWh&k;o4@vsC>MU>TZJX|!NpC<7z=;f2o+?C7rl3XP;y}Q__6LG2
ziBv+lCY2I?!VpCZ4=qLY+k#!=Afc=Xek$o6A-+%2q;?6um6?q{?9C^1?GrNr-MW3;
zuN`)m<6KC{YLQ=$Z&Smxywz^a9!tNuXpYi>ABw{4nEWQj46Lq_8vN5X4EF4tyjLbt
zW{Zzc=FE(QX(M^zEa3#^vW@Ts^;1bdti_1x5q}&ihP4c)!3=?;Fu10-_gPxj`2{aH
zbxSC~O=4$aIP(lt_BuIvNmVPku(BVuf@gsa%hXr=bfuWrR#CG4_=aoxIU-p=9WP`F
zz<-TItT6e}D?f<siR*3c+Tnt1VhqM9@h*E2R}v#F%_h%4l~AB7LG?7s`>-(1LZw=Q
z!)GD#7j~Ad8X+`r7##2Qd6eFMM+Q+XRM~~u_%$4S<FhbZr?Kk6knrAKa}a)BscDP|
zzr;9ok1#8Dhg;51s}uMsV?_6Y+KTuFaA`q&P%3ESK72c}*g`m|Jvp)%PR;A3i9vh#
zCi2w{{h<-Fw2=2z@iL572k8C^B+DE&`6@84=@-3*zu1`w_|T)g==ED8t~JOiw1j&O
z@*;wfBo<CuO=Y3<<M82yEQNmn%d^@w1{dlqjk%0??9u^s)-cDFK-|*P6sC6vsKU8`
zFGa0T?QTMHSde79+x(`!e2DU(`R{YL5HD<>4>u4*0_}%;5$4j;p%{fo#*z)5{Ulz<
z{#B+~;#~!Xm0e5cQWV6hXeVsa0<9%i*wRy?Pd=VrFiw&Ll@#jaFR^hPsvop;;3!yi
zEz#NjQavNP=T8<-;aQ{y`8Zkt1>xK!Hve$ykEZ-00W0)P9#&GaJKc;(e?j0Ki?4EA
ztii->fcJ68F}fTjns1@g`40;ec~4`Bm@QI#vN=_r*j{$H5$p}A!XBx#3qnpYjw$UC
zvU1w5AfevR>vN$nV)P))JI7%#Y&hm1Whx20Pv_%1eFCpOkNd&cmk<Ex$P43+RI-Df
zfav1rn=)@OQ0!@E^-~&^VE>3rWTLw)8k%L8Yoq*5bd)6b0TbsIHGw&ga69>JFvmzN
ztQ-2T5EpEdpGzP!Pwayn&FrWgccA3BcT7RsJ6;U(J?x$u?8o#JWgUPj1kRVZ`26xy
z{yBg_J-H(XPE9_QG>QTEQALxKh2`v;nQG3VG6Fh#6O}kwTn=)gE1aCAo$Uqs&AfzX
zO4dzF(;-upT3%aY=?0+?lUQ+&W*yheJgQNOihTd%B>i{SC{H`XZ>k&tD}|94&6B}`
zkG4G>n{pz?^~#O(p_Ro>XP*T9%qm_&EcFCTi&6I}TaEFdx~x0^{g9x#^Lm9V`*3D2
zGP})Gib<fj5$UI{L2J(yeG8t+dB}^j(PSh=@r5saWBubex#=LReW7|=F}_AHSsJ^C
zilJw;9!~k<bbp-iUGe+CcTlok-FysV(UCI>PM$_pmEYmbi5LkgjMhBmkER1!<vMdp
zi5(JA<Fy7|4EcTlJ`QC=tbz}d6TVspQ>U1!INEqRSvBHjRlEmupm475`S#>u@-tod
z*Mtvdi&L#==i-lsC7J$Ye$LOL%{KumI`dFMCY=-;G7ReC(Gq`Jwo|i(zABz>^?p&-
z?~}izDuTz|f0L^ZCS#hGhuf$!;2xQ4x4Ri4IjOcxGdorTW6WvnCg!0(SSDsHaE>CA
zX*KP}nX!viSf}JdU$@z&{(XK>I7gN7%c;BBrOoU#1sYkNhD}o(YnMOwvRhrfjxQ5E
zdw8~at^&stvu;Ud2*D5q9ld|(lj}&TpgyM>ZYyR(?N9GmdcS&^g6tqzZ(oHQK7wY4
z$Y0WoZ{`^S;PMgCE^Em{Jjc<DS3^4cO#WkDKCct?heHSC$-aTP-wScIkJd5w3d!rZ
zBw1=gP894Qd=ay#t9Yq(4^5v4AxYx=q=H#wmKY{jQWLqDEcWR~YRTS1Wrcs4Vo%8T
zE>+dCVL;1C61!?Y-D#n+o6CS@YNE8kCCbPtwYwSu(I~F3wm1Y-;?nJte@0%xZ=Tb+
zgB%p$*wZ))XQI^N?K~c+W@a=oeA%JWbmyhw@>?|zkEIJODES0&#3KSUBAgW|r)kCS
z#cl8$t)PChp-Iq|m2+<{+Tt<OQMzkTGr7QHRXg$qs2G}+<uMmf99-0oYt^^J$&ZNI
zm$S|Rx+<b-UF511Rg&_WD5SOWc^MHCFlY*xMjdSpYu`juyc!(|V2Km8f|P%Mvep}`
zV5=0MUw(7dUni96+!&{v!!mtD5QWr^JV&4T&T5MD%^-zjWU&-&*c7q?bp)*#4Q$Db
zB1XVsKwBoQ;eV#wNF+lWdcLz(Rdup8a@oKc1rf<@#!r?DSf=*kLsHObDCD(_y|nzJ
z$ly$H!5m8;=1|EM-EmcK*KcF0n;3$e9l}ppx9QyAa7ijM1j^{<G6lLa=yGVw9k{}A
z({!m673uPaiS&bR4#K*}X?I>Fi4w~1DhvugxGeWNc@9p{Nxp4RsWfX*sK{j2u|@zD
zILytsXengOW08z9>ILkwXc{sF>po~H6$$Io=`$L6yOdVy*7k^zR@kK~n2fH7sXj(l
z>e&Q%8l^=l)wz<7NbhanPRoIv9)FN~)<$+8SEB-ixCoHLqdtw12yeUE)t#Ha<4V|X
z>M?0hyL0~Y_O;(`*t3{JA41srUvPnbn0cpQV~lCk_G!e2q`K0PtM~2nUwAs~-lP5{
zWJ2)#)#z-8hD!3>ZoMNDplNW@Thxxt|FT_e7Kexa#a^ai0&FGlurfi@t;%ud`VfSJ
zzBQfaC6x2U6%5gHiB^!^&J}^OEtY9gN6^0|s*`w#?bNRPWV8b1^xs|yTfG5>iNdOg
zg_)?3*MEZ}Ap2l+BFq#i4gcaoeMb@n4?$I=;CfMrnO!lqB7wDh;3?Xn=y99U<{HO-
z@K7Wwr5j)z&}8;<|L&!!Og;`73>zR`c%-4$AZw26NLB8mJTTo4ecX7k4NV$@wpp?I
zM@n8<l_%;WYf7SL(&vL3C+7&D_k41?T=+cF{Xp7;V2;~0!vkM^B1qFO{;QmjjB6N*
z7nzabc4^wylgyAnkYyyiZG67_O2FI~z>=Zv$KTcd`XYANc|CG--C0OXC#3)R_@20>
z{ng;&YUbzT>YDZL{BRxj^?Y=+Sn3$J+bg6lxYF}CSm#^5rD5W;l#oBr7%F#rFfF1?
zg9$^`#Ut#Wt%ZF1B;CD}m(L^P!7MmiR2V{5VbgCZQ6xx*8hLLP!ny#X^-EJ`nrsTI
z=I=hEdqT^f1>_mCrXcBeYL1lvWr!uLHn!wBGZww5cS(n{R1y(EuwSLVm`8@`LnL<C
z+h4wCBJ?*k4xc!5g5U!{(=W8K2UKmv$89>qb1KAhJJ>-w<uXOb{CG;(E|JedYUA3d
zt!8}oOP2H>q($3vA@<Bn9{D3&NanWd+g`UDj>y!Xz9!=<J<ERx0{D4<)bZ!<SoL)&
zr<w?j;3ogbR_JUr4m;d@jC6N8-W48@m88qxQ#}8>HFrBPX(T5J7@A0K(|3GHj{0N#
z2o3qYmeW^|L!m=&sgx!eNOFA^^OkgYpYlAC`aI&GKOT5m4MH1vEPW`R5}jP;nbzjP
z*4-J9hMSeSds`))-5Ms<hctd;Nvx@JHCT*G>r5>8QrkK$eOfgpo$$}gOUkl5e_G(s
zM&7{Dw|p-OU!cJSXer6fuW@NBByGT>lMBk$&<K*7Rv;zZB3+duQ`@2Ry1x-5J0L+9
z>$xa%_KRf9b&^9LBa!TaW4zxVWeqLIn`1OPI`U9&srwK+ei}L}GL6hhyR24};@<qt
zg1D}?e)r7_kk9Wczts6tzZbM~#^yaE<q8k&9|InytOCOdm?xr(MEi=G{jKY4Z$edv
z1N>Tu@@OrD75Yy^a27{hIf9Z|>PuT{amDaGw2)swUKnDPQIiZv<YdES1ql2=iQCL2
z76@#GbkLu3Hf1V*K%In2=>I`xz<-;t4q<UZ<!`DNy{=}-`!zH6rg(60_xbsW^Pc99
z7@yA#><M@Qp|Cm5=|m;mpIz8nv&fAdw_ry$FRsi%1y_Cf%pf|XW7mi!$l(67a{|be
zL7^EzK4pVZ8WC($9@ax1)p0cUTq{EU;xOTh*&G=G`@SXqNdbkipLm9Sa$iK?ZL+|x
zJG=#<c75%Z43^^Fj2b967<-5aA*mdHJidqi><=Yii8tx<apWcjcEEt%DE1eoChbr+
ztZ|YHI#FPi_$P)j<wNX*&m?%o5++ZhVv+$k9Ju3Fd#bNzv%h^OWvFt#5t=fcH#BCP
zt}~L&;rs%c_2*Z}y^c>z;WtW9#$Xjy?vmN~Dq&Szb(}zmyX5ao@1acr+H+bLc!Kdo
z5gf^YzzWhA_d8W(RqpP=Z6MmLi=0VrPx@q}96*~q$pn$a0V)nV_##qyQ;)Vu1x2Qm
znvua@$aLom8><A9BMAd7@<OqGJId{4I!C4ySa`-4t5ovm3uhepD;tS_C;e|9)!WPM
zqKU=tT<zad;|t~(a4Y&&@d89z5G~17Y#_=&ia^cCJ=G9AF8XW*?iMP1WeE7^RN!h7
z#3K2?49s;2M6Z#kEDIVz3D29h7ztl%6aGu7GKmZpJzLB%YC-Qs4sSg46AM{6@jI%j
z<$gFb#gEH$QLqDB2GI6%MHsA+-R<-zP4d+G33m{Xz4o8BeDS~AyBm(`wiTJ7Lu#}E
z#B?L5s5oC16|L7+N`(QPP|cvAzxZ9VT11yjaVO2EuMW5k5o6&gN{NBR2D8v)Y!~Zt
zTA4X%Z=yvsr&UxZv>!{(k=-#U+KG#r4FnmNF&K#~uq7+976obP?ZblV8G+4=Gh2=C
z?LMg-p0k?2IxT;@KHCu=J2dO?+4g7xIpxn*v3?k8&RJNko9+##Y2y=X&IKntJWNLM
zT_rzOM?!-;PCN&;t7;bPO)L-R&fsp29@r??^<^6pIiwDiN9y&&2>5uyE)n#7W1+#f
zZ&nntDxZB$huR%#DQ2oUCKkyN-Lxc|^%NcIWh#qiF$XJ5k}T7Aady7F=@Y~P5Ht=O
z5A9cx4?HsHnkBQCVsu<$xoYB(I`x!46_X`pa_LW9eUx(5I8^cTXU)wH<mL_+bkQ;9
z85Ps$b&v4u?tA7Ay?NZ)4Q0|cKn!9b{r9w-`T}n<j6AWm#8Oq3db*1zA5|}Xx?X4R
zI`{^H2Tu@1)+mU>5POGb=Hw560JUAG1IY}VIWPnb3Pnqh@7y;m{=Z1{=9=rQL2E<J
z6f|Rchis*wI1a88@V^IeLN8nH<!D-@2DJW#+q|Zs@h84GHLc)*??NMq#|+ITbMGV3
zB++2}o@y;Aye>*Ch{2qv12qH*VfcRZ{0nM2N*^r^F4qh%R5^@ROr7)wxU($eR)s08
zs1LN3YM`OcIXs3qL}AijJb&aBVWx>kv5#QM#YYZ`_|MrJ%v&|7^-1x#n<~9fK+_By
ztJmVz`O(#@b4k$cJ6z;wH8!l|AR``Oq3n$zR$m(Ut+Q|3%8L&rgi_=lBq71&Bud|8
zgme8*hO26yZ%U2n{STMGUX@>qaXt)dp=t1`(XkTIg$E69i~fGkS4Q2;Bz*CH!9-S%
z>P_rF1?Ld^Gyjrr?pEPyo4pry-!2S#gI5O>8TL3}AFvJCn=^#rr<Bv4feQqtNXJnV
z`VRZHvQ{#EihsLMPAc`;Zx*{`5=yZ2Ex}P_7Er%OU_AwYL<#~iMem=|dOq#0Mm1;L
z&}?k5$tJ{{__S(_&xj$h;aXP&6UDZ@S#Lr3ft`#sR`z~bP*9-!p0uyjl=@9yP6_{J
zX%PDAo6s!~fypa<dEti65am`Gw#=)414$lTQHuN`NUDiN3IGJ=u5o;CB~YSdzZDc!
zedK?ugO4XH(KDcQ{oU*S`7JdLgtS85fFH)wk~{NUTZ(<ApR_j*{D7^`_SK#EhTfE(
z$lKyyRCR<5Q*eb0+aKX{nV2D53~^Xsl)JDbz4Rr7<aQ0gwv!+j03j?S5^yhN85E&+
z54jY8Kks46iVTf}NeS>y8((C3t`GFok>YZ?ffD0y^8y~qZ5>c!BSU%o%5hsAB+8KZ
zY-?POlEkyWcI(=(y!xh@zuIqTY`8+NJg-sbC|2hX5HIYMv2N}djn(8utwoOy>Lm=5
zFB(9)=t0bOdJB0a$$5tqQ|_X`gQe;<X`nBWX7{!Tn1>^bX8XU8sEaDgh2Zxqp^dgL
zLLfJ~8vy@oD)O-zY_9-x`eZ?E?xJ@u$O^ne8y|m(IMA?LC8T3!{6KSpx%R^w8Ym1{
zF*G0D=xZe1@6+@NYMz;1lyDzQeMEXj_Os84gwQ|17}aGoHQt5wF&BDBWJ=#6FfQSG
zsd6T|cy37MJzqM!WK2R%f=<Rz>1eOXRd#+CBLhqKR7$bAABH%TO81!%GSgbUQO1{T
z-)Q_VqkXdwj99jVWRL??cbVHhgvCR6O4h7ab*jnpSYrB>j1qr`rA;ZO?K5$+bGgL8
zDiKJ!GwST6WzNLwtt*?fz?Eo3fHi3D;Xzw)c<Sdr@_6sF2br>Ydc+r$asX0;X!f3g
zia@7CbymP6Zd+D>r#rYl4|p2eP0r2WQkvZPe*8H0kqJc0kSIe@W&&h>+rtLu-zq)H
zKz~Is=oEE*bBb_ESgXSinSWP-V6q8GvX{*=q0z!Hbv5g!815G-Y%Caao4u$JAR(Gt
z1WS+p7P(jQi}ZnZf2C?IagJKHkm4Z)xFvqdnJcv^;*>eji{z?<X#G}QErR;7zuEJj
zO(vIX_*SLb<M_W1-s4w#LY;AjY=Y_SyOBOOF|-5Pv)S8e$`Yw;1pz*CH{{i6N?@>{
z7xcrkL_utLT?4-S5ZFZh?B4^f$PJJ(4AzIbA%XKpN_j;y_*s7SamUiJl}<5WIJi~$
zgmSx3O~UQjj&<?GSS)jg*0`Mti5NWHR_y>Z!|RVBIU~1$jNt1qGb5=#WWkV;K7O6C
zDyFVs%)lU3ObT8*?l^p{B<og!Cjn32t!d~VqU)JVc|&=V%uMZX3{Wb){u8+IJ5{fq
zUg6l@OXlugEdSZ3s<aS3A7cbWyt0>&*S4tnJ?&fQ(&9gyW!6g#?zgp}P2%&u#)hT}
zFG;~n>M5`rTX$1t3*W3|HbtVDv$2AOL6&#Wf2+PAI)T_}gT*4VL5WN{B7qs8U-6Kr
zTo;!YW>#b!GM2TMCgUX=&=R6%Gn|MD|3D?PXgznw<J7;vC3_adn0f|`SNvN+N;LR*
zP_1xFy_B^1)gfwRWK=g^kv&l4#NRB3KBX^-6R9git(Pj{q03Mhy1GeP&1<owznM<A
z!Vg_zgVc~I|1Plq{-+Wr!YQL9g7n!{m#VzG2!>*dQaTk4Zf&9dEhPThxkghv>N}3N
zdi(cquQ7%*_+jt^&;v6-98bdUJa$Y6LKTtGB?|}v&#qAe2PZgiNx|~8#Y*#lXl&Jy
z=b7*OwA2Bwv@??U(4Og_Gw4XQ*4OIsVBBaiWU|(aVwbnkJ-kfR$9>+EKWCbzJYEoo
zVG9-=)SM1*F0v(-jj!*%-EZ9?QhevRU>F)!)4*BdQdGo_i2Du*U<mrRuGTopqy2<9
z)G9#!0hB*!7#{ygH2p+eLEY4U>6gZL*3;h3QH8Si#uNEPba_d8saS|`jp5;myM0<8
z;z?)C#$pW`B(<zMOgy|WWL~+y=y$YQLLm(8*6R3+yHINP7iBuzf@alJHZ7ctU8q1I
z0(^a-+-EdROrj8=c4zsNBUI>6#@UyrB0QOzH(ta^OGCcRidi6ktGa4h@*K)gc${GV
zkjT(judGe%?+)hQ#pCsXiKQlZT5LI!KCd>CRTlbpGJSrr+D{+EhY({DZX}4a<@O2V
z1PTwtwm%f1L1!%<%<~HS<uria%dHf&&&eH{_L~9z``{1|bE$3V`Zo$v91HAi{+F(=
zzmuIMyN<BNjgQ8Qt^TqD&<MIksL(IO&+hx?zMmpRN{&q>E;wK9I7;VW)p|o21~mZo
zgjmgl2KXC;ClfHl>ARS6C%Xi}B9pRVGxTCY@$j=7V?SUMIZ(P08lzkLgKQ;ABUM4e
zEbwqp^*I8~C?$o513_z#wDhW0e$7|SbMn?kc0s)Wxcz=A!$X@RCl2;P_<sVF^NM&3
z2-qo)!w5u#k?y?TZ`%S5he&Mm@NiI|C9yGrwH^s<=NiA!n1n*92N|a4_4rE)w81O0
zT?ppRO9-PWlR%m59d9A;;o2=Ci^SYO)1iGrXaEDmdGcWpuKk-3L-*EoX+&{kP<_Zg
z;$Tts3=3nhup9$DsgWUI3loR93N8}S)Dv7NR%6_zrV$4vWP$K`nV@FI-$Meb23BE0
ziF};|`L4Rr1tI$)ga1u~y-u7_WXV^l=2iE@ipi^MSV2iI&=HGOF(WHW4kUm^qVIjE
zf&fo9<wY0$Mi}f*!E#pE?p9+a5Iqup(fmE(1C0;rbQ;9V+wp(Nchdgo;E7`$?A>}{
z|8kZB_R5Wqq2An!2#KXS_+UUwmX76~_@=2q0Ox>z(F%%%0em}u+IY-48fh0;^es$w
zeYAFIst55bg6LQ=vwiJ<Yc(edLgq5#72rm}*kWi?gy7d$snG<QnLZxYi1dQuZD7ur
zR{|^p4r4@GL0+Ib15GlwgE6BBC{gZoDYr9)5ax(}0S9@2OF={Onb$)H={6b;<_*?P
zH|TiZ5QbzxVb7G)W?s~tSvBg&jH&rt;2_y{+db{tbsY&&tb@art`RsU&-?8T7jScp
zQ+*AhdA*=IdvW`Mw?>fwH_(`;8(i=70yY9u<q$I-B}SI}z46m6QB?`yss$t>0ai&=
zKOD)d<c#}T{1i5D;-52OVAe7GV-`pWFF0gx!ESCPGl)0bOqxk<8}6DCc@$2|r!-VU
zJNUO+xz;E^N}mQ~q=p-l<h@r?4fwY9>~*ZA)+wkk?lJznCZVr7%rPosI*rN_K0i(k
zLmy6xZjz<N%sYP@rL;rz0eLFX(Z?LPTxf~t1Y{EC-=Catm;4LaEg%njfWMxTMW?4W
zP{3VGj=L-u@ut&o*zVIXKsv|DT*kL8Fnv28ZM7N#ZGt)n#h>WwVxp}e0lwy;G&A82
zya(ZDU-|&Lpx!pnwKJ!m$?&)Ccu_7qMoh<(hh6(Ff<5uy8iHpxe>zyQ^yWl(Ii}ub
zwHPq}$>*=j4_;)9iqWR{G?`23e;|c3YKcZqv&|<n9t<AF_qMlQ$<vg%<FGWWr5xBN
z-xP!+SJ<38Mp<4}lDJMu1EACD@mHtC!cgHzntq(6*PbA9&<@?SdSN%Q{DAgC^mbX5
zmHKyLtrfAg^D!}&=*e3~irQOcVLsOoW7OdO=`}OYKacs*BKTqNV`G%I*tlFxSf1kA
z;!p50trFM8m77==N$65pb*{slmcSN??eJMCKHS16r(1_e%D^Zb6QIN;9<A_W>)A3P
zmA5{+9X*Q8oToVi`U|r6JxY&N-<Alsh9d}J6}yfSL^jXes1v$CYx>EiLA{}J@m{eo
z0)UfR{fy5d-SvH^_iz&SnA!cE<Dkr`j?cYS2bbWSVfO#AbxqNgHBB_OZQGpKwr$&(
z_{5pmoY*!ewms3rww*~bf4=ws;jBJu-TQQJb=B_Ldsid-T!BLRN17pr$r(g{Z2dGt
zj_vw-?p6oi;sv@Q07x`{6zgF(q3bzmT>HY$%WLll$v1u!?7p7d@5bOmh*08ViV-t?
zCam6bM=#W5q~wG18RMbbRwHxagy>jJH`TYMqKa7c@I6|wnXkFP{lYL)gN#G~C}DYb
zTlXx#19!rT$cqvDwgA=~d`L<rRc{m8Ty(`HDin0&FPg4GU{#hs=%Huwd(e{CwPLlJ
zbin!CT)Hin>7CSy+u*Gw6QPobIUB~Web*aia~<MOpPHP2_Rqt;kJrb4B97-v|2lpJ
zd?;3h7Nw3#hM3494ZnkNucNXV!<$o@EGSw%-PWc3o5<12e7*kp%%0R23d)VUzD3v(
zk({G#qSa3v1&}tMWM-53W1I#TW#`+2HnxAtMW{J(#cbQOyS|8t=)PRfFA7YOY9V#x
zAa<;o;k(8kc~0Quq_T0CPC+J?22#1>{t<t#*0_Vu9169DT%J*tmO0X?&kP&}FZKS9
zJYle`Z=_J0UkmO4uOGAfNbh>6yVnxTS7>Wn&W@S{DElOE8J(O84`IJ6JJPG>*0#yo
zimonEat579$S6oFqdVt%KRiH0E{zRRPgr}0-5#`qBN-^^jV9w)?Tt5TR>x6eyU#kn
zC~0~mHU`V_>!e6VQm1>}eeRD>gxi99-O&ZyS=<~*GTp6fgDElTpXpvaZ|#gv^YeG;
z?2VrTqsfE9Mj`CaTOvo{TsVRtpRNI~Q!a;=6Zz<m&cN5po8N!Ius0FDZ;HSThG^E#
zjh5(Wy@_jNpPrp|&p^DNYZHzlk4O$ing%NYvT$LCf%<Us)e-nqR66ZtSu@^mIJ}|X
z@8DY^*wM@}vW41Y*4t|Eys}G+kf#@h0va^&44GuWm^#dmoS~O0ZCPZUSHO)PP$zTs
z$YV15#8x%N`T25j0`*C^#z5T8&&L|269mAWYB;daS%tp_Y|I;?!ef)ck;%ySbtVXg
zOKr3MCYt(7On@9hnr&2z6hS?((c=BkzCCbe>=4Qg2a`6jy-5JkF<9~gr{^l11z7LE
zZIOrTj!NN%FrWavc+k{@=w!E(&rgu<<@4%sK~o!VhF@n{Qet2~Pa(U#()Nqe_KMm!
zlW~T74Ku6Qn+X+`U>%KW699ScA9+RIWp$7-rja3mj4Oo!k@KqM@aag`UN}wHGt9U>
zY#m^dQDuyOKA4@uw&zcZ+Ye!D0rss;7sQ|ZBCmWiQF%^W9u|2Wi9*tZcX0)Xa#?3C
z=!u%56+;@WBSgNmBl&ROH=_1A>r3e&zWQw-c??B3v_7OmS=vf0dDBo~f5JO5Yt}ZV
zQl?^q@u+HMc~exD2vT*Q4`PlH452OA2aR1lp*iEG=H|IEBM<2q9HrnJfqsOvDtAP?
z@Me_C+Lz3{j1o#d4dL_x&hcR-w&L{5K!#@7KkjmS-?4Ogl#^s6Y{yasr_|^HAFQ@e
zD}8-y@o+<li+x>VlelK={%cYv3ozg6Aw{YUrVVa39jOS{msfFZEtz^0Wd#+5s<kNU
zXjrtoy2WFsNK?(hGtpCf00#z4Zb+uU#`&B^U)y%aXqQ0x(;Pzm#a}AXad{fT_E0To
zt6$NTm2pkDP9JBJJfE^8No8RsFy2e?Y(`Mx8M^^tIa7d|S+(IAyeke-Y6{&9y!#XG
z3Ux=YHt%wgAtV-NQ-jUthha)gF5Bu@02DqgkJ9>&0#xV-6s$E~;JBiL?pS6yYKcb)
zvY-gjC0BiyPt$qaJ8CtHEnE^;%<P&+>A#JXU50r(XJM^0tskuF2Kz^C_Y0d2JcmF1
zo+uJ%k^Qsy%|<Cm=_a!&PnXtANqzLgLa1fID!d)!DeuEPeq6zE#*`Q0n#*{-lutK*
z<aUzB#1XtYP%R7CVID9S?J_pk=pw%f@V$cBIKK&x!2<^gG!D?4dyOSafj}!Yr!eOY
zJIH~vq695n6f^}vk-`~DkA3<lsEe;bJApV5nfYy^=yJ?<_-##2DX9wsUP^Tl1!?gG
z*Lo@pnc?pF?l;9{gIludaKA84l%XvLj6f<paKFouAg2$g%dosmM=WAsr0?o4fV|H`
zL0EM0%aDC%`4M;rGiLzyTY)3C`A1P6m^i%BR+M=2yCx>NW_5&O;vWV$_{Ptu`j(TQ
z0_L{!6r@%W7+5Q_h$`rX)=bxu$(5oH7G#_qRl4miw2A!INe6#QSh65#WJkI&?Tsbs
z>QTf*tz}>U-dgiDR7<wlBfM7=IlcL$%4CcCdtNOII20eAwa0i{yfHh6nQG<wg3fH*
zJKaiNm6YONHOf3X6$LtiGAJzRS#ZOdEXEEF)=cu5kYTUP4oB;&+0Y>rGNV!GA1`0f
zMy24O{cTVjSNR<ROOxSFjdz$?+lmr9y+T}QO_mXew@DYPOa8$bVv)X#(~mV)U1%Dj
zJ|1G{pt=jcr23L|>Q6waWf{plVm=gAPd{rTU;CT}eFavoq-n758uPd>sV8bJ#MQLs
z7a>G6L0-}@IeC}qUktJHIP8_u(jk!<x#lNp@>{Z#^SreM;!&j#GX)wKZy4vEl_BQt
zi$nm(wmQR}=LyY+I69B)m~J4KN`ACBy}&=56J`gnUfkie>=?<&Z0s0_x@%+S3wP_t
zQ{k6UgdepDPq(U9_0?kU#zK038zeF_zZ>;7(D447S(q;?x`%cmC~OVodZ3}q54LMj
z=mnbFelFL&=fy~tsz*)Hs!2&Pq1(Vq+CTzib&`q}(iP6YF~LTDv7e%*GSVA>XklZ)
z9~x2@gX#zi?x-65ZzguIai;%;{L*uH(dx`TO{-ko-WyL85z-j$E{*9yc~CspW=zd%
zAI>kM9i=N`pCj>M&j}C=4_6>E>hb}XoGH+sl5RmH#O#O;hc!hFn3hCPhIJVO0ScTU
zwm~?ty*zFr3QjNaKwRN*h(i0mksoiyJ7rHshE2f_fuH7>{*DG~$GiQWfC4+>=g1Et
zvoL55@-ltHM%Ohs=!VMM=cJ;J+7n`Oa5Erp)>uE5PMFnQxw+4sBj1ecHF;8IO*T+0
z{zNGQ{dr%H5rtwL)0PRp=Im@H3TR4rO`Ro`bF}A~WG}1{(7A+N6WX~}he@A7R1R6^
zJq#*;&<az1t4PINUh%YqcYc9S1$8L+-XgqfKWt254vs>*HRuuHN{R@<Z3(g6TLM{d
zvw<3u;*r2b$(x^ph6&SsW>;pleEwLog)@9A{_fcnCH-0aFbzM-`*Yps1~BAcjK#$|
zQX~&F6yPqp;dyf_y5<()c%v$gEj8ex64?>!%6_4S&bDIP0cpi}966o;SuDJzp%9T<
z5&c{S`yPjKgGc4`cYb{l=O#~+9#<;7B~5x9L@a(R|BK}q3&fLWI9~3pg3u5W#Y;6r
zOzho33`5wZ_4#o_#|0n#0HEvvAv0QZcc7mzZ2Q9SxM;glH`|p#(#u}ci@Hqo6p^)K
z2(fH2al!3>q<(lQSsfI|N5hn`hTzf?lQ$^y;1kf!`=sq#l-SJ^jdEJMOluEzTgg~V
zc04gO*Di7FGn@njPoW(4@8PNC<T}^1ZPO0R%PMF?DHOU2H~ev%1o*+VOA)djXo9IY
zzr>2Wy=>NKOVLS1%B~nuNjw9vUk1qR)C^{A;=?`})gABM*Q*BvZHOm|VI9bdU`D(E
zc5Prx!nw~MBUB+0S5=cO$!Ai25!9UQF0{klemlIacA|<mi=6m2`!LA-(~s26UwC1?
zqf?kTNwweH6uRyUu-fkVq|y43On0CK?3Y3BQ6QGQ->NCTX*D>?%(A#_&WZ)T51m`D
ze~0Ed?3H9}bStE@oUdf#Nbw!m()lDbVE-B&bz3pDly#$S;zWDqwx{C#x;xSJllwg|
z?z!gP@lVyAqj`;X&UZDG>{XO&NlX$`$n-9J6+Fu8(u2(lK<HX>P1zyp>*IReaGk}O
z!@lNp<7Esc4@OU4rwq;<eoKWi^JV))9rkb+C_;TUd$!aRWN{U)=X8@rnLPYGFs~T|
ze8~qGFtND;an{Vk6E5BH9@;f7$ThC4(utn==EE1R$p)vPY&~ie^X*?$@OihlM<mkG
zCfnAulZkGCsXHoXqaqvrm<`D?@gWxSENOo+WSk0>O94&)vCE=wYrrH5?swO3$b{A%
zengbtl+1A$MGn_)S@d&;i@s$PSLe1MR+NmWeETRPP#B+2nSCrEr%%63o_W;CI#r83
zL#lI4c_|vMl<aMX-BXf}9E>V)4VE4w2OpUkt1Mms!r45ui+|6jr4|>8BcR)w83dnx
z${UZcU5vB$MAlGXMs8|s4M{!}QedVQlfBjbw-hF+r(|%;sm?dSAE8U>qu8zTR+Kl<
zRY-qTaTy87+YH3SD0Nm=O=lT8v=Wu1C|T9{&*Z2S#3ghpOb^#np&UwSiT_SRn_Kv*
zfC^W<`fo-V2|H3ugO7cym>+`fEUho%d`;QVmjW<vnNkO*r7^53mrv=;zZJOtx_mWQ
zjmCD!!H5K`f7~QU^AN2POS3FkAKL`Z{AD8g1?3k;)^KBP?d6q20{gS5!4v_9EPoyX
z{NC@SjupG^-%srk0%fY{P(=^NM9ZN#YM`HehVs{lF$eh|?BL>*{sks}R2xLZcT6-8
zLNFm&PYI2#wHuA131bC>)%_6g4|e&IKo?=X0?1`89I0=2Dh$(N#UGQV!F|hf;W=C2
ztroUBuS8w4iLH}4+jwyw_%)x-B1}vKy4tU#?h{sBNvEJYB^@44@>G8a9Db;369CR6
zq^)Vq(&C>88WDJT66QT=%G|w7rP%xQ+YiAlkjC~3p6ok%7o^ri0vPe`gaKANO2)gZ
zIYHkq=J~uR*nH#8ci|1^l;9K4MEG87e$)^2L!uPCWLx*@3ZC(7t~F|r@yAYqcOCDE
z^FiRQrFqlzU^)h(Qg{d!JuAXFRRH3<64g0c_w%m^VM^uznWo~q;s~QYYoveG=~1Gm
zpFGo#5TnCTFdtB~x)h8ut2?L%wuMG7m-qXOZwncV%xxF76j5=aA{90w_#`#QgVL#G
zNWLn%{xXOa8|D^WDdo`Tn5LWPEqaxD4}1&oalS?}PeJc|N%WPfSujhf*no%-hT$7q
z!$=Rj`*;V|i4286$1|l`TnrHgj4F<k+WvVTp%xqGj^3K{KPol!%0w5!-6-?%ON+)h
z6(SK?_9~qcI9;6IM4y<jAGguE2l0}B)BWS$3xpy%Wz6r#Yj0lNehC+N$ndBT_1_%I
z1ZIQdL*D;p6}kD`$SF7dcmVkQw^EVyx|oB127-Y?1wKUWn~SkR8Ou;=1fIn~Vm2f|
z7C)LWsl|CnpAG(Po9M^ci=P-gr{9;q&EdULX^Ug`&>GJCN-%_0bnWrmC^N-pawd@J
z+{s@8Rx3J}(vQ*1ufSj6UOaOwv8XR`WP<x`0H#OxbqutB+%lHy2KenOv`poG_N6hg
zCh#G!DywaWX?(CpWcbjEDg5sF2+Qy}#S;3e-eDP%I|aWGK~r(@vAi%7aUp+-`@z<U
zfk;EAU{=aq(Fb<TskASFWI)0}(*)<3AD1sAY#QXol0sr;{2}@cszM$oI<M3OhaKed
zqP=3+Fk;#{#Df(Z476cAP=U_5^9bJupn`C`qjp&ECW=Mr)^89He=+GM-WjA%f@8>t
zot`02c?m_)-WiHf>xP<o&btvBJQEQC^@6b9drvOYxL=1?ta6nQULsfhUnrs?U=XQ7
z3DvbetLdKIdtcK}hfLx;WR*@DaIRFe4MjdE2H>_Vr0MLpfdx}p)I_izv}s|Gv|i)J
zee-Fh=H9^c_Zguy8xXJ`9OQLn38Y>arBN*+(geQf=PASHXhF`QS+j?{&t=KQp+(Aa
zT@^`8iRW&TW#T*K_i}i{$wPnq0<RF8O#ZA+ip!i!I{8>pdNx6?P8abRdt1gbjy4$r
ztYb;l;?5u}0P3h`<o?0%?>O8+v<cele{t78T$tNEXv*5?QpmsBMaqi(A9vyT1R8me
z^zEUpUjlw*McBg&p_C%~a?LQ;sLr%B5oezcZ8;}ch%)C2JJxyMke!Enl<a`Woodv6
zlarHI$}s2JKHz<-;b*`E3HqZW@b&U5G9KR8r~w}k;|4kC_Y(e2+HHVWWW5(Ff>AC)
zUFE)h8=e!BD8dGk_J@4kz{_O*DkBv-&T<z-N#p()`C`E~p#(AywTF?fLaerCqz>`6
zZx}-y#2R_<XW?jgR3CpqSo<Dlz-Sn#+8D11k^LW#LpBoWmB{7ldoeV%b=-tB<e~as
zypfdv{V3AGSif9=IHf!ZK`T#={D!aVA4zd2X>gf+M$#7x0;Ms5bu@<@<sj)-W($Sk
z=5cgL(;nOAoU<*<5Bc%6?4)Xb8sS4_-k<3n-`2Or!Z?QpeZ*c{cn@8Ij(04X3?@tL
zczTRSOU{-JCO<R`Ccj!HSGr8?+1m+rIv#SsFx=NyzJTwF>#6P*u+rFApu5zf@5k2}
zW7m;)4spf2tNUNmME+sXopGDgV7Y^`&9DBODEe?2?5yjlwqdl{>u;B`D+qo4gIw@N
zeXvBMz)ssZrLOONfAD@8LHCCG2RU**QFo_X)MZb-R*p%no4K$~j?`KCHB8axD*?eN
z{4Ig4K7{5OyV0fe=b#2U$mNyJEjTFs2oE{j5jA%ESaSa)hn2F3j!>k6gUEwA4CYhM
z_qhAqK-{iTy86v&#ttHNA<sOcA;eyOaP!u0b@Zqsdmm24o^=XKG~dKe>|XbxkMQ`w
z&(<-0zU(I?uLteYDIj5-o0|s62mms%v?3RZB?FV?VR=FeJ@a_{_}}=>`aX#4KKCSW
z?h?JKa)#YuRKaGwNJyzf-5pG29zJ`dbuO<pWKDU7?^LhDRe#~i(y}0@ugu@N&}3R)
z-3*i^|Fh<Twx*oz2k~*&-r-c3f4F8uUS`yyNP?YqZ3!$+%alJ0;pu5R!UQb6nXd}s
zzKjY2qN-o4tW!Je8AjtYY|c8!<s#h!<!5rFhzN$rdVG9lWj!(z`H$c)B`Ha$3bEX@
z6J*qcF1O1~xUDY9;%R!;Bj!kCMbP|RHRudQq<D<oOpAK^c1#I>5663_m+P(|&pMIT
zNnXgk9F}w_l2p8WB^NaDEr7%_#tpq~4><(>Pf%0v)9C&6bdgKyMe|sTFwBBLhUiu|
zR9nVa-@3e%1`14q#V*)s9|qQt-Rku{N$+-q<>`k3rlu9F&d;0%UkM0`qaVG=R^2J)
z9Wj&^IiL3f--dq=n0Z6hQYOh4fHlPI5^Ab4;>_vEDm9O7`Uh9<{Q-oh>}{zE&REeY
z4t#OjmW<`dTf8$_`Ws}s+7RZP_@&IeG%2gB2~c?~_H#Uh`hUv|iL=eklW6~4F?#i?
zJ4%&=L$Q5W(T*KM^ltX^!IA#N^novVu;6A(&;Z?}_d`sdeCGszv~`O%oE^T#g-@2k
zC)a2wSDb{FGPfW0u?6VcSSEUT%8^&C!eoo7FokgHz^hr*uQd&>ESIDNX4zFJ9hByn
z2U5s8RUc2d1+g7{U<*iYs2d7bGfvuijaBMcjasCazg=L$2)CplGWgF}O)`7WSoNzy
z2c!ZD`tId&jJZ69UhXw2+5j25PX`5ky7^&JwSLm2pG+E{0@N>X_Um9nPS(L8wHDf}
zKrFsVI6*3I!7>oBZqMBDAG?|uR_usw4{eb_*E)?w>JEpLxC+(6fE2q#_248!%DiKx
zjXelMy9Bcd>8F^{KPK*BsV8MHV;eWvaEmJD-g+TkP;M#DSWY?|(0>Oz(VxI<kpl#Z
zdk!^sbXOji0hjJAn*H=zAEn$tHG!dlbk~f-jcNicVWs>8eJ^VgL8ShhqFDByh1}V>
zvvz-iP~gyt;4pI)qR~<dVCZda5E3x;TnoRla&~zVdW%(d`Jsb)HfpM6;kQ`5NpDqq
ztVdArielKNKTtOZC`ZeKoj^a}oMey?hGamXrHxwwtjTCLtTiWCl*rjRuLjQ8?da26
z*j^fRhDJsgui|fMkw-i)(Rdr#?fQ2^ZTAuQ<j(cT-z4|8l`=8B%mn3I$kR4NJYKjR
z1q?4GerX{Srp0D+{w{gFZ!p*1W295*D)H;fKSrvFcK#AW!4Xg~tG@Q>Fx=_qCALGp
z677TrLJ_TOhe$X>l4>|Y)NQ&ll26xr*$HZ@GDpDWFWZ>9K8^<le}XzFk=KInp+=`l
zi47+0j|e(}qg7sQ_+A>p`#yNz1)f7Z2zh6L!{A!t1rswRjAYA@)6l*XynWXH4zf}3
z3)yZ;4?%Q2IU}AsMqdG`KY%b1$j!*Whd8AGUWjF^NvUJpu@r{8vQFy_ZsenS2?)_?
zkSM;N1>vK0B1H#F`t<OX>5@$1Xrd$+5rT#si9r5)f9tLLCto!p5MM5!-mO@uY|Uv;
zxZ_K3@OLz4Qq3)oQkD|w7TcO^7HJjdGb>1?B4sF_4wa&n&>Gc%$R(p4getEL&Q!Mo
z;H^jf8Th-c4#QMq5hJ7&HFbX~xIkT4VBjHMM+7EDp>mp768Y&~^Id~npRMwK8xHGG
zn)gSgspWWmq#P}VVl$a61Rg^diLd0CsB@Oo<s7vL(`pnH6@-32<g=T%xVU+E@giy-
zwRAPy4OycOm?c7pblMa)%My2gaZr^AfJ4tDEd9N{b}f?cADYCah*5m?=Ii~>M)u1?
z1M~Qe^lj<Qc&^sVNvDgc^gPPYRR34pFsI4%y7n@&;j|t<6}%GW-iO2MZf2t;NyhU@
zqb20qX1{0L1q{E9x8(ax=FQrSYr}2)ZGZOB@7oOi&vwt7y_ubhMm2w<Ul|+7ffdJ-
z9-x%zZ#!0FOyOO_=}|}L#n1R{i##OX-ne$U5f%jF1@~%SEQ`e=!NEQgk?`RF;*BfQ
z)`Q!VUY@J&A_JHPDctC1_8y$T_O2i~O5Xwhjxc0J`n)nS$cWGFe;Bv_KB<wQNya&z
za#LKwn$=cF4HC{MNA9V0w8c2xfrt5HA}@%@ybR*$NVi4_T<VWdRHxlQANbo9A$B9P
zGZEqj?eR#|9gJw&K16yAaND=UarnhBc|uJAzPx~6cI-KI7jIVG--kM#BDzO(DFbem
z>i^VHgqy-`0&a?Shl7wyoJ6<ktO{6dpFu9Vk2htNHM&S816T6eNf@0e0Jo|nC#Me{
zGkPG;(S-j4gG2TJ>>fjM+mqYy>o;eM6E(+=<ysyapWF6WYA&q5rh?x+3Fx8Z7RhxA
zPhgSs-sLq5e-w_Ek!?Ehzul`rI8KM_bgxo{5tBhfA@>MAaG=BV<ew;`A)o};pdlkF
z2Lw&+?~eO;$=&ZUrcs`J&7WPd{Lh|1KyK)1#{4+mpZ2FOPIdhxM2zV^Jg$%HSshuK
zQ;o1<+99NNIwz=BM^qcveVWEkFTbi#D-KgHxb_RX%(XxmJQKNVw5Xg53Aa>IzuNRS
z;JOAZNL8dcu51yN*dF#Z)S$%~z!OBHibDybwH=c@^kc8%bba~&tT)Hu`-yr(N70eP
zocBE7O)malb_GszwFNh5OFbprjNx4nbt+y04jd$wenaaOKkfv2ujPPBTlxZuqMr2?
zqf^)lei{(J*_QmrRWCRgeVu^!2AsUvjOo4(w<i!?vv{VEtI~E>f4cAI;Wpzg2&Caf
z&QfG=Kc=NCC@wC6IpH1q2c8E4YC7jB#aIfXcS3)|jh_VHBTd0G*;B+b5bZGCT;+yT
zm&!l5xvDDGibdnNl7Ab}>>urfh-Hs<!Bc{w86^|5npAujQRhqwOQd6!c(nnO`=fPr
zvHPclZUB0ouO7v?{q`3178E|$RVJ~Se2=hi;+Ln&u^QVjaCbwaeL&dybJ&~!Ct2oj
zbnxfTcp>$kzm5q1didT7?gkHyLbMl|>AAR$+PJtz$BCu>jY!Ak3Htj&{QD@lYk1nE
zo{GZm=%Toe4+tE_OTQld8IrF|havCfb|Vw>24m>EMoQlg5VrPIhPkvtwgog-U_g<4
zXDBNJ?G=I^2gr_F+bgx$m0}#&vz&N|^I7hQBW{QzNH^quN>O}xF&fz%wAvgn5!WQb
zKN@3~I)IPS!yzYy-ocx{;;^pOlb1V3i8Z<~!oj7Sp)X}9Q%4oFsVoek{{Uz=IFOU^
z9x#8NH^W0~+668^t>bMRl8eK4?lt(s>+$U|K-`UY1FT$}djrpLP6R&VU7Z;uR-qdt
zPNsT@s~`7#PKA^)*3PnbX}r`S##xDCzxd*^b^Jd(?3IKGI+2QWzFh6GKHe`+r@MVM
z>d20E>)g(ER@}~MD4HWd>~PyyNYy70=EG^+^<QUEXeO7P?$IC(hu?25JB4xQWnq6U
z#~x+&fgZUwJ13WIPo%4LCYSBUot}1Nv2SBawg0kRHrsm|VhXbwXpcJfe_fWvoCl}D
zt3UR^?m8VA*LZ0;hiqZ`(GB$?7$Nt!I2Nw_19cZ~%4UAr@K7ENb51oi>1X}(^gyG@
zgqT?|zmqngkogl#2`&!^WkOMWjfgZ`i744V0<v6_=>_;mHvI9R<`$c-`6;;^4P(4P
z6VK(w2iqgk!tTiD#TrC8bq}qZ$V+-KIz{C%u^y8=?e09)uJ$RmNzjaAYb1M6d+n|x
zee2u2I*;H+*A`MT=_j(l^wZ2j;}Uz*%nnd<>dc^Iy3VS(U5l)jqJlZxk-WinVkpv1
zfiK;@_j~zf$hVX_os%Ka0sDS;&{)cI283jVxT`B}Ynw;b4XNczkc7hX4>W0SA7NR(
zCCY`ZZwU)qxCu#L1tBOUW}pqSnC9x&mt;DDOtuI@RhGo!ItW7pza@Y~VoB|x86*Y4
zTkw>-^uM2aKf}`%Bt;Q6zZzSZG~EdhvVx(kbzvwfx3+inzCw{brWK>1*n0lW(!U#u
z7mpO7uulU5fuPUUb&_*Wt&6UVyl0Dci_!RqeT6)DK42`*KW7`17wW7)N?Or9X(!Yi
zxD)jQ)(gAdutIzMJD%BsV10(v^Y>a$XgmlBkeY7{OXQ;cqT`QN5e;v|3venx?*<`F
z;Y*`3&LSsdk>8gDKug@xMq~}6NY%Dss#o_}``fq!Ux2QrJUX8R)&ayp42b?g9TZFC
zu`!fotyvPEsT0x<v<YPjd%;_ZffWU^KOm@NNOHPCIC$s>-nd%7+P9OeX1OySa-K%+
zq`sHyNM}=tyl3p~hzAPHJ{-;fxukhn`~K^p`^(j!d|Dt`KbLT4?Mo2qMdu%_T_ju@
zwQF}!eu9;^5UMq)YA-BZ_tF=;-AU)-zNJFfI!vD2EIQ${@XAIt7bE^b&Hv?8ndlUk
z2KU@y7}D$k!HNURQ=bc$O%oU(KSfb!={I)(_CpDg5<}FbR1tL?lNUDx=mdp6uJ_B-
zZd<l<GVd#OOCK}tUZ-d6FN=WnRPFZ5aWD(c$uSB3FYlvIedYa({6hRlOg+=!ue>i`
zKLqhigs%RT_eUY%I|TEvSTaa|Q~NjCo_bzhj#oM&v8*x%^*@4!7~_t`!Jkal&jl=N
z;f*}TSzs*1PP5Mv5&;*27G4Qe0=<(VG(C}9xI46B_&Q_h(}AH6b_m4k63{jhL1NQ;
zYY-Zx?K^V=wyQJNjeT;_cOSLxIl>>TUDX*8xq^bld8J#NcQ77-+-{ynS)&}kwPABt
z=3Jx<(r^&sURo)wDy=IR2tBM9mq+~9_<#Ol_AQIEsW7&d{R5!wZ7Q4&7YXpBq@sJ$
zd#Z={%j&jca2iaGt<eSaH0|DT&$u#i(xi0|+`S@1j$&pieW<VSQlNmk<?3g2+sA~*
zMXjFJpw!CfQAa{|-RQ62Xa(@~JAEnDCmy~-tu^~x(tWn^Pd!2e{dBCvF70&KDeYw6
zp^}542j}`iQUH9r%EnHUsoaiaiX`ktO5gMrI9KI2TX2=zD87<hEWc#ZKh%iZ44bvx
zVNO0gHwty3PRn51AiL~%8^<~!TrM?cxDpm-ZqshiPCiPwT^$H@=KppQ<kn0O0_7z6
za{8YVmQkD_WIM#&1%%@w3Vfwe_*^yMF~R_KB;a2T1n?-*JNLRYObied(yK4Bz;oXh
z;~MgnGQ19X2qBwjK%5T7FL88-<uZX0e3<(7z@r6EQ^59$T``P7;+>Gf=eh;*NRUW@
zmj8eXhu<_3o9rFED*qyT1d+~X-m`|Ck>-(Yv)oVH&9fUxfI_kXN~1>c{EU439d-mm
zOHbhiAe}MU3j}0Lf7=eN{sOMTowbez-nlF5fXRpq)){7mU_c!q!I&HmI}RlQ2H!ef
zYj+^&pSY6Vm{d{17Yxl9_f@Z56G^WvU62)M2aVM{ON7B|uKL``hyQ)TbdmmJp4u$7
zkM*u+&kM$Yi;N-}C&2`tmJR)U>!yW_8(mrxXy=No!d_KKC*{=ba@>tjCHX1dFFXI7
z`$g8hy1e9fR*HjK=0DtwW%RMx?BcL*z=)E^I>#RDW<{Q$Sj3B88!(&Qr#8Iia%3;c
zJx)BdA|5|@LLHmKnpkjC7u`7Y^F-+dXxhUbf0@m8v(aYOe7U8TBx{IgbmkQvoAYx3
z1Xdv%YpbvQ!q~hx8|3*$+1$irZFPgpB6-#QycPVx$ndtc`Y>R8Jy4JaMXcXX|MI8<
zF65H)1(Gz(o4!C&z?%~8OAu*618Ko6E2v{}WEj}Z9BP0ZGmUA-$c^m%>WkMNO2ReN
z3ay40Eoc98oqv&sjpUIbJcM|$FeMNgK)Tl<-co3imcjpu9imU2^$L>tH92H|w<_Am
zrL@yeDIh!G#p(U_JfiJoe`%O6=fl1}PvNO)IG}ZH7U}Prg^=%s6*17$-9>fSr=*JX
zPVxVi3*vw%Y2nj)B!?%qQ4h^WYj$ilt~0q{06}Yr=~gspxHoHcj>0`5cWZ!IE`U-~
z_Ksbv)yY3YDa`?5ItOwJ5_AGB0mQf9<5Vb!L2WVLDX;1UwRRZ%RBCJJel+Z*jBilv
zpdZHuTZ?S(MhSaDgn9Ho*(MYYMnGT0r<y7~<Pw|XCI~oxQb?elaw8+%AE;CXja_vh
z)sZl&E%a_!1a~9AFsSiH7#P@PGOR-3j%?fgF;&Q*^T&8}%4q}Ely(&z{dp^kJ)KDo
z)D!o;n%E98pj?I~G=P_3Kb9{KuSa=-U^%M(31_NC@7xX~n(*`G8vo^c%r^kU?jptY
zKXv8Xj5C=>s8yFG9^CB>q%~xD3@hO6B7HPsKKP%!a=!9t7CVqFHa3zv%Ybyk)cmB8
z{vQ<x!-xx;>n*Xp!>Nbz3)|tHaI36zhdYb5xldv|WPBJh<OGHS-XaI-U<a;3q(Hw>
z6r42TurEA$nZJn2$Qc@qp|WdzStP}QQb=fdE5TFE0G$N{&K75Nla1cMHt=aF5UQ)N
z?j{I6?&^<VmvC}!YpYaN@!N4{XGm+78Tt_vhi|nwAH%z9(Y9?tL=<J@Z(Bxqh7pxm
z+{r||?*eApK+x=?G6V!Vk)mGRYav%6KW|HcK>C5~ECz*)?u+(#CVUJh1LFaj!Le>(
zf?s;tt>l5e^fIL7LX2kuEx@6c4mVvIGRl{OW~Mw-HvX#qEqTENFHh-pvBYv|=zQap
zlh>Rq**?WY!@aV*_?}KfGxF~GU$bvVi48Uoi$1uZv@f-0gnNA3q;z1lQ6H5o_rM=e
zj-fKLA`yIx`A_^{Swoja?=7lI-vw7M_91+MH9({o%~HD^1E8yB0d_HZlP{?e35z$l
zDitnfS=P5eNe|Hm6V#vz%yOpt^LJvRxLRie8;U$Q7rk!cTHK`BZ}mNiVPOdZNkODp
z0wG^s5Mwxy;vCLGDOE-hwYmBr<QE7;k*@S>MJ?wzSd@@&Xwef@;6FirV9cvc8`Edy
z+{_D$f&O7pBD}{G2GHETH+I^Yo?o)zJS>tIJgVL9f40h4f8-?2HHOx+!7_d&k;FNS
zT`5g_8Bz2vI&n@G?ax;7ocb4%m9e%9naaZ=WE9&`%8F}s?|e#&D_wDWvG(bvD6R=h
zkYpU<8_W$1Ir?&RkI|VX0W$|pp-_$4sKaLW^KNB%r;la8l#m&)gEBY33c}p}%PmrX
zwNfXBSpqq6p&%Ng!DaRLD_9z|<4$n&Vp)drmKdGWcj!(dprpSkSt>}3CA+liYdFo*
z(cFiRn{c+F9Exll2#Tv8i-9l=Ov|3_*=z>iUBWiE+`l04Fdq_q516XvKONvL!sELP
zahUML1c{Y^#<E(Q-7`v6y{XAH<6>^eZO8&eJ}NCb5As<U^#sm#5zZ__441GtXFcH<
zv?7vl?uCn`mZsS>dwdBYxOCqbr?8fkCMD%y3w-3>^}tAoGTY7ZZz`JRv|YPX)%?{G
z=$if~HfBv*S8=u;Gij&<O$<88KXet?nNz)>J2wfyy71(~CObB@6Ju`9uol+c4tf?h
zDYz4>`Ea&1<}wKizs?WpdE6|FkqOoi@$ouQs}f2`*tupY2*jvoqec|~?zdpMN#Rv}
zo36ayvP}{hP3#XX2v)1Y%HR2MM_8;rI}}!}Sb)TweOw^yUy6sjX;AvCBe8wIt9o@R
zxl~C2RG=53p)zq-C+5;k&@9WH0QZ}^7imzq4YJ6rDXx$t+W=4oZrV&QL=^D;a>~*)
zr&O(cf%?h67AO}(pRID<{O7ErCG|H=Cc9375y`)#i^1p)f4OipZL*En*~5~_26;cV
zlA5?vrb(Y8uYMG``y^Hlmanl+1)`sPHy{Q;16kOf7YIpv<&wJ~Z&IMX?3}$yO9&~M
zum_0PsFXMi5>y5up{T~fI++T+NpNLQXr)OAF&7O12bvucZ737c`oLDCKhC?M0elPr
zrLB!hY1*D{d=7t9?L#a6t%O6+Gw~_dHQTCDb-VrF_`6?>=gIb*R0^tov0nxXdjSm~
zlCd1EP_8;i_%;4t+=;oX_d`R!QEGG%br<)-Sl9c8mQ?y{Rgv83*@<h*(!9mQ*@>!+
z2S$a5uEXQTA6eU!smxy9!eI(5L2V*sZ8c4{LoygFkwadq77rxq5mJ8}MSGO!bV<>2
z$j@39L)~_YENL${+AGFemu!i2eMSp_^_0!AEwQ#Bg!Zos^HLb3lWS@xgva&YK8s8&
zF-4}En0BXaA=jwwibzgS2a(S$9EM^`gdpiM)HiX)R$FTK&I<TRz6>zX@vtz?vU!n!
z6R&NsinW;x6bBiuU6l6W4xCkB+1wPo3QZE6h6RaG6T%1an!y*TcjG^Ld>ruky4{L2
zS^|1?Aan=boOkaT7FCl(6C>M<VVR(cwUVm48HHH1X8sKx{mHR#uG^Iwea;$V>bx%S
z$6t5*i@3jKZIvrN-73tuflBe9(mNtNmUSy_)1WE4PI_dZmXjtHc*d5u>ttYbV*S-S
zNpLi>Ma5ug>V4g1V3q3?kI4XN`Ytm+<CamWdmhKVQ&`$1^Rv?I{^u#>vlHWn5LynJ
z&EOWaYx^Wy9_PN2lFm`&*+^-Q)$Ge+9@~C=IX~Z=G$~Bp#&pCLT8LwPIrg<lceaqT
zLynHw)vw|i%prDH9FLS|sbmziJTT~Za=u*=C&_X+#gIZ2Q6=(zeM*3<#*9dQ98vtM
ze*FSD?FjNVekzJ6nXP}&4&paPgP-oRo4ykF^RRkpR`dEsBu<J4Vd`K~yXV5yw*=Eu
zO>!ei8g51k8;x6JFG6?pB_rMqrkca%FVYL}BSU0KqWm{@9Q7DPp&yDwh=M#&G%C7C
zAu11Pk>7bky^pnk91E<2)@~F`R~y?i{KeEG#E6>>5z?Lw`}APS$RqN?fuQLa=mFQp
z@;=bX-YsbQ0W<W0^m!oOSIUPa2D?rzjuBO^R4ntQR}ixcU>%Vsszdx8*62c&=61fV
zQQwkR16_xvnGRN8pp`ci_z-)Fa98T}a{JdQ^H$taQdz*nc?j4S3MH<dsKT?ETF&5<
zCB;xhJL(g&f%>LsE)p%v++*^@G4AfI55<9sAikDliTBGscvh{!eiAO?4;>kpMl_~2
z8d5H1v+M?h1%4R@K1xkxumxF&Ki?CLW{XBO+5u{1Z~V72aL`0p-RYZid@22%O>P2f
zq*x3=_=K7IkX!(4g0^Ez7RHWEkzpk42c?m{82joCq$dfiiR(T@2;v<o=4cpSy#Yeh
zH*(b|n`@9U<8yBY?ijs+IR!Jee(+{)kqz!HN%@jZR>^Ofc<2b4qVcn$HT9tEgHkMR
zTsTKOl+W`8chbgF0mR1geXOWc7f-S*_prg4KEJS4w|Rk#ifg2)sg%JpV@u6jJ#co7
zZvE<=uW|4tD#4kQ86E$OOB-`^g)%y_?Vck0Gj;C#|2QArF|HeNHzh(_eUs&OV|1p1
zC9us}VOnF(<)wP;Kn=au0sk4BLYY_YWe?}`)MvR*3;vTE%oIByIdd^rk#P~qe?V_g
zhd|5Swi+AQ60iFOK>Id*8JrCH{U?;{S<2q|;5U5^T;;K<wLw3MBRJ7?po1V%$dbm)
zq9Aa8l($>)3`aAolgf{G0T}?~k0dKA$D4<HB6kB0AtCg9?pz+K3lw)6x^u4?N(loL
zL2bM;btr>Y5Qb=fDWREKPnFX#^%&+i(yiI_Wdb1HM>$lg!_Aw_XBB!r=%HX(55rWt
z6<lGCt^!Y#B(>gU9tjQNj?GgWIyU9zt*&8ZJKU3UIT2SG^1i!Q*Q<xmAJKD4N}Q@X
zJIO_s%-q#(XsZ5w%5S;iSs{ajKi<xlLs!9Ax3YSfh=hC;L^?FwY+qA~X($wpcHCK}
zsu5t2)Sm0AcDSh8v#A&nW^#Muu)A2qI3v$1-QH@qLaW7n9tpXT@c-}>310}?AfXbA
z0*xvYC1-v@YbeTC|Hy&wYs6&Yigktws+GSnHi6mL<X&BBp9KqBxFzB+CL@`UL`GT=
zJz2njBMZbg1*G@;E)W`i?&T6S8r!^Uf&woH82gM}Yi8}bBw%xw2+4Nec`1>eAza!e
zfBmg)@F1vd;3HsCL#o<$)){s}j8OBKs1KGS_;Th)4yJN%eC|6>c-nq&Z_woqQHPIM
z$h_JVxlFd%1M}^cM0hI<^X)D9E*Al40Rl447KdSjh1C5a^q!RCO_Il1wD2M-sKDCL
z!^M2Zk(%T&o8v`C)b?sfow09PSA&%Ri-B?&`m|pl-D=Uq=%5yM?_P@YYwkPu$IbT3
z{tB|w?Pyi>ciz8i#zH?YtfD{coAL;snkECDR%Zo2{d~O@CW7*c30`FW-?Aq3?mp!2
zZt`OtU;wBAyf=X+{wY~4le$+XyJ5ZR6_?Hj%d4~i3@*8Uy-&3s9S#TD|AaJ-2~iHS
z(OL><RKN4Ic14w>Xy~jn$jyAR5Mqf3W5|;9kqJ-Aek;3U@NVWGKh1@=1epp15lJKo
zt1;JtfD%{~Xv_U9?F5oHoD0Lvc@$hXF5{^I4XkmK0{0C8l&vNV{Ltn2A-%-@Z&_fv
zU)6}-C%kJxPL4_evRe_iL<^OdU+>%Ll%izEX3U-&8|7rPwuoE*s4HnhwdF6udI%Up
z-RKirUgF1_zudddm_M7A-0iQep9zuPFRg1O)%oOG1{rK4Ow8zX*=D!Ml+S|ozGRBP
zxb~KOu^u~qS4fOpbI6VJ6a?+48We-;i)@AOq?h-EA)451m~HE~laA2zvh2S@LGe~r
zoCJUSlMIYyaO_roW%q5^;jG;B-3latlMJwQo0vI+vQRg8bqHwQxl^|D+tb(kC$O#G
zKnh{5?3yJA$<I;8mFV3J(t^hznZZo~Z2s+oA4pTQ=(9RGzIONJ!3!%WvO;s~J;-TD
zCB)T8vP!99E;ItM?+f`4)mZA1?ZFEcHtNbgkR?unDY@P`y8J0UC{6#eOwMff44vft
z17^Nqs|jU?RS;`tyos_r_HczMp6t!n!c)7w{DU8zLFUZL<KJ0TeAsKaAG|XIj<r~F
zPZLVWb9li}@G)@PW(o7LQRARjeBE6<$5*|qCS8cFcSJ|=7lioP7*DrZoT0z@BDoC^
zX$J@cLCW)_`ArhSc4!mN(3X;oZw6;ls1=k%X9<2B;2PtXxDw2FwDVB0=$7DESx|n`
zHNh`Degpv#I)?rWcFIX(Hq>f>42F4WlKw&_+<onsy7q%c>7I!dnhNWBImqYsP7&;C
zyKPQQ9bo78HxlIVpzdG){2a!SO=jOciAhC)P~Ko{dg-u6`}lZ)&@FFhp)?s9O`X6x
z_axV{Ykb>=nPZ$wy4}TaA%j#%X=}_jsUVJl<-u(lTBHv84<4cjogQnT0Nz|T{Y(YI
zD$YxqidlV(7R@7W&V%)l;);w_qNQKSTMUL>rcPnEBy(7ZPwfi?;6eqZUh#-$(Kqy;
zuLLSwIAA#LDJ|ZVzC=K{&~aujlt$nQQ@oVMBLVf~kENit;RvU5Rfr%X?QDf$=tx$0
zZ&*ig#Jsw&7_K&mfr!BQS*MJTnFhD?eZDKLz7)ZMvQr(mJ};7MJ1+r+2GX!g0>_=)
zph#nGIPNYSbYh9hE(s=5<14rHk%z4zL2(AG)wFROhmEYUu-%7o+$&FXKS9lO5Ko+C
zKY<kHR0B%JU<*;FC1Bo3)tx$4SJ-V`zAs(0F&+}<@Qs=1j2oa6`h7d^!@=Ynb6?eV
zW5heL3j_I`7ohyk4nW@jm1541-x{Q}MZRb)-RB3t+TADALr{~5k@P1C6S7_Z_af!>
z_v!6uQRrU>;U12okxurjj08Mi?z1zrE=md(=H)<S{Vd!@#8jB8S4i6YR3=gplF@g~
zn;&ddVVGQag_c0tzLdjG&)a;6+>TiE0}{L4z1#^y0j6)5Wb-7^-$ZE$N^T#ix93=q
zw+^bcZ@Aa!RnT%lJDn_xqC<V0=VdUn_cvmCnIm#3@e~jy0|^|q<GH2t`{kgz-$vOw
ztJGamjzX=WmdA3zm&fQkF7_!;=QAZ1SaD$*u-)WRe#royl?mCBg`b!-PCn4YXNaYZ
z61-<0fiu|*GWd=b^<{4(PqX>hwgdz_gl($H)NCXL&dC|k{Hu+-b(cAQv62Z)VJzO$
z)^fkqQ#TBK%Jng-%5m9L0;nUT)?H$JCvowWwtfc^)*g%eH6He36OI56;k|N_kAx?L
z%UJIxw|4*pXL!)Qnu7ihk=mr$Ws;-aI|nqRPq@mG@PhEu)(`U7maI6Sgq_6UY0aD0
zAdPEccOd=*4Ho0dLG?nlL(SW{!k2NJ&9#0zsWYSBbNBo9+Ems4jni5_fZ5eFLXJml
z@5P&1?8Pc_w2h&n{N_gY*-*E(k0jp_%>Ab>)fWm3EwAhV#X=p#jGH?^Gj9k`Nf3qq
zzBtA_y_5GSKL(=(1?b?V_V=>AIQ8@k-ScwR^#eiSF`P}GWs#oUHUIA2T055i?dyC!
z6K}mN=e_OVo0m=NMFG!O6~3DR^EiDCUzY|%5Um4-{7}yN0SLm^?ByNi3a(@cm<V6^
z2PX)d32Gp~XY=W6K<mpQbKcfRiSOUf`=#l>O1;LFDVjyF*H2F|c6hq`<Lwzxx#zKS
zNpANCgUwcLHvUDPF8A}>1(QLrPsO|4F3<vhjq?ps^r2fKu9)7_@xmJho|R9Ow2#;^
z`e$XzlMC!Rn_@<fNx9}#lcK|{X&q=BfHE?B1FxTNzovtG0y%G%;f?7D(2Y=S=Tf(m
zBnSI5nlUF6$euvV5Q1&waVq1pri;K?xY&amkjoRbH|MlDaG0ppi#8WH0;1YXnN_9K
znHG+Zo%RT)qX*Q3ZsBMGe@VDg__YedHtu9O9z0zc@5O4Pq<GDm^)6h6_Zt7f0ItkD
z&VMurvF3ZCb%kweD_OAP$wWAM)RouOe+`*v9js?JPVIU9K@V<`o@C6Exv+0Umzd}s
zm{<+FJ+KrjO5u{8=tH)yT5U+A5$~t;SA(@FYL})D|F?*NhG?XeWgJy&9u*kL<*Is@
zZEe62#$c`?EJf=<E^&I{@#q@acVIsESfpvSHr`mG9QKDmWGY%Wt&*9c0Y`@BLk>zX
z53Xn8t1^zqe%V-i$>kfn{x6pprA1?Y$a+p)A?k@+ok$Gy0$tt5A2i&U3eI&&gN9ts
zI1?hSR0Se!PcO8?FGvwi#*i-qmtiy{?XZ`M_Wy$Hg%H6RsdnWwiAXA-aR4oxXn5u7
z3OmIRUzWu898jHQ<aSBi9dl63+Uv(1^pk|tKus+ZHO;fwh3dWvPKdI&$MBN<k`T4g
zD)2JZLuG<&S@K>EXS%9}VAR?^S{*!0ZjB(dpU8?9hGkg9sZ|MK4%2~^9ISQUIci^d
z);Fy6sha{Tli|vJJoD)gT7b{O+e-9UIGT9jR?2R#t~2x4+sfwYW~ce~BlB|V@0w^G
z1W>dY?B9?E-<&^g-v-l>4ZvJBNHiDBog90*e7}3Rq4&2Lqet!PCE2q$s>W-dA-Ew(
zqlmQ<eBFTSci`TM@6}1V06G^1bs+1r#(;DvdnA__Q{S8#Qo)X2ZVR9#&~eoc`>RN!
zn~rE}cEfeZw%Rjmeoxt@s8|{QR3|YEPQ70p%ZR-5BJ04o;bsfj5|{zE@ne8Gq^)QG
zyi5IP#i9hwFrCtz#TyOELv1^M{I&V`sZQR+FC!5++{{n*7*ip3_RF5M1B7`xA$_H9
z%;!F-uP&^tjm%rWRv#dCC@Cl($09#FAywWTN!Q3Svl8*HpJ18QVJkq)J=#CcI@)Dm
zMsCM78cK(B9g(QUsHEt}&9^>fCsGh*9O4AW3@Atqbc9hGU?T!uLf~(IV#Dd1faWD2
z@_a>$w#20QCM+d`EwGKUOJNoMmEJsKecLg>hZwpJA-8ptSpne+toPT=TrZ}6kwN8v
zYTd=>ZX(SEE1yQY3{a44WaZ!_Dq;HSOBS|n+5ix6hchLGvS9W7f9jtBhvDi<4^(r>
zC1RD-RUztXU$LO7@D&TvoK*s`sI?>-U$IcED^mFrxx(@*7LY2KwqUv}S?sb-R`4xz
z@|vc@bd;=s{^~N!sb4r5OM@{C%f)~Dn{)WCp|w%$pCtw>%kVgriCpaUd~WN{PVojS
zN2F#qDb0v4FwHN(p`b&A5K5X&hkmoTnv_mWFyMl%xet%Y+q>?Yg^t-WS>@nxTAcTE
zA((UAVYA*xJ9!7ZS+8<Au4w5z$%u4xyP8-QhaKkv>m@h+`kL;dAidi%bCw!_C{OU3
z%M6^UI+|-D_X{DLJlsUKpcqT%ZxGK0sFe~dI6gpBTdsL-wsrnoS8L3C_LxM^tWeo)
zL`S+ec2)#)p({g1ik8{@43)%mIOK8B-1^tk_Bit&k9)*z&x#1Azd8}j5$RX_b9dVB
zLW2ANPe#!u#ldl5Du$(MjKflUM&!2=caq~EQDvf#d<2h9i9;J}b$i-uo?tdoHJSMC
z$Hz5rooD|+g%ec<M9_LMFpc0}SK2sq3m`#p_Ibr|w#M&;eXbxEB@L7%DJm?vJFS=q
zqJDu@R=*wMm5pF?DNLo8<#uaUYzdd0^rk<62`eW;|0l)Ak-WtcaQU(-@QnX9wef$O
zI*_)?A_%n>gzD>$>{ADo|B1}<-=@B9N*^U?wOm!nQeWXqJ9y7_aAX*7(pjC?2_s~L
z;KTEcpL2Uo+jsAl!Hx_3j(&}b<cyhCj31@HpDabP9%RU$=H5D^t%_eZfT#!wJWz_+
z!Tf}`7*2C7l0)^Axik^|L;j<xI#>s_#PsNLtsIS&)gm~Ff}Osl*D$7^1m&ngOGHq%
zxU9dr?W(T`E~v023a;Md;TFH)+Eozm(i!rz2({;1K+EPVF%Bywd0UztRqPr&4@#cI
zpW47d*Tf}KV;3A|$YC{fMbq!mKqv`D$1e)AhJ+;sl;E{^3lLE}P&g9?evOpcaLCe_
ztcb`CH7Of<J!?4H2D%YHIkQP)wC6cdpJ?631(R++J0l7#^L8(R#Q}=h`<Z3zXHaHp
zk!Y2P74TD!?GQVejD?9e&>hhKm2}?0aIIk+UQw16y~T=7qD4vc7DQapR_`KKCrXGO
z4k1`Xi4rAxT|I(`C{d!V=xl<uN`y^xE{P59N$x-2`QtgyocZ3FZ|3`*d1v0`C?@LH
z<kOMc?XI{m+N(-gw+S1A-28ivfY7?f!As!4ze9S4dU&g(owuH>kqOnJMy~0xXOhFj
z8ClJ>a*M%qMMgBdkbx}oq@|-zCA?CX7Ldj9sl3vh`?1f(8qPErHLKky_Dm*#p(Do8
zNMg@1j)oDFEipXBQ0`#+K|xUOXWZ}^BuHip!oF)m$|QNw{wS_Kj1o5mFeW8%4i#<Z
zug~8Jn$0<{kAPI&jWy&T_Qkp5-{_?M*xkHb{N;_v8vfMfx6-tY<#-nDL_r;Gkv<rU
zB4xo?1eve>rl{3+$qkG}5HIoxZ&kItKe0&7rhlNrCDJQ51H16W2aH8?Uwpb1NE>lJ
z=8@YP5F2OZS+=boz{@KkTbQ9pM~(^ILD!XtefZiNV*_?Zh{Sg_1Pvm4BPr>m)wlRU
z!)|jj*V#6MH`&8`G0;WK3@OaCKgajTNIfr`3X3E^S=q1`Z+D>k3S(%i7PEkt2{N-o
zZWNEM@-8Qk^tzMSmG@h~OoVr3;38i2TzRPox$?Khr1w;TFjtnSjGM>O|FHLK^2_%L
zC_t(v<uLTi&)V(9i`-EpX-N~CmeG);i&i6(u^`4`sb??U5SM~2-h{*Fvw`Mxse#ok
zGf`B-wJhP*+hx!LyBf25El-+-neW7UpEeb<TFHye8QG#Sy}cU^Ix`9zb?tPU)1Rfw
z>24v6t!)c{5<h=egHM42Xq1$i;AY+6vg|kQgxxYTD4^BzY0m);&uQw{v=hZ7&pT9W
zgis3bc^*WL7G;+}%gXv`4N>J^7|tYBkeN-A`v?~MH#3`Xg~*yu4#ZE+rJmJHJ1-_$
z9xE_wVU33+sO>NhA3DT{KGx6DdRA|?IX_V9`2`E0H}tI9w5eA@SG>^&_MVG%5ZAoK
z_bo0f-gU4b8_JzylCiGiD_d+=aNl5)r?<n>|6$t6J@)D3NIfcFzax>#a8R<}mZfz!
z1IoA1bYGbZYwfC>JWko<b4roJq$MvbSx99-eJ7VKaS%6@($oL+qFqIA7Q2cjALdAn
z-sT0w{HDfV-S?c#X&UR1{yJOst$(Y4kVXs^W+`!4%!|N2E{uPdIdV2vnl(3Wj;FZg
z_yKr><ypuxlKkd?iJ=NS3dfQ$Ev7&EMaGeW^Nd?dUQItj!!6Xqob+u!u*q8StlFGW
zq8Wr(a7zA`(HB8Rt}L%*m}KPQ<+N44lnns(lcxi9IlWaVErl2IP&b5~hRRZmB4%p6
z`*4xO@@ll)f^XiXv*+zILXDhn({%dSIB8>Ar1!3NjGFz(=@NV`;T%?G7O+k7$oC+<
zlZ;bsm1j)ceB4sK10NtGG~!&R0X7kOP2`t~OD$j{b{_sR++^t*L)??5<ZfI_{=@~K
z(ccSR#I^nFn3NUfL2JS`IC7CaDln+O=JeHJx9^b3cIroNvI#Nd{q(QX*5mK9kn@n1
z!`9>0Gw{kxS%6i{Kj&7=*E+bZ)E$0iQ+c?(z#X`Z_wlq3vJdY=EG!AgU*8Q{dTM~#
zSi+8(YiGcyr~_Lk@`TCoU9#P18&x1HZAwUPh8Kn^&q(vDyfFd}#*B^HKEAZ5+J?Aa
zsJJfm)_mt_KN~Hcamkh#e2KU2cpdvQvRlCOZSMj?OyN5N6I~Q$(7LH-Ln~3xr!+~&
zGrUb$n1W{w7O1W45=;ttC*X6iP9Zj1X?`PHDqyaQEy(w*I|GN9zmwIqfdU3+4J@`F
zgG)kweI1@KKWp$3sPycP%r~%e?O|>>6=g2hIjlAbEMKss)+Q>}uvRosjUSj+`rcm)
z9hm9bA;la+QV5cjwvPREf-Py#TVfCus7d$EgzuMy#S3TxX>61f4aG5iZIIK><*I9U
zDkeLff6Ct{YRu7;t}XQf`n)rbI6D*tH~evTNtejZs)z@2#ob2D6<h&r*L(;86^*zD
zS}|SRJ>`7xRi($O4Sc~C3?0}7^;e&3WrmDB2^N;tHSc?0h{Ua0SWXQ|Y{PWTpMY24
z`o^KDs`^G#3rpDxm@fFUVBf+rA<Dxu&`eN&>_@nnbHteWBeQZq-*xGgoY^<>+J7x1
zx+?XZ>KPXs4RZZe;>We0AzAJ6D}s`@qXWL)JS~n-`Z<=Dq>`mAWSnkDf`{@$Z-=U=
z0yJ~5an1sO?C1B{A1cQfHzig}tLG@0NG4XLU7BUXZz?6R!LB_<^lB1p%QAyK*S{(c
z36MAqY;dy0Uu@U|7qY795edwa_wxo+QX{6RB%WVhxjAx_yvXqG!vfzC{=HmqaKH^$
ziEPU`uEncST(~vHlas3E^Pui~>*RnTYCF7Do0ultE%iO9b?ggMv~p;tYr#M85ZzII
z{zEE6-SAuvoo^v|hUFZ5EDnLxneU<-Vm4KeU_ZJ(7fC<^l6*XAbP4py10CA|j;}KI
zgoHn9eb)1;siLnU6CzHq&dT$7J(bOd(H2WFy_JGhiU-E5?--n^_=Q||Qu*yD$J{GE
zDm=X(+r68f8nQ|*9jyveDrkm$LO6`-H|{7*t6IYfl2j+ul_IG{Uqbg3k720lc&uO)
zjNyTN?8H0(l}}8WqweEKC6TQlf@8d)QN5{|F+&4#w(SCVVyp7^J|x!kJmaXJCyUXX
ze4sj-#&8B=Cl}!05W>@d!hL)oYE$@Gb=~|hE133t;q~~(=FUrp@$R<vT}#n}dwwZd
z3|{A}z19Tf6*oqE9Fkt4jYLwDlrH<uDa_lO-w%i;nm-8CeEsoS08d(V`u&4Wh7Ara
zku&<swU#UfEY#n`towaCraWsU$JKpFSm5<1qgK?^*(>=pKgko7-7jYx_Fp5(r-}bv
z)0ULY$~(Mxgd%t$@eZk@O1tmNGvSxQf(lNSbrTmNaLWx6Me~&(cGwFm8{>4GtzAnD
zw-kX?J+w?%#0#qaN}5rWy>IoT6uEvOg)w+$lSk9>Ne>0?yguqINO;m_n_woPAEdW1
zUUK?M#|*``XfCSf9}XiQs&Gz;jlE5{hs?=Np=pmUx|_-{<#X*JcMoOB`O<_O$N7na
zE48@hadcQwsGsyX$?e@6S9?}=4<C9w8Q}$Zk&45|sMDFk>M#L~N1K_b#-}-6jQAm`
zd#!G)A2kny&sIJpo8|sG;zExWCaX74xnL`%BfsXZeC><tqbVo)I~^v5Lq~X<-jVY>
zfv`~{eH=<7Qhh#rmousIL+;Sr>)tvovk!DXA6BvKzt;A2M|CN$r+$04T8H4o-|z{b
zBAH~#I+~vQIEeZA(OMGdZE|s;66qV{v^QnR(mv}CcH-`&E;U8(KKIab`|Z!AEv0C@
z%4nrUJV|T@y0wYF>etumGvlbz!{hO<g^<A-8Qh6HNQG>Z>CD0dZ&C7TqIJaywNz(=
zOK3N<9=BVLs!;z?R4yUfSTelI`4niRpN{jWpwsO+O3NaYYUpvJb5y}uiG$V^Db!No
zwJxV^%zA~OCES06$|a<OR<-kKGyQa>M+E|ua<T|-H1rBV3H(%D#eF4rRue=n{H)B1
zcEDt&>1k+=fs|;R%iL6rOC7SEy|@<HadqBGx1pdVf#4d`lmP7exw+lwOqdg?C}kKC
z8Nd{mw;Xv`*JKxH3DsPYh^qii5731FZ(8d%)PtrcXoBKH>9@_f`$$EOztEcF`DDFI
zNA}WRv*=wp-W!v-pvIl63dMS~SJ#R-FNfFz*b@42Vs7G7=jC5&7=JDx|E|78&!IYd
zu<FdgtAFf_rp@-ASW*<EG%IgRn$A3CQRdE!+Hkxv9+CkzWs;8%f}SSmooW8j?t$7Y
zsLA}*tSJiqMLQn233{}{3NXd#n`?pVH?O%1)y%wb5&mglGywB(R1BzPKD{C%i2fyB
zkp^xU?EfxKH`0BPyNk32tF!u^Ih0*S;1A6KDG2k7l>Wf^|KTaS4F4Zk{68!;68&p}
z)%jz>W%&L;^#8DC{gdnaY=M@V4JDtl{f{wp5+ry9oC({SKYY#R{FlBz!S?~e<9Ct%
znUT1=ui?>zf&iCd<z!96;_USZjA1*!2v=fbm5>7brBT4^v`{voRiVZzXzE+jLFk2v
zqyQg|)t~#NT^|2iw?1M-ncv77tL;QA51aG?9=Krpy?a4os7rE*8Nv*KKqw)k{u=3p
e9U8RY)9S^)tnk~<ArJ-9^xX~_3Sv3<2IN07!{i$P

diff --git a/Solutions/Global Secure Access/Package/mainTemplate.json b/Solutions/Global Secure Access/Package/mainTemplate.json
index 4ffc806cb7..0b5e05f3a7 100644
--- a/Solutions/Global Secure Access/Package/mainTemplate.json	
+++ b/Solutions/Global Secure Access/Package/mainTemplate.json	
@@ -52,14 +52,14 @@
     "_solutionVersion": "3.0.0",
     "solutionId": "azuresentinel.azure-sentinel-solution-globalsecureaccess",
     "_solutionId": "[variables('solutionId')]",
-    "workbookVersion1": "1.0.0",
+    "workbookVersion1": "1.0.1",
     "workbookContentId1": "GSAM365EnrichedEvents",
     "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
     "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
     "_workbookContentId1": "[variables('workbookContentId1')]",
     "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
     "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
-    "workbookVersion2": "1.0.0",
+    "workbookVersion2": "1.0.1",
     "workbookContentId2": "GSANetworkTraffic",
     "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]",
     "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]",
@@ -333,7 +333,7 @@
               },
               "properties": {
                 "displayName": "[parameters('workbook1-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Traffic Logs workbook\\n---\\n\\nLog information in the dashboard is limited to 30 days.\"},\"name\":\"text - 1\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The log analytic workspace in which to execute the queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"additionalResourceOptions\":[\"value::1\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::1\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"EnrichedMicrosoft365AuditLogsDemos_CL\\r\\n| summarize Count = count() by UserId_s\\r\\n| order by Count desc, UserId_s asc\\r\\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false\",\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"2b2cd1be-9d25-412c-8444-f005c4789b55\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"cc3e67f2-f20f-4430-8dee-d0773b90d9ce\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"All Traffic\",\"subTarget\":\"AllTraffic\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| project \\r\\n    Timestamp = createdDateTime_t,\\r\\n    User = userPrincipalName_s,\\r\\n    SourceIP = SourceIP,\\r\\n    DestinationIP = destinationIp_s,\\r\\n    DestinationPort = destinationPort_d,\\r\\n    Action = action_s,\\r\\n    PolicyName = policyName_s,\\r\\n    TransportProtocol = transportProtocol_s,\\r\\n    TrafficType = trafficType_s,\\r\\n    DestinationURL = destinationUrl_s,\\r\\n    ReceivedBytes = receivedBytes_d,\\r\\n    SentBytes = sentBytes_d,\\r\\n    DeviceOS = deviceOperatingSystem_s,\\r\\n    PolicyRuleID = policyRuleId_s\\r\\n| order by Timestamp desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Log\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"AllTraffic\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Unique Users\\nNetworkAccessDemo_CL\\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\n| summarize UniqueUsers=dcount(Country)\\n| extend snapshot = \\\"Total Locations\\\"\\n| project col1 = UniqueUsers, snapshot\\n\\n// Union with Unique Devices\\n| union (\\n    NetworkAccessDemo_CL\\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\\n    | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\n    | summarize TotalBytesGB = sum(BytesInGB)\\n    | extend snapshot = \\\"Total Bytes (GB)\\\"\\n    | project col1 =   tolong(TotalBytesGB), snapshot\\n)\\n\\n// Union with Total Internet Access\\n| union (\\n    NetworkAccessDemo_CL\\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\\n    | summarize TotalTransactions = count()\\n    | extend snapshot = \\\"Total Transactions\\\"\\n    | project col1 = TotalTransactions, snapshot\\n)\\n\\n// Union with Total Private Access\\n// Order by Snapshot for consistent tile ordering on dashboard\\n| order by snapshot\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"ExistingClients\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"ExistingClients\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"ExistingClients\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\r\\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\\r\\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\\r\\n| project createdDateTime_t, trafficType_s, TotalBytesGB\\r\\n\",\"size\":2,\"title\":\"Usage over Time (GB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 0\"}]},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\\r\\n| project  createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| where Country != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Locations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where tolower(action_s) == \\\"allow\\\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\\r\\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Top Allowed Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where tolower(action_s) == \\\"block\\\" and destinationFQDN_s != '' // Filter for allowed traffic\\r\\n| summarize Count = count() by destinationFQDN_s\\r\\n| top 100 by Count\",\"size\":0,\"title\":\"Top Blocked Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where tolower(action_s) == \\\"block\\\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\\r\\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":3,\"title\":\"Top Blocked Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where sentBytes_d > 0\\r\\n| where tolower(action_s) != \\\"block\\\" \\r\\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Top Allowed Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"magenta\"}},{\"columnMatch\":\"Recived\",\"formatter\":4,\"formatOptions\":{\"palette\":\"turquoise\"}},{\"columnMatch\":\"Total\",\"formatter\":4,\"formatOptions\":{\"palette\":\"pink\"}},{\"columnMatch\":\"Sent\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where transportProtocol_s != ''\\r\\n| summarize Count = count() by toupper(transportProtocol_s)\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Protocol Distburion\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"group - 4\"}],\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Enriched Microsoft 365 logs Workbook (Preview)\\n---\\n\\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::all\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The Log Analytic Workspace In Which To Execute The Queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| summarize Count = count() by UserId\\r\\n| order by Count desc, UserId asc\\r\\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"e841bafb-6437-4d29-84ac-ba16c5a6d901\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"ac5f2082-50bc-4739-bdf2-20c93b613671\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"SharePoint/OneDrive Insights\",\"subTarget\":\"Threat\",\"style\":\"link\"},{\"id\":\"dc2778e7-739b-44ba-9ae4-c81901277f57\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Exchange Online Insights\",\"subTarget\":\"ThreatEXO\",\"style\":\"link\"},{\"id\":\"666111e2-54ff-4fa4-a648-11a5c8c0235b\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Teams Insights\",\"subTarget\":\"ThreatTeams\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Exchange\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Exchange\\\")\\r\\n| summarize [\\\"Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Count\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Set-AdminAuditLogConfig\\\", \\\"Set-OrganizationConfig\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Audit Of Critical Configuration Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Set-TransportRule\\\", \\\"Set-AtpPolicyForO365\\\", \\\"Set-MalwareFilterRule\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Changes In Email Security Policies\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Add-RoleGroupMember\\\", \\\"Remove-ManagementRoleAssignment\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Monitoring Role Group Membership Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"New-TenantAllowBlockListSpoofitems\\\", \\\"Remove-TenantAllowBlockListSpoofitems\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Spoofing Settings Management Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"New-SafeAttachmentPolicy\\\", \\\"Set-SafeAttachmentPolicy\\\", \\\"Set-SafeAttachmentRule\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Safe Attachments Policy Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatEXO\"},\"name\":\"group - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs | where Workload == \\\"Exchange\\\" | where Operation in (\\\"Add-MailboxFolderPermission\\\", \\\"Add-RoleGroupMember\\\", \\\"New-TransportRule\\\", \\\"Remove-ManagementRoleAssignment\\\", \\\"Set-TransportRule\\\") | summarize Count = count(), Users = makeset(UserId) by Operation | order by Count desc\",\"size\":0,\"title\":\"Permission changes and security policy updates\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"seltab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatEXO\"},\"name\":\"query - 13\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Teams\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Teams\\\")\\r\\n| summarize [\\\"Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Count\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatTeams\"},\"name\":\"group - 10\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\",\\\"SPO/OneDrive\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"numberOfMetrics\":19,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| summarize [\\\"Event Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Event Count\\\"] desc\\r\\n\",\"size\":2,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 20\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"group - 20\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| where Operation in (\\\"MemberAdded\\\", \\\"MemberRemoved\\\", \\\"TeamDeleted\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Changes In Team Memberships\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatTeams\"},\"customWidth\":\"50\",\"name\":\"query - 11\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RiskyExtensions = dynamic([\\\"exe\\\", \\\"msi\\\", \\\"bat\\\", \\\"cmd\\\", \\\"com\\\", \\\"scr\\\", \\\"pif\\\", \\\"ps1\\\", \\\"vbs\\\", \\\"js\\\", \\\"jse\\\", \\\"wsf\\\", \\\"docm\\\", \\\"xlsm\\\", \\\"pptm\\\", \\\"dll\\\", \\\"ocx\\\", \\\"cpl\\\", \\\"app\\\", \\\"vb\\\", \\\"reg\\\", \\\"inf\\\", \\\"hta\\\"]);\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"SPO/OneDrive\\\")\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend [\\\"File Extension\\\"] = tostring(parse_json(AdditionalProperties).SourceFileExtension)\\r\\n| where [\\\"File Extension\\\"] in (RiskyExtensions)\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, [\\\"File Extension\\\"], Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], [\\\"File Extension\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], [\\\"File Extension\\\"], Operation, Count\\r\\n\",\"size\":0,\"title\":\"Risky File Operations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| where Operation in (\\\"FileRecycled\\\", \\\"FileDownloaded\\\", \\\"FileUploaded\\\", \\\"FileCreated\\\", \\\"File Modified\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Bulk File Events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"SPO/OneDrive\\\")\\r\\n| where Operation == \\\"FileDeletedFirstStageRecycleBin\\\"\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by bin(Timestamp, 1h), [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n| where Count > 1\\r\\n\",\"size\":0,\"title\":\" Bulk File Deletion Operations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileDeletions\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let baselinePeriod = 30d;\\r\\nlet detectionWindow = 1h;\\r\\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs\\r\\n| where TimeGenerated >= ago(baselinePeriod)\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| where Operation == \\\"FileDownloaded\\\"\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by bin(Timestamp, detectionWindow), [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Bulk File Download\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DownloadCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 4\"}]},\"name\":\"group - 9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n      | where tostring(Country) != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"minSize\":20,\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"numberOfMetrics\":8,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| summarize [\\\"Event Count\\\"] = count() by [\\\"Time Generated\\\"] = TimeGenerated, [\\\"User\\\"] = UserId, [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem, [\\\"Workload\\\"] = Workload\\r\\n| order by [\\\"Time Generated\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 1\"}]},\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| project \\r\\n    Operation, \\r\\n    UserId, \\r\\n    Workload, \\r\\n    SourceIp, \\r\\n    DeviceId, \\r\\n    TimeGenerated, \\r\\n    Details = pack_all(),\\r\\n    OS = tostring(DeviceOperatingSystem)\\r\\n| extend Workload = tostring(Workload)\\r\\n| extend WorkloadStatus = case(\\r\\n    Workload == \\\"Exchange\\\", \\\"Exchange\\\",\\r\\n    Workload == \\\"Teams\\\", \\\"Teams\\\",\\r\\n    Workload == \\\"SharePoint\\\", \\\"SharePoint\\\",\\r\\n    \\\"Other\\\"\\r\\n);\\r\\n\\r\\nlet appData = data\\r\\n| summarize \\r\\n    TotalCount = count(), \\r\\n    ExchangeCount = countif(Workload == \\\"Exchange\\\"), \\r\\n    TeamsCount = countif(Workload == \\\"Teams\\\"), \\r\\n    SharePointCount = countif(Workload == \\\"SharePoint\\\"), \\r\\n    OtherCount = countif(Workload == \\\"Other\\\") \\r\\n    by UserId\\r\\n| where UserId != ''\\r\\n| join kind=inner (\\r\\n    data\\r\\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId\\r\\n    | project-away TimeGenerated\\r\\n  ) on UserId\\r\\n| order by TotalCount desc, UserId asc\\r\\n| project UserId, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\\r\\n| serialize Id = row_number();\\r\\n\\r\\ndata\\r\\n| summarize \\r\\n    TotalCount = count(), \\r\\n    ExchangeCount = countif(Workload == \\\"Exchange\\\"), \\r\\n    TeamsCount = countif(Workload == \\\"Teams\\\"), \\r\\n    SharePointCount = countif(Workload == \\\"SharePoint\\\"), \\r\\n    OtherCount = countif(Workload == \\\"Other\\\") \\r\\n    by UserId, SourceIp = tostring(SourceIp)\\r\\n| join kind=inner (\\r\\n    data\\r\\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId, SourceIp\\r\\n    | project-away TimeGenerated\\r\\n  ) on UserId, SourceIp\\r\\n| order by TotalCount desc, UserId asc\\r\\n| project UserId, SourceIp, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\\r\\n| serialize Id = row_number(1000000)\\r\\n| join kind=inner (appData) on UserId\\r\\n| project Id, Name = SourceIp, Type = 'Client IP', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = Id1\\r\\n| union (\\r\\n    appData \\r\\n    | project Id, Name = UserId, Type = 'Operating System', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = -1\\r\\n  )\\r\\n| order by ['Events Count'] desc, Name asc\\r\\n\",\"size\":2,\"title\":\"Activity Log\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5},{\"columnMatch\":\"Type\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Other Count\",\"formatter\":5},{\"columnMatch\":\"ParentId\",\"formatter\":5},{\"columnMatch\":\"Operation Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Exchange Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},{\"columnMatch\":\"Teams Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"purple\"}},{\"columnMatch\":\"SharePoint Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\"}},{\"columnMatch\":\"Details\",\"formatter\":5,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\"}}},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<br />\\r\\n💡 _Click on a segment of the pie chart to explore more details_\"},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| extend \\r\\n    OS = coalesce(DeviceOperatingSystem, \\\"Unknown OS\\\"),\\r\\n    OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \\\"Unknown Version\\\")\\r\\n| summarize DeviceCount = count() by OS, OSVersion\\r\\n| order by DeviceCount desc\\r\\n\",\"size\":3,\"title\":\"Devices Accessing M365\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"Parampie\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend \\r\\n    [\\\"Operating System\\\"] = coalesce(DeviceOperatingSystem, \\\"Unknown OS\\\"),\\r\\n    [\\\"OS Version\\\"] = coalesce(tostring(DeviceOperatingSystemVersion), \\\"Unknown Version\\\"),\\r\\n    [\\\"Device ID\\\"] = coalesce(tostring(DeviceId), \\\"Unknown DeviceId\\\")\\r\\n| where [\\\"Operating System\\\"] == dynamic({Parampie}).label\\r\\n| summarize [\\\"Device Count\\\"] = count() by [\\\"Operating System\\\"], [\\\"OS Version\\\"], [\\\"Device ID\\\"]\\r\\n| order by [\\\"Device Count\\\"] desc\\r\\n\",\"size\":2,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":1}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"OperatingSystem\",\"OSVersion\"],\"expandTopLevel\":false}}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},{\"parameterName\":\"Parampie\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 1\"}]},\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let BusinessHoursStart = 8; // 8 AM\\r\\nlet BusinessHoursEnd = 18; // 6 PM\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs \\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend HourOfDay = hourofday(TimeGenerated)\\r\\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\\r\\n| summarize [\\\"Off-Hour Activities\\\"] = count() by [\\\"User ID\\\"] = UserId, [\\\"Date\\\"] = bin(TimeGenerated, 1d), [\\\"Operation\\\"]\\r\\n| order by [\\\"Off-Hour Activities\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Activity Outside Standard Working Hours (8:00 - 18:00)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\n| summarize Count = count() by bin(TimeGenerated, 1h)\\n| order by TimeGenerated asc\\n\",\"size\":0,\"title\":\"Microsoft 365 Transactions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"unstackedbar\"},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"}],\"fallbackResourceIds\":[\"Global Secure Access\"],\"fromTemplateId\":\"GSA Enriched Microsoft 365 logs\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
                 "version": "1.0",
                 "sourceId": "[variables('workspaceResourceId')]",
                 "category": "sentinel"
@@ -344,7 +344,7 @@
               "apiVersion": "2022-01-01-preview",
               "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
               "properties": {
-                "description": "@{workbookKey=GSAM365EnrichedEvents; logoFileName=gsa.svg; description=This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Global Secure Access Enriched M365 Logs; templateRelativePath=GSAM365EnrichedEvents.json; provider=Microsoft}.description",
+                "description": "@{workbookKey=GSAM365EnrichedEvents; logoFileName=gsa.svg; description=This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Global Secure Access Enriched M365 Logs; templateRelativePath=GSAM365EnrichedEvents.json; provider=Microsoft}.description",
                 "parentId": "[variables('workbookId1')]",
                 "contentId": "[variables('_workbookContentId1')]",
                 "kind": "Workbook",
@@ -417,7 +417,7 @@
               },
               "properties": {
                 "displayName": "[parameters('workbook2-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Traffic Logs workbook\\n---\\n\\nLog information in the dashboard is limited to 30 days.\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The log analytic workspace in which to execute the queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"additionalResourceOptions\":[\"value::1\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::1\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"EnrichedMicrosoft365AuditLogsDemos_CL\\r\\n| summarize Count = count() by UserId_s\\r\\n| order by Count desc, UserId_s asc\\r\\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false\",\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"2b2cd1be-9d25-412c-8444-f005c4789b55\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"cc3e67f2-f20f-4430-8dee-d0773b90d9ce\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"All Traffic\",\"subTarget\":\"AllTraffic\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| project \\r\\n    Timestamp = createdDateTime_t,\\r\\n    User = userPrincipalName_s,\\r\\n    SourceIP = SourceIP,\\r\\n    DestinationIP = destinationIp_s,\\r\\n    DestinationPort = destinationPort_d,\\r\\n    Action = action_s,\\r\\n    PolicyName = policyName_s,\\r\\n    TransportProtocol = transportProtocol_s,\\r\\n    TrafficType = trafficType_s,\\r\\n    DestinationURL = destinationUrl_s,\\r\\n    ReceivedBytes = receivedBytes_d,\\r\\n    SentBytes = sentBytes_d,\\r\\n    DeviceOS = deviceOperatingSystem_s,\\r\\n    PolicyRuleID = policyRuleId_s\\r\\n| order by Timestamp desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Log\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"AllTraffic\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Unique Users\\nNetworkAccessDemo_CL\\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\n| summarize UniqueUsers=dcount(Country)\\n| extend snapshot = \\\"Total Locations\\\"\\n| project col1 = UniqueUsers, snapshot\\n\\n// Union with Unique Devices\\n| union (\\n    NetworkAccessDemo_CL\\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\\n    | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\n    | summarize TotalBytesGB = sum(BytesInGB)\\n    | extend snapshot = \\\"Total Bytes (GB)\\\"\\n    | project col1 =   tolong(TotalBytesGB), snapshot\\n)\\n\\n// Union with Total Internet Access\\n| union (\\n    NetworkAccessDemo_CL\\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\\n    | summarize TotalTransactions = count()\\n    | extend snapshot = \\\"Total Trasnacations\\\"\\n    | project col1 = TotalTransactions, snapshot\\n)\\n\\n// Union with Total Private Access\\n// Order by Snapshot for consistent tile ordering on dashboard\\n| order by snapshot\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"ExistingClients\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"ExistingClients\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"ExistingClients\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\r\\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\\r\\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\\r\\n| project createdDateTime_t, trafficType_s, TotalBytesGB\\r\\n\",\"size\":2,\"title\":\"Usage over Time (GB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 0\"}]},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\\r\\n| project  createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| where Country != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\",\"size\":0,\"title\":\"Locations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where tolower(action_s) == \\\"allow\\\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\\r\\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Top Allowed Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where tolower(action_s) == \\\"block\\\" and destinationFQDN_s != '' // Filter for allowed traffic\\r\\n| summarize Count = count() by destinationFQDN_s\\r\\n| top 100 by Count\",\"size\":0,\"title\":\"Top Blocked Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where tolower(action_s) == \\\"block\\\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\\r\\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":3,\"title\":\"Top Blocked Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where sentBytes_d > 0\\r\\n| where tolower(action_s) != \\\"block\\\" \\r\\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Top Allowed Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"magenta\"}},{\"columnMatch\":\"Recived\",\"formatter\":4,\"formatOptions\":{\"palette\":\"turquoise\"}},{\"columnMatch\":\"Total\",\"formatter\":4,\"formatOptions\":{\"palette\":\"pink\"}},{\"columnMatch\":\"Sent\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessDemo_CL\\r\\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\\r\\n| where transportProtocol_s != ''\\r\\n| summarize Count = count() by toupper(transportProtocol_s)\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Protocol Distburion\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"group - 4\"}],\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Network Traffic Insights Workbook (Preview)\\n---\\nInformation in the dashboard is based on log data\\n\\n\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::all\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The Log Analytic Workspace In Which To Execute The Queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":2592000000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"NetworkAccessTraffic\\r\\n| summarize Count = count() by UserPrincipalName\\r\\n| order by Count desc, UserPrincipalName asc\\r\\n| project Value = UserPrincipalName, Label = strcat(UserPrincipalName, ' - ', Count, ' Logs'), Selected = false\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"527af4d2-3089-4aa4-9fbb-48ec697db20d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WebCategories\",\"label\":\"Web Categories\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"NetworkAccessTraffic\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| order by Count desc, firstCategory asc\\r\\n| project Value = firstCategory, Label = strcat(firstCategory, ' - ', Count, ' Logs')\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"2b2cd1be-9d25-412c-8444-f005c4789b55\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"cc3e67f2-f20f-4430-8dee-d0773b90d9ce\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"All Traffic\",\"subTarget\":\"AllTraffic\",\"style\":\"link\"},{\"id\":\"5ae54b5a-ac7b-4b7a-a1e1-1e574625caa3\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"URL Lookup\",\"subTarget\":\"URLLookup\",\"style\":\"link\"},{\"id\":\"68c566f8-957e-4a3f-8b66-730fc24135fb\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Insights\",\"subTarget\":\"Security\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkAccessTrafficData = NetworkAccessTraffic\\r\\n| where SourceIp != \\\"\\\" and isnotempty(SourceIp)\\r\\n| summarize arg_max(TimeGenerated, *) by SourceIp, TenantId;\\r\\n\\r\\nlet SigninLogsData = SigninLogs\\r\\n| where IPAddress != \\\"\\\" and isnotempty(IPAddress)\\r\\n| summarize arg_max(TimeGenerated, *) by IPAddress, TenantId, UserId, CorrelationId;\\r\\n\\r\\nSigninLogsData\\r\\n| join kind=leftanti (\\r\\n    NetworkAccessTrafficData\\r\\n    | where SourceIp != \\\"\\\" and isnotempty(SourceIp)\\r\\n) on $left.IPAddress == $right.SourceIp and $left.TenantId == $right.TenantId\\r\\n| project TimeGenerated, IPAddress, UserId, UserPrincipalName, AppDisplayName, DeviceDetail.deviceId\\r\\n\",\"size\":0,\"title\":\"Sign-ins Outside Global Secure Access\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Security\"},\"name\":\"group - 10\"},{\"type\":1,\"content\":{\"json\":\"💡 Type the URL for detailed analysis\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"text - 10\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ec8c38c8-3064-4921-8dcd-a69d3895599b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"URL\",\"type\":1,\"typeSettings\":{\"isSearchBox\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"parameters - 9\"},{\"type\":1,\"content\":{\"json\":\"# Web Categories\"},\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let CategoryData = NetworkAccessTraffic \\r\\n| where DestinationFqdn contains \\\"{URL}\\\"  // Filters logs based on the provided URL parameter\\r\\n| extend CategoriesList = split(DestinationWebCategories, \\\",\\\")  // Split categories into a list\\r\\n| mv-expand Category = CategoriesList  // Expand the list into individual rows\\r\\n| extend Category = trim_start(\\\" \\\", trim_end(\\\" \\\", tostring(Category)))  // Trim leading and trailing spaces\\r\\n| extend Category = iff(TrafficType == \\\"microsoft365\\\", \\\"Microsoft M365\\\", Category)  // Set category to \\\"Microsoft M365\\\" if TrafficType is \\\"microsoft365\\\"\\r\\n| summarize UniqueCategories = make_set(Category);  // Create a set of unique categories\\r\\n\\r\\nCategoryData\\r\\n| extend \\r\\n    PrimaryCategory = iff(array_length(UniqueCategories) > 0, tostring(UniqueCategories[0]), \\\"None\\\")\\r\\n| project \\r\\n    col1 = PrimaryCategory,\\r\\n    snapshot = \\\"Primary Category\\\"\\r\\n\\r\\n| union (\\r\\n    CategoryData\\r\\n    | extend \\r\\n        SecondaryCategory = iff(array_length(UniqueCategories) > 1, tostring(UniqueCategories[1]), \\\"None\\\")\\r\\n    | project \\r\\n        col1 = SecondaryCategory,\\r\\n        snapshot = \\\"Secondary Category\\\"\\r\\n)\\r\\n\\r\\n| order by snapshot asc\\r\\n\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\"},\"leftContent\":{\"columnMatch\":\"col1\",\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"# Traffic Access Details\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkData = NetworkAccessTraffic\\r\\n| where DestinationFqdn contains \\\"{URL}\\\";  // Filters logs based on the provided URL parameter\\r\\n\\r\\nNetworkData\\r\\n| summarize \\r\\n    UniqueUsers = dcount(UserPrincipalName),\\r\\n    UniqueDevices = dcount(DeviceId),    \\r\\n    TotalAllow = countif(Action == \\\"Allow\\\"),\\r\\n    TotalBlock = countif(Action == \\\"Block\\\")\\r\\n| project \\r\\n    col1 = UniqueUsers, \\r\\n    snapshot = \\\"Unique Users\\\"\\r\\n| union (NetworkData\\r\\n    | summarize UniqueDevices = dcount(DeviceId)\\r\\n    | project col1 = UniqueDevices, snapshot = \\\"Unique Devices\\\")\\r\\n| union (NetworkData\\r\\n    | summarize TotalAllow = countif(Action == \\\"Allow\\\")\\r\\n    | project col1 = TotalAllow, snapshot = \\\"Total Allow\\\")\\r\\n| union (NetworkData\\r\\n    | summarize TotalBlock = countif(Action == \\\"Block\\\")\\r\\n    | project col1 = TotalBlock, snapshot = \\\"Total Block\\\")\\r\\n| order by snapshot asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"name\":\"query - 14\"},{\"type\":1,\"content\":{\"json\":\"# Bandwidth Usage\"},\"name\":\"text - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkData = NetworkAccessTraffic\\r\\n| where DestinationFqdn contains \\\"{URL}\\\";  // Filters logs based on the provided URL parameter\\r\\n\\r\\nNetworkData\\r\\n| summarize \\r\\n    TotalSent = sum(SentBytes),\\r\\n    TotalReceived = sum(ReceivedBytes),\\r\\n    TotalBandwidth = sum(SentBytes + ReceivedBytes)\\r\\n| extend \\r\\n    TotalSentMB = round(TotalSent / 1024.0 / 1024.0, 2),\\r\\n    TotalReceivedMB = round(TotalReceived / 1024.0 / 1024.0, 2),\\r\\n    TotalBandwidthMB = round(TotalBandwidth / 1024.0 / 1024.0, 2)\\r\\n| project \\r\\n    TotalSentMB,\\r\\n    TotalReceivedMB,\\r\\n    TotalBandwidthMB\\r\\n| extend dummy = 1\\r\\n| project-away dummy\\r\\n| mv-expand \\r\\n    Column = pack_array(\\\"TotalSentMB\\\", \\\"TotalReceivedMB\\\", \\\"TotalBandwidthMB\\\"),\\r\\n    Value = pack_array(TotalSentMB, TotalReceivedMB, TotalBandwidthMB)\\r\\n| extend \\r\\n    snapshot = case(\\r\\n        Column == \\\"TotalSentMB\\\", \\\"Total Sent (MB)\\\",\\r\\n        Column == \\\"TotalReceivedMB\\\", \\\"Total Received (MB)\\\",\\r\\n        Column == \\\"TotalBandwidthMB\\\", \\\"Total Bandwidth (MB)\\\",\\r\\n        \\\"Unknown\\\"\\r\\n    ),\\r\\n    col1 = iff(Value < 0.01, 0.00, Value)\\r\\n| project-away Column, Value\\r\\n| order by snapshot asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"# Traffic Logs (filtered)\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where DestinationFqdn contains \\\"{URL}\\\"\\r\\n| project \\r\\n    Timestamp = TimeGenerated,\\r\\n    User = UserPrincipalName,\\r\\n    [\\\"Source IP\\\"] = SourceIp,\\r\\n    [\\\"Destination IP\\\"] = DestinationIp,\\r\\n    [\\\"Destination Port\\\"] = DestinationPort,\\r\\n    [\\\"Destination FQDN\\\"] = DestinationFqdn,\\r\\n    Action = case(\\r\\n        tolower(Action) == \\\"allow\\\", \\\"🟢 Allow\\\", \\r\\n        tolower(Action) == \\\"block\\\", \\\"🔴 Block\\\", \\r\\n        tolower(Action) // This returns the action in lowercase if it doesn't match \\\"allow\\\" or \\\"block\\\"\\r\\n    ),\\r\\n    [\\\"Policy Name\\\"] = PolicyName,\\r\\n    [\\\"Policy Rule ID\\\"] = PolicyRuleId,\\r\\n    [\\\"Received Bytes\\\"] = ReceivedBytes,\\r\\n    [\\\"Sent Bytes\\\"] = SentBytes,\\r\\n    [\\\"Device OS\\\"] = DeviceOperatingSystem    \\r\\n| order by Timestamp desc\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"name\":\"query - 13\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"group - URL Lookup\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| project \\r\\n    Timestamp = TimeGenerated,\\r\\n    User = UserPrincipalName,\\r\\n    [\\\"Source IP\\\"] = SourceIp,\\r\\n    [\\\"Destination IP\\\"] = DestinationIp,\\r\\n    [\\\"Destination Port\\\"] = DestinationPort,\\r\\n    [\\\"Destination FQDN\\\"] = DestinationFqdn,\\r\\n    Action = case(\\r\\n        tolower(Action) == \\\"allow\\\", \\\"🟢 Allow\\\", \\r\\n        tolower(Action) == \\\"block\\\", \\\"🔴 Block\\\", \\r\\n        tolower(Action) // This returns the action in lowercase if it doesn't match \\\"allow\\\" or \\\"block\\\"\\r\\n    ),\\r\\n    [\\\"Policy Name\\\"] = PolicyName,\\r\\n    [\\\"Web Category\\\"] = DestinationWebCategories,\\r\\n    [\\\"Transport Protocol\\\"] = TransportProtocol,\\r\\n    [\\\"Traffic Type\\\"] = TrafficType,\\r\\n    [\\\"Received Bytes\\\"] = ReceivedBytes,\\r\\n    [\\\"Sent Bytes\\\"] = SentBytes,\\r\\n    [\\\"Device OS\\\"] = DeviceOperatingSystem,\\r\\n    [\\\"Policy Rule ID\\\"] = PolicyRuleId\\r\\n| order by Timestamp desc\\r\\n\",\"size\":3,\"title\":\"Traffic Logs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"AllTraffic\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Unique Users\\nNetworkAccessTraffic\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\\n| project SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\n| summarize UniqueUsers=dcount(Country)\\n| extend snapshot = \\\"Total Locations\\\"\\n| project col1 = UniqueUsers, snapshot\\n\\n// Union with Unique Devices\\n| union (\\n    NetworkAccessTraffic\\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\\n    | extend BytesInGB = todouble(SentBytes + ReceivedBytes) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\n    | summarize TotalBytesGB = sum(BytesInGB)\\n    | extend snapshot = \\\"Total Bytes (GB)\\\"\\n    | project col1 =   tolong(TotalBytesGB), snapshot\\n)\\n\\n// Union with Total Internet Access\\n| union (\\n    NetworkAccessTraffic\\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\\n    | summarize TotalTransactions = count()\\n    | extend snapshot = \\\"Total Transactions\\\"\\n    | project col1 = TotalTransactions, snapshot\\n)\\n\\n// Union with Total Private Access\\n// Order by Snapshot for consistent tile ordering on dashboard\\n| order by snapshot\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"ExistingClients\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"ExistingClients\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"ExistingClients\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend BytesIn = todouble(SentBytes + ReceivedBytes) / (1024 * 1024)  // Convert bytes to Mbytes\\r\\n| summarize TotalBytesMB = sum(BytesIn) by bin(TimeGenerated, 1h), TrafficType\\r\\n| order by bin(TimeGenerated, 1h) asc, TrafficType asc\\r\\n| project TimeGenerated, TrafficType, TotalBytesMB\\r\\n\",\"size\":2,\"title\":\"Usage Over Time (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 0\"}]},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\\r\\n| project  TimeGenerated, SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| where Country != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\",\"size\":3,\"title\":\"Locations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"allow\\\" and DestinationWebCategories != '' // Filter for allowed traffic\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Top Allowed Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"block\\\" and DestinationWebCategories != '' // Filter for blocked traffic\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":3,\"title\":\"Top Blocked Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic  \\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"block\\\" and DestinationFqdn != ''  // Filter for blocked traffic with non-empty Destination FQDN\\r\\n| summarize Count = count() by [\\\"Destination FQDN\\\"] = DestinationFqdn, [\\\"Destination Web Categories\\\"] = DestinationWebCategories, [\\\"Policy Name\\\"] = PolicyName\\r\\n| order by Count\\r\\n\",\"size\":0,\"title\":\"Top Blocked Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":1000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_3\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_3\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where SentBytes > 0\\r\\n| where tolower(Action) != \\\"block\\\"\\r\\n| summarize \\r\\n    Count = count(), \\r\\n    [\\\"Sent Bytes\\\"] = sum(SentBytes), \\r\\n    [\\\"Received Bytes\\\"] = sum(ReceivedBytes), \\r\\n    [\\\"Total Bytes\\\"] = sum(ReceivedBytes + SentBytes) \\r\\n    by [\\\"Destination FQDN\\\"] = DestinationFqdn\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Top Allowed Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"magenta\"}},{\"columnMatch\":\"Recived\",\"formatter\":4,\"formatOptions\":{\"palette\":\"turquoise\"}},{\"columnMatch\":\"Total\",\"formatter\":4,\"formatOptions\":{\"palette\":\"pink\"}},{\"columnMatch\":\"Sent\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":1000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_1\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where TransportProtocol != ''\\r\\n| summarize Count = count() by toupper(TransportProtocol)\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Protocol Distribution\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"group - 4\"}],\"fallbackResourceIds\":[\"Global Secure Access\"],\"fromTemplateId\":\"GSA Network Traffic Insights\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
                 "version": "1.0",
                 "sourceId": "[variables('workspaceResourceId')]",
                 "category": "sentinel"
@@ -428,7 +428,7 @@
               "apiVersion": "2022-01-01-preview",
               "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]",
               "properties": {
-                "description": "@{workbookKey=GSANetworkTraffic; logoFileName=gsa.svg; description=This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Global Secure Access Traffic Logs; templateRelativePath=GSANetworkTraffic.json; subtitle=; provider=Microsoft}.description",
+                "description": "@{workbookKey=GSANetworkTraffic; logoFileName=gsa.svg; description=This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Global Secure Access Traffic Logs; templateRelativePath=GSANetworkTraffic.json; subtitle=; provider=Microsoft}.description",
                 "parentId": "[variables('workbookId2')]",
                 "contentId": "[variables('_workbookContentId2')]",
                 "kind": "Workbook",
diff --git a/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json b/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json
index 39b4440aa1..ea40be7808 100644
--- a/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json	
+++ b/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json	
@@ -977,6 +977,6 @@
   "fallbackResourceIds": [
     "Global Secure Access"
   ],
-  "fromTemplateId": "community-Workbooks/Global Secure Access/Microsoft Entra Internet Access/Enriched Microsoft 365 logs",
+  "fromTemplateId": "GSA Enriched Microsoft 365 logs",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
 }
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json b/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json
index 92c9d904ea..e4e50d998a 100644
--- a/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json	
+++ b/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json	
@@ -782,6 +782,6 @@
   "fallbackResourceIds": [
     "Global Secure Access"
   ],
-  "fromTemplateId": "community-Workbooks/Global Secure Access/Common/Network Traffic Insights",
+  "fromTemplateId": "GSA Network Traffic Insights",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
 }
\ No newline at end of file
diff --git a/Workbooks/GSAM365EnrichedEvents.json b/Workbooks/GSAM365EnrichedEvents.json
index 461ba0feb5..ea40be7808 100644
--- a/Workbooks/GSAM365EnrichedEvents.json
+++ b/Workbooks/GSAM365EnrichedEvents.json
@@ -4,15 +4,17 @@
     {
       "type": 1,
       "content": {
-        "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+        "json": "## Enriched Microsoft 365 logs Workbook (Preview)\n---\n\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps."
       },
-      "name": "text - 1"
+      "name": "text - 2"
     },
     {
       "type": 9,
       "content": {
         "version": "KqlParameterItem/1.0",
-        "crossComponentResources": [],
+        "crossComponentResources": [
+          "value::all"
+        ],
         "parameters": [
           {
             "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
@@ -20,24 +22,25 @@
             "name": "LogAnalyticWorkspace",
             "label": "Log Analytic Workspace",
             "type": 5,
-            "description": "The log analytic workspace in which to execute the queries",
+            "description": "The Log Analytic Workspace In Which To Execute The Queries",
             "isRequired": true,
             "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+            "crossComponentResources": [
+              "value::all"
+            ],
             "typeSettings": {
               "resourceTypeFilter": {
                 "microsoft.operationalinsights/workspaces": true
               },
-              "additionalResourceOptions": [
-                "value::1"
-              ],
+              "additionalResourceOptions": [],
               "showDefault": false
             },
             "timeContext": {
               "durationMs": 86400000
             },
-            "defaultValue": "value::1",
             "queryType": 1,
-            "resourceType": "microsoft.resourcegraph/resources"
+            "resourceType": "microsoft.resourcegraph/resources",
+            "value": null
           },
           {
             "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
@@ -106,7 +109,10 @@
             "multiSelect": true,
             "quote": "'",
             "delimiter": ",",
-            "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+            "query": "EnrichedMicrosoft365AuditLogs\r\n| summarize Count = count() by UserId\r\n| order by Count desc, UserId asc\r\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false",
+            "crossComponentResources": [
+              "{LogAnalyticWorkspace}"
+            ],
             "typeSettings": {
               "limitSelectTo": 20,
               "additionalResourceOptions": [
@@ -128,7 +134,7 @@
         ],
         "style": "pills",
         "queryType": 1,
-        "resourceType": "microsoft.operationalinsights/workspaces"
+        "resourceType": "microsoft.resourcegraph/resources"
       },
       "name": "parameters - 15"
     },
@@ -137,21 +143,38 @@
       "content": {
         "version": "LinkItem/1.0",
         "style": "tabs",
+        "tabStyle": "bigger",
         "links": [
           {
-            "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
-            "cellValue": "tabSel",
+            "id": "e841bafb-6437-4d29-84ac-ba16c5a6d901",
+            "cellValue": "selTab",
             "linkTarget": "parameter",
             "linkLabel": "Overview",
             "subTarget": "Overview",
             "style": "link"
           },
           {
-            "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
-            "cellValue": "tabSel",
+            "id": "ac5f2082-50bc-4739-bdf2-20c93b613671",
+            "cellValue": "selTab",
+            "linkTarget": "parameter",
+            "linkLabel": "SharePoint/OneDrive Insights",
+            "subTarget": "Threat",
+            "style": "link"
+          },
+          {
+            "id": "dc2778e7-739b-44ba-9ae4-c81901277f57",
+            "cellValue": "selTab",
             "linkTarget": "parameter",
-            "linkLabel": "All Traffic",
-            "subTarget": "AllTraffic",
+            "linkLabel": "Exchange Online Insights",
+            "subTarget": "ThreatEXO",
+            "style": "link"
+          },
+          {
+            "id": "666111e2-54ff-4fa4-a648-11a5c8c0235b",
+            "cellValue": "selTab",
+            "linkTarget": "parameter",
+            "linkLabel": "Teams Insights",
+            "subTarget": "ThreatTeams",
             "style": "link"
           }
         ]
@@ -159,77 +182,179 @@
       "name": "links - 7"
     },
     {
-      "type": 3,
+      "type": 12,
       "content": {
-        "version": "KqlItem/1.0",
-        "query": "NetworkAccessDemo_CL\r\n| project \r\n    Timestamp = createdDateTime_t,\r\n    User = userPrincipalName_s,\r\n    SourceIP = SourceIP,\r\n    DestinationIP = destinationIp_s,\r\n    DestinationPort = destinationPort_d,\r\n    Action = action_s,\r\n    PolicyName = policyName_s,\r\n    TransportProtocol = transportProtocol_s,\r\n    TrafficType = trafficType_s,\r\n    DestinationURL = destinationUrl_s,\r\n    ReceivedBytes = receivedBytes_d,\r\n    SentBytes = sentBytes_d,\r\n    DeviceOS = deviceOperatingSystem_s,\r\n    PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
-        "size": 3,
-        "showAnalytics": true,
-        "title": "Log",
-        "timeContextFromParameter": "TimeRange",
-        "showExportToExcel": true,
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "gridSettings": {
-          "rowLimit": 1000,
-          "filter": true
-        }
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Exchange\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
+              "size": 0,
+              "title": "Access By Location",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "CountryRegion",
+                "locInfoColumn": "Country",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "Count",
+                "sizeAggregation": "Sum",
+                "labelSettings": "Country",
+                "legendMetric": "Count",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "Count",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "turquoise"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Exchange\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n",
+              "size": 0,
+              "title": "Access By Location And OS",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 1"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Set-AdminAuditLogConfig\", \"Set-OrganizationConfig\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Audit Of Critical Configuration Changes",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Set-TransportRule\", \"Set-AtpPolicyForO365\", \"Set-MalwareFilterRule\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Changes In Email Security Policies",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Add-RoleGroupMember\", \"Remove-ManagementRoleAssignment\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Monitoring Role Group Membership Changes",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"New-TenantAllowBlockListSpoofitems\", \"Remove-TenantAllowBlockListSpoofitems\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Spoofing Settings Management Activities",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"New-SafeAttachmentPolicy\", \"Set-SafeAttachmentPolicy\", \"Set-SafeAttachmentRule\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Safe Attachments Policy Changes",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 6"
+          }
+        ]
       },
       "conditionalVisibility": {
-        "parameterName": "tabSel",
+        "parameterName": "selTab",
         "comparison": "isEqualTo",
-        "value": "AllTraffic"
+        "value": "ThreatEXO"
       },
-      "name": "query - 6"
+      "name": "group - 18"
     },
     {
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Transactions\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
-        "size": 4,
-        "timeContextFromParameter": "TimeRange",
+        "query": "EnrichedMicrosoft365AuditLogs | where Workload == \"Exchange\" | where Operation in (\"Add-MailboxFolderPermission\", \"Add-RoleGroupMember\", \"New-TransportRule\", \"Remove-ManagementRoleAssignment\", \"Set-TransportRule\") | summarize Count = count(), Users = makeset(UserId) by Operation | order by Count desc",
+        "size": 0,
+        "title": "Permission changes and security policy updates",
+        "timeContext": {
+          "durationMs": 86400000
+        },
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
-        "visualization": "tiles",
-        "tileSettings": {
-          "titleContent": {
-            "columnMatch": "snapshot",
-            "formatter": 1
-          },
-          "leftContent": {
-            "columnMatch": "col1",
-            "formatter": 12,
-            "formatOptions": {
-              "palette": "auto"
-            }
-          },
-          "showBorder": true,
-          "size": "auto"
-        },
-        "mapSettings": {
-          "locInfo": "LatLong",
-          "sizeSettings": "ExistingClients",
-          "sizeAggregation": "Sum",
-          "legendMetric": "ExistingClients",
-          "legendAggregation": "Sum",
-          "itemColorSettings": {
-            "type": "heatmap",
-            "colorAggregation": "Sum",
-            "nodeColorField": "ExistingClients",
-            "heatmapPalette": "greenRed"
-          }
-        },
-        "textSettings": {
-          "style": "bignumber"
-        }
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ]
       },
       "conditionalVisibility": {
-        "parameterName": "tabSel",
+        "parameterName": "seltab",
         "comparison": "isEqualTo",
-        "value": "Overview"
+        "value": "ThreatEXO"
       },
-      "name": "query - 2"
+      "name": "query - 13"
     },
     {
       "type": 12,
@@ -241,24 +366,62 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
-              "size": 2,
-              "title": "Usage over Time (GB)",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Teams\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
+              "size": 0,
+              "title": "Access By Location",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "barchart"
-            },
-            "conditionalVisibility": {
-              "parameterName": "tabSel",
-              "comparison": "isEqualTo",
-              "value": "Overview"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "CountryRegion",
+                "locInfoColumn": "Country",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "Count",
+                "sizeAggregation": "Sum",
+                "labelSettings": "Country",
+                "legendMetric": "Count",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "Count",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "turquoise"
+                }
+              }
             },
+            "customWidth": "50",
             "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Teams\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n",
+              "size": 0,
+              "title": "Access By Location And OS",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "customWidth": "50",
+            "name": "query - 1"
           }
         ]
       },
-      "name": "group - 5"
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "ThreatTeams"
+      },
+      "name": "group - 10"
     },
     {
       "type": 12,
@@ -270,12 +433,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project  createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"OneDrive\", \"SharePoint\",\"SPO/OneDrive\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
               "size": 0,
-              "title": "Locations",
+              "title": "Access By Location",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "map",
               "mapSettings": {
                 "locInfo": "CountryRegion",
@@ -286,6 +452,7 @@
                 "sizeAggregation": "Sum",
                 "labelSettings": "Country",
                 "legendMetric": "Country",
+                "numberOfMetrics": 19,
                 "legendAggregation": "Count",
                 "itemColorSettings": {
                   "nodeColorField": "Count",
@@ -296,88 +463,190 @@
               }
             },
             "customWidth": "50",
-            "name": "query - 0"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 19"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| summarize [\"Event Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Event Count\"] desc\r\n",
               "size": 2,
-              "title": "Top Allowed Web Categories",
+              "title": "Access By Location And OS",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "piechart"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "filter": true
+              }
             },
             "customWidth": "50",
-            "name": "query - 7"
-          },
+            "name": "query - 20"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "Threat"
+      },
+      "name": "group - 20",
+      "styleSettings": {
+        "showBorder": true
+      }
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload == \"Teams\"\r\n| where Operation in (\"MemberAdded\", \"MemberRemoved\", \"TeamDeleted\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+        "size": 0,
+        "title": "Changes In Team Memberships",
+        "timeContextFromParameter": "TimeRange",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "ThreatTeams"
+      },
+      "customWidth": "50",
+      "name": "query - 11"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
+              "query": "let RiskyExtensions = dynamic([\"exe\", \"msi\", \"bat\", \"cmd\", \"com\", \"scr\", \"pif\", \"ps1\", \"vbs\", \"js\", \"jse\", \"wsf\", \"docm\", \"xlsm\", \"pptm\", \"dll\", \"ocx\", \"cpl\", \"app\", \"vb\", \"reg\", \"inf\", \"hta\"]);\r\n\r\nEnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"SPO/OneDrive\")\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend [\"File Extension\"] = tostring(parse_json(AdditionalProperties).SourceFileExtension)\r\n| where [\"File Extension\"] in (RiskyExtensions)\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, [\"File Extension\"], Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], [\"File Extension\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], [\"File Extension\"], Operation, Count\r\n",
               "size": 0,
-              "title": "Top Blocked Destinations",
+              "title": "Risky File Operations",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces"
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "OperationCount",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ]
+              }
             },
             "customWidth": "50",
-            "name": "query - 5"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 1"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
-              "size": 3,
-              "title": "Top Blocked Web Categories",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation in (\"FileRecycled\", \"FileDownloaded\", \"FileUploaded\", \"FileCreated\", \"File Modified\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Bulk File Events",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "piechart"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "OperationCount",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ]
+              }
             },
             "customWidth": "50",
-            "name": "query - 6"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 8"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"SPO/OneDrive\")\r\n| where Operation == \"FileDeletedFirstStageRecycleBin\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by bin(Timestamp, 1h), [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n| where Count > 1\r\n",
               "size": 0,
-              "title": "Top Allowed Destinations",
+              "title": " Bulk File Deletion Operations",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "gridSettings": {
                 "formatters": [
                   {
-                    "columnMatch": "Count",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "magenta"
-                    }
-                  },
-                  {
-                    "columnMatch": "Recived",
-                    "formatter": 4,
+                    "columnMatch": "FileDeletions",
+                    "formatter": 8,
                     "formatOptions": {
-                      "palette": "turquoise"
-                    }
-                  },
-                  {
-                    "columnMatch": "Total",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "pink"
+                      "palette": "blue"
                     }
-                  },
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let baselinePeriod = 30d;\r\nlet detectionWindow = 1h;\r\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\r\n\r\nEnrichedMicrosoft365AuditLogs\r\n| where TimeGenerated >= ago(baselinePeriod)\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation == \"FileDownloaded\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by bin(Timestamp, detectionWindow), [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
+              "size": 0,
+              "title": "Bulk File Download",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
                   {
-                    "columnMatch": "Sent",
-                    "formatter": 4,
+                    "columnMatch": "DownloadCount",
+                    "formatter": 8,
                     "formatOptions": {
                       "palette": "blue"
                     }
@@ -386,33 +655,328 @@
               }
             },
             "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Threat"
+            },
+            "name": "query - 4"
+          }
+        ]
+      },
+      "name": "group - 9"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n      | where tostring(Country) != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n\r\n",
+              "size": 0,
+              "title": "Access By Location",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "CountryRegion",
+                "locInfoColumn": "Country",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "Count",
+                "sizeAggregation": "Sum",
+                "minSize": 20,
+                "labelSettings": "Country",
+                "legendMetric": "Country",
+                "numberOfMetrics": 8,
+                "legendAggregation": "Count",
+                "itemColorSettings": {
+                  "nodeColorField": "Count",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "turquoise"
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
+            "name": "query - 5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| summarize [\"Event Count\"] = count() by [\"Time Generated\"] = TimeGenerated, [\"User\"] = UserId, [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem, [\"Workload\"] = Workload\r\n| order by [\"Time Generated\"] desc\r\n",
+              "size": 0,
+              "title": "Access By Location And OS",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "rowLimit": 1000,
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
             "name": "query - 1"
+          }
+        ]
+      },
+      "name": "group - 19"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "let data = EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| project \r\n    Operation, \r\n    UserId, \r\n    Workload, \r\n    SourceIp, \r\n    DeviceId, \r\n    TimeGenerated, \r\n    Details = pack_all(),\r\n    OS = tostring(DeviceOperatingSystem)\r\n| extend Workload = tostring(Workload)\r\n| extend WorkloadStatus = case(\r\n    Workload == \"Exchange\", \"Exchange\",\r\n    Workload == \"Teams\", \"Teams\",\r\n    Workload == \"SharePoint\", \"SharePoint\",\r\n    \"Other\"\r\n);\r\n\r\nlet appData = data\r\n| summarize \r\n    TotalCount = count(), \r\n    ExchangeCount = countif(Workload == \"Exchange\"), \r\n    TeamsCount = countif(Workload == \"Teams\"), \r\n    SharePointCount = countif(Workload == \"SharePoint\"), \r\n    OtherCount = countif(Workload == \"Other\") \r\n    by UserId\r\n| where UserId != ''\r\n| join kind=inner (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId\r\n    | project-away TimeGenerated\r\n  ) on UserId\r\n| order by TotalCount desc, UserId asc\r\n| project UserId, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\r\n| serialize Id = row_number();\r\n\r\ndata\r\n| summarize \r\n    TotalCount = count(), \r\n    ExchangeCount = countif(Workload == \"Exchange\"), \r\n    TeamsCount = countif(Workload == \"Teams\"), \r\n    SharePointCount = countif(Workload == \"SharePoint\"), \r\n    OtherCount = countif(Workload == \"Other\") \r\n    by UserId, SourceIp = tostring(SourceIp)\r\n| join kind=inner (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId, SourceIp\r\n    | project-away TimeGenerated\r\n  ) on UserId, SourceIp\r\n| order by TotalCount desc, UserId asc\r\n| project UserId, SourceIp, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on UserId\r\n| project Id, Name = SourceIp, Type = 'Client IP', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = Id1\r\n| union (\r\n    appData \r\n    | project Id, Name = UserId, Type = 'Operating System', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = -1\r\n  )\r\n| order by ['Events Count'] desc, Name asc\r\n",
+        "size": 2,
+        "title": "Activity Log",
+        "timeContextFromParameter": "TimeRange",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
+        "gridSettings": {
+          "formatters": [
+            {
+              "columnMatch": "Id",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "Type",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "Trend",
+              "formatter": 9,
+              "formatOptions": {
+                "palette": "blue"
+              }
+            },
+            {
+              "columnMatch": "Other Count",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "ParentId",
+              "formatter": 5
+            },
+            {
+              "columnMatch": "Operation Count",
+              "formatter": 8,
+              "formatOptions": {
+                "palette": "blue"
+              }
+            },
+            {
+              "columnMatch": "Exchange Count",
+              "formatter": 8,
+              "formatOptions": {
+                "min": 0,
+                "palette": "blue"
+              }
+            },
+            {
+              "columnMatch": "Teams Count",
+              "formatter": 8,
+              "formatOptions": {
+                "min": 0,
+                "palette": "purple"
+              }
+            },
+            {
+              "columnMatch": "SharePoint Count",
+              "formatter": 8,
+              "formatOptions": {
+                "min": 0,
+                "palette": "turquoise"
+              }
+            },
+            {
+              "columnMatch": "Details",
+              "formatter": 5,
+              "formatOptions": {
+                "linkTarget": "GenericDetails",
+                "linkIsContextBlade": true
+              }
+            }
+          ],
+          "rowLimit": 1000,
+          "filter": true,
+          "hierarchySettings": {
+            "idColumn": "Id",
+            "parentColumn": "ParentId",
+            "treeType": 0,
+            "expanderColumn": "Name"
+          }
+        }
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "Overview"
+      },
+      "name": "query - 6"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<br />\r\n💡 _Click on a segment of the pie chart to explore more details_"
+            },
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
+            "name": "text - 2"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
-              "size": 2,
-              "title": "Protocol Distburion",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| extend \r\n    OS = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n    OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\")\r\n| summarize DeviceCount = count() by OS, OSVersion\r\n| order by DeviceCount desc\r\n",
+              "size": 3,
+              "title": "Devices Accessing M365",
               "timeContextFromParameter": "TimeRange",
+              "exportParameterName": "Parampie",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "piechart"
             },
             "customWidth": "50",
-            "name": "query - 3"
+            "conditionalVisibility": {
+              "parameterName": "selTab",
+              "comparison": "isEqualTo",
+              "value": "Overview"
+            },
+            "name": "query - 6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend \r\n    [\"Operating System\"] = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n    [\"OS Version\"] = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\"),\r\n    [\"Device ID\"] = coalesce(tostring(DeviceId), \"Unknown DeviceId\")\r\n| where [\"Operating System\"] == dynamic({Parampie}).label\r\n| summarize [\"Device Count\"] = count() by [\"Operating System\"], [\"OS Version\"], [\"Device ID\"]\r\n| order by [\"Device Count\"] desc\r\n",
+              "size": 2,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "$gen_group",
+                    "formatter": 1
+                  }
+                ],
+                "hierarchySettings": {
+                  "treeType": 1,
+                  "groupBy": [
+                    "OperatingSystem",
+                    "OSVersion"
+                  ],
+                  "expandTopLevel": false
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibilities": [
+              {
+                "parameterName": "selTab",
+                "comparison": "isEqualTo",
+                "value": "Overview"
+              },
+              {
+                "parameterName": "Parampie",
+                "comparison": "isNotEqualTo"
+              }
+            ],
+            "name": "query - 1"
           }
         ]
       },
+      "name": "group - 19"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "let BusinessHoursStart = 8; // 8 AM\r\nlet BusinessHoursEnd = 18; // 6 PM\r\n\r\nEnrichedMicrosoft365AuditLogs \r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend HourOfDay = hourofday(TimeGenerated)\r\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\r\n| summarize [\"Off-Hour Activities\"] = count() by [\"User ID\"] = UserId, [\"Date\"] = bin(TimeGenerated, 1d), [\"Operation\"]\r\n| order by [\"Off-Hour Activities\"] desc\r\n",
+        "size": 0,
+        "title": "Activity Outside Standard Working Hours (8:00 - 18:00)",
+        "timeContextFromParameter": "TimeRange",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selTab",
+        "comparison": "isEqualTo",
+        "value": "Overview"
+      },
+      "name": "query - 14"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "EnrichedMicrosoft365AuditLogs\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc\n",
+        "size": 0,
+        "title": "Microsoft 365 Transactions",
+        "timeContextFromParameter": "TimeRange",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
+        "visualization": "unstackedbar"
+      },
       "conditionalVisibility": {
-        "parameterName": "tabSel",
+        "parameterName": "selTab",
         "comparison": "isEqualTo",
         "value": "Overview"
       },
-      "name": "group - 4"
+      "name": "query - 2"
     }
   ],
-  "fallbackResourceIds": [],
+  "fallbackResourceIds": [
+    "Global Secure Access"
+  ],
+  "fromTemplateId": "GSA Enriched Microsoft 365 logs",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
-}
+}
\ No newline at end of file
diff --git a/Workbooks/GSANetworkTraffic.json b/Workbooks/GSANetworkTraffic.json
index 46e0e43e6f..e4e50d998a 100644
--- a/Workbooks/GSANetworkTraffic.json
+++ b/Workbooks/GSANetworkTraffic.json
@@ -4,16 +4,16 @@
     {
       "type": 1,
       "content": {
-        "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+        "json": "## Network Traffic Insights Workbook (Preview)\n---\nInformation in the dashboard is based on log data\n\n\n"
       },
-      "name": "text - 0"
+      "name": "text - 2"
     },
     {
       "type": 9,
       "content": {
         "version": "KqlParameterItem/1.0",
         "crossComponentResources": [
-          ""
+          "value::all"
         ],
         "parameters": [
           {
@@ -22,24 +22,25 @@
             "name": "LogAnalyticWorkspace",
             "label": "Log Analytic Workspace",
             "type": 5,
-            "description": "The log analytic workspace in which to execute the queries",
+            "description": "The Log Analytic Workspace In Which To Execute The Queries",
             "isRequired": true,
             "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+            "crossComponentResources": [
+              "value::all"
+            ],
             "typeSettings": {
               "resourceTypeFilter": {
                 "microsoft.operationalinsights/workspaces": true
               },
-              "additionalResourceOptions": [
-                "value::1"
-              ],
+              "additionalResourceOptions": [],
               "showDefault": false
             },
             "timeContext": {
-              "durationMs": 86400000
+              "durationMs": 2592000000
             },
-            "defaultValue": "value::1",
             "queryType": 1,
-            "resourceType": "microsoft.resourcegraph/resources"
+            "resourceType": "microsoft.resourcegraph/resources",
+            "value": null
           },
           {
             "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
@@ -96,7 +97,7 @@
               "durationMs": 86400000
             },
             "value": {
-              "durationMs": 2592000000
+              "durationMs": 604800000
             }
           },
           {
@@ -108,7 +109,10 @@
             "multiSelect": true,
             "quote": "'",
             "delimiter": ",",
-            "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+            "query": "NetworkAccessTraffic\r\n| summarize Count = count() by UserPrincipalName\r\n| order by Count desc, UserPrincipalName asc\r\n| project Value = UserPrincipalName, Label = strcat(UserPrincipalName, ' - ', Count, ' Logs'), Selected = false",
+            "crossComponentResources": [
+              "{LogAnalyticWorkspace}"
+            ],
             "typeSettings": {
               "limitSelectTo": 20,
               "additionalResourceOptions": [
@@ -126,10 +130,41 @@
             "value": [
               "value::all"
             ]
+          },
+          {
+            "id": "527af4d2-3089-4aa4-9fbb-48ec697db20d",
+            "version": "KqlParameterItem/1.0",
+            "name": "WebCategories",
+            "label": "Web Categories",
+            "type": 2,
+            "multiSelect": true,
+            "quote": "'",
+            "delimiter": ",",
+            "query": "NetworkAccessTraffic\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| order by Count desc, firstCategory asc\r\n| project Value = firstCategory, Label = strcat(firstCategory, ' - ', Count, ' Logs')",
+            "crossComponentResources": [
+              "{LogAnalyticWorkspace}"
+            ],
+            "typeSettings": {
+              "additionalResourceOptions": [
+                "value::all"
+              ],
+              "selectAllValue": "*",
+              "showDefault": false
+            },
+            "timeContext": {
+              "durationMs": 604800000
+            },
+            "timeContextFromParameter": "TimeRange",
+            "defaultValue": "value::all",
+            "queryType": 0,
+            "resourceType": "microsoft.operationalinsights/workspaces",
+            "value": [
+              "value::all"
+            ]
           }
         ],
         "style": "pills",
-        "queryType": 1,
+        "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces"
       },
       "name": "parameters - 15"
@@ -155,23 +190,286 @@
             "linkLabel": "All Traffic",
             "subTarget": "AllTraffic",
             "style": "link"
+          },
+          {
+            "id": "5ae54b5a-ac7b-4b7a-a1e1-1e574625caa3",
+            "cellValue": "tabSel",
+            "linkTarget": "parameter",
+            "linkLabel": "URL Lookup",
+            "subTarget": "URLLookup",
+            "style": "link"
+          },
+          {
+            "id": "68c566f8-957e-4a3f-8b66-730fc24135fb",
+            "cellValue": "tabSel",
+            "linkTarget": "parameter",
+            "linkLabel": "Security Insights",
+            "subTarget": "Security",
+            "style": "link"
           }
         ]
       },
       "name": "links - 7"
     },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let NetworkAccessTrafficData = NetworkAccessTraffic\r\n| where SourceIp != \"\" and isnotempty(SourceIp)\r\n| summarize arg_max(TimeGenerated, *) by SourceIp, TenantId;\r\n\r\nlet SigninLogsData = SigninLogs\r\n| where IPAddress != \"\" and isnotempty(IPAddress)\r\n| summarize arg_max(TimeGenerated, *) by IPAddress, TenantId, UserId, CorrelationId;\r\n\r\nSigninLogsData\r\n| join kind=leftanti (\r\n    NetworkAccessTrafficData\r\n    | where SourceIp != \"\" and isnotempty(SourceIp)\r\n) on $left.IPAddress == $right.SourceIp and $left.TenantId == $right.TenantId\r\n| project TimeGenerated, IPAddress, UserId, UserPrincipalName, AppDisplayName, DeviceDetail.deviceId\r\n",
+              "size": 0,
+              "title": "Sign-ins Outside Global Secure Access",
+              "timeContextFromParameter": "TimeRange",
+              "showExportToExcel": true,
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "rowLimit": 1000,
+                "filter": true
+              }
+            },
+            "name": "query - 0"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "tabSel",
+        "comparison": "isEqualTo",
+        "value": "Security"
+      },
+      "name": "group - 10"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "💡 Type the URL for detailed analysis"
+      },
+      "conditionalVisibility": {
+        "parameterName": "tabSel",
+        "comparison": "isEqualTo",
+        "value": "URLLookup"
+      },
+      "name": "text - 10"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 9,
+            "content": {
+              "version": "KqlParameterItem/1.0",
+              "parameters": [
+                {
+                  "id": "ec8c38c8-3064-4921-8dcd-a69d3895599b",
+                  "version": "KqlParameterItem/1.0",
+                  "name": "URL",
+                  "type": 1,
+                  "typeSettings": {
+                    "isSearchBox": true
+                  },
+                  "timeContext": {
+                    "durationMs": 86400000
+                  }
+                }
+              ],
+              "style": "above",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces"
+            },
+            "conditionalVisibility": {
+              "parameterName": "tabSel",
+              "comparison": "isEqualTo",
+              "value": "URLLookup"
+            },
+            "name": "parameters - 9"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Web Categories"
+            },
+            "name": "text - 11"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let CategoryData = NetworkAccessTraffic \r\n| where DestinationFqdn contains \"{URL}\"  // Filters logs based on the provided URL parameter\r\n| extend CategoriesList = split(DestinationWebCategories, \",\")  // Split categories into a list\r\n| mv-expand Category = CategoriesList  // Expand the list into individual rows\r\n| extend Category = trim_start(\" \", trim_end(\" \", tostring(Category)))  // Trim leading and trailing spaces\r\n| extend Category = iff(TrafficType == \"microsoft365\", \"Microsoft M365\", Category)  // Set category to \"Microsoft M365\" if TrafficType is \"microsoft365\"\r\n| summarize UniqueCategories = make_set(Category);  // Create a set of unique categories\r\n\r\nCategoryData\r\n| extend \r\n    PrimaryCategory = iff(array_length(UniqueCategories) > 0, tostring(UniqueCategories[0]), \"None\")\r\n| project \r\n    col1 = PrimaryCategory,\r\n    snapshot = \"Primary Category\"\r\n\r\n| union (\r\n    CategoryData\r\n    | extend \r\n        SecondaryCategory = iff(array_length(UniqueCategories) > 1, tostring(UniqueCategories[1]), \"None\")\r\n    | project \r\n        col1 = SecondaryCategory,\r\n        snapshot = \"Secondary Category\"\r\n)\r\n\r\n| order by snapshot asc\r\n",
+              "size": 4,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "snapshot"
+                },
+                "leftContent": {
+                  "columnMatch": "col1",
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "auto"
+              }
+            },
+            "name": "query - 17"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Traffic Access Details"
+            },
+            "name": "text - 15"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let NetworkData = NetworkAccessTraffic\r\n| where DestinationFqdn contains \"{URL}\";  // Filters logs based on the provided URL parameter\r\n\r\nNetworkData\r\n| summarize \r\n    UniqueUsers = dcount(UserPrincipalName),\r\n    UniqueDevices = dcount(DeviceId),    \r\n    TotalAllow = countif(Action == \"Allow\"),\r\n    TotalBlock = countif(Action == \"Block\")\r\n| project \r\n    col1 = UniqueUsers, \r\n    snapshot = \"Unique Users\"\r\n| union (NetworkData\r\n    | summarize UniqueDevices = dcount(DeviceId)\r\n    | project col1 = UniqueDevices, snapshot = \"Unique Devices\")\r\n| union (NetworkData\r\n    | summarize TotalAllow = countif(Action == \"Allow\")\r\n    | project col1 = TotalAllow, snapshot = \"Total Allow\")\r\n| union (NetworkData\r\n    | summarize TotalBlock = countif(Action == \"Block\")\r\n    | project col1 = TotalBlock, snapshot = \"Total Block\")\r\n| order by snapshot asc",
+              "size": 4,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "snapshot",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "col1",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 2,
+                      "maximumSignificantDigits": 3
+                    }
+                  }
+                },
+                "showBorder": true
+              }
+            },
+            "name": "query - 14"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Bandwidth Usage"
+            },
+            "name": "text - 16"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let NetworkData = NetworkAccessTraffic\r\n| where DestinationFqdn contains \"{URL}\";  // Filters logs based on the provided URL parameter\r\n\r\nNetworkData\r\n| summarize \r\n    TotalSent = sum(SentBytes),\r\n    TotalReceived = sum(ReceivedBytes),\r\n    TotalBandwidth = sum(SentBytes + ReceivedBytes)\r\n| extend \r\n    TotalSentMB = round(TotalSent / 1024.0 / 1024.0, 2),\r\n    TotalReceivedMB = round(TotalReceived / 1024.0 / 1024.0, 2),\r\n    TotalBandwidthMB = round(TotalBandwidth / 1024.0 / 1024.0, 2)\r\n| project \r\n    TotalSentMB,\r\n    TotalReceivedMB,\r\n    TotalBandwidthMB\r\n| extend dummy = 1\r\n| project-away dummy\r\n| mv-expand \r\n    Column = pack_array(\"TotalSentMB\", \"TotalReceivedMB\", \"TotalBandwidthMB\"),\r\n    Value = pack_array(TotalSentMB, TotalReceivedMB, TotalBandwidthMB)\r\n| extend \r\n    snapshot = case(\r\n        Column == \"TotalSentMB\", \"Total Sent (MB)\",\r\n        Column == \"TotalReceivedMB\", \"Total Received (MB)\",\r\n        Column == \"TotalBandwidthMB\", \"Total Bandwidth (MB)\",\r\n        \"Unknown\"\r\n    ),\r\n    col1 = iff(Value < 0.01, 0.00, Value)\r\n| project-away Column, Value\r\n| order by snapshot asc",
+              "size": 4,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "snapshot",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "col1",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 2,
+                      "maximumSignificantDigits": 3
+                    }
+                  }
+                },
+                "showBorder": true
+              }
+            },
+            "name": "query - 17"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "# Traffic Logs (filtered)"
+            },
+            "name": "text - 12"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where DestinationFqdn contains \"{URL}\"\r\n| project \r\n    Timestamp = TimeGenerated,\r\n    User = UserPrincipalName,\r\n    [\"Source IP\"] = SourceIp,\r\n    [\"Destination IP\"] = DestinationIp,\r\n    [\"Destination Port\"] = DestinationPort,\r\n    [\"Destination FQDN\"] = DestinationFqdn,\r\n    Action = case(\r\n        tolower(Action) == \"allow\", \"🟢 Allow\", \r\n        tolower(Action) == \"block\", \"🔴 Block\", \r\n        tolower(Action) // This returns the action in lowercase if it doesn't match \"allow\" or \"block\"\r\n    ),\r\n    [\"Policy Name\"] = PolicyName,\r\n    [\"Policy Rule ID\"] = PolicyRuleId,\r\n    [\"Received Bytes\"] = ReceivedBytes,\r\n    [\"Sent Bytes\"] = SentBytes,\r\n    [\"Device OS\"] = DeviceOperatingSystem    \r\n| order by Timestamp desc\r\n",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ]
+            },
+            "name": "query - 13"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "tabSel",
+        "comparison": "isEqualTo",
+        "value": "URLLookup"
+      },
+      "name": "group - URL Lookup"
+    },
     {
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "NetworkAccessDemo_CL\r\n| project \r\n    Timestamp = createdDateTime_t,\r\n    User = userPrincipalName_s,\r\n    SourceIP = SourceIP,\r\n    DestinationIP = destinationIp_s,\r\n    DestinationPort = destinationPort_d,\r\n    Action = action_s,\r\n    PolicyName = policyName_s,\r\n    TransportProtocol = transportProtocol_s,\r\n    TrafficType = trafficType_s,\r\n    DestinationURL = destinationUrl_s,\r\n    ReceivedBytes = receivedBytes_d,\r\n    SentBytes = sentBytes_d,\r\n    DeviceOS = deviceOperatingSystem_s,\r\n    PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
+        "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| project \r\n    Timestamp = TimeGenerated,\r\n    User = UserPrincipalName,\r\n    [\"Source IP\"] = SourceIp,\r\n    [\"Destination IP\"] = DestinationIp,\r\n    [\"Destination Port\"] = DestinationPort,\r\n    [\"Destination FQDN\"] = DestinationFqdn,\r\n    Action = case(\r\n        tolower(Action) == \"allow\", \"🟢 Allow\", \r\n        tolower(Action) == \"block\", \"🔴 Block\", \r\n        tolower(Action) // This returns the action in lowercase if it doesn't match \"allow\" or \"block\"\r\n    ),\r\n    [\"Policy Name\"] = PolicyName,\r\n    [\"Web Category\"] = DestinationWebCategories,\r\n    [\"Transport Protocol\"] = TransportProtocol,\r\n    [\"Traffic Type\"] = TrafficType,\r\n    [\"Received Bytes\"] = ReceivedBytes,\r\n    [\"Sent Bytes\"] = SentBytes,\r\n    [\"Device OS\"] = DeviceOperatingSystem,\r\n    [\"Policy Rule ID\"] = PolicyRuleId\r\n| order by Timestamp desc\r\n",
         "size": 3,
-        "showAnalytics": true,
-        "title": "Log",
+        "title": "Traffic Logs",
         "timeContextFromParameter": "TimeRange",
+        "showRefreshButton": true,
         "showExportToExcel": true,
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
         "gridSettings": {
           "rowLimit": 1000,
           "filter": true
@@ -188,11 +486,14 @@
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessDemo_CL\n    | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Trasnacations\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
+        "query": "// Unique Users\nNetworkAccessTraffic\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\n| project SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessTraffic\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(SentBytes + ReceivedBytes) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessTraffic\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Transactions\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
         "size": 4,
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
+        "crossComponentResources": [
+          "{LogAnalyticWorkspace}"
+        ],
         "visualization": "tiles",
         "tileSettings": {
           "titleContent": {
@@ -243,12 +544,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend BytesIn = todouble(SentBytes + ReceivedBytes) / (1024 * 1024)  // Convert bytes to Mbytes\r\n| summarize TotalBytesMB = sum(BytesIn) by bin(TimeGenerated, 1h), TrafficType\r\n| order by bin(TimeGenerated, 1h) asc, TrafficType asc\r\n| project TimeGenerated, TrafficType, TotalBytesMB\r\n",
               "size": 2,
-              "title": "Usage over Time (GB)",
+              "title": "Usage Over Time (MB)",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "barchart"
             },
             "conditionalVisibility": {
@@ -272,12 +576,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project  createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
-              "size": 0,
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\r\n| project  TimeGenerated, SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
+              "size": 3,
               "title": "Locations",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "map",
               "mapSettings": {
                 "locInfo": "CountryRegion",
@@ -297,19 +604,21 @@
                 }
               }
             },
-            "customWidth": "50",
             "name": "query - 0"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"allow\" and DestinationWebCategories != '' // Filter for allowed traffic\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
               "size": 2,
               "title": "Top Allowed Web Categories",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "piechart"
             },
             "customWidth": "50",
@@ -319,41 +628,79 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
-              "size": 0,
-              "title": "Top Blocked Destinations",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"block\" and DestinationWebCategories != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+              "size": 3,
+              "title": "Top Blocked Web Categories",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces"
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "visualization": "piechart"
             },
             "customWidth": "50",
-            "name": "query - 5"
+            "name": "query - 6"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
-              "size": 3,
-              "title": "Top Blocked Web Categories",
+              "query": "NetworkAccessTraffic  \r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"block\" and DestinationFqdn != ''  // Filter for blocked traffic with non-empty Destination FQDN\r\n| summarize Count = count() by [\"Destination FQDN\"] = DestinationFqdn, [\"Destination Web Categories\"] = DestinationWebCategories, [\"Policy Name\"] = PolicyName\r\n| order by Count\r\n",
+              "size": 0,
+              "title": "Top Blocked Destinations",
               "timeContextFromParameter": "TimeRange",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
-              "visualization": "piechart"
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Count",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ],
+                "rowLimit": 1000,
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "$gen_bar_Count_3",
+                    "sortOrder": 2
+                  }
+                ]
+              },
+              "sortBy": [
+                {
+                  "itemKey": "$gen_bar_Count_3",
+                  "sortOrder": 2
+                }
+              ]
             },
             "customWidth": "50",
-            "name": "query - 6"
+            "name": "query - 5"
           },
           {
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where SentBytes > 0\r\n| where tolower(Action) != \"block\"\r\n| summarize \r\n    Count = count(), \r\n    [\"Sent Bytes\"] = sum(SentBytes), \r\n    [\"Received Bytes\"] = sum(ReceivedBytes), \r\n    [\"Total Bytes\"] = sum(ReceivedBytes + SentBytes) \r\n    by [\"Destination FQDN\"] = DestinationFqdn\r\n| order by Count desc\r\n",
               "size": 0,
               "title": "Top Allowed Destinations",
               "timeContextFromParameter": "TimeRange",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "gridSettings": {
                 "formatters": [
                   {
@@ -384,8 +731,22 @@
                       "palette": "blue"
                     }
                   }
+                ],
+                "rowLimit": 1000,
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "$gen_bar_Count_1",
+                    "sortOrder": 2
+                  }
                 ]
-              }
+              },
+              "sortBy": [
+                {
+                  "itemKey": "$gen_bar_Count_1",
+                  "sortOrder": 2
+                }
+              ]
             },
             "customWidth": "50",
             "name": "query - 1"
@@ -394,12 +755,15 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
+              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where TransportProtocol != ''\r\n| summarize Count = count() by toupper(TransportProtocol)\r\n| top 10 by Count\r\n",
               "size": 2,
-              "title": "Protocol Distburion",
+              "title": "Protocol Distribution",
               "timeContextFromParameter": "TimeRange",
               "queryType": 0,
               "resourceType": "microsoft.operationalinsights/workspaces",
+              "crossComponentResources": [
+                "{LogAnalyticWorkspace}"
+              ],
               "visualization": "piechart"
             },
             "customWidth": "50",
@@ -415,7 +779,9 @@
       "name": "group - 4"
     }
   ],
-  "fallbackResourceIds": [    
+  "fallbackResourceIds": [
+    "Global Secure Access"
   ],
+  "fromTemplateId": "GSA Network Traffic Insights",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
 }
\ No newline at end of file
diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index 4b96290dfc..d00f2276a3 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -8017,7 +8017,7 @@
 			"GSATrafficLogsWhite.png",
 			"GSATrafficLogsBlack.png"
 		],
-		"version": "1.0.0",
+		"version": "1.0.1",
 		"title": "Microsoft Global Secure Access Traffic Logs",
 		"templateRelativePath": "GSANetworkTraffic.json",
 		"subtitle": "",
@@ -8035,7 +8035,7 @@
 			"GSAEnrichedLogsWhite.png",
 			"GSAEnrichedLogsBlack.png"
 		],
-		"version": "1.0.0",
+		"version": "1.0.1",
 		"title": "Microsoft Global Secure Access Enriched M365 Logs",
 		"templateRelativePath": "GSAM365EnrichedEvents.json",
 		"provider": "Microsoft"

From eb842a24aa17c79dfa05721d49dbcfe8c217b2a1 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Sun, 6 Oct 2024 14:25:49 +0300
Subject: [PATCH 17/27] Connectors

---
 ... to Team and immediately uploads file.yaml |   3 +
 ...365 - ExternalUserAddedRemovedInTeams.yaml |   3 +
 ... Mail_redirect_via_ExO_transport_rule.yaml |   3 +
 .../Office 365 - Malicious_Inbox_Rule.yaml    |   3 +
 .../Office 365 - MultipleTeamsDeletes.yaml    |   3 +
 .../Office 365 - Office_MailForwarding.yaml   |   3 +
 ...ice 365 - Office_Uploaded_Executables.yaml |   3 +
 .../Office 365 - RareOfficeOperations.yaml    |   3 +
 ...ce 365 - SharePoint_Downloads_byNewIP.yaml |   3 +
 ...- SharePoint_Downloads_byNewUserAgent.yaml |   3 +
 ...ffice 365 - exchange_auditlogdisabled.yaml |   3 +
 .../Office 365 - office_policytampering.yaml  |   3 +
 ...repoint_file_transfer_above_threshold.yaml |  11 +-
 ...file_transfer_folders_above_threshold.yaml |  11 +-
 .../Data/Solution_GlobalSecureAccess.json     |   2 +-
 .../Global Secure Access/Package/3.0.0.zip    | Bin 48426 -> 0 bytes
 .../Global Secure Access/Package/3.1.0.zip    | Bin 0 -> 48462 bytes
 .../Package/mainTemplate.json                 | 476 ++++++++++--------
 18 files changed, 331 insertions(+), 205 deletions(-)
 delete mode 100644 Solutions/Global Secure Access/Package/3.0.0.zip
 create mode 100644 Solutions/Global Secure Access/Package/3.1.0.zip

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml
index e9fa0d76fe..8481644cb7 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml	
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Teams)
 queryFrequency: 1h
 queryPeriod: 1h
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml
index c2220e61a0..010189337f 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml	
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Teams)
 queryFrequency: 1h
 queryPeriod: 1h
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index eabfa1226a..d6a9ebb224 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -9,6 +9,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Exchange)
 queryFrequency: 1h
 queryPeriod: 1h
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml
index 2dd383aec3..d73d02c23e 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml	
@@ -10,6 +10,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Exchange)
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml
index 789f90df15..0628b94341 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml	
@@ -9,6 +9,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Teams)
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml
index 1ab3097e01..cfcf0a9daa 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_MailForwarding.yaml	
@@ -9,6 +9,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Exchange)
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml
index 954d1961c1..31eae6d848 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml	
@@ -11,6 +11,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (SharePoint)
 queryFrequency: 1d
 queryPeriod: 8d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml
index 54d0316344..862c72ef2a 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - RareOfficeOperations.yaml	
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml
index b5b02f5145..aa21e5cc0a 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml	
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (SharePoint)
 queryFrequency: 1d
 queryPeriod: 14d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml
index c9d57bdca8..04ab14db07 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml	
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (SharePoint)
 queryFrequency: 1d
 queryPeriod: 14d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml
index 9ac9b79f19..8136e26684 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml	
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Exchange)      
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml
index 74ca0aa0cb..ee57a2ba62 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml	
@@ -10,6 +10,9 @@ requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Exchange)
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index f9a4994748..4d072b9dde 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -1,14 +1,17 @@
 id: 30375d00-68cc-4f95-b89a-68064d566358
 name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
-  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
+  'Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
+  Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (SharePoint)
 queryFrequency: 15m
 queryPeriod: 15m
 triggerOperator: gt
@@ -71,7 +74,7 @@ entityMappings:
       - identifier: Name
         columnName: FileSample
 customDetails:
-  TransferCount: count_distinct_ObjectId
+  TransferCount: count_distinct_OfficeObjectId
   FilesList: fileslist
 incidentConfiguration:
   createIncident: true
@@ -84,5 +87,5 @@ incidentConfiguration:
     - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 2.0.7
+version: 1.0.5
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index 81410ac5c8..500b037a4b 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -1,13 +1,16 @@
 id: abd6976d-8f71-4851-98c4-4d086201319c
 name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
+  'Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
 severity: Medium
 status: Available
 requiredDataConnectors:
   - connectorId: AzureActiveDirectory
     dataTypes:
       - EnrichedMicrosoft365AuditLogs
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (SharePoint)
 queryFrequency: 15m
 queryPeriod: 15m
 triggerOperator: gt
@@ -68,17 +71,17 @@ entityMappings:
       - identifier: Name
         columnName: FileSample
 customDetails:
-  TransferCount: count_distinct_ObjectId
+  TransferCount: count_distinct_OfficeObjectId
   FilesList: fileslist
 incidentConfiguration:
   createIncident: true
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 5h
+    lookbackDuration: PT5H
     matchingMethod: Selected
     groupByEntities:
-      - Account
+    - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
 version: 2.0.7
diff --git a/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json b/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json
index 4f92d581f0..990dd54b3c 100644
--- a/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	
+++ b/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	
@@ -56,7 +56,7 @@
     "Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml"
   ],
   "BasePath": "C:\\git\\Azure-Sentinel\\Azure-Sentinel\\Solutions\\Global Secure Access",
-  "Version": "3.0.0",
+  "Version": "3.1.0",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
diff --git a/Solutions/Global Secure Access/Package/3.0.0.zip b/Solutions/Global Secure Access/Package/3.0.0.zip
deleted file mode 100644
index 6df173c9523aba092dc9c606146005040b430f97..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 48426
zcmY(JQ<P@GvaQQ@b=kIU8(r?Q{g-Xqwq0GeZQHhO-`?l!^Kf5tM1CV<#)w=aV=e_5
zP_SP>KtNDHcPio<>_tXS>X<-4ym3H482?s{983(HOjIpIO-wCpESxNCZRjl>ZEdb}
zE*v(*Q@(ptKM-^>vQf_V#gx1v0olKdxMC{2=G3J>2OQc2^Q4}k1dV3>%*iwVdZ&0d
zdMCV1pAAPB;ZleM;L<27$3U@SZ<Y2qzH8(3e4hA1+2867=Z=l?xRD~5YNVt|4CHq)
zhjp%Ij!O=&^?q>uKI&bG?=TCI2t4SM5|BD-N_f~yRPjjvyn8FpDpNO+9tli!Pb<$Y
z=-Y{o`Ei&%aGmPpgffx7@hJaP!QmT&Ai3^X4g`47DF?=s*&mo(yX+V1lCrQ0N9vuT
z(7$u%lvy|frzW{q_&m=8VNmFr8`pHQJV)IFem@KeVhgBB9dCc`P-nm-zQ;1ioEL3-
zF{-Z75}b&axEYE6B3{3hz3lmN)K;m33nfH{;PT2ZU56_j#!0(4JMvGfAk55PfqY4b
zedS8D<enJc+0h<Oz02mQaUv(!Y9pBzKEt9?;)*XHZ5%aKl6As7Z;L23q^00a79Jvh
z=#Q(O^)4L9GQE>j(EIu6`Jvcme8c7#>fo4vmaAdD;Ta;m0<+CgO_A1+z1nm(4Ve+<
zd+zVa!OfN-n7SJoeJN%Vc|rFXBZO&ZB^5GiPm_Y<yGKt8c5_9$aHmaTa`&d)MyoXs
z8Sd)9?ATjww*N!QJjJUYYx)~ZN&MHrdAM=1&m8p{1nXZ{7li(4!PUE(s3G=xYpX>1
z5IWvF`dQ=<MU++#6cNb-A(j3dNty#6n~+KEqsMW9_ao7d?oguhGd-)5rRZuPk#Ip7
z62oi*YM(Sn6buaFUJ{VqsN&qSMYyo}et$H0x?pL{qI-fi>AC2b;#t&T$%J#lmxlUy
z;2}TGlKE^Nv+~2xD8sP%p_7z^=2#U`QJs}PWqwI{%V_9Cu_9M`cUJ(0$+zGYYQcuP
z0xsUpdpAPqaH5=Hjq~u6(x^)wSDz@*^blCh_rFuYk7jicbH7Z%#o;#z8L%G^jEN8Y
zO1cJ>HLmXPmDf(o(h%~D36ko5Z=rgTVM6SJL<ngkg=)Y*j?&VFbqJY&=1anN66#Yy
z=j~a~-|ElGgAV6(>;V$fC3v42l8bMnY7;EsJlu`E=`0*Xqg%MUumRpCl6F~-gV{VJ
zkIkb=4BLnKhZ7@u3r_?NAnPihbg5J&eOIyRkh(}}S0Dv9ycKgzaX>V*eU$XI8)!cy
zYMxZ!L!|`tW?1GufZ{IHX>x*<Vn;cf19I+J_wxxBSdwjw?Io?S_v(lCyhe8o8^?kB
zsi&6h$2<&>+s0~BPRJ>_eIW!myfEcSXdazm(jQUVXnMCb{y9v~u=}<nFh(}Wr;wWp
zf}Uk52>gfT1X#~f31P!G2<ruEphk<24<YcNxPru-G#RF3KRa^r@)%m%3o6V(;mNRs
zU(s_*p`uzmgTtIjLn&SZvytH5Dd)TzSOTQcIRal$eF4b(HYvwXF%be=1Y#pgC3?bz
z-5(<gROZ`h2a$6d4%APICXqpzDiccm9*ok3iUm1><0afy{Kd|0`R3@5wEpDOq)Wk~
zI^g(m3ll*_TpGx9b!J-FP~-uOs}kOl^Wr;k=V}=WH#a4flEv8y!wXi+7D#mqc(ZUF
zU4_>l;uxgkM8V7c#wAkD+-}d01>v%k`fE`;VK1Qg+1!r%V$`R2%dLBkSf^SHir%H~
zeEeM8T;~LQmjrkOhP@YREidJ&S-!_0{Bw#yI>)R_V^k^;;uo_6)e=)Hg+$QyCM6=1
z@z~i9?}CV}drLBuP`AT=DmiWa-BOvPE(Ns^;n>8JH$g#t_~rYPm1ekDpQ4`hTYPR9
z?ouNl^+s!jj;qFg1J`~nr#W_4?fZ8em2$giC5dMkr%cW-wf9>&l+{&3dKmEB3b@4A
zkQtrvc%cOYdh~Qt42bwT__)u6md1m>p9c4igl_KrB<jDfYeG-k{jEZ+PuctaMwKa7
zqDVc7BbeX7o&nR5zsc>@sU>mvH+tY~KJ+)4(_>WP(<TR$x!`^WS>r0nL&I}i;y^+-
zh8{bX&Q6^3s`!3zK7zRCGn4nilYmW|Cu*;$rMkwVF+Z}rF=?$W+ZYePHh#yb3?xgi
zPNblTZd{+@f$LTMr76BvJpFJf-M@nu<=PX51c&@BT#JW9<i*e((hhFaN4<nu7$6<3
zQ)>3YSC|zcd9j!HYGQ3etaLO3=9eszDPvNg%y@_EQD9`uUJj=7EWA8}5#X*&>olzv
zk*eSLTBuMa)3sfnROfk{F*dKSuNQSUu+F_HhhGsM&>lt**XvVKO(qIkR2P5`+fi9(
zv=Vg5tjTXSX7F3b+H>p;4`8#HUNtY2+HvgS{`WivkuuA4OjL_`x;`sq8}<VM+`CeB
z-Hgw&?L&`4eEMLflvGyf_~i&vIzYu-!|b%bk$4t_l%c2H_qX7l_L78c0w}<=-iIA<
z)JFg|YU^*T%KocUx0YMu3fRd2&2ZVO$={KN8W~G+pqT6$S|cuWbv0vwfW^=jO@v=G
z<)P1#Iivzsi}i+@T4k-jj*wS8Km!p5rwcnOqn8TADIZltM##DWODY~MMmz9tGVIL{
z=cN34;F{RE9C@u|3rKC^7Kl|h4C5t)f(5Kyd@QLW7*OLlpTB5$n29*v<1ErNHFI~8
zaspj|`uD-v>MpxAj~#SyabiLL{4k-)m)noKrmF>P^&ejt+d<RC+$M$(jHTQslFzR5
z-(2<2O9TxC7p&P@L$jhVH(=U2$d#B5lM!=Z8GUjwhdE2uVaLE=SrYAvg{AYtb@<7a
zm|&mq<``&VJ#JSZI4Go6J52UFGjb(`wmZ6T#6N*B__=k{s|;rE{;Fe$PnhG!P4NMr
znTz7`?m7G6Ps$Bu56(GQ^SuBYkULP)gX8CL2jY$`id}oDeDvOhlz3em7~8I=*u<?G
z@5^*yo&e529)d*d=7i3F?xIdvkY-p0<NJf&YU`EK^eFN<veyY<F+sRCNac|=R$JmR
zHoBRB?B-aP?FpFZJK=fQdqAGqwdD?B2d~&XVApP$hi(n3NV!$MK{{)Qv{!kSW7w4|
zug8uJ-alod0)X)0Npb{x0(WvOKCnGKPsyN>k8n9wxZ{3QYjZBK)U$H}np#lNZ*h^S
zjqD><Lm6@*Witu#Z*zd<x}`gB(LOAI_SFT$pKB@=uUM!+3#!e^FHZjgoSbWr(<9XA
zmgq>%D&UFF*51nM>vR)gDAxv0BTEVBhz2P`IWQvXI8{T~*Ypq6-!0A5J#>N1<rxY6
z)#Nt|!xP0P11uqOC)5k%c1Qho2cmGPNlUXZiNV40h+OL+-8`_)n6Ys5S7uK~s~cd2
zK`c5YdF`r?Iq{0hqU0_V+Baa5D&vDI>_!9TO^=J||H9m#CP@ZA`Q?RNl1Dln0CjX|
z8K}~AX!hgm&ZlufULjuw+{h0g+7Wey<q7```N(z<hx&y39a0c_aQ~VQ1Wy;zc%D*>
z6?f|9;;;927jEeaSuT$voUJ_ZLjg0L-J=8uo%yx6K(RZ36codwlO#mVapx(UyAjLU
zpd8U;XF6QiVD-Fcq6FK7o4@4Ir5bMLo#03a$K7O&xdIo+QNo)aKy|k;K#>nkt=m>+
z7GM4)V`R05qqPir$lix)t?pe1X4Zuu=1P@n17JzLXbH{Bv_1i40^Jdu+OCX)HtQz7
zP_ZAno<xO38=ZV_Th$;D9$mk4hls%fda`(MetI*e(gVLn&HcsMC7QDY6LMkTnQbv+
zf&O4_)?O$L)P1)u#v<B+&ShP%bBc*V`;QJ<f;5|~@|i=s<R>o77!gmY=|Ah6F?zyt
z#48U4kI<7O{LXqEbC*Hp&5dWC7D+Y9@fFL=b0nZ54|m3l7eRIERgL7J>DJcQ=uJ8N
z(H#S~ip~=yftEzkg6NO_fKmmUnsdx?(FO`SSQi9ofp@&YT--;>XHcUDSVQddjN3N2
zdkqIF%W^l2@QZUPx%67WDTQD|Jcc;HNKp!)1m~LZ=OXrkE10g0BqB`py9pKT6ZzaH
zAQEWPC6L%cl?UY#pg4gm@_z09Qhy-Q^eQ8EBp_@Tm}Cku=;*w!#nYu43{Y*S#Z@ou
zr}m?i*SE^@#=rhTm?<JuE=$V7N*uM`gwk@43?SpA?Hv_k2j`VY<c`nwgqJ48*Mi4r
zp$+J<!B8s_A+8?#n0;|^Y~Wes8U{B5KZ;!=>?=Wje%d|-CiCOYiiUO{_Rw327#c8y
zrLd3LxIhC*bwTKpba9qy@;5JoTDGJz_StDExBI18#rN=`8e*c@P4l$(T84JpPGGhi
z?BU-PCgPv@;zw`=DvBmtP@B_Wm~r$i?}MAErqdqcVd!KJv79X#G4uFZgPd<I9@MMj
z<RQL61yWYd36FXbN}d*zp-HoG!9JJO(1phSfuk+4-K17K?@rm=)9vh<VpEhstWPbc
zFE>b$U&#r|;msKpw}>~M?}Yu16j)f~-y7`xF4&1PFuQK$jo4sh;@?<mOI7*Y>eimy
zI1M{eb=yw^HkIom8bovuMzUsi{rz$~{FxSnJrQgcVK;i5e&}X<*jjnoTTSWFmAvLI
z1PQbn4{4Zydw2VDbo)n0k)MKNIb9svA6{$lo>dG1v-Tr^`FGWIJki(UQaq*yL9iD&
zAJdlx85EGjZGTKY+{4BgsQ)Gy%#~l;ctnVuzgY^rBGXXj{``q)=mqiQuJA<}shOBn
zTNF0_a{U-A--s%VY7SGXC8Q41L&=l2a||6J2S_G{+02>`m4;y{e&a!+TI(@<hhOcu
znOG9S#XBf&<QK=dHkx$>aoCjO)EK{Abfy^=P1V~7Bh+r_XaahpaEVzu(79)L6NS##
zEGZ&ZZZO*hyVW|h@RBH))CvqCt!rB)bSG%WSC|gs=jW#t?C4tLtxCFj@DN2^e*%Ek
z44+c4jx=l~Dw@UE$e<&HhhUu{9G4WJm_t_!7Jpta$k?H7s96Wuq>sNq@FXj^>}quB
z{KQBZ`k2olvTw9-f&_MkcR5;^<{xawRf&HwhFjs+4A!XmBTRK}6_eJ)0ZLnJ1YL%N
zLa&qq`wKhPa`7+M9v{Way7<Rd%ACButzq`5NG1h^2RYiUBdix7NEYh^$IP$eV+d$=
zX6!!l!8}ST(Mb4%Yo=C-hmvbMKVv@z%v7ci0j(Un&^xbcH1mmHN+DDN#51^G9$5Ai
z=tX-C;J-UOmFVev)f~O-d6myrZp<RVRF>y1dXx)=$E|6NAN%rbMnj>rDGEgxLbaD1
za{wc7$uJ<g8$7jVO}^6v+b!JSbo8Xa7a2g)`77pdlq@$+{bhbptM($Dx=Job0WLTJ
zWjBak39Bq)Q^iI`Yf08N=ITJ3f2>$nN}j9tk$R(yw&c*Is4}$+lQYL!(X-$V(|xu)
zABUK}qplJTo17GF3H`c%euE-K<w@#lsK_93CRhSZ<v`UwL0LnKEsYs{5TeoOViS8#
zaw`p4M_W_lIMH##MRd@J!)$}s;|KO+?&F7^_dGA462BLDyBiwgcfv;;YqCIp@6a8l
z@BIzNWDg>H?lc$nh)M%0F%;0t0S+;Q)VrgW4lMRk0I0$Q$4mp_v+xW}nV*a?EDv>>
z=)3W7tELFE4Ck{(sbuoQ*n9rfaA0V1{STKt^+3-r-ZCdPeu!Y+QudM6iV+|fpXR%u
z@evY0+weV!DwdX5*Pr1mYijfluiPw!0>Z1ICP7iOE-`hsMPod)x~L1@C?-P;p5tAx
zy{^BevuBHuOEWI7MzzQg94TJ62vvd6s`7CL%%%PKF@TmSTtto;Tr)d<fT;1ftQm+{
zHc=Ub0c`WkfcI{A#@4lbe_dmqqjAQjq8SwZEuGbEfyc1Bsz0m~LMxY)R;`f1v@iDK
z5fBn^VIH`N98YsyjSHv^j;o$6zN`GZaBEf|rdN(K)_8DmH{0fwSZ#CJWyx8l;kyaa
zFI`zkW)x+>1$B?Bp*da_^@{5no0a<pfr*yNd_AQ7*a%e}?3w01Ta#-IY9zZgq)t?3
zo#uXWNz}HG(EenOqi7p1;r;vH!QzHE1e<DvPnC%sEs|B-wQn?-_B&{f-W^(`pg2e1
z>|zRNDW`DYy}#?t+H|d=8w^dxvvQ8GPd;oQ^y|=1F{?-BfsVA(r<ak;xau>?YiXah
zvJPfiy|DbAL2d)bRO@FP!9SYZb`JfPMgV1&&?V5nC2q6Uh|c6Xi!=QP4)e&lNDkxW
z3*0*ViV98<Y_t{uVzid2QJjS$-b(Z(d2Y@vcvD5)S($K+KH_2lEln9g!$mHcO{=1^
zbmKjDmO&eSv&}HD7cv7mrm-Z^YJn_jfixIl3wA95TQ$#>K~4T^ns{k)qRsq41wpWF
zl-I_8Fn|g3mJ8Hz2l{nV2jK{}VZe62?*F=BFKj>-#udtB(jH*hHv65h?{;QG-MDgB
zgy)+s|ES$|9Z-*un{Ljbp}&saYyF0!(bw3iCu@ApnluH!N`)VG5l*i>6HkKq@<4#(
zQfvhm-QH3DTK)_5fVGLKtH|R5YLA)U0uqMUJql7c4EORYMvY4cB?67vwm?zG#xywF
zgC=iXp6<XhfVSBw<C#)w*Q+IE+597Ad4O+w#lW3DTXj^*Z&XwGn5|8fTB*)6@(BpX
z)>_lN1*Ao<Ma}2|-Jh6`!>O}X)`E!AHZ;VzwXuKrZA&?8QhPDg3cRlac4Q6a;a%uY
zZjqc=QvEi$%AflZ!%XI)%XC@ZJQ&@~!>i!YmO3^wlQB3Mt4sp`e~Y~76_FGmLe~cL
zrctZ%tzJ!Emh~!<Sm`zKBW_8}5WS;f7nchXgbA9PVssv(u5u#(1{aC-=e`Wmm7Iu|
zlh8$_!bcFDPBvngYTP9@t$u`VnzSH#6rMt4=05f!pfFsiINH1sv}MD4(FuM1!O{Cr
z^VeV02lNj1aVvZdL+Q*0a65Vs-FE0I&|8;F9y&DF1l%fBWQAz1iu%T9dI<A-%79c$
zo=wNj()TapVEU%7Al$s|c`TFEy5hw5HdeLpkZ2Y(F3bUOVRr`&>p%9j#|%iT>W3!U
zQDtgo8X@LY2!4up8hK6*QXX1v2St34lS&E!%PL~X+Iy=jQnoJZz;wedoQK9Yc+7zQ
z$Y(FLcNFmh#-53^(-Y$8k^bTY&?V=G{)9%(%UHMQh1c8H`8%)04cpuqR~pQMY{6rS
z#@h!I*x*Qn=@yIp%UW6IHPN*!_xn=1dOGwq<Dy3@lW#j>`@DyH#;|+NkmbhGtzd~Q
z4ty@7<>^`c@HI~S17+5IB&BF*`h#LrEdgcE2%Av99plf$EIATxgxG|Xw)4m_ktK|i
zLuT&@gs7IBd|Q+a839TWv$Y3%_znO27?ON#EwLD-@8>^xQNKfTAL=9zefJkYBf~tM
zt$LiFCWWY;*%}-~hUxy4%_nO_+c=5K%<07Es2W!xU0#h?SWj~@gH>ORC~N0rM%0wg
z8jNGK;-c$R{pHCb@xpoC`<|YmP_N3{In=<N8oQ3-h*N}aDj_dPMVxIFpLYw&TM00=
z9pdBidZ)s3VBz)!=S*m&vTc9vy-NPDVabcx70DqYhuByv==#e98Za?{@QqY20DFDn
zWGp$ky6t(`g7UD{5XhAQwz?%B@9~W$6g#TG!vLCBWHrb&D@&FU!H+u}&xYAzls*+s
z`&`6$Dmf%!3biIHbqPCDr+g||$RgE`J2TD-3_C{!x<b8F$9Gw%5VHyRBmY#EthHX9
z-q#9|#BV54irvaE^EoCRRODhfU*ohH+Uj&|GyYImvp!OcUWZ4&rUUlwi8+u|(7_8Z
zLsFCm%N>&CLMfV2Sh6p=l(2#*^6IY>AK9w|QDK32jbv+v8%VZfZHCv{bfHPg{f9Jj
zQaI+qOOi@FvQ;deh0q+nyWXE|#$TqLN<p=sFy4(22W0}ummbPVa*G(E;-rT5_u^HG
ztysbOY7V{-GjZOGHGy+JY_@o$knptY-cD4Q8-{5CwJoby6K#Gs_Z<JHeZg2!$%<18
zn_0*kne%H>OhiIc;ghTd_9n_IzVBIRIfq#X#}lUBZTR_5h*!h4B+$o*XUi!hqhJCr
zfc8-+oo$H$0luWzheNS^j5|KnX%wDtVS1HioFjXnd{Q^+^keUH*1)xQg!U;2u!0ub
zL!?@F(5+|4o$e#V)7T-PAcP@7(+aq4xzj+LQOc&szV-v!xq3bn&?iXWhi+e`(bYqE
zsg3;EYg(-*@uB)+qCB3x>aNN2nN8EUD_k&FdY-Ue?!4;KA}pc$?)&+HR`~zSi0@Tr
zzr{izpto=cAmo2$gtdW%jf#o2oz*`};(u(2%dQKT4as`?*Plw~ZD6gX22s^Sls=vc
z&Fd7p4(SCKsSTwoZZi%3b;7u$S#n@@A!)UxXP+>Q2j7}>vouJaSVm-bU=+as$=d>0
zaMzl8Xk&6_5)xt-lJ2P2gPtFbfz>x<{hheFriZ{fN0v;v00IPr)x@v5BaIbf+0M1@
zrw=dbXKUZd9dO9#_O+TNt)_PO-MF#Qo)HHOV_qx`minLA-k0u;@_EG7ZjM0LAMq0Z
z3(r?P$DWv<gPRd!Q?6w=&s#`-KZ#{8mxJGRr;sZ-@BRW=SZpL|zsbLyo?GhNLhuZu
zXJ?}7V1bvpUnCx|ye8A`5U@miEk9ZBA(uxvDcIqLIqR)az<AU@a4tp%Gc;$hPD>Y)
z<88H8RUV=6r>`l%dQc}zs$J>Y{fz9pUIsgIwtBT#JTBw%*$Ae-r?96ix_&F8ygro6
z`DDC5NSWB`c^x%uszuOuR`uqzqi&aG>wTs(A%-clK|G}IA@3uNq`eIf!hj59!~h!B
zFbG8$S-!vcek89xhjU}IuvMzM$eVJj%8fo0u6ADF4>$~4bs0%g0;{kaa11{`vIV|S
zWN9-OMLB-9T088oa0cMvLS?tKUJvcgV=eApB*fMIl`ww1jDGZkLWGJk7Yl6@;)2JX
zpj(mo)z`ixtEmECA&m4$ka$Us$r&ws9l_c_u%JdLxM5=@28VsG)JUq!FC$($JUw$C
zM(}a&1L92_GneChQFmB)PbrgwUcQ^`4>bxu(gBc+sbGgh35||OBr7B&S=)Y-$BDrr
zSg+q04Iy$29Kmz0s`nP1PbIw;z4`<h+3YU7qZk}=W5|nw)o3JRc$P+vB3)^k1Ni`f
zenK)bH-MZDfRVT!0WA0?<`fFUa<`&(v$QsOoZh<?_8tixH6g@%U|zZ_i<+*AV9NZ-
z52c_tJn-gJ8qE&D^g>PUvogG(3GhDV=QB6{N(lIkFa0QvADc&glSie-$)dUsuLb=Z
zSM#{^f#lGlZ`aoL>^!-005+6nI9z!R{>}Vn5O(t-Q^Srh0<uF@<lO#!LWPY?fOz@p
z0lLm!O;$s79EN^Tr^9n;E3k~f>3Va`do_2<Quk_oE3a8A+w)rBBuGkL?EE#k{={Ji
zjV$4z*ph_bZ9OxV$U-?O2J_2FSRc>ttx0^3P-H4XWd^hC?}(R#6Z=zk8=gxRs+FlX
z5tH<&_8;q&c&Cn~t&TqWuh2e9w`t1JjnPW^itpi$KI~Bv?vIFozX3a_4+(Btvq+&3
z7@>Nja69&VWk|up++z9pWH8YblrYiSiuzsCSX~fi>^Zb%?Dt$OQsj|0Zv4{{hfcSM
ztG(%U&e}e?D#v>cfr|;S4iWZ5Hfvu7Tjz<I6-Q2hTYv(NQ|Qxrt&y|j))~B~h>WF_
zjd@+cZ~LXWFj+J8-;A{NAJx+@#o@o5_7qcq0U3whQ;L$xnM_nPRO*0sR-8~Rz$Gj|
z%vSa?up?=26$rIsmKB!cUcEJcroYj=0{|b=CEsAWPX5?z<Z9XVoTmtA&fI#>1F-Mf
zlf!bTnHgl?Tr}7n#H*{@{sLETy?dptWGf+4Z%rTRSJy8Erh9hKNJDqNRNJ_0-e}5U
zGhfzxa_M0|UD{xqw`|!>HsY>Q`^Wk7U(Un-ao+yJA)oF~+GEvdO&;l|8}2{$VMz_P
zm`hm*BFpEmbcWC=U9O)rm?B=T70=)^TeWbJ8mVW|Xl)9K4jO)W(rA5B$APX={H4FQ
zjJhg$8bxJnpwB6XZgWy+r&Vi5^ADxCa1K8u-lGLztx~IEt9${d74nxoU7%aJT$+}e
znBD|$R5a91{|EIYNn6Pg0Yba!<AuJAojBM}Cx?E0SZ61Z`;W4}D$*fz-c+&{6vM9N
zQuXJi+0whgX8p=^%Od?t7X7+%x}SSz#cXeyq^@?G5~kMf<W55!AS+XA#}OOcVaTvK
zW@4bZc)qa}v*oy(rxAKo@cUBJ7YH!ii-j_84<UEzLJsTte*(SypFkh~Baj8d=A7}K
zE<Wtb<9}p^$mX_y=Vq%|u^e!iJ6)n}fb6o4@9V9{<qZ3mjwgU~+QLgOH`p`QIcou1
z3>f{I&;KB6IxR(i&*vWk9Ja;rKa_UsdBEd4+ejm%If#{iTHjs+lT}k?_nLKMd)L2w
zYW#!Qx@%_ozeWrV{zu<$RDFYNCMnv@Wn+VeoQsXJiwgs_W`5StX#ce;_z(HgWe04v
zslSMjY!v|HhK1`yax7y{j`NC!I(bN#R*v)7!4Z!E%Ke=(0e%tyyd|`b)iKXmnJ47N
z<uMEM!>O~UODU82QWm?vb0I%iAYmOu)Aej~wnvwB!ZirT7WStTHy&m0XzWqh0**Mc
zxDQAUca@M-)aH`Oq4pm<y8MaJMyraoMw}~js~t!_&JdT7EzMk;Ljyzs+{V7PRh_)}
zmEEd^GeKZ+A6nP!ZN>=3d(_(%3wTQ`@oDGPIh1xSSk2~*fNZY@a2v6XotmchT{T>%
zD~~A~HpzxHg7qt1ip+nAhW{c;{|~YL50PFaR=p9E0wiv8%E(M76B4u5v@xK$aS1eC
z$UjIzb+&TO*RW!{)X~MB#m$W64xhu5jqpqVaKzzXGZ#XU2mtS7FXsvW+s)!o{ScEf
zyQMi>KjqP|5%MKpwa{Q)TlKiHOMRnt+pulHbtPZAHqEY4ORi>Q{9nrMe<_GL%Xukl
znuqPT=FmFgB_>t=3umr8@>Lv{8BJ<6*30jFIP9YGT`LxgQzdIN>;w(uYEJ&<PI*8i
z0x3AZZ860#-=JUb8X=nCNKUx#|1qqX=wvbi5eOxb`PLgPtJr}*w}9dZN)~Y8s_@G<
zqQOJE*k13QxE1{32`17@IiiT8KEXQOH3Kz4vMi3<AO80gdxvX|+-e=mq+djrC)TSF
zPgyQgxU3M~r?wcnrY!f^ydM88?EHTV%g<LOL^m+nCeNoSoEmSjraOSInJv__jPJ7N
z#C-}cc!~`)dchhB?>O7k9+N&b3b?&E``;vt{+oo`b0b9Z#3+YjXNSjEjU#i{A05qv
zor%;GyN3C=F*1xOJxxm|x%rEyNzI0BVOr$|#fEi}*FS}G7DS`v&=N6aWNrBpZA?xN
zGrvI3;Di!8qj~Q`#64J2J1?)J*IeHR8v*E?NV81KmGIb8K2t6bbn|#{1~V3bgqAzW
z!zHW$a`#O4L+f)#2D){u^`dB=Y+#^!{g(v@Rw%(jfOp4|HG3bsd6QFH%iDj$wf=>l
zC8nZZy}X;2uGCwS=YNc=LC&&0nO3b?K5v*V;ID4Ale=rhit1()nJ2VlOKdlHJLHLd
z7|&Wf;Z$J@k>d9XoU`@rvRRsTEm&k)+vT}xWgJ=ypu4k$<VkJI<Gb^`Z^}eAZ}_p=
z@*wm&-MI-c%Ed9AS}rtR;58tWITlQGWlIp(Oe3+5ZA_8a{>klZq@48Z*=7c=SK;VW
zmB&>uFow!IMZa9oA_u<6tG>SCPq|*g{Fkby`{C7p&W;Dyfj3|MV)-SGxDrf+S!%UW
z*>okoWy3vaiBur9y-gDT#|$dt@aiPKrRKM;W+UhVfCs*G`E>nXqb&oU0&9(E)+pMp
zd}IsZ@kaiO6Tp5sMihEcSDfMdvj~ezYpziWzH{Tc&K3!m3B*JYp!nC8tCn@u1@^Mq
zcozROhxR;H)G(XrG=cNyRPFFmeB$}S&gw?v3tNyI$Yq7?gKYws(_#kqQL<;vg1xGm
zKAhm<v4jOe2jv8Rhd3@7BHUuFWWoO2rAsw%iqpf|nsZ=7UoUuzYa7FcbpuZ#buiXB
zU;!(TKHM?Z4*63eaPShzY&|;X%IS_9jhHus-0-@+DTEIb=-FmA;H%>w{_0mL)BoTP
zz!=3&^7_U>SXw-H!OPOC=rP52F;-QpOslqR5H_4kZP_2Icw?Ot{)=}&HWm&XY_w{b
z1G9s~Wsu`+8nCoNnKe>_WalB@USpRlt&rOv;hs8+5=tFx8)+L&ugRxejovI-@Y5**
zeWrl@Ekda0hSRNP>vG=Z16q4xeRXtQC-1~<G)rcG9Ut>X&L$;0fq*k5k1>;BiW4J7
zhZ85=g^$&b-mqllpEy_flG#q`Q>mOijp-zn<ymQ@%OWQxG_hQ@U2C$uC%c2wn~y5`
zce#c~tqQvKfxfj(5XyN91@XX3B~IN8uAOw6Z=K0Eh8$y|zN&i(+htwN8j3Uk{x{;|
zDpK#vlbX?KZ^^vHdb`<4sC^`rWaYma)QDf7{k!-`nP_A@&@Y?yx3#j>@UrNgZxNAB
zjX;g3%U`T-$4+yu)dOSmBiV-YWcD`~{$2VqhMLRF8`cZNRqIGDskJJr=xM*#YyDl%
z<x9=D10mAzS*1SJOL?-HD5Y@UH4?YC$h<oG%q@1Rp~!O)q|>QsAPZ$7=#Tp-ixnme
z^6W8ZDA<pk6wVM~NoGR^5fR9hf0mthwIH*!i4+8%zkh2}#W)lq#PDJd^suKVXr*pS
ziMgi%On%KJg+v*_6{TJC<R*2Zgm}mPaT*PBleaq;`;|W<5MRSceChJ5qNM;rp0;E@
zfU|2iSg-dz0G#e4(phd}%n*#~{^P{ln2~3;E}dp%Np0vt4I-FbR9od>I(ti03f^W-
z1-s5|wQ;HL$ipyUpTNs63UM!#bB;9TqmePDb`U1Yye<fCXP?2ye;oDZR|47hpkzFe
z#hF6?UChyVDD!TkimL`NG|ub3hYBnN$8r*91PGN72S7ilMh0gw>`#*aVFTvl{&4bZ
zJWY0QEgWQqy~H4sLM-ODf;6RH{D;JMlfPa$wy5Z1>7=at;f0k=G~5c#`vQ|pE#pJ}
zX7tfo?~%<e!X~mLNs`~mgP$z?L{3`^{dl5*dkoWE{5CzSuu;3w+S*i-dV{_|lK36P
zG!1Mq3vmDrQ07i#*i$)IWC9`O39P1{yvWPuPPpTwdDp|p5dy~UL^c6EQ#@p!DFP6z
zQ=4+vroGTKsM`}X3~_9~fSlW8FpN*1V-mOKN5@T(EVNX=45}KJQH0OU{d~oe<*nZ9
z&k%gLshDEsjDuA`rN2Nf84L-Tc=r*QD#>lMr?1T_`td>@?q1#Qb`tbyRxpcLT0&+5
za$8d;*0gu04uBc@nZdQY?=*hUsdtoBe9C<HAWZO!)ZZB9=PS36g~^sea5HZHwQ4t7
zAm<fd<(CXxF<+zK8jjCvA9ggoE5FE|`T5&sD}uE*Czw;}5=5S14ft`7F05VTbL}6{
z1-*`?5WeYIW4(oQCC=%8Z#baT;Jssu@OU;t5=GL<V}n6h`})Sc+yvYOP0q9PjNx#z
zPw|Hi?bqRr8b-O=Wqte2KLJsU*Kqs^zSBCh{QnF(Zi-ttcC`i1b+<A<28PmJ{hvO^
zD1Fzc0g;3Idj|@bsv8NJ=1krCx=M3!Ok~$}h=k75&b^kIF}Rlz_5IkgM2y?xY@Prr
z{h21uVTc$jtj$-~5!ww%UOYofXfIyJk)UdDJuV(@$K`Fv%FRF$$nQ6DNmpd4woMM{
zxiaPbrKiP=O<d6=(*VNOIV;3Wx>87T^IHTEa@<ZT1ftyyh!3R}+ZP~{4loYgUO#@#
zZRZ5=yEf#mU8|Mx-NZ+gS}*R_h<Rfw;YPzlO9w-;+!vOd%&sU5ebb4uIZKmH3pN}q
z+X5-sre$m6r@Xmqv!<2umU_!{c)K&xrd4K^Ot>DkpO63`l)as<bVwFoTKii53Z*`!
zq<DT3M?+g6m|0fHCKptZYj*4>%^m+heN;Hns^`3IU}n0$@Sgqv?9s{PQT=A7(IQXz
zH<@LX+Vy!C7YiH&tTv-m3!rzxlBvOQ>}u&+O1vpN*N}9NARCzD1ExzbUy5NIf|$Kw
zA}j0NoADf`R*u>hiWtiC-+Nghu^Li~ld8IdwIDp@S7nldo|U3YZn1`tJ$ru9rGM_+
zFj7P~Q)k)lFkBF(iy?4$DlbDJRAt}(J|Hd?JkZHRD~;F1YQJ(KI~y}Yj*6g_ntvqG
z^I?srkNwP<i;hT#fAd|PC`B~oP~O{|$BMWpoib^>Eo0E^bfO6*#2zx1--0)MAOjrt
zW5g@_J)C+-apus$)%&eRS|m*^QK?|JJy$+ZP+Q9e@^adGH3A=Q&w9JM#S8WwfSge?
ziRS_7KvsB*+;mPnJn-rvnkhOs>ZXwTRd}U(99RM<?$`c!^p!%Zr@?Gp<PER0{i!P0
zrya_eP&RBDJtv^$nxCqx?v(_39CUU*Z0A6#mMf6@mFNBKTy{W{Q0B!xj<Za2Rkh6s
zxd&%glcCB}edQ7{O!4@aU6_BUAnb*Hv$l!YU5dACkm%Swy)YH50$p00`!slxE8uLy
zZ)`Qe?_K@Dk+)bG<b2u<7Ju3Kj$PP9{`XE;V1<?y288iTR)D*iul~*~S!(uVSFc(R
zY>M6uP(L8-*=bB`Kgl)fmna50tj<L07$&Ym4Hd{hWKQY=e4<$bgJ7e%N@|1-m`<-z
zkS~K{a5Q_L$Ru50B@3Lse^?_fGaJ2pY^^r974N*}$D#L4b?Re%x~ivOzv3QH?C16p
zp{D!=?Cb5hKfs_e=(Z)&s4EKYfG0beK4xBGK|&5I0!`4<is}1ePV;5NBWE~(a>^Sb
zOum^1!OsN(_GK<9@TblKxVl1Zr@d?%j<<jwFucJd%~d|VLP|Kq_JH&TBf9$*s{U%Y
z;nTe0rzEZ6%CAQBlYG<b_Pta$0K!r|$FfBi{Z?5=<(LDN8|!+n2gC!ub7M3=cYg)q
z_x<X{hCS+|XD9(S$3Ge?;*&vC;YuMrQ&NdV)AycT_pTduL#>OD&CAEud&_s#Zg!U+
zUU?xhSY3Zn?}#You+rxTJ;?arAprGR$(SYIyBU<9Zi)9dCz2;mAx|!sdwzyrZ6B#5
z5|Va7H)fe|LEb~ujGbZNPz&neJS*nEB_H@Bv9hA<fcNz2#UF!^bLLS%bBIm)2@1U3
zfEr!@M`Nl$DR}Q~fm4Hbhv@N+Cp9WdG?Kl0)G`imJdur~E(Esr)-zLy>=kTVb*#)8
z-`dLY0})DLo{T@^<Cwh$Pd6){<wI%PN30ynz&zst9VYsU%5O#*;_DRy%i=wT4t#JZ
z`wOW;IJrvzB9o-^WSUSx_T&XPN+-#*W}s!?WZx;}5+Y|Iq5__=mTUOz&2bT5jC0P*
zTpkY3o9K`K;&Ke`Dnb~x;CVi51)|p=61aTnO3Fx+!6Sc@(!OzT0Dlfp%WjV^F}@GN
zgOzf#AU}tE47f=6QBvLHXt06I<QP7oV@US0W=p?3CI8>glzq^0V7fVUJywh~28SUK
zvq4TgY}?-boAupNgT|9mmjifJ$i8M+sRIkBv7yC#5ZS}1mZgJzd)CaXH<FcZ-;>|J
z^S53%5SLF8Vk#%q>8Vre8#LDT>iu=oThe4Q$;O8Z!LzAcKZZ))UJV@&Ih$g?!)8I>
zA(`=k3`FK$C5ON1fX|Rlp=qHdlwZ~d^orxGeEi>bJ+CK621@(~IZk=8tO^2fT<?|C
z(v}Y*#~BW*U4(dV4+HsjdOYDzh8b@9NFDj_zK9yM$jB&q+}cL1)O;|T?(zm>yTyy9
zq6(3$8m{&ie6aT&5g2a@*Cy+2<G!s#(09Vo=oD?1@sINYRXB+2A+2Ivew0#jW9&lx
z7NH<-dxBs2$VKv5Am*H;M&N<u_qu5Gt!-|fbM?DKd+HB0qTdn>r!mf%gaD$p4*^z1
zlUlfIq*^UeLt5jAwYdbZdOL3<yNxW&cpbHX!GVsr!{873_W8dv4%k}rlBz}Pt1Rg1
z<d`Z%evn2Nu+U+GgbImbtg=n7#xU}%Zh?vnVS!*2vN6Y~y@(}8WkBucibG|2DwE43
zX!+6f_HoqS3Bu^<t}RZIDF|cpL>k<rGNFeuj*=x$zGu;1*W06^JfU`0Y44;7abXTK
zWXAG>_{9y9VWCAcr-cm*NH`kTGvi+xZ2~keW{8af2Mk?Y*gEo|muy|33p1h#VqNa{
z>h+KsSPgK<UngyHlREWL!2mVG-%<=OIKRP8QqH5+*SA)68*x-RbK2##bwl@cDZ42C
zKwT*N&hnWLKcjjQUDJ|QYj68CB;O0NwudH-7A^7e1{`sXrlH}&9SnvW$M6}e*`6`6
zd&mlM)rS^iy!GWtOS(h*-g)uqA$s{O^6zEL9BM=Nn|V0}GQ8M|!4Wv&alJ4SuT;-A
zg?c5cE!yvj3qa(p_7gm-Cs^g#K9bau)vONUNeh6myxa4{<x%{EeQBNd>JToudTG5+
zuP73JWyqS&GnlbP_`E*<DX&01i)Kq7#f$ic&+I-8y^!*5P1jISdGR^Cm-y+3`U@|V
zr@@m{%r5gOj+QO$7lJ~PWl@I+T|?<F33domn4%)+@7Tr-TUc{>)$j%1jKZF9s(ox$
z3xF2)r1Z{RDuo2{!gzgzQLu}y8B~kCBnz016Uv0CfY@lzDY~;S+GS+#qI>GgSd+~T
zHHwk<Ho(JY3jB(xo>)jG=iY%ooxg)`PWk<0_cCkN;Y_el&z>{dND%IA8+%Ac&d>LJ
z!+R-o|5k&#w7?<Rc_?xac+)D<vRTRxCVlbb^%#6ch^}9=D4<p3ix2ePwEj#zPy2Z)
zqYA}S-0fHj<edX-9tp@;q1Um<J^X6)zfdij3UY6Fk){6|o~}Qm*O!o7$QUJQG#lPO
z<{7?`8mBy9Fwv2^jcy+Mw8_>la?=}7-G&crTzFyhSZunrN5ScJ)k|sK8?mE3b9b}b
z<xbLbtOavPn|3a~D)=D**NVh<7iv%kloWfgJ_&^@HbAO3=SKyrxi?@W+kshw0DrMw
zGdR+0(C|iFg|*?v2T7Km_S{9cE)zcH#&xa`rS6@!0pYwVJ;Z^M6a39mCtx!zr9Mnc
zZG=uo&=58hj6iY#16v+eW&8=Nb#&-#y+$Z;?+YtR?_T2Jg#(Hot#gybvwLw7(y+^{
zTA+bm6R-F=YWsVC-MlaPFXwF#gcHKcM1jgOxn^77HkeEBA2bR$MfUfqfabE{`+Y+$
zDvnm=pKCtxo1rhQt{9z#;SS#F-r(13)@={IS!NHg5n1ri;p0JOyc9+5RJw>I%2&ST
z4X9!ok6~j<T@IoF2Lst%|7rK#bcR36<|=Cy(mFh;cx}>Wve!{0VZT)rc_*kNaniV4
z`XNw7$oPzx$h1ra!uZCjG54d0gB0SF#Vo2M4VT1BEN|0*c|>_yS`Y9wU=@JUAi(^Q
zZvSY?$t)brR4SfB*gWb+ajOmDsiDu&ECZ1V>Rz4t$VMFrV;?TXD$^`O6|3rg#pQV_
zO{r)<r6KiyySx7Be1r5_?=9jAt%j_OHKm%9W(Bqqh)K-=q*a02$zmuQPnkPAsgpXm
zDRJntg=G%!!YUWp9mOhq`~aDzpIvG##o-G@-a)P?Pdo`Kl7<X;45*4uwKrh$3Tlq1
zQ_V8!s(HDGyWa;)!jhq?mJhpEP}@thaXqP8U{^$05h+IwazJ>!&iav^L|h5c*w;~l
z8#oJ<g;e-eIt+x3%_w0PFwxOrjFGD)#+m1P3u^RTVSSF}2zM7yHu|3mJma|<*JX3s
z2<`RRm=kUX(>>Gw=8@=VmEriFm$ZnrphEu0Mk@tJHGXZJ=&z6=GamO^k2WVsl~TN1
zpf65eBuNjceJNR6-n|PS@OJ<4PsjI1N3o3*`_m`EY%eS~DwW8a$Lk2QG^rpwKT>?y
znkK8zug<*!Y@S8Q%b<h7M?!@AMS@iT_}6jlg*Z+*mEd|^UlDgw^j>-R(HjhASsp3X
zpm8%rJ$Z67bYlTllpbQ`^inBT7ac?@(b87MYw&$m8ABu^+v7IBR3Gx;&@J)cY_f`-
zdIkpF;0e+vOA{53%}AYVLu`lWBg^?m5QERkReZ_fT?6UItLZob$mBt)f9b~dI^$sD
zC?q)0qTGHAgS(`!bG+F5JK~MWPq^C(V<~#zA55+#LGk(T5b05*Kzb-pPhVnuqHh(h
z^Kc_xSxro{zNPjpa=Hzr1pIvI{jB^LY4>gSeFuCXz_K&0uo@B)q6%7LqNeJzmQqcf
zL4o1F+418X_^LP0?ndZ&xc%Dyt1M|V@0K~vCmc=PjEI7@Dr&7_a2%r7#emP5`R@ad
zIO~AQJ6EweZ^#2*Q;T7nArLLZKpY7Mklb_S=Bp9+mb{`ow6x3wurvqjAAtt0>Dn&@
zpT$MmkV9?JWfiN3@&lK6tzT205~5`UV+7<R@q0KR#3tn_N(iP@7_b2w%jHhoKe%Vt
zr+xl<$rNoZu4KsO3|AX60&llO_Ac1a^o0U`Z*G}M@coM?+ZhSVCp#Xin!H%~7oz(4
zsi>#(6#wDjW%n?L<r}Pfm!|!>^x2Ml%iiR&v}g<Y8r&SV=0*b}5o5e=&m20B&!nRq
z*7rVVa~>2&W=nmsP*enA!M;kXoGLS_3b9<=Ko6~1M(TyrrhLUw9mBx>6RVXR$QAms
z8X+1#IOI915HUWHNbQ!6Z7aP}dxY~N4<3?jIX}D(v2?(QaTyPr<JQ*qRQ)A6ZI3=b
zz5v@-5gv;lE7>g>8xUg1jfVhG7e%nh&d){n7wL-<9fbA2N%FEJr`FXNv*#;O(@6K8
ze^7KxoH+AB*N<_@Lr9x1oy-qePgWW%d-N$=vC!9k^}ONYt|j<EGUb=F^VZ?5o3!Qd
zgsyOz{Pmm8HPV41ECzEHH4p-{`SQf8j;O0R$8*=Swg<^fU#N#5H~DrloG)0_p4BfV
zyf2&6%S|Bq(|<_03&{uDFmS*t?Vmpn{E20ARF;19NhwN&dAEj3^xI(N`&aKqo!G?A
zq-o-AXdq~B@zx~d2V+rS?Q-9oG02I#bbH2Vgr*2gp%f7(rr-#|FnZ<30_ZYnHoI5b
zj1}09pou%r($Dt}W<S$A$)V8+q!Hwxu!d+H@Pt=8xNu=SaoJ@^C9<NW>rF#F^eIo<
zbLq>fsNV}AFY~%o$_KjdE#2HK!PvdZaotdy!biSMi#UY^0zc49KON<vg&k0*alRhi
z)&?G6|K1w4d8>>AyQw|=Cs)>hMCSUJYFsL%vtJ;Sj9Jp9M#22Gt}{o*f_FR<<>iS@
z^2#<Eixz0hFjPqsO7G(gHT1j@v|ZJ#sq4#bY``N=;w`?wBZHU_r6272V)3&uZr{!~
zlH5=BCIJZQfui0mlcVTo7~JK-6-d(1z(wymqD_r2Yf%aUgUzO2waaQk-x$6hQ^Z=D
zAZc8Jd4hB}gtMy}JhAZ!0vL!B-I6om600rkb?RJu06Hxq?U-GAD?A#+zxkKrCbjzB
zxg2P!gsWXY(lHB6BjU4fQLb1vCT=41WlUJ8Mi#=FjmM9ZAAb4oTn(n#PW;cuQZ5s&
zfvl)1018w9)wn$tFBtG9hcD|XwH+q1c(E(#R)Euh2@JIZ+G9K+(sN3dMgz_hu2Pd9
zp7A}B_vJ?SBoeivDTH<tJCp{q2yAUIm(Gi{iVumjakKxoY9)Od&F}K^_R%4p2OQbV
za&YnUelFaL`cYCU@TEr+m9hE8Kfph~7HZGhrF5jU8jc%qd^5P<=6dX|S-8O`!g-{h
z!uaWC)Ajj<KJ-j&1tse$+%_}&$f-h0;_W)`N@wX+A>F?qr8rLjGh7!_I|W^cw5?cA
zb36e{Loj^A%ZnSaOT2`-*7&`?X37`48Pgm<tajZ1^z0kZ+#5biSB~Y%V+b}?DjiMk
zgyk_(%8kjnw;itcBTgeb!t+|$HuR+TBI-PKm!*BLN1mv_9Iw$jp5pa8-LI)MIJ}8-
z6(%2P(4~VJ7|kPV%EMeG@ATok?MsHd>Yr}GVKFR=)VyD6-~9O|qSo55%oY0+Q66pU
zLe&GMr&%^I#oz1(#o^Y^YI9Qs*E<+x$9N;ba#79%G2Crp{V=BRM?8g34dpkJS7Law
z=(0}>I{7yKWMYf^pX94Fzlv0!t2%S{Yl-Mc&%6N*YPM7_RdYV7Oek}YZ$Yb^TG5zf
zw;%}0&3~newyMI3?;>O^z)N+tmoB{umMJe?oTAFYM5sR<|D;OSYD}-X1|FHY_6=)I
z@+C4@QOL9wjeX%p(*k0%H?;=dA7IlBdUkmQaNAuPMM^TY>%37vgh=R$Ym?j!0}?Xy
za4C+OBKXz_La9QZ=@u89rVMWa0>!s3S>(C=xUk<|)aAW`Y<~4b(l`*s|CErS*njV3
z$jYL|5Ooh;1<_G$LpMXsPb5#DF%Gjno_3znmSQTEfh+`SN^vSp82W{wNSxTgP%Plf
zW*3;d4K8uN&Y^DTybm5@8D0dGvN1+uvP^fH59dX}k{^3ECVND+RVdg&dBW5>!qA}b
zB+PZ-C~Uy)I-_MgkLV*43$fXAqMFq=`s=4ZR1LQ;C{*znz!Cv1_D#XCC-`4MT}1@f
z;_P^v*;V<O@=I&<mB#y&WijE!un%cgLHzK=$Mi7*hh5rL?walvW@DA06bf-d0U=9R
zo~!5mtO#j8I$oCL4>6f4=$PXbg|rg*0HGU-H<*)imTQ}G;UIVhhAi2vOzKwX0iHDZ
zR`C%%*$m;=t6TyfL(_Wl|E?9=Wl?XC_OM3CE9(v-nMAn}$)g9UO9c!}Rtb7I%SE-l
zZ@}Yr0Efe1DyzE+wi(^|f+rS^Zk|C9j0v37nz*1KN&lO^-tEU=UdH(40yb>X<~ZXH
z#ZKURvRmuP(~~st9iFv!>L+JSasPNsGG68fGTYp!6(s{2Kcd^2>$2Kbcj<I>epii6
z35f#8VFC!Io@>_}Jeu$=IGa+oE>}Ddh?;;c;6Apxw=UGX$X=OjieuB_wxgnS?S=s+
zcG4cqz4Qnyk+3U0dxOw>5y+Ke;mKaxGj2A|%(|>R8f=<XQ5;pKBnNUyc#KP$E%8f%
zcGn9v+)rw1bPb9(X3kx6|Hi0EobY16#{E5>B0481h!-b<zq-ROb0(rzar_`yr-Z7u
za9IIW;)S{wJS92+7n~_IPlX$x<P?3;bKDg7s`x&D5t8&vR()#aU;U@TtIK(ITxQ`)
zN>{PIz%=dy8a$SOyCZp;1Q3^dxaVKZunHRIpyM$y%5te{TX^~VeO;q<{i+9i(j=WA
zrwG`GXk;!1V?lu+q4zgRptS1y@Z$LD?uhVzJJlRBii<N*QoX^xv}hmw&_b@ztR;Z-
zgF(!&_sv-ge*OC$)jRBkq0)<rL?A;zNm9Wft$wo+M+dO#fZb%;1&ISQVY&1^&<E6v
zK6w4uF`cLAni7|}Gr9}!2na9cRocIumh4Ol0t^HU?%|2RX^ryuBgG<x4|ht9kOFlV
z97acjwYIf)yp(^tBPvpzsHa@d01L>wrZ;Mca6UE$aV#eW2jJX1faFJ`$wFK0S81xR
z&}GC@2hVH%k;H!U?khud;2@CK6o~Y~Y@7<`+2=rAetlcbr{MM^3?W6P9+bsf{(k_V
zKwrOP#qb_4OUMc#>No7Vq6-y?Q%z&gupM(iV99Q@Yb~>3*Ltm1t2V6H+jgtl>krxt
zQf(8NC7?-A6k(&%J&te);Y%t638Vw|Z$6N!#b1S8$NKSYuWdI;r#o!ahK>5L)@n8D
zY}@P9yWQrXUw8WaXta(FgBXa@ucFWJHuiEsuiF-Bw+3wsj*MN<@PjV=%OqyaB<*gi
z(`eh4)m&SzfBpC#bcz3k<2d7;hL`fY1%2-H>~^OEC)|F!OJIF!4r{$Zr&H@T>q8rM
zqs{hku(m!6>t|?WP;_0CQTIF!rlhP6LezaGq2~~UsaiaF=!Zq?Dm!|Ix4ETYV03|W
z0}qBZp3Lskx4Wa|5vY7Mw!S9eV&Bt+Qn~|7JPQqtsVEia?zQK7xPtK>M-SrtJUKgZ
z9MG4+qK<}ziuN?D7<E<L)5e8%I;9W<w3^385bu5Z;`E3N0V_Fk<txHjvn5{{UV3Wi
z-RwW%XZIt5fnnuOQxuN<utjWz6%)giN{L6RAfOWEB$^3IDNYuE^*WAhmQ{X1fL+%E
zaE7=ouo!}hbgscN7(!6h*tKGNh39zZS0|d1GGTIYY^$V?H35l{p4CfJn`uL)cmC+z
zc-*1mvINHA2x|r2pV58bifl%k9h9{0sqD-TpL=&XQ+Aehn%F(N*|U3anC!G_tv)zl
zdXDYXtWMu)_WJF1zdu;U2=np1d`dKxCk!_@2keP`^V<Jf+}xDdV_O68>uh3={YdN;
z+tK%R1?M{>c~V#M?0V9t;PNdFr3<zjiMt)rIsM%~9gjjG!3&I6KtLG+Ilj?l4iD?h
z_8u_LT<8FzmwuT)&!M^@+8)LY1`!$FyKuyZ({zrZfJfQFz&DYtfLjI-b4k5^mNA0X
z#HYr$HFgatqy&cXj(-^2ddmu7-?2Jt3d5<xFc1X_dOdlAS2lG_-SHKTY(rz6vyQT-
zP%`!`jPc5A1CEw<-~tL80QGXvk4d{S1!amqgf}JY<L+=+;Zu2`a?{}5*)U{T1Z4XV
zJ`cOXs7fMh3j$u%wcx9U{88`#sy>?D<^Afpz@gC$zyL75&{aTY5lw!iJz+U==#6rE
zn|w~IN)s;c^khcQya5VZALzz?f_T<+YTaLrh<81^sU-WiXS_1%(!3?#qv48?_7~Va
z#BNolL;KnO$b^q3x*=We3_NQB+a44KY>F2QXDA|RW`LVC9oUXFMGO1`8v@XtOHjmI
zL=iKCBCI26sz{Vcbx5L(f<9q!1%>!WQ|7<031u*w)|Om$nZZU(Y`BwIU+K1;Lrd6`
z<b_c|Bep!@F=SzJoIJL@pn<C1QJ?@T3j9g;!d-al%TYq2oq<Da;BvMo!}-r0&&Thk
z?DEmEd+nmd;D-jgHJZv-8%-SSFy=G7l&QY9)zx32#j?nO?_uB)<x0JtsK1htK-(^$
zw@&}K!a~jdEA?wpj7p{jsBaG=S~6>V>bNOiWM?%*u!pdYbZ;I0B!XaqWsasv5ux!A
z032llp>LD-<!Qaw0E7CHS&zQeQ{B=q<p7omy~Ik<({>C7!L@aYq)am=7s+hWsPt*9
zgS=`rqhtJaY{<HOD>M%aIvTZ;>Lq<;BwH!i#bQ&Q-9=h5ql;<AQ7<#)0+YGGq~Z}2
zT5w`j8~H)P_!_a%r7C(yt&gC%!B`i*Zf2}x-?Xk9FIu-=!>Qp811f;t0rYLgg0-Hg
zEnBc)Q3=NTIe74#k1P1k*Y`8n-zFE2kHjYKEyY-1LGe>vIGTk-v&Nr|c+JdHO4zdx
zuW10#IUFIQ-X4HStI^u8hySP=jm$15TL_1u)k-*)WHZqqmF;A&qSDZ^yS$(q37R=D
zuXtt&<9)_L!qT^CLx6NvqG}}!c8-T0dRCWuDFq3ScQWxJ*2nk;L_i3nkH}<5jXpK#
zY)+9Dr9`N7d3e%_r5uz&`Km%cL=7xCjbsubWbguwB?u?C7I9fdb5dNRXqSaAWb*U1
z9FMhZCjMg7_v>(gh5rJ#(r0^0{$ai4Mal(!$rEI`z%N|jmpGWxfINUX!X*+z=BO9?
z^@KFcU)IyuN8PYMsck{b+{>!O9wnMfyjy0sv0$aj%o{14VDZks3ecH|)|Q<GCl%H$
z?6g!`db+sE8MsOnmGJSRYVZE__!mVrB%4%CoS#%H&CG|R8kzDl)}B!C6s{a;_5b}}
z|MmYyr#kugyr7MNIAV!5{_p=UI(Fr?K{KU-X?jX#^C`?dZXnrq9XW`W#nGTK8$1b)
zPXcdu2KH#sV(|eW-^F^PUTY|6&-{^V-_wBEf~xG1iZyuQkMofn&5u3Bhv2kN)CkvD
zx{DMwVq41;|Ka)`D<1AjGXe{;2#1*|m?FzeBH$2{m_<RWo|S1;t+JaB<gU+hJqmxl
z3<rCes=id)rP_WJwJmw^?-fgD+;5$zOM|N+stNpn{>+D+vuGiFBVH(~(j6exfl(#l
zg?)-kMezl%@WK+09xd;ZUw8rvt<-*-UBhH3^#-Fz!$vRebMe%x*-A^<Cf2d#Q%JvM
z)rbX34<?$0bbzYj!aogM7F#7Fv@cHvD__##pWmnM5`bXvG{UMPAd55b<k4)y$|m4B
zycYRzRYgSNTr4JX<0{LEmyA?N4;h`BL+%|DS(9a=D!n!$lP7o0Nfc5!`9ezuz0A%S
z4X8`Woph(kfQ(EmaRNlV6eqF<_#mlvKJk7+Bkjz0{5gOV7ucP_R9it?t?@lI+48>_
z_y_bP2;2;`F4hF}&$WAP(I1&^Hhf7xjn?k4E2&PZ{b%$u6<VB5h0+bj&UL^Q@(1@~
zGqb0f9rleAP$p9k{1qI8{Lqt>pqCt4HM+H?MXgv=)&=xReMgs6Fv44u`H)gj=v1u2
z=b}pp^#v6T_+He~2I5QDT8&^eXfO;5p>~Lt&d?`jE7b+o<RwoBeUG|4oZnb(^0!}s
zUEmkXF&E?}J5S{=S2du{ST34CXf~Me{b>UIBz9#tfG!kS;em$!G^-)ccVGhv1>U)2
z<Ye}Sw|6E{7}_J=N4(Qcsf=6DMDT>rwLAb{F?C7vvK!u)X~ZUe4!5hGq0J(`XfL&7
zXROs9_(GlZc}L6Uhr~L)AeeYnK3JxXWa>JIb&1te-Kb7flaH^lp5`SQq#y?a`It7z
ze1rwhdrua=IlyZdQTm@p)dk`0q?7?Nd5^i&66@9y8#)xmB{C_J&-|PyYi}_C>4K(K
z1PSaiA6ZBR8Do@feu@s4+oFra9%<p`kJIQQxu(^s;ae${qM#!SUBV_->>T+IT8~d9
zCujIewXKZOUoPBC;%)SFJ<*lqRx|xF*>LpPj7_Fu%NW&JxY<;0PZe9sSk}%=z5OD+
zLOf($j!&9ivda86D2(0R2#H7!y|gM=(|JJ3huJ4S@u)g8e*#<5Fsx4ArtJcXA8|6O
zVis+Iy41?tm=e|m45$>=xZke0u+pk&Vcim`O1QkBIK{-2Qnd-^lJe5Dv6XT~p>j-|
z7RwVmS$MuzqhU^rG@eX@_X{D>(xnp%NS+&B!_A+vb7Y8LJyZOoufKHfb8cEvb?*9B
zzTtX6Ef>1U;sc->%UX&dEkMNoPVS?$s9<Tiq8+(nak{WH^?Bglh1oq;Za{Yv(0<uF
z_Q?ME3Jxy|^%y_TCvZLLi#`d(BV$H0ATNpQK!z5qMsYPLSy6I&X4V4RZ}e%Yfr9E%
zt;w{~iOPHQQk^}3I>U5r08XclA4R*s9>^Wbv>Y=MsM@9+xlGFw7MoAmDDv;qQS0Wa
zYTaB_t((t8t*79JY$vF-m79S_0CpFZR2zFsS_;BG9D}EI>JDg5oEL5+cqrg`hC@iW
zeOhZzT$`1Ug!Ze<S{wUQX02T!Yi(o0S!?5YwzM<WKCS#m&n_pe4E4^=MjM|So{2V?
z57;L*m6TSUv8!0(!^Q(7rOo_CnUq$hMwyhhOiHWzQzoT-p-E{Qn@URCSZ`9=#tKPk
zQ*{e0DbF)0t;J7pcoU87P0ZcBefeoJU9DLrt6fX7+7sA8!j24&xkp2gh@WAH8_@jT
z@bF5UtgR8wK@jFX4A@1&ZAxdG&w?WN^HWK4n@VteG=dqIg+({-t$OTN^5alNCx@RY
z{tc!0r}omgJUH+HXA^mLiykoP>5!RyK;>clLUga#?94^44$W??nc>?&dBf*97vQ`|
z)3TDG>tVpONSzutC{6pu$;`MRqX~7?jD63A<C_RKJserr*X+l=G56+Zv7)guQ2yB0
z#@0Rmq66~{MbZ5`m<RARIE>LxRB6m?qy)T<PMCp60)uCFf{{4D7&&2{*jv|UsXKyw
z<vAp=W*!6O0kir>B8A8~A*~+<RUgXsh=<IEQ%+M|sftj-<Hs<}9S!S^Hb(~42X4k6
zmEAx70C*_)W8ufi`RTWByL&&fj45y!Ru+HjIqAaEB(VVES4c;w+xwA1Oz;s-Y-%!%
zO3yg@u$OKHJ}=rZStIb_j3zq988)FbEk|Zy869j4pe!L?B_hlIz8LbJgs{O0I2|4X
z%N!bl3RfUHV7S4LgUu$^?q2l0sODd?$OGIHm3nok9RGql2Z}5x5#~7_Z6_5+hsVJY
zc~UT`iu&HW#G+v7j0kgb#u9kGWy_ru3<%8{Xc|wvPp6_(+axI0zMB&G+p{VAo?Vzf
zXBRyKn~_gd-`Pc@r7jo{SWKZCSn6j`?&?Bd`bQ`_jP#hNf>`)<sr=h~VFcs<^);C?
z^7>Pn*q#Q4pI+QpYD(}b7hu-{;KT@<uPZwO`0hDs<ej5i%LSD1h$!2e^3<fqF}qiK
zv1ES~>YcX2wYNWIyZ0m9Nze@rIflmZ#l7n5v~Fma%larS_0|IjGpu4Cq$vDHbMO?P
zfh?8Xoc;N%dYrH^({f5e;{su4c53GYmKf0gOtI|fHVUp0dapXW-3znc?Wu_c@62XX
z_giew`N5iiKl8fqjKZQka`GxKXn;1tyr*J$Q>cI}rl7UM-2oL0+DcYw#iVA@MWPLI
zozyX9>+$X6BTy}_QwtD`C&=0m%}&nL<Wewa@=@vK;a;Bbq=%dTY*$bIsR>RD>vRDr
z9TJISsaeQ(pf!YoK7~~eRMPn<HW5V}4oe?sd9$S>LZ(LPh<Hp#M4p<Ke@Z(2o5F-G
z48`Z%ZvAqN>&q*tq|rT7N3F|>kZXt6A4}MTnP;D0z0Eaf=54X(H*)OxjnbaKZhQVY
zAl-;_&QAQn%eLhw*-yC4UV<&Zk*U>_!+!y`d=B0M(>N20D9ed3EK;+)!c+-1e$Rjb
z+Ft?|iwn$P*HHE3%-}I0D2@!;0^u34bGG;l;Hm(9Rm9K^t%@|&Z|H|u+ow|7Lb6vj
zw}Y*ksg2=%NEc?{4ykl#;B^SK!8#soEws*KhRI~On!PGo#l_oX(s2xG!Hu%9{FG6s
z4L~tR_Ft7bne`V9zqD5v?G<CFg?+LD8$19Q#Rn&H$$7l=A}UG2<IYe%{COac0c9ra
zKe%bkJ!O@MD6|6qnOQt!RbD=#Nk)Y<M4i`E&`>lX?i`6v9i~68loYw7!iF9-4O4sN
zxQL+y!#R<ul%gcPdF0%KzH{x$Cw2{(&7jMiZ=gN#bk7i$yf)4#d?PT}N90c@>HbP$
zkr;C<-~l-T;9{m+FtBR$;ZQW9V*EjDN>hG}@D4T09vXmmFGkEdPAN;5D%#a+L(y5O
zt<q^yI!#KaN$E5xohI~8=`_i7OX-|{v~3n}YOv5Nt8;Lnr<R2Wm+%0^-5$zw3BALz
z;Hb7+UD;`pJf6bQ?4g||jTN0HiXp7*G%0p+-Hg*j({jL@EuAJZHA<&R=``7Tr-`nT
zTGeT?q(x{6*Gblhq6-SeT_;7`T!Vhz7S~BL$92*yT_<aCot&aMlNbQr1Lq0(%Itzy
z76SQ3{xt|CwWz*qKT47pc}1B8x7Lr+%vAKr;ct~6<s@>Rfbo=NgMZ7V!=TcESLEp(
zh8qj~DS%Qpgs@bh3P5A&6$XAo0qS^QXh*@Yz%_$$YQ~cp#?dFY7T^FJy4s=4VD!8D
zi3RJO58s^P1q*_fcP%#xhPM#7Tq7pgVc!Kr7ek#eXUQ5IDeP0?0+sQvG>#1QrLZ?|
zZ!vKNm|Wup<7sc$JG{y`@+~mE|EGbeFIcxPcZ_t792)fB_5RbSTmrTd+%7an>&~&w
ze^8S?4J~-;jezL*6zR+HH|)1<g%cN_*F@*U8p--~PG&Xw6+un_cMRR@%bi4Ooil3+
zj<zsr40Vp+qbpQPmFW3iqF$_Rj$0S0-9xi=vhh#N&-*;Xc&zUW8pE-?!x@fxu5fDo
zI<pu1wRi!AYb&H%GK>%V9R2}URalC-5?Fo){1-YGSlW}5v#Rlt1oP1h1EtT=tq=~p
znmxoMT^X>LJA*JyJNrtMv3d7zV8KX4XcawyciayU^*;GW+2$quS<ozfz4yt)mf6F-
zJ$1)_J^ST+4s!B!+1}G{?CxeX|I5X(k4tn`>w4p;^KUSp<HCCavZ@dTLuIkBW}L;d
zw8qj(W215pCmJ45=`389_Df|@L>a`cGG*xnSy|@Mywo92Sckmv#{<_BTLfwW2)8+0
zU9i}~&Kz39{T5Rxyk4YI<n4&)KFiM+*FNdR(3)Of;R+}(idEzLJq5?ge9HQN#y#fm
zTm*Uo_;WI!U3&4}iBE<JG-Dr%7TW3tSIf}B&3yRDMW>paWBtp4=CRh@z>H$@&A<=D
zap&XmZeV#gu)y8GV|I#qdu!37={he5wmXeydjXIsjRIHL-pxl8-;;fZt-7{riS*~X
zt|P9mTcI{A(6^}03%oBWR;2Q#Wa;!z+fu=f_|Q)O=88^##Sm6@`WG{^ZpP`aY3An5
zmQH_}8l}^}boy_-(_dFfE$#GQ)qk;s+dpeeVH3^bZvUcfu0ca@i`&1I<MwZrZvXYW
z{V|d66fIMD9>n`Vn0m`ME{HXzb~SfA2BQni0(jBDzy@~qz!<tC^0H9@Nmk_*We(k1
zR6r|pB}fi``)*f8zIrzS5&%~+5u!9lQG(K;G+9iZ!2gVY2Y3UI-P{WB#xfM7BE_Kt
zSdpGxFbLi~cvdk^BBoI>DzD7?9<7Iv1ojL{Ps!NFEKxjUe{h4B04LP2N<%e*?Rejy
z-5(<}0AK-o%h3sV<!cDG?qK5D^bVN_#keBqfE~Z!DUK{)1Eu3Zo#0Oq2@#{$%1{Kf
z`Qx|vT}=^^4Wkp*nI(Q>NQF@D=<Fsvj|n&82QnUzDY&FC(^A5XBE6ISSCadXl?c#D
zvJaM}gvU~@A9`IbcfNc3KQ6wDJ|+h%6yHh&E|lC1Qk%@v@Y{_qY6-^!j$2%I#4r5A
z2R=k8K6E{36a1~A&s;^@<>;GB<Bv=(;^kMQbWv)jDSk|V<CdU#R8LLyJ-pH_Ggpi=
z<S)O9W_}G5_7U{|)S<3*O!~P)gD{*ydoxVJ5e`Z<Ys`x)(rElT9Z@`$G~ZlZ0{R#I
zXP`%N<{rO~<$k3b6|Jdf#FUFIpv5A3tVolb5eapgRb@3&CLNy97Zn+}7y;N`K&G7B
zon!;ARH`|uN_kh+ZWdFgR9IE!@C8aMDNd0TJsM)=0auTOh={$teXjGK=HjyCm_+q(
zGz;WgV-AbX<AztMrDn9~tUkmdww~Ed>WlQ&WYy)cAd9T9I<8|~t11?T<p`Z>XK&qe
zx4z{pcMaE^#1$uU=_Q>{=<}Mo^-W)~-3Z?=Bqe<<JCcmH^R>*z_9ssW4JVC_LE)Aj
zR1t_=TG_>M-3e@AtWTFae*=&&!xyF-knz<TtpE}-(I<Jx3p*93jod3m6AQYfY$vl{
zocKCD3+GAEw|F!8y-T(w^=|`GqMF#O=MuItW9k-9NCrt_6*H){fy@e7IS?fH<a_^4
zU8c;dApa@zDm*}5g?6X&Y@w5qDtT)7NwxNSN>IuLdbmVY>XA@hl%5&`W~`)7i31m{
z=_Lymq9NbjJW(c0@5`Pb8)obfOGebAVu>&>!^&mjasZR^&<OL^iU@PX5LQN*7lZ6<
z24SuVnc~fs2y>YlCBnQ!m~TD8TvthL0AaogSZxX1dDck7CR)XD=SACGgWld2+<7|(
zcit{>=bOWw<0*)q#5oS)#G|gkmklpZawM-PGve05%iEdDKyvuo3@;y!EWn!~%-gqF
zst=efL~6%D<`%OWU`a%j!=WUJIp=6`FNqTO!HJC7%U6yqCtn|7;1m2Lmu5hj8|M^{
zj*h({l5s6SZ>l5UYhXO#-8nQWr;{I;19I;V^f0D@nnf|jO7O<%M1IBbRTSS)31L$_
zq0IQUM!rsv9K0BNEZnkZzsOEgUL=HRg@LP}n6mYZobz&on6qD^;4qPgRG3UIy>H-u
zPmnX5<}^WbQ8W6uI1S1!j@~5D*_wop$KcXydhaRB)~fg%Wz?+n#D_wZ60AxBbE+6l
zA($sZ)5Jg*fIVYTl)|3M;-1~p5K*b<t3Gg1Xs~#HvjL3i9zzEuiBibfQ=_kDZ=V>A
zrQR}TV7+31rsPCqP*@L`tU*H2nUFJ6oslS-Nxp1yEkeIYT@u5-^b~kV(G3b^`_qWP
zrY^=rhsK|#xV77lPq&u~pe=;zxr!KIDXdSllBs}UqIF$>m?)nK6iYOy2N+AWN&!$$
z5j6Ic0b?axicBwVEHxc~h}YNnp2JvSmt0pG)oDCHYBRgF+!1cMmF*z_%>@hCu{A40
z%@qkX2Y9@|4M2u$vR1H^+1v`Slu(6F4KA>F&3H<f0gc6|1P<ttvIJ4B#EB({YTXE+
zr=}H45LJSvYRZ*iIyXSAlQVTZQ^h7I`6yAQ%*|OiH)qoO1fG|N22r(F1W_r5uri3M
zm}6=)ASzAAAaAw=QOVROK~yD(YU@E%x=LyzVLDfF1up@k${K6fM7ubQs%V>Q(A?Vs
zqw3_qs5&K#YW*;(4`9c=0#hxRYwg+9t!rJq{d#&en_6A~z{T0s6ei+jW2usC$t%j-
zxV2cSPUdQm9R5}(@U*-rhV-d7!uT1Xgcv9x7)8^j+1!9XDSB$?Pw%X$W6(`wun*o;
z#Akt}b>w8^^~8b$|7)ThFsT65XY{Qxocd#9JRi;634AjK;93!eg=zp6TBZgJPy;aF
zQ{y5WWai1EDDcXUfvRXcG-bfdEU49CDn(x!3dA$?{X*_);RtX5EL$I@;Y&P@P(R?g
z7~LDk_aGjwok#}fu%~k7O>};Tp@E_ZCyESyW9tjK8dwOzvA;y{o79)~IqD|;f@S9v
zajIh2A{+&Gui92X!X7CS5T*zckD6D_sH&u8a+tL5VGEZ#zj|Lh|1Jz^l)_fMrGF&|
zrKGbw&*@t9yJFT~gLpb`{K@@=&*ocj^#?E$z&e7DSqxk^@O+v|_r9WNGfIXUk(sx2
z;bXYIj4H7j0$)Ji;OOA_6nubJ)@W4u+wSG%r@vNy_+bcte%SkK<*#RdIXUAQ>t9ta
zFP%SMUhb#=+WU`B|LgMd^XEVB!GHf+`BeMiGgdu=nR!Lu@BI~wHG+ztE_cF489}h%
z<qkU7MfcF(9_#lzR5XX_3C8CO;b;+wsz&%(*;5~<2=nt}hZdBPQkzz3&tk|H!TWNS
zy4YB9;Rh!P*g-7*lOF0oY65x-*ck@sAzarYzEP;UB|wl*K<8<v!rTg#7>4b_{Le=L
zi~@6Yi^tIM2>_=3j6kMOKy&KPR;gGwsaPjVC{_tVb#x7lED7KZ>+d}SeO)ZqZaB23
zpys8JdIKMh!MNFl9$$J4t?35C`R~8qAI_$8qT2gb(`y9c=+wdTq<Lcj^CDVC^O!_X
z=1n%6&Vmz`lj{}x;7`GTgq@6a!oZW(kB<Y#E0e#Lh`hpxyf^IpjfMfG=NUF;Lw5w5
zdRk<ym_1V&34*?>H|oz8&sXM+E%U~1oXNuFtpF%W)X2m{m57wMb(flU7g~2iD>E21
z!Qxp_8gF;^03EWxp1oV;wRe|Bq$F+lV84E7L`r8xM2cbvD<e{hnfEt?NYQk!@McRy
zicF0Xky0X3wjPn9tE4u7NGa+STLOcUHM+2gPH_xM(KgqhtG5M%(#^r3bW04%CNL-?
zmOJw5!~+lb6%zhsV@{H6$Sca+x3!p)Zl=CZ4u7jKC#ORgB+a!N7#93{N`v>fEPg(~
zK*rGE*bNAMY|X%K^#v{G_LQIixF|Rjib6e84!se?!6z)X56{hI*w88b`wO{;p*SHl
z1)~RHOrO9vEZWA%9lJBb8n|$}y2l5AXYr(tI6Q$YZ5=vwzk3Tda6)2b_KnwM<loVp
zv_@b7ZxCuCzvtD^R?a$%fs5dwiyit%hTz@wZ1RI4<nr$BZXfKI;2WT#I6VmN1Iq!+
zI4loil)vDh`{jO8w+>*fhM!jxXzB(G3RgfYbn*vR<NGUcpP_jkS_TetuI``@2de^S
zxb8Bj?phyE=I?xdz!M>PoNmZy0*v#8Ih-t%I`+>f0WbSK1m`OI*I4wB{S<WJ)h5=M
z{mbzUfI}EI6#f!>0&MKD2RH6Nkn0@w>zy^TM(FNZIXUj4uu75Nn>uVVGU1_<mC~O%
zSSh@t@{t4pl{%+))>*L&@WQ}be`=)PozLOePUH|O>`RiDishgZQ7cY>tpe6ss?7g6
z_r4f!QTj3putqo}Mfmi&Co81X0w@gi1d5V$E&QI2fojk<JPjXE(!n089vi#gcE4ZL
z)@%59vZ2(o+*bIfPp7KpvR_K=@`PZjApj{sjPH$#kd-i-7?3>O=EC9&`l7Cv!uUka
z(-`0&44=d%ejkM=;aU_$P^x|q{>hB`pJMglzvHW5W=&^+Ci?X0^X|g7Kl8Tt(ygl?
z6nwZaAa^*dNN6e5WPn3e^|+d>n<6h%Og*bEn2tnPEfn};0<T9Yq(=;$5#^=?yI+b*
z2@o8X+51#OM|N&&m+(iUL0T-)W){vP^8WHXbwCfCWAvo{I<pZvlk^Bfk++^B6|lZ0
z3ea44Qm`=Y?oDuSHKrM>f(O7MJaw;K4=Q`t=VS`|?G$oQnu^sN^UL_+V_!`5RsC(n
zkZ_e@-4M?G4d(MzN4v`ddTn~WTLx?*BVyHyq@-!r^MTk3yY|+#mgl9u5Nk@gs!4px
zKDD2rZ({(K^s<$1N2PmXjVxFMGkc{{(Mzn{@*L_c!Nvow-IM&ad$MTlo~*WZPZqD;
zlWknP^;Ydg>$Ubuy+v#ElURzAu(;*Y$z~^$RiWc#(hG20J|RU<^U}sffV%j1qS>sj
zGHuah<-qC+;O5L@E!bQ}u@W`M=upP7TSFW>HHPgNOnhDd0&fND2F}&{y=>rIw^st^
z)*9vMi3YkWquMP;x5T1V!sm+ls^O4lIbayyF8Ey19SN?uhlbB}SA@?ghOjbxu9&BC
zGw?Z0Pcd({gwM&;DB*J@d~WOEbGk}uBk;M!zVRjCa#^DZo9GsY%N1>N4Z3+-;Bvhj
zxLmJ<%WVKI#{<BK6dbT2eBtTtl5EH;%G|fLaJgQleoqenMW(x>NH~n%5Qa^fq1cEl
zc9!8-_W}Zk2RDXPgArh;B6&FjM}`L<19uZt3#S$iEnwB~$Y|C0OQLsFs5yR*W{?Hg
z9CV+Dds-P;2G;I#Fux<A!2RHk=VQa0V@iOKRv31Q_5p)f0ac9%S!P%vXbWxl(7+X|
zaz#x*V8w6#xM`<(ktA`M?sF`|J=9Uj$g2=q`4@X}lrEgA!5d~1$)lVEWR??@LrS=2
z*6VfZ!C;Pr_(-hj)VjYK5$}3-Q;|QlXS_<yh^YF&?w{4rfW^}+KCO9<vP*5lL}qyL
zg!ZDrXoN;%GOFd?Tjb!&aq$WN9_#UsS{^*54=<eH_*_N~yqp*p5ATb6@87A*%qOsX
z2e_&q&v__<g;6o0@^AAO51t*0$(B#e_dik8d6`fuNveg*SBAeMm4INKj<}OC?7e1d
zb+5I0%HaC^UB7g%MUz;%*A%Y5DACkr0xfVwUFQFIG<Q+*I1WeAhjthBR&*CBhOn}`
zsMtw;GwvcyO9^kbbQi_c45E!w=6w1TZ5nC%eaqT=`O}%2)o~5xY7!vBGdOHyEVaTm
z6d5Ak_)}<??fr844`v8qwm4_K`P(>D2w=I(s6Q&*MceN#(p6HMa2FM~fi2-d${JwU
zM6b99sc4&PP}keyLF(stkou(uY5g7~_Tvh}o4jLr3h<)zi*_L;`H)wX*>7uINc~Km
zpB(;HXZZ*{M3u3R7vXL!&+t96$Ko99iUb`Pp8;O0(|y1{(YF$yWfndMdo0@FeIu3t
zWWZ8?@E{H~B=;2Kj5>0i;t4^Lu^HBu97KEo4Wj|Ob!TwJ!8&!0<2{c0zAir%3l$MD
z1G6sEr$b?51?#ejX5jD*hIsJt>QmQwKzCF;%<(J3y7ntlclcd%ojad2>in-Bk86P!
z+$`rG^MHBnhA{p99Xd2=8k&KHlMT!QR=znLifJfKn0&mpD4J3w3&30f82kPM<1rS|
zA#tlzBo2@sB}Sngv^%<oce%qECz+l@{Eil+^YLsF##ax&yxD{W51X=p-zKA;om+T;
z3oEpKHTP)y$qrNvhSd(h7d-?&%<OP?3acS##w)hA?CvETMUqJ3Ov~}zfs4qr61#P0
z$SG0Sr>@)~`RWF<AU$y~Con>tVpYu#Bv~Qr3yN~OpUB{@=xg$=%*&ks3jKhui?<YY
zh&_l)j?_u@9LfC7lRhxZo4PoD_D4xdo@bf_MbB5yMX+|iFED`X*)v=W-*DW6!!Cg`
z$6=WLK=uj?pJJn3=e>?OjadwS_L8nXqGf)&6i>mCx>0jXbmK72Yv~TZGEDBdWdoH~
zt8iIWFd!cl?r~sM^M@7IpS@=eGbpxlFAh@lyw>k{SfYnrptG{5l`C+$0+%cBV`YFV
zSKx95-V%J6{&s0y7&7(7Jc_`U+K5F^GrA#^w|)<eKI@i|AYjtaK&2#C83|%Z09u(p
zsmz}w^FtX1LJOx>edHuvV$mw&Ka}ww(#}zE3_diVufHOoPcej*0e!{%rkeruY5J{s
zvn8NUrbY?qE8{<GJ)lolNo^9)w-jz*32a~1Si>gz#j$-w+gyX@-WF`1S<eCYne`Ig
zw|;aVOEZ2o@xc^#KeNW@#(L@Sz7#9+nlTRCT7VxNy?PNy5nx*(e(n&A(O?x8@(?CG
zf@O#R?;~6ekzK~fzXp5j#ThJ4LxOi6s`Ot+h}OG7#)P-f=o#kGsiJrHcr-DXup!Lv
z2z<E?ijM`zwXt=NNIaU?$Ovy&(of!64v_*_pqKd8cfl7-yTaP5G54^;Vx`71BLz`v
zB*(Xd{n!PLg9(Crf*Ud#9gJa_8j%CSUDOBAIScALwb>0`;)NOYc^?j@WbEIPngyey
zS%NT~)L(JB4@K?TWK}F7|8YjgXIzNcSO;K`djAoLnFrfL4+P;wPABidDxU}SGtzzs
zIl^>S5CX}m{*ls_x!=GKfCEdp<D-gU(DKWjkk_O<2Q=!vvUHqNwX3`bHV?E)1G8(D
zqoh*>T?ipBQpD_bz0Sgh%QHjiUI>Eu5!4#s7C^Nchldg@;|TMFB|}Bvo|G1Kz5m1s
z;)Uq^*!)N4{Lnga7RrKNoq7O;;Nk5hx-FYpAiIe*XBSB37XYjxK-uDB<lw6Wh;W&q
z$szZ1MyBY!q6q}ur9hSn2-woG`lXQXNvu}Xi*y)zWVv*Rc&IG%3-bpi1I8zSG@AI<
zM*?S2mujSullUtXbhb|o6>tK}RchP^)3|IRxV~M4l#><ge=e(Fwe_paAIoW1t)y!U
zmFvoB*B0y6vn6$Fk%1{yt9o3DlyNUjwLYf06j+)VV1`0y_^vrrj%@G405Wbcod5p&
z{o!m1CkuJ=RFwq#(#x45`H^adq6hHy!k<~A)Eq(kmH0z3U%GRZH#xbWnEwFn2xcz)
zU~G(dEG)C9ltG)GN6@Axn?0r7X_VoeqUkQfJ3Y1VP9<z6K`lV==xVCuqePh`ZFOwg
zFFb8Z%ISdS_J;<}m@)Uw637|lC|1VK6m>~#20f$g7UB(;_!*fRC4Q#F&ul$@Mqg2F
z070YSEn5O6lR2cYjpWF5fHK8fU5lFD8nBF+2bM8Qu*}9nVf_lI6L82oS8u<<W@<)f
z>4hU^%nX^6*>HOiGiJ8dPZD6OgJO|T9*m)j*;8N|SOBa!7a2seaFGIY?k)TsfGOC%
zF~Graegh@Xd>8D))Qs(s<EeW~0LVg}ek@bV3|u&_XOHI475rWmehsU}_3titckMCQ
zhX>Y-eVtn6k;sUJi9DZZ)^`&fw~TA}lE(sJ0s4k@7lA(jumMO8wnvkkSRRAiV8LCe
zEC?&I!XSo+1?+<P!pp4`t^;Ty13W<2G?D|K0qW@-TO+`?5_HqCcHu!HeaeaunqSDB
z5veKT*0sd@cQ7WQ$s&vUW`l7dj3~JAM;Ps-!NYJdTAxnf(XQO5T^^4soJ9<>2CRVr
zaX`ADAxzb?Z@|nRFu)88s0OnzLVf{`y7%Y6W;lH_4i^DRK!X^BMcjAag=cU~-vu_p
zzmSpeZ(t?-3z%t_`dqL!b>hufu$P{QA_k5h{)h$^+gPNLLmFy?e=XA&3Z7O$&v=n@
zsyvatAweU=5hqL1Zz_9m!Kr3}4A>+JWEH(eXXwta-WSim^P;EVu%aPJ-g*IA9HiE0
z+9cLW^0IVn)KyL(bo<0ZsZ^!rs@eXczmt2F;|QM|T~l=4xjTaeeLAXg3VkH77Jx30
z9wE_C&_q}N0V>KseSA0~!x;kL<bWiqDb1eN0h!$qP&^f!+>pQajQ#!CbcZ3pwB~%t
zd1uum$6t~lattB`wJ?JXAO#i$GzyEH!9sTq16M>YQV~5BCkLbBu$VYx<lj+@qz4KW
z)Ed4C)r?#_jAIk~^ea_ij7!7A7%9dnC+LaEi;7^Ow4`3jgbGXXpir{hz+QqmcxHS(
z#f2mNsVL?W>lqD{6Q`w;$K&aS#7ICY;4Qv;2b6(@DT)HeY?+bVpo#KRtr5k};%%^o
zqbA<@(=q7ps38%KZc47n*N{ba|Mnl3@Mj;j?-lIcm8~AT!{G&>Nn#y@XJNM}Vqy0H
zWCV7%*63iD(kDHve>u$PCkA($1I6fqrvNU*#h9}?t~+sfg2eKx1riHYRuKD`q{+e$
z37r`)8EMj}M@epo*H|Rtf~Dd$63i|N@ib+a-wOHq4Oqmb20(V@r2yUkYgF};eosz*
zHFN5-nCvm}9*+^1RCCX9nA&s16k>ew3Bw9v$V8Cy3PvZ|KluFTy+0wm$dnL9uzL*1
z6`oHQN9f$!+fOhYSD@@eiPJ#-z6c|xWo(H;{c^ZmHyID6T3xho6sCf_#$--Nl4+Nx
z_0!ulq5!Qyd%%G*RIf{tDy+Y^ft{v?TyJ>enH2ozBK*Y_z=MkGliY}}Q(2VT`Eom7
zZs#?(^T~~TkuChf)91r%=GU_jZ_PGdz_ts9JX8lZRA9PQu@Q^JKMbcbTs~yttG03S
zb}eEA9GJ9uL#r*T8uls;z81*qwM1Bag2zWm(&Phu4p4plQ1o7zJh+VAxNaOeNGLd=
zog>eA!!p!l0K?y7E@*4?0sJ*+$z3ZP-K=M48*X>&B^*7P^%9Ow`J#lQKffrBkB!?G
zdx8Rl!qS@|(yt%iKTRryTb%-AqIEYzC+tpnyW#O}HzWaK2#tF1+YRQbw;NQWSp9ZG
zLHO8)Za3&c_;|zR?S`1LDbsy_kzuJLVokk7oGIef<^lW{?D7ZKR9tHT71x?Y#q|J=
z1ON#nceOhJdez*ZrYfaMot}3aP5voeUHhiELm=?@=ltS;>Yl-iz1^U#s5WrBVHF_b
zGS?o=+zSfk64xFIx4IVny*1Y!8hO_q8s)Wz^<R7V2pc5!Amoade&3;yA#5`LZSQ@D
zM)o?8B*3=bci;lzhXN6y(_u1DEJpXn6n~;8#I`(xt4#R!#2UD8V!~$T0U6Fm^kxB1
z@V#ox%#Y%mXFg7eOFQy2@IdXO8+;LEBSBsV;D0T6_e4N13{vJeB4;IdFUD>_5gat?
zqV$USR+0sj`7S?%TH~WXB1cgC+GC+F^)h0LM;BAe3no63r!X=Z65aEK^DjbK@BVUO
z9Q}In^XbQvi~ot(*7N^)e)0B$QHi8g#6|<LrI%uU20z;#B47(trD4*JChq<(WcJ3N
zl7;o}ns*agzySdq4c*{|=HcWwR(LA-T{(mnyOUF7j$%`=mlKpN^enDF>2PLt!(>jw
zmBSxO)WSbc9`0F+Tq$yoCUTRfCUQ?EJ7ogS$`Bd}<bn)SKoz<SY$AErD*c6pz=U`Q
z){auhC>9VnOu*&=%e?pR)Me%q*jdu0=y=Y}0ode)`Ey?RxA{9C;HK+qGG*lQspF!I
zmbW$0@}wM;4;3lTG+QM!A)4wEnn3xYgeIh*3AoNYd3b_CYvlPS%4m6o{mDrK9GadU
z+@IW7)t{^y#p?d#g66pm`IB``q`cwMpDa_O^e318<n8w-Yb&Y^_>)($lP}{>ZsdA?
z8%y|;3%9x!{k=8*<Yt~fxmo&?*Y8h`0)1T_`*$89H-f9dJ@{Wv&R)1*xtSq!G9PZQ
zU%8pR9wZ5{t$t<8^Dzb-bq!;<I2w^|KyIvC*QdAT0y4w6XNDyOQ^SZr=*xsAz|%Z4
zm`5<cd+hZ3JG-TS;Ba9RvE}e9!>K<uJiu0+oEa87FOy*3IGGtFK%^CT2C-KLCYPiE
zm;9k{aEINh8XzTj>VYrL(3d?WHpWa4A?&JjogI!W@LZw4kvq)ESDO$TWY5B^mDYSD
z2Z)33G}<fr!lj6U2ojV0T?ik;tM3?U57zx(y#RwDoSd!h4o`)-Ym4Y{zenA{-bis2
z&{?W}cexYRj<zCl__|AqY!_;jIL!4bL*mfsq6lDTwiZROJ0?Tw3W?3ThxZ#t36{)C
z*oLKE^U8cuip0C)@hKAFDfagj!70=U$1=&i&;=@!InlfufO8*o-0VKOrmYAJr3j=T
zyeX1{CAwD{PwpkRbaZ<y8nbS%D?CY(ZhK-Te}cK-@<=C62xaEPvBGqS{P_~o_i91p
zpr<iU>&QF?BZ0;j%y@Lic;Q@$m|bicR7E=sN3xuNYUH?;<u%l%D+G^PQGgGZVT=sE
zkYY`&Cz#J>gF-!ox|yt5-AuI9jRqU0wa+@3QCA(6T=(ph=LBAdYIA|Y6zC479J!)n
zaVk>VRoL9xb9%rGx2tRq>qM{+#;*98*Id)mlPY+ZVKnK@PdcQR>j5o{O4f2q<98O?
zIWUk(MXAWOJ}gRWe|nPCgvWwhs6+-qMV{kYsA2YugYe%GZe;{#tkg*+Ixbv#Dq6=y
zIr@Amtg9ke2(YHirq#uar-})ZT(7g&Zv|skqwYfMTnr?FrQ)QpGI(^95|&!{D_R5T
zPYytZe?L;Bn{^|BTKQ0*4{(y4k4rSr8y}?G23S%i7$xftxGicjbM_IMzo=#)$L^HA
z$n?GMU^+IGm}iCtdixd3BY=HeKia2R1{;y4t3>orz9<nrWw4R$3^r0?o*p8GM$$Qi
zZjlGaJT+IvJgG*pI_9aM>u5umCtdd)Z@9!f#dJ*>L!*qLvGtfIZAG;K%+reg&}Cpx
z&0K&|a|zf};a1n8!nX$Y)XIZBwMy92L&Bayo8SvaKeaMsPiDvMML)H&SB4}3wjcfE
z4rwMgZ$2J?^&5QKj&IMA<3w^!Slhr?ARtZfiz1oOUtp6;um{%fz_-D?4sWQ`Sl|E%
z*S9%a-<XGzx`Y`R36V|_c&8#zN#N6I?{No^@G!_P8}0vNZ*5SeI5r3uW;UpRjbqU$
z){kC#mf)pCIFg!y?l42#fyP?+fY9H|Lz9fBj!nuW2Y13S@1?<l&@;M-H@_Z*bV-sb
z?F@eR>rsXmm;1St0r=ws2-|pdnD*R(5CP;7Tz4s_Zfa<BM8f+ixoF|Zdl`t9KdNHD
ziuJ%LGKa<7f_%PWXf5_;3z1r^NQBv;jV1YWL(qh{H&;xf!&o8yGF6)9s+KY?rHY3`
zQlwpqqFDf=EXZ5I1uLGyLJkRGq+QTSCR-d~W}(ttBR*_tEm}f#7U}%F$<<i`q*+c+
z{gYY-@<yApDij>(W3CK&Bh_6fN>JT{KskA<ky<`X0Wg<Z3gwkBL~U(oEzDR2rS&gs
z<=fbr2SSpDV<mxpLf%CxDx{oXe^@9(h@XVQN<@CjhWLg1tn}tG6X>VfspTQ<a^Q6e
zvMxZ`WerBs1uCtmIUrr|;97@NIH6hwUNd`+<KW6g<VzqKu_HX?Ig82lkpy5afc`A%
zOE#XdzTapo0PQEvVl?0G-*(lJ(s=T+d}JSO0dRc@9A#}v7&37&o>G$9__Qv{ww8iE
zD!78-AS0!iKt4u|F&tzGNyNNcn2&B}K}@p?vF8F?P+jS<o>{Xw+VyshZY{S=qZa-t
zA&DEzCB($K00ipYd^FlPBr#II1$y>Cy$bbu5!_f<XEW$A4kmw^>8i@?XPSg60f|d^
z_rZl`Ax2)ui$`5}3%z)uKk>1XdL{j}=&5{gKw@iEK%#0Cs{;}XdUH1fNYwSH^M*@6
zqD+kvkXQl|w;zzGt*AB%NL&}{VHu2KD;G`JS^}e3xYf02^{v4uw(~HG?GmH7evD#(
z0y&`=MT{JEHN#9dLo&Ux2L3Jl6!xJP4peMs2%yZ9+Y3}|XRjDZ0&FW#kqHgT%y}p=
z3{!u>B?h2`C^7&jwBZ}T<`S+BeprUtu7N{t4&p%pY!iClegD!s8xcfapg)l16k}Et
z@T*aK2Mv*6O{dm9fFuJf1`fXoCZoa}9)XXp1N;{AD#CX#j2tG+v_^A6zwEK<RpSoj
zbTl$1U@c>xVudJ@6495m9N5pJR+xtXW4uj#sD{Fg1$h_YG4D&N(_nrEIc2LkbmAP}
zdt|h4M4r?Ubcw@0*@vO~V{n<cv{z2lU)P(=!Qd}-2DpXgYJtZ2j=@5g4Y)`#57!OS
zg$@whF*bbvnl*&P^KFonb$~Y&JYXDA7Kp6sYlmmn>-7iC7$x9DBD+~d27fa6=BY=H
zr|vE0MKiLHVNvZY0O<L>XGhP`o*REB0HX0X5o|Oo-I&4yANk9veez1+Os<3jTj}-2
z<uMp#xV)=|2{Tid^QTGpj>zFPNN4*o+v9}eKdV<Nj0_(wrIH1T9zBEZa9E)Nbu}X1
z_3Wk+c6|?FRAx2u{Dp6r%MhNTg$Pr*5o|I*7ymmnzA}<u;a_286toB-5q$*ztQv@9
zjcK0NlB|#xI;Sf%(l9OsNw$vx@t%+5WXnYi(zpN_sg{vMsGJQ-O1z(?ysVTK?P;Vz
zOLE2<@}8xcEhp_+q+P37%30$56qq57gT+0jK0M*VY=6*-nUq<u44TB~fMj*2#5o4H
zOc^xkNd!%5ltGiCKV{G)#up_<p~NT@1#?6T^xBX)D<NO7KiYwll#b_lF!RU9fFf{5
z8OACo6&}&>o8kULO@bX^qo8O?tdOyjQS@7-ns%TPr6;VVL-#t$x~lG~Jw-g?39kdi
zX4ARK^Z`Y$r~VvmNLmfkg&nMV-kXsh5J&nzmT@Ke#_M}(B#o&2>2pr`H;HM<t}ycb
zF9UG-$?0g@H#<4)zeO%`bD}CPf>kZxP+<xCKxQ{=&v;HS@u|wxnzB^kY-#dy>QR~e
zaAn+0(*1yj_Xo$_v{%L5s7A3m?xvt~VnetaT?Y|wxWwJa)F^Q`CGKYXaW~qEYE!tI
zf)1-?kTvaG3`~0oWKH2#*P^$#23ga|L)LUkWX%I2Yla|aFu^6lW+9UbL6muOdl5FB
z?6o0DfR~K0;XsctFa#4N=95_teq)sAn-YCf5Pf49y679jSPp-)9QsDC`QQM8#aY)>
z;WIv6?u2DA>>F!kIdDz_E}{q4Nmm0pUCI4Nx+TMND16cq#%LjMp(w!TX~TOSJj)Q3
zJ2jez30f|mM+?mp6Qd=dJdZ4ftD|`Igh`3&S(`{LB}a?lKczIKr70il!z3#g?URl5
zSsLk6jq{G^avb<$B)Z1FxC!7-f{CM!WnzM8$Ri76$0n6b*w8{AmLYX)WF@F56~lz-
zSfBcIf1+;2GVI9<&cs%Nisb1kGqF*=C_zOfsEGY3K}98~s00<I7S0k>^x}f~Bt0(Z
zYj|)_QD;?9k!lpHgNh3JV>SdT()Ee)hD%V9OpOv$RDz1OA5^5RsGc#XsFMr-=_~;%
zD%|Q?^!C<(in@8AqHYN)S_`P?{I{PlBKp9?*y1DOn0WWbM<DbIkI2)_kTIF<wihqd
z%~tzK0&FW@$Py9(kM0fh@X$y(0q7qnU>j`m4Dim+e7tlG{uSnlg(m|mz;uE%Y>vU3
zu|PzCqp1%pn8AOoshs|AM64-znG6Re)w@QR5x<@U&jgm}0)x@mmKTMmnfN#>E;LUh
zgLf4Q02~58N>4>q%xw6kQRQw;4A?UR1Ns+OO2NkgV}%iruOLS*;!%hZpr`$IK0?RV
zz=f0EJ&t8;;r$*=rO3wRPp>V{{hf7xFsF$N2LwAmfJym+DVgrUy)-3v)@Wo*QHN-S
z#Q_5n`qt7KiPE2Y)uG47F`BO>6wWX6@#*k<<^<v10(@*uo*D2x&JYZbU5ZDzj>sAK
z8Z;cw8F<4VeSk+YvS+^@y$}t(o&%Mrw^L+AgdGlUfGEW0(D;SSkk8r4mcNqS(}+C4
zJQs(?F3`v&&aV7c$^au#>SV(5PD*bXMd3waoaa;fWP-$}v_F(PCx2%_7On)v{%n}e
zp0U4A6U4zk)qnz)07-O8>8I!P2JdBTWXa~l=do;TFh{r7JXaF)jzUA3Wq})@Y%l{!
zRhN!tQQ3V(4;kH5ZM;&j2cH$H-BZ0=YFf-2It!kES4q!-`a6mgRT)Es?y8$$ABvK`
zjL2~216*=ygnSY!PxHPkq$7t1g@lykZEStL@`sg$9PnqAxPQNp6RI(}j$uU>(d|{b
zk8vD9#xSdkT9vpk>^=M`68ht3y~rPp_RrfM`NMn(xk*&($z%EFPuK>9^(Es*dCZ5e
zE&|{jI4C$ro&$uRP5qIsub<tg&rA96fcYYX3Mdd@06?!OCmV_}09z_015_WGP%#Zz
zfLgy!Rm`ytO8xrry>>8$<fHQP`pSN$<VhXRs1NRE>aOZ%QjKDDKU2YT{D%BYy0#SF
zaOr1~sZsiwN<Y)~`<b*A)zW^Z)y+!F_?Ei4UZCz0zNNygu0>aGjc=)!=UeKPzNJn0
zmd-GcJBS#t>CA^+{R?+7^)f_F=DzK9G4--Fev$y&>SD6NLUkQER3=<3Fcpy#cQ(oX
zB}|6^E*)T2=q}Ay0Ci!a@TdW97HAw?5&R~*@G1>>?()Sxq_6{HH-J8%*GPDw*r$1i
zi@0%wtQ&9mU~ydX8jDIHSc~^2<)G;b2hGQM=%5jgXqM?z4W-wD*B1Vfx1JNVhZPd<
z!}>6=3qKtHA-%eo=hMkB+pBsDCj6)?d-<*(>`%(vFI&46Mt=GAaWJC_{7{}gd=mGE
zNCT#T9b{MWtg5zjzx$`-CEXnBq@FZm3BN~SdWHQ{5G#DQfKt);mL^jMi8TBx@e0(z
z@+T~|pYHjg@h7m7-^}(^9Doi)R#Eg*st`VkN+rf16;8ZKOv-#Tin(y4o=??0_b-QO
z3ddb7$)PHyM9t3&CMD*MIyqxeJZY@Wdzjv+8kSAGOtrLb?@jNx^xbTM@8-!}uskM1
z;sxaGtwpzFr3VKbCbDdoew@6R+6iS?x^l|=-^mj(o&_J=mD5|*m7^NP>aLuE=j9E#
za&&DLyy4Q7BU7VYy<>DNZO|?p+qUiO*vXD<+qP}nwr$(CZQIF?PM-Juew_17ubG~!
zYpPbSHLI$t?z`Z0oK%x_?RsoRU7@VaF)S@P>1OBA-jlL}gqQW-A1iDd4PKgi+JByk
zm&M{?*XH_k6xD7w)9>>+;LY|0Lzwt(<N5o=3N`n4A?KeB%{h=9z=Pk(-xO`ELNkLA
zf|D`<;>w4$`<UG*`F5i|^^1)fKKO!?FG5>*nCS)3oC?OwoyVeOeo3I*_@3&Ha=}HF
z!&NZ1eFGR009*K1w&7Y>RQpFEtOKp5w?G0g8p2Db$Gy3lI6Bp(MQ1bS%Y%fWwdb0%
zvD%}$4zlQq$`{-+9`M>B)Z{Whr}Yyv=7-xeYwUF<esD2x*`mEvao@i;+bM5nMQ}qK
zzQtHnDbl+XahJ-6hfA%jnWGvbCs78+!hj;73u|3f_3N-!_%8^rm$1jH7fGw2IsxhJ
z%(ST`$44Q!trhS#8aK5T8Y;i)vgpu%{TU)P*&#}`V`r|BQZAp7BDwhRl9|$sx?E9m
zd@#ChEH(M1MQrB_x#;lUW4Iu<)chT6zhQ@E`k{XmLNF<}gl4i>-<>w(n0OZdgP6g7
zo*Ue$6NH2h)NvUl7X%-mndPom=L=^VG-LZsHYL@#GHU9*ilXScJS|Q60b8wghy(nM
zM2>O}+RSprKLpxp-pbT_*kwgEN*P2`OMXBrJ=Oq+41I;A<-0p3o0)5hP$D2Wp>Mjz
zY~ooS?hdbyc@5N(0TmRLC%)2ey9QAY0zbYO_#@j=5*9&qX1a_CKQ9c#SIOn)Es$tt
zUc=47=il{a4L~dKfU-Ic!OHmnkvI=+G^ziUPBGC&nQ-ndQx6+f0TvvWP2U%yr;i;%
zuvgKF#czxXklgnNPa!N3K{|5{X>u3cvhu4?MzX79OUJ~9qIybB!`~gG`{m`8cw)#>
z6fzg?XR&QdfYu!dib2o7-#p{sm@fg~h4z#=0kYD8H?&|#96j5gvxj&QYPGA>b#7F5
z)@NN%uGww$&sLCk#M}wWj5XjZCh7~)PuW<WK!n}Z$48d(8+a<Akbpsz5JE(mY!aHf
z|3OoV4NjL~7TSW7mnN~UfD8_Bk_vx~9jQ3#ftq7~v4Rhij>FGX#x_Z$<ol79tC~Jv
zt;~!Y0U}upptcgdE3ZBrLm4~hrWNQIurIGN?-%{&$K&bk>s>Xa0<N(26(wG{j!;j6
zTzj3Iv^_oqbAK~rkF<vv!!%BMI7zF+2*Y<+DOBZSfY;Q{9A7C&f+fjrd1Ve|MHXqq
zgZPj64X1<od3{H~9+Gfzn7`XFMQCyYbd6fdf*^59r)+_80(M!(bQOs+Pkum=M{Pm}
zmXmoETde{W`+Rup5YYFCC$kDaRb+-p_?S7i<4Si(abiNairxZ&`A4g6aF^<%Mj@;i
z&p*imQD#9r%Uo?R1>a!fe5IZ!5@2~$hVF$`yG|M%$5I_@2{jM8cvBiGJp8DH;REh!
zw3sw2Qj-gT28N1WcjexL++@ypb)|2;2Kc(cx#{W-Et6&P?iojgVrN-)`h|o-iSmxt
zTrFs}?%+9sx5hPjtEeaVUj6yo`n6_?7uHWy1pd}!SSxQCvPoNa8M1v9@bB{PjIQ&!
zQjG?OhWj_2LWZ9ql_v*D6`S!1TJ?5P&nH@Sp8~yV=Ke?|&`L$nP|^7+=Kd<*`>MY4
ztiA`-$I$hhQxbHvY$)V^B{OIoH~&Jg%9Od)D(Vg=;QVN$=BrsU76)$iBd6$`<cKL+
z2ZtG3B(N#*1W<#AT>x1#Q^=Q5P+wR5bdZ2i&04kudhSK{vM0slJD*mG&opho>7*8|
zu2(Ok|M;9&xId8aEqfDrmD@FDu_tc>?I4?xtnxUK^2KEBdt!^S4u9F1@Yb9ohRGpd
zD3{$2*HNTnM&uQwyZ}C!NJ=IBdX>n^1_doJ$jx0b5<~?JN=qeQD;8NOy27S=z~x4W
zjT>O6<8)QkooqirKYK)6rP#PF95r{We<~L%9_rMIClykk^;!WFSNob(!k0EW?8Twc
zY3o_qYDM5~D&-G)Rsudepj-SYr?`W?IrPYX#720n-edssjH5B@LT9feM|?=v<5iQ|
z<7x%zaX*&b{;kpXKTgq0x94cIv0o|{2HE=r%IGx-!PfU)4tw~6UK*KgeK;P%aa*-1
z6v8jmVXRHmnWct2Qfl{@vZa_h!H#x>7JqGow*I7nr(w>)!dP(Tq16j{(lFC>+i)Wr
z^7Ai8`<i|_-fZZKytc{me<<p??GX-20M`u$FQxsuPqf0hf}8j)9>;O>Q%LSF4qkx+
z&d=CW?_;ff>JDKxJo0H3*iH+SpT1250#X>+G%69AEREYP`%J|@#<sZ~2YwEsfN6yG
z7j={vMhuUoQP4`Lg>VM;OT>9|Kxccdwm+l8u2q%;4`Ew_YnKc+P`}-ffPZrA9===-
zBNqlt!j;53-k@RRmB4o~z8(EzB}z$eDiX4XYQTvNHi`Gi==Kt44ME$h5^&pwO0+KE
zXHgtf8!-Zt<I@k*{3uZMV#_`iO%N_dO19D9579q{DZUNlXfO}o`6RK7WhsS}+Z+B`
zB`8INA>W3f`GH~6hvmdq$ni}lvYssxpnHh|Lj&FH4SZ?=k|Jsot~-#dKw?z_RfTya
z`=JgNBo$wR(y-{XneEvi7!8A?FTh?|;tgl{h7`f+)mT5cy?mBj$atnlUWIQyV5gtn
zj|l#rV@)P?g@Tf;-=VR5DKvXd(qq^(Hy(^Fl3G3&QhJ|TytHwft7v_dxrQDaw(0Xq
zj1F0Iv#)*5?Mba(Pgd4$GC5j4Ow2oVJFmaDm+*i7-u!mWR{HI0AOHRxoN<+?^_%}X
zHJX~4YSUoL>z(M`viV^>rNjur=qJ2L?8-f1(q|Qt-yaY$?4rAMW6=EceAesvoo$*W
zQ7_67@e1A32IK&$`u(%Jvr69@P5u7uTY1A}*YKKhjQKA3?ILr4DSK6Je@&t?Jj0=h
zYOLHOyuLA4B$0IZ<|Valx-Pm&-o6d%2O#cOAf!P=DwB<@K>|>K4V$;#dn1y|{-Ltw
zPzskdgCi>pEBSGoySV226Ez5UW`yM_W383HS$;c@fKfe!;hPY`!d#pmyA9t*B<5m(
zn1TE{uHv56ge+1OtZhO&#P<`ui52b7YtfhyhImJ*BI$>zLJekhE-I_DM(1=8$L6ww
zv;F)hFn9fFR@7D-W*0~_TCuq29(?WvJG|V??$wv0(D`I9z{H<0M?Hm1wCa2RAc^gb
z=~9CQTOxQcT}>S3Qh}%_O5B1OiyqZ)9c7@qC&5xH1md8HwDzv;VBAvA=1j5oA1WOO
zSv$q+0VP_bu{tk0S`2DnvAS5wgvWq>Y3#TJGo$sJlF{4s!l*3bRt8)nSbZ!Cq7WP&
z_nRASoyXoDbO0P}KM0{!G7a<I1N00xpvcOgq6)ffeU-o}jH&gA?eN49<AFNgRWmEc
zTTzRBUW4~ppa9)-P|O^w>M}rub|Im&>rUR~&A@M30of6lwjx$8`dP+2)o5n5fNC-}
z%b7-CjU;@BiFRQGeBOkmcnum(=D?{$sKT_=>OzRZwX~n%s|9-t0y`R0m{Y&F7Xwg<
zYcK58&HL-*jhm4tU^Wq}hZ8PgdL_)%$Z@=?(r}!ucqQD_jWTB1@Hs$@loh8M1Fl|R
zcT>%<Qy#G!RBT0tB-MD?^~)z$WLyRasNc0aaS>j)sb60*Q_QZ)<Ky}uA%^Qrj(`PN
z>$P1Qrp?sN#dJplO|T&a2Tn2*(!9u4WRrxst*sTvj7_h^q<sN!CbtF2`(CZtBht!I
zn>Y&O(TLmx1GOhAlY`~jLettm`*};OO7nCa^2C2NP4n*0<HU#c7=NV$h8#PF(vrO)
z3JT(_qB@2^k5$o?HeA2&-ZxB%h{)zW)d=<WM>a2wfK_OYGsxEYhrs<>ov#b0u&IVG
z!f4c<V9rlCFgsf=S$)(mop^t?+`c;Cf4X&k+V34dq|+?_70sVN`CK@$CZ<078jy|B
z>-uPf`uf^<?YMn`Rvrk@kw1BTnaZtz`0}~x1V{fV(d(b7q_<cRt=qT^s6zQ@F6uEK
z=iZD^=aZlc1U!o}cEqgvfR3X<Y9$rwPRC+oowe#Q@%1Z@|6vc(jS04+T;)D+a#!u~
zh|fGFTBW-tB0ttcl-z_Ss2$^`AbLlCXoyOy!hsmcIwxFjLkWhpI1U$&N(w)p+bmlY
z0)5b>BA*^C0W%za<-A+~wuY74xN8LKeLyS-u08nPgX6s(Q-hcxmwhQSjfdo0yK=jV
zbN`ta&PC)D=m~AwxO=9b=?ZVLn@mt#P&CPcNi-J;a6-@GXmtPX=Ckw1jg%=|@3OJJ
zwOZ|OT^{s*jY8Y%c0cU%gdX%?OpC(?mofL!VYd?@{w<{$@mIE4Vz-M1rssjna*n3L
z1J7Bp)27{G3$9Hb@ir~7G`HXVf^56>iT*$f{5WvM@Cf|8h*ia0jh@7=EsMb1HBiA_
z-LCyp1FcZgRuL)^c0UQSQeg^uTh|yMoBWyja1Wcd;%WBm3x-*bbGxZ`<VkTT(IL@X
z&k*JEqtCNKCz)<uf0QyIo=y*%BZd0|A($uhJ~>c-I5<_>jwRz@Tn{|4Ui!yhhx%(u
zk<<RMfgURiM^}RF5KSXzBDNvaAe2=twa`dZgGWB}FD+>%r~Y6D_qNg+`#J6qpo|sM
zL(H4HCu*zS?7h=8&b}3yK3c%<{OC!Km^zM!k{n{vh}uKw1dpZlr!nafWowPNkZVFz
z08{36sasrEj4-)Q(@T-s#=7X>1*?7+z@dbkVDkn_C)a*)$xLJR*sD7Lza*8*HZX+>
z@S-bhX`+uuFohR%u%aSHLbkYsg|{xhq$u6(u5~Oi`F43=N|v~WCw_?)mI^ll(#qm8
z4FCx!KI-gICzFm8*4XoY5P;)6Fu4d&xwE@#<q)|8q*3aMfDyJ-<xn}e3YdJko?Gxv
za4_;DH)i%O<`^J;{?*d+;h8L7%WI$uff6!Q*?d{w<4*=|I+&9orc1On@v&7DD1}?^
z`44RH-}M4Uz)PT)$*|<EmNxQhrdjtVr(4Ze0)aV@w&e*GU;`*tiP7BZ;eWj&oI_U*
zuLNNigXIfpXh~5Ig}0oyVWuTTR+x<n8ub(SS>#rk7Vus5<y0x*!s)>*fE>hrkv`Xc
z<o6IM{`t4hXHjc2)JT7EBZ7_+NfCd?qpgI5Az;#|gBzGhshyJ0IoWp>m*pU(J#GA(
z#@yX0G|E3@CcQrl2*d`A;Z9Bc=tuY}2i;+lWv|hLRBHpM+vu9bXf#gKQ#4*RoR*GE
z9JUA+u)^f8ey3q+Ur0FN`>~-)Uo?G?imw&l+vq~WMf`dJij*M}$gqdiK*;N`DqwWy
z$e`Rdt%qLNLL9Oqlk$6R=nIEB8(o*eWI0SUA@WmWNs<#EHs2yjz~Y?lANC6*mebWb
zo#BADv3@(#BKgzi?WSZHusjF?AEnY0=x!JQ4m}9+pDH0s{i;%$o(L1tuPTB3s#2QX
z?<8;@vb6tH2{~)xNu5@YA-Fs_rYa-7rZ~EaGYbF)Z>3MqzK@^^=4lx8W-`yL_9;HZ
zzWoqY+5Yfjs$wuOR5=7ZcrCJ#TkOu$EE|x|I4{1`%N;W=t~>fLP<>utMgA`T<lSn3
zj!Eloq~8XnOY;>Go;JhE)z|~5aWt&O0L{b2GrBuNef11&0szwy%_L*=k5#<_P3?l+
zs8mWCOpMiLMjF)$75ym8M$|?dt)|kX&7@A5zQ!bmN`m~~741Qa8hUZLm7pfgdO6r{
zD(gdyrKY%aCe=?b{l#LO`Ya~t2z9tnt!zs9nkldK!j6bNevqkht&DD`sF3LhwWpLI
zODT^8ti51+ZSSQ|w18bLZod=`9SoyJ*QVVe-%Gt3C?K{_5$dV^F8|EIU_dr=sWI5C
zB4%FtJ+eb^UfUKh8zq~iK55u38Xmhu=V%ZADz`=K;tJ5+qPmuayXh$>T3RnhX22ef
ziv7&Ld)RhwQDm>`=67Ut&RqpmR$jI0&UYte6MNE{c;nyWg@Wt)aDL(=oVWw0gqMUl
z5Jv1mO&A2^eM>w^LoqQH{v~&!hS&H%c}2Wt=pAhxpR2tqb0`+-YM@c>8&Ib@vZ`Cp
zU$ty`r~>Zq4X~BXp(%7gF+TVphWP9t_=!nAp))jT5X^N1(DIFuEXoArz;cMvFyzy^
zY%_0=p@oPp-j0ed*_$k-gB(g+X0@YAqnM9L!OzIJ@^J49s6hQ7>j0VhZw$@=2`yH*
zqk;hZrvK=|`a6h=rmSYhp&7bf&S-QGKrlcI!SqMKDDH@m$W0;af@GT>pt7vq!O^Vq
zbE74?Iq(fi@a4OWLIpEqi<qMKpv9a@5X18XBC+5BJNRR7j@yLLyfZ98M$bki_6VhH
zg~Z4h2}z@2(!*hEy|NIqAUP_tGD(J@SEO@^SyZ}gAB4fi$mZ=zt~{4{Nz5Jacrj|o
zAo~!4@NCxU%EV)Hc!uBw2o_Q}75q4n#}OX!!gD%xPERTwAC<9YIR0oD$DF{P;?Tm(
zh#UU3VJ9!Xckk!G<a>8-WXURYC=7A5U^hMA&#JOiy0?>&VN!0+%SK^U#o9>!)sbMA
z7;=8DQI;k}l%~ZmY#Nbo#k+a`TTQutKG=1@fq{~-)y!^(P<Z{h)UcmJ#tEuQ!tu8f
zm2jUps+e#7l=}CS`r#aaCM2r@U?64?y@uc@_Zr@AMxb6kN;p7RAN%$au=5ik1|O|H
zO>pYMHagIlLRxw_e>)M>>Ex@_GDv4+??>uZG%H_WlEGS|XDx5(`1WL0zr|7)Wq<rr
z;d8(HCOaozX??c$SG9e%4_Cc?c=lEWeRvL54ZFVQdrDmPB(D3CH~guafmJQQYnI@&
z%5mEixa@dzK9KhLOZ0F>UTF3?-Dx+rf@sj5F$F@XHByC$$4_?Kfe9dCi%MPZMx$)Q
zn-jdIm-Vi^u-Y4u`YlQU9rXhmKuG%V)%ZR!9~RWWtUvw^t;(arx8u7b)#95Tz`wfq
zjRksJYU`AT4f?*%!D(>pbjbKx4F(Vad9C@T4^ai0t-Jb!0oGg!^l?C}<A7d+2Gdsd
z8KZU(f!KoWM+W|Rdv^yNAVT`0?AI<(MPd(Mtdr@apf}05QhR6H6{Z0d9eB>oLS#FC
zK&qn)%zl0xiGi?Cz|yZxvHm=X#k;CsSb%U6p5y5tKAm~T8!)i!{cHsOu|CMy1;yQ*
zyIIfM?d@sp7Q^4qIZF?g(%J+n2Z*oVu4dW5P7M0GTbY|LVZq}8npkSx=GS&friqL%
zpN#!<1XPPUG;+Gb_u6PU%)86qzvHhV#el<wNuDBjXt-;6D3D7l5H?IGQEEFAmOS_!
zLsJ3J5PVP=n7-IUNNwm12}*Cp@mUg%g5o+DK+yv9VjYm;0FAN3a<(3Y_P*N7HLFm8
z$%8JqR~09^9yp}N7ENr8R6g9-AKt3d)VZmxcC|+g+D=i%`b?)vK*(@-h_4osqB|q#
ze|9m*lOB>xxYvk*4rmOSy1CLW=Yc$2sEJ*3nxSzbp&x$)g>T8B+)u&ZJm=UXrfop=
zJu`KPzW?|;*T#TcIzO;wPDwq(g6%rRm8*C-Z$~!qquhqvc#*j$H=>j2x*~iOxpnm{
zDcq_-9=_7Nb%S+NHNEaP0r<Uj`z5PI`;+Mg!z5-T*2A}W=&)4us5GlCB2$tXPZvsf
z>G1N;{ynO%@X?a;3WKV*GOenzVP^dN7|KX(ozfvDneu&wTQH^kr%p$<5|&u7^^ya)
zu6}DbcxV!9385)oP>v&O04V5h<x9Oc1RmE){&Hh(p!6lsM4SKYEOGu2U>cBL0w8xl
z^zMk%q28K_h}s0FP2dgyHbb&{Al5+JR?q~2c^x;;V5LV`6z3f<fr5}MZKfqN^u6eB
zGd#0G*Nf*JKoZ7>?O|Nx&Td`uz?vN7je0~r-ketCjr)PDxrMa2O-R~bo57K99E9)Q
z*o>Sp5xoIf?ebUCgS_cKqakA!EO4^yAS$WvR=hoL^6R8-&ueTVfBt?n3u+L;nOg<B
z*}`iv%yF+5;(4Ij&(t<Ns{aLYpAOr*|1w+Np4He?e&IXhvx8D|fa?P$ya_Nwb!3Tr
zm#imHV0E4suA&#m<q7cE3ngo7`#>?B5T!t+p{x7&<dV$Eh5=2{W2bgMj$*T8w*9=#
zRyBIc=+8I81t7GAkwj-l5i4)=z<_V(aFEVopZo@nq59%)vw&@CiiU>w@Xs35#^EBf
ztx{aY8h*Oo&>f^Zvbri<#E#Ot4_sl+Lu?M`g<r>(ZJPJ}%bLTHX6vW6jO!)`ABE$`
z4g0TLa6Kx1b#n<0h5)d&2e!fEawrX3rR^nO?lYYPFD)T}4_kbUpLTS0N=t9e7+{H@
zdn>}2CPr+;GRDYnQ6eM;u{y(N-sGDYAk@+T*2%;0XKHkMGeY(BJvo`vEfiJej=-&J
zf4Zv~D~mvnoAN;1DFijRy<wbC{+}WyjiUS>0ClH~nVi>Wg3uR2g!kH@(C+@`#XRn#
zz#?=1R+x||f+Lx{G4#dtSiUfP)R9;9Fdrf_Hlf~tE@a`B`*5bovz>j<om)8`y|Dve
zx0z(s#R?qG&9x)rQ9=`DI%|~sf`5o4e7<RYL@qJv{%$B8?MAfj3a{^XL(0Y(`VK`*
zSX(YhUbK6#qKEZ`wWWbA3y;K#l*^fG8DHV+{;`>zs3N2a(I*!Ex#p^2`diU>S<E<H
zt;Y%IK1zbKIh^zL{Fsl;T<<o(94h$&#SAz=K<0{w<Wvj^fvH$Vb%YDMFiIJm-q~AJ
z+@4<8dOhV*(Yy+7Gm@kn(~+Dal9r7eI|-5}9BC3^O4FU`1xAQ38?=9XVT^{#k|K3s
z%_wnfLB@_3Q;(72-S-le+x6WCQR&8usYy5Ob+Q)rB3io6Xu`BqsVs{DlyZPGBrZgd
z?_+J44B2wwEZ2d2HIA|xM}wKJj`MXHk2;ryWpkkm?{%5=T+Bv#Q=wR`bhowiRdtEz
zct&C~@ru;n`~H`{;N`sWB?$xyf##e<*;&LG`?DVA0+z5-$wCy1{BFq;$waF7%KJ>F
zwAQ6fd-{%|mZTH$RELgel~B0WD~HO9h=I%{2UEN44@t8I=Hs|UCT`N(O<jqb1J{kg
z9KWW#A02!ZvB@4lQO?LMa#jNkuJ%oyx4fNxGzc*|ij{$AxQoHQSlqphzRScyT3BQm
zf3B^_{*PJvZ9q5W0V@E&k@CSz{>uGsCX9Z3*A})nF6Hf}v5&aZ0${6tQZN4&V*4Bf
zcTfY-e)bW^>3h6Fvj#!vd$K1iRbS&l9VxU9*PhD&A!5UsUSJ|#6Gub)9^dNj6K6|L
z)6N%wsvK~F{y>kZo@O3fe16<-R&w$_C*C6$U@2=KofyCLe7zmJYp61ZLKn~~ZNStW
zRE7^u<u0Z@ns4akhY!hPn_`|H2f3E6Uzy^+?~T`5gk8P~nQ)uIesZWA2M_A&`_(^X
z?iFqK)~3fi-x|s<Z^ZGZfYC4k7>ny(W_0!I;Ao8pJm{B?;3d^erSwv%Q*8lmBOtMy
zC$FOsamc!0_}u<iWBj%^a;PGKM94+O@eHcd;+JaRk`bUp8gYi&eosz%_!!?vdY6J$
zJS%x(X+w%kVLFdYh`ZaHhO86?8Da$p(m?WR8I^83una5#wA4~vjLD&gN;oRiBHf^v
znX{kdvJ4q{^lhWO@AomR{bE=@#I>0=FwEyf8VmsUB;3_%78ybj<#n*k=-(E*0`J%#
zHIW%yb5qzN2Jg9I&TH&D@V<BPi7(FmX}Y<>SRiKY{ky<wXxmUY`}^|;n22Maa4$zf
z10|k0f{^Emf1rei$p0>cj)r2JI<1dN_@BW(1-l=%#kjKd*b+4BW}oH}c1{AQnJ<^(
z#2J3*LpZ~t`FQ={d)*7oM%8&v9EF|w#?f0{bYc;j*yOOJD^OrS$@qmzL0fIbgQ_aI
z+`;O~Cg#u`Yw#nF^Z%(WDu>qY2$WS;X;DufT%j@$SV5)M5(jZ(J+2^0$$J_euLBe6
z%+NP380XD>rdVm_u0&dr@92%PTp|aGhpaw%a~@Sh?TR7yGievw??yOJ0#*V|QgrM}
zPFN|*l^aQpBHaaRF@8LU-tkWwC_4Nt-MokoD?EVPp<@-yM5G*U_^tY|^TxwYahGK8
zFz=)Tn>zrTzZZ&a6Z`O<vU<?#OsfhCp8Z=J=a<hT!r;h=aRTaiW2jh6!f<lW*q7#K
zNR;O8rWBZt3c{pmLTzMuqi14iuV+Gq{}7mNK0OONHDz&p0K2MJG7*h6Rn<Rr49>(<
zt2i8(-k5Ge4Q5($-@0LUa+O3&pViI;IkQ#1KlOJ{N&;u&Qv2hn+wI~xZ8{oZCK-&?
z6^1I8%FPQ}!(Gp@bfS-J#&6Akx5*I>4=-y6;0RI{_S9W#zD%B`D_rIIp2sV5`-4v7
zUIU)UAQ1a_m&<IWaFEfx;Q;209C}4e={f{wEGb?nSCOQOzX~bEI1p9$Jb-4r+E<Ma
zT!^y5k*SSiC-7XjFp>#00y)`mDkX2QsVinRD}GsV0G#PCDP16y17PxEtv>a!P`d%9
z2=OqoM=Z*56H~toT+r<gd=14=fHwjzgDkB;{7@ViUYs6F6w=?g2ogF@ekeg1gMQ97
zG0NE8A-o@w)#Nq)5`NUJm+u=!j1TzJx|nFh`1tI}CU#Q9KVKF@srueiUK&duk~9Js
zv0M;pEg5#^<_|jHeo<CH1cc}@=(^5NQc@7|WOy@e6;lz2GVNU`tgnp+<|D)WvyLuo
z);Env>!!Tae7)|o99{Z+>$4Nsn!~lwoJlhO!0hq<z{o{IMRTi348`c%$iDIdOvWg&
zS#t#Qt7yT{B=u>J4(5;C(jb(f<phG|K!i2a_X(^(C`#uO0&O9D2(rOd%^-Gyf0l$&
zt!1z)1Ly!xgT(gN!H7Z&0dxfGJA8nHv%ske;Mj~>@ouJb!L>HB<Ip9;zuUJpot%aY
z8naB?g;?Uq9E(H`F0*ev9NML?mLJ%+ai<JL<lCET)v#i*aT!lWj$F(9J#?{Tu0ddq
z$(1FFA%~2u>Uwf}A!)N8jwMkycd}W{gQy4?V=GA(J$0#!nkmj&b42B<2gmO}Reu=D
zG0^L%gSM^SVRF*9+kESKxp@G#fxM1&;`n;PcYD7(hwtj@^x8dG#r4@fUgh!GK3xU&
z;W=6*_Td@1#J{%uzr&m2|10iUJ#41G91tN_+$ve;8rC*{m1<-#<%H_oYpi0*G0+}5
zU!ZqvaiWw-Q5m!=2r+t2J91mgWmi(igM%(U-1ooB!mk&w_Lk*NCSMbY^-H0A8$j>w
zYhQ5WlFDH0kRX?!CvtXcSuA1#$CSo3LCH;|ER~u>b)tGxqa{gQmf8Vy^xI2r4y!I{
zY{pxOWy7g4V0y_If9bH_MeN({=w~U|(Z9egDZ>q!RBAe6_KXxNceJ5wv>_98W|HqR
zNpS<mOfdsTJWqq99Ib^>JGzTkc~!Z8Na`jD$&p;H`g7JEkXq{XIu6fk&slj4*TZQ6
zK~r4+lGTVf)&1)x+qC(^djSYxl(1RB-~pT@MXIhDCX1;K9P4ZPUk6T93BcYf|GLP1
zzG->0K$5O|p_*VAxJFP@e|YZpeZWtW;&18bx|}_GLl&qZif=QlcRL+J7hKW7i%TB}
z`I2&0KDY9os?d~n>|l#4x61OLuq1SSD0m(@mAR92!q$5Y(mb#_E2GP2W!4`IE<6(%
zp1ZLW=|L24-(wjdv_G3J2U0mceTVBGc>+&Lp>TG?Rq(iWsrg)d;2x%gQp7o-K?tx>
z#;+yG&xC^xD^K~{**lf2x*jK<dm4s<YkWt)@60tCdIju0fPL^!hVpJf3}2wrA^-ui
zRY5cqsdjJO{v<43Hn2yGX&#irl`nuO8DET1oQ#zUW5WofW!BAE{S`Jr9lDU?s0uCZ
z0%Nw2OL%L_DJS{!M^U{0Tq<~2&WMU;luGg5jv-umi<Qd%r`638gtbQGboumW>+^va
z@c3!<N5Fh7<;1+%KUH8rLD9EI2!oyrO%<7}wB%dJ6+${*h)nMO#ma#-yGokYR&jC*
z#(^#QYPf+$G_j<m3LgPKijJwGtJuhZmBb+CR9^*`Rw`U7bHbB(Je?RZK|B=dIZQ~A
zz)4YtC%8jQM&9s2aUPL~46~WCkhyWl)O5lH3Vx8JE+SX3s1pkF;0vrSoG*Gn`oIQj
z2c=dlOtE}FiS?rlQ0TAKKa4wYu7&GE3>Lu{r?h1-07Gt6d4I@ICRju0QVINjbqEwk
zQ|G{#Gw*DfB8KwpV=p$i3TnbQMzdD6Ynfbd4Xx}rB>!23xc{s|pwSoB3G6C+*zW@a
zyxczScvRp|tzzQ=!MhYYY9Pl#Te%-#^+i8Uqas=$hsGqZ<CSax$BSiJAwt@qV@`+5
z@BD=IDQfw)f@<cadRw_0rToLp=?OvHkK<5IUUu0P%853+?qKRfhqoZ0+?n2Z+mqeC
z&+mTxM$O(p<Yssm%}r-rfLDmQQM5&+`1vw$>HXM|4Zd$gk6j%t?e9xnOTw7_=cZxz
zETyKp%MV>!e&~RO2Vv|x;k8518^MFWyj{YRW+#bog@FIFGUmPlq1)9?xjQxcHjmvl
z+q)Zp{FW_PI5@pA0GW+%HjJN-czu=fBZdP)O6ehb__0!8Z$r@{E%Pzf9$d`7kez8Z
zZjhG|s~B{mex~0oRY)o!iWE>MKvFH@P^A9CZsMmhUB7ix(Z#-T62=UCs?Pvi#YlVF
zFe&+`fC;+PkUP$57Cog5CJ{?1A0%4nkUDO63LJlj%SVZJVg3vp=Hw`}X<r4*(?YNM
z3&<m%un#Z?lA2{(9uQJGZAfZ5kQVz}Lo>H#5n`d3St{0jQ^K+%RV(+sOzX&V-bGC4
zJrE}ctj2Pi>t@d51)p|p-^Tk4zbb7O?aWS3ZuBdf+FqX@5T45|pqjRiLo^(aV`cPa
z40XVJ=gO_LfMW%r7L2wKG`G~G$;KMqgb@R9TYz4QmgBAmaE!IB5F6t#j7PErD(K6e
zu;l9nV&{g_b;cc_sp0)?##LMG6V2j+k9z>QyHBI?THxU%^{rYh-K`XPd-@R)!XgWn
z*v68%Wr%za&gbWx7Z4ezvZmj6_w%@i&o%Jp`vB&<+-uDCPS(=L2JEM5H>hiWW3Ses
zko9d9?B|&6%~Yq<gyjw0Y^*HpnJ>C|x#jymOQZ1vPp19@Z*l3Xzv6oiynStdJD=zI
zxYcb|%M50xH}|SEfA}#wVF&<zJPI(y7zjpg$%*W*!ceE92c}~O6ZG{|fJ=jmcXx@O
zdi&k&`SmgSSh-98(^sgVk-2$iWjWcQSI&}Cy*OHb`wnk5-tGaXx8Z2J(PxpR;|;O0
z?w}XQbAGea;UE8Hk*}S!CGgv55KJpwA4B(z3*{f`q*oA;TDC&=mOHR*!u=ab5t)Vr
zWPKcuF|P5~Qc*Q@cRBqA_c^p0aP1ePRj^<Lsy>+ZGo>>YZ&Z1$T1W)UzcfPxDZ>T1
z?%wY1Ug#5(9la_bCZtO)tVuB9HRikZIx9`S5zl&5chMwziRZ-Ddw(=x{R+P>AgH`s
z#KfRjI0^x{wsVm#*AL<!e{zBFSne2VY@0Xe66qVpmDiZ4FGzn4**P>gL#E^@Gcw$k
z<!+PufrWtaF}TGUKjnWHz%?*YS}P!YiIhA)#b}u6pcvyGdzx(>jA0~re-@;&T2MS|
z$0|gh*V`;iRCsYf%>rHP<dWkK<I@etu1&`P#=uxnYctHVgd_LG=s}P&AIIP&86O6%
z(mU72B8$|$Rz>TGmOzejh9t-5l}hW~w3*XYp3;p1cseeL?g^PPR$>v`jlcfEX4z<6
zKG<`6fz+}5^O-N}GfggGhko9&5K$x4U?h2^;<$2ljxEPY(nCsdvXt~HR@>b>#1;eW
zu=6AY1!2pNo+o&d*qkj1MoYXSq=%1NQjMdY8V03UDKzDax$PHvaD_AC*zJ#Yh)M)i
zYRmD3R@UQ31JcM2)mArSo^XMcQAWt(WWY{=JAsqIrGd+mI2QD=qpE&y_g7SpM(x_i
z%2H^T4^(7fZ~oj<I&rRetI}$xu|fr|SXk4#w$f@;Z0TBWgChr24rP&hKHyhQv+ypy
zuMiA`Dw81CO;EwB<*Z`RNp4Ah!AV)o65?rZR5)=!_-)=zgB$YveK0uuA$!{iVy{K0
z(lDK?<?Zo$^LarPVB1fIGT4f;qqkF}*|4Pkf)Ga#W7YnRy!Li>>0)?g8zctKPYo7F
zjcKfiGm*?qFU&a5p!0&iJ<h+(>aV1Ds6m7l+=0L}^00atS7|icVsIOSlx1}x?ZC|v
zmP&F=LWYSfkEe@A2g=O5cDU)81s>sr68Mm`w8qD$*yHdw;(dr}o)$BV`EHL?YEyV?
z7Gt+4aq0nw3W%g6n|R^3j!|sUNn=dOFIC`ZnT4TYrwZv!`R!iCDQ2=AJ+GSCh{c-m
z0k;)G$?e`aIlEqQjzi5j?evo&pET!WFg4?3pN1a34O4gM6x3lvy~?;^pdT{N>|B-`
z%U>hR5{&9off{fdp(MzV2e5+UrT@BkH#8aEiT!g8Rgxw{IZq8An3N~VOE4(02a}a+
zC)jj5P!WdtBrg?x$yr3uPXYJs@xLA6pumvw&o|3!f;-!LQl1)e&lDaozenmMJ!#}Q
zC`&G}lAkbC{yDrr(ambY<u_mFF5Py*Wx+<sC%c=ti~R$FWhLIDP^HC;T<oHZ<(v`h
z8bamYT#F(N!HP-vauc0Ws8FRyHXv0P6KO;5X8o0QN===#XEUTJ52eAX;l3)~oUwzb
zj@xU0&qH5u=-&=%=4#Jld0-Vtqpiisp~|sTFqInkUbcZo_*bYTAAbG*ccJA;Xi;ez
zD@tjUt$(OP_<6M%nUHh0+^`87LdeC)3rj4vRa5<=M83IAeAHF5Wbvgx$gcizPV%BE
zeN>{Ih-kFkdTN8=PZ<f9g4KO{6j*;>NFEWV;hK60R3(GxqColZ2bAYYoI{f|N=oaY
zU)m|2=Qll)r?H4ae;HwSm%Fx0y%@kfu#iEqm}Ui6*?7TS#GM$B;aaxGm5cHZ1q44k
zIGK6|_Ab)1IyHvdb}k)k`pDm--YrDKYv9fPkPj*Pag0d+?WXq}*CUIzx;!!<+DQ82
z7XSt(@QxGE@br~JFDqDRAh|CDIT0j9O8ioR-3Z=w1DcXLSNz5Z!VgDU0ph&v%%EHZ
z3ge9d;^eeMc0!NEMd#N|(^}+UgffQgrs<Dx0IS7QsPDP-@9!N+x?qEPgju(WWv%=6
z#!k86O9e)ws}bur&NQwbrv^@6(nRPdfTG5uBXC-S2AbO-OJ9*gAy}G)pZPmr$<(FN
zJ)`Gh+8|X3Zn1syMmvdVsg=8<IG*f4OpN7K8N!v>8DIa{HdoE&v#9nPNEhb2>>Z%0
zp*Wd53RW(azZbZMJI#69gqi|&=>Vz>XcVcSB}6W?@o-9sNGj1=0`EZ3KVs}vb<jp4
ziTA0^M0wIbjK%>8C`{Ciy*Y6G1PD2bwSituVzXqeJ09M-lpq;97CL^ohON63-l}u;
z>u{=jy=wc0m$tyShn_oWDRGvgjfo>y;V5Gk@jaG%b>$f>gnITE^q|9wY*|A$5kUmZ
zrp}Zj2IH0D1R$;Wl>k9RfLJCdK1xaFu%LLDEYOHd__)Si>iME#<I0R^npm1(iEW{X
z3)B|NlA+Hfnjb{%1cSqu!DwX8Ij%b14?P8rNKY8;Uh}GWuU>YN1H{!?w*Ytmc<c@c
znsu~mHMZHFyTP+D@3Q~a??)j%F&x@+K96%hf#_kM|7K`Qu?-~yxDd6Yo%x9Y`&1|x
z0LeWg@gfQ&%Qs4VMG=&B)Jjv|oO5X_e7-wHM%f{$+m48;#Yp3TuMqcBp;KWIxq;;h
zw;mF_)C;sn4JTB26<BGM-en`<y@iH;0Nz-@j)=L<o^SfSvsGimYzv;HB=1$jj8K_*
z9=Zi`+0K)HW&485MGBQgA0qZO^*T$~uk3y^{%st64)<N=xxZbr(&x$H;`i)g_hbF_
zg#kByePOUU6PDHc5KBLmV-eW76@cpp;HLi~WWWt>){_Xpmfr~3rEd3k@x;1rcjg78
z&&9M8%nBONs`*_>m3@Vt(7nq<XzvZI>Eey%4P6x@S9vBWAH;1Qz{A9Cz;Q-wXY)_c
zH!^g-sAY<?MhJI>;$aK2V|hZc)QM)~kua#W0g+ZDeH(nGFXwd#F@thMpK!K=F~7#&
z6u>#82bvrpI(&kxlsRRNHwi;3)WQ*k;%R0B;))KM!sHCGhhcDP_@X5HBG3r}a;$xr
z!Xf~MLR&OMgy4=`nS4t~e=!p?r|fTxs2||U{OsGLe8%9EGch2yRSXcC=K8Xx9LCXu
zBW3FFTCx<%9=;;-hw7z@B2C^6m<YmoX<gPQ8tCDIh${(gG^pHOP8C@W+h@bRn~@UA
z&UE*LhJy<f<xVbpixwss=_$Ype%n?Yn?wJiH>uzKa#NHo7~7KkcuGkr=B9?LGF&|6
zvIu^n#uBkHm<UP{ekuto{A4v3P6GtIST%h0w71%sT6GJjXx_f(le+9{_d?4K`Yn!p
z%X6=>=$c|yK6)qG#`<73twKvGHVda}k<}DD?a3aQ?xXl%VGW4N;LhTQ-i0<zxQP^W
zS4-)EZ4H(i6^NS`ydH0G!8%<%mrO^YOW#LPS=P6Vmzpo?y{B~KK8m=YDrUUjb=j~A
zf(Kg5<NG$1<a>5TVzXTsnhazWcFH?$<Sew5KlBl!+h?M_M}5nk!-fAe4$K5RfV?o?
zAR=*I{@~XtKZ&c8>tQ`$OSl@i%sx$d7bL;W*WFy_S$fVI*%*8EzN8mF|8C0orQ6f^
zJdXBlR)*fo711V=t%cfRv!?CkR5zNgx&0>0$=zV^j^A9^qc(}M76JD(jsGR~UyNja
z29OYb9qF;``{^ueoY=|;XR}pc7Gqj3p6)GpmR4gbmPd|uaI%AI`Z|-pyr*M+r_}D}
z+Pw@Mw*Pd2?V@DZDVvM}vb4u8C+fklBd9Jm+!Z#h8L7r)hkBndkG)df7RUw43OJ(Z
z2av-X8XwNU)J4E|UBqTSZs-{xka)0W$b#4Yv&rUj-UXF6XX(Z5E!iOG78vVd^+KV&
z9GgUSF!M^Nag)v=rHiBcoq8nhFu*L65LyWTD!Ny++N|ArKdDjr_<lNax$6CP`}}V<
zI(O5SZlkL|QKWS7qkM5)N@wNg{hg01`~S_cYx$ag3(Beef#Ix9^UUR{{q5G9Sf_W2
zD#8@Jw|RO^|1Sq#xrkW;7CLNTL}7x$v=kLJ)D_Ht;m&5X%{wfu3lDnYP`{c8M4Sf4
zpSZBy<qkT?1Gg;pKEzGTvXyK@mX5<CJiN3IwISu|E`0eQw3YF1ax?E%5;M?Pc>pdF
zAJZqVpOyskyBBgwMy$%TyTL_~H$C3oKhueu(knv8-N&PAkJ3ul4v$jmVVPCdTc=-`
z=~HT1+b2`%YdS-$Gfjt5%z3h0bVaqJ28#2+c}}aPn;3swF0g+Py*yR!JrA4!?)@nh
z%5kg?KcKPTcBdZ_Eil_(sJp7(am9l813U~k*p~(N)sL%oYj*RLPA0f`wo?z3w3>7D
zT(W#$)2|5Otc9*!y7Z{UHs{ASz<!aVK_0~x(Q}>xs<o(iGK2DhJr&0A0>7s;q~I0W
zf9ec&%Ngj}3_LV$V$GkT;pnPwPCFA!`fCNX)fO^xGod9_yaL#?I_t`|%Cyxi&{K|G
z^~bwpP;Unk;FT)VDkZRTE3Yg5a2ZG1DVsN@vlW(3RQWZpKObmr2%%B+qv97~t_HqE
zEm4@vFQ4C!;DYGkazv^mr6caX7v|5xBSmzHSNQeD;%iksnYcZGRiXB{x;_BzRj%5$
zywO))bLts4i^$;j)V;mx;PXy=k}o0H;=G}N%uNEjO*`MidBZ!%@G}i2#(+ov%>I1X
zUJ^$u7WqAowA|#Mw`R|oAHikG<Jpdh9-(v#uk~W9zTIDN+^o1Av1{&e01<bPvg27X
z+I;P1TaVDc1=?F(77Bie76eR(>YOe^_8QJtvuVDF7bUJ5*?83D-dD1$bA3?1HToe<
zdJ>;OP?R1KKmeo%sLs(xehsnh-7BRb#=Qm71j!oCzm~8_IlK{$uT9rwj_5FwF~BiA
z<kNF<6z~e*Tfqj;rN_6vBgkmuK#Xp>!L*FIlaug#8WI}~fK5?uKHq*<i&8!w0iS_&
zqQY@M15C^6&q&wZw8!!^p>S*Rn1Npd;8khy_Fb}5B`G6rljfru=urroT?1#4@?QoY
zzl!&TSoK0egZ9ZGs0W8@_4J=7Tz~^BUkn<cNBvZt#|x(*eM3ztgJb7;0mEz;f<sTL
zdPupTN7h>LG<a8Zqw(Bpf3D(YjhTDGogi*@uzNOww(jqvQ4@cBjt4d`c#D`PG}kbO
z<G2BA<@<wA5%R#YtRnXK_oAlZ##`5m^QdH4EKq=c2j*duBrAgeQ};lXMgTja(Hc<H
zPDP`ha4^_RrG;Gbz^@Ddxtuiu_Ugr#&hT^S+8{Bk`Hl6)Jcd~!Ld{<LN!b?m!;+16
z-S={c)DYIW9)9Qo8{2Q1YaHBDcD=ZBw>9(f4&YTJnd46WWppKIE?zl$7e^M8!cIf>
z-BU9B1FG$dLtRLj!j(b()6~F%*-(7CdyxU3D%pNfd>&)|p{|s>SWa~xVCfNTUQ!|F
z$6DP#n2j1`gW3{xRVv*Qm?s>^X0#*q#v6bs6j<Haw*%9&?X2T3Xk_aJUyXMI-#a+#
z2~NuX>75`QE&DDOmL}7nJn#EldVv?Ngkxe%<kdgKJI-k#lc0KqGA#5u^dZ<E)6M+2
z>Um_`e~9puaevgB&P?z;eRoVev>(y@A!+m&xeR=aFzy9P@QHx~Z6K>(_+8=Am%*m!
zc09JzQE0yoVW!2p_MWI&7Zz;?y6x7{I*J{rC#X6xgzaoC!w^<o$1GDT!<RLTYuWz^
zIhm17S{@b0RbOU76MqtZKSbRP-Kcc_B?3#vEU!(X5G5gzMf`a7Ba`!edvxBr)(o`O
zTtYZ-f?AI^OBA9Tc43_^WCeBbbY0;(T$dbhhD$up)gHDpkKC;YRp1&ebbCVNp(^`i
zLm9Tigw&lHdB(#t?^#UXu`BlELs#(nEOeV1a0W~~58fWeJBREo2UP$cErfqU^iNLq
zNuM%|_YabHQsfyi&%9_c!M`=JCwsbr*k>X9U#687b*}Z9(i|)7r^IWA-@XPZ$4iq^
z5$YVwjVbCZmdA_JWyZMs$8$3pCeKyLvV4Up&Oxbyf|lvZO)9*&(Hbj=I&ier#wv>%
z?@!DY>Y{EO%*`q4%D;@u|I4_dVd7k!EUWv!jE07$l9!OPrH%5FoCA~j&Gk6f9s`f(
z)=LdBcQ_fE9j=>7rr2qUi?RaEJ=)vlRK|JkqgR&kkteu;g?gA~J1h&_(K7|Ms)CO;
zzliA<b^H&~`9*BMsN{c;52hI}!!JtsA0+ULn17Ma{~-Ne^ye2@{11}HG-JibWr|k$
z4>@u;Avx~Ult+n&q&QoQyHK9V$d5Q!7?L?xq5Q*OB0WE!DUJWV@eaxSL`KPkoEt9<
z%;u`XP81JJCX)Y%>Hka2WaRpfxbeTlf0#_f{}J>5msrS1{Xd*o|I3NRMD!oA{C|m+
z(w;fijG;?(IXC7^(ddc1T_8@fm^m6!Q|3`N&!^~ti~7C{P$Sl8u?`~%fd)Y{c*18m
z!rHpRWwKk7a`%YIt;QNkM>vy{WsX)x^Pm~rP~4Y*S(+9Ff}fO-3F$VE!LgP3(}?sN
zbGxxRGiF|(a2s()0ogCFy+7!mw?Dvgl7K)c04M+e01yE8N+Rm4MTSml7ytm=aR315
zzgPd?m!X5PzLT-Cxsb7mxsAD#xvdSIg`=&_|6j=WnzP?hAppR8I2Zup|05y#SG2Xh
fxs8&swVl<ksQ-^06zsoW0sS69zvsBF|Iq&d)S2r4

diff --git a/Solutions/Global Secure Access/Package/3.1.0.zip b/Solutions/Global Secure Access/Package/3.1.0.zip
new file mode 100644
index 0000000000000000000000000000000000000000..b4bf1cfe08054024f9166a0bb0d954d371b7a4d1
GIT binary patch
literal 48462
zcmY(pQ<Nsb*0o#KTejV0+qThFUAAr8wr$(CyKLLGaeD86e;4OAN8~eN&dA6SvF1{c
z1_eU}0s?{p>U0oOXDc#vQo{rS;)w$S!ua>p(7{;W$ymi)#Ms2##@xx=)`rf)(bncl
z`@&&EEakgb<pW+jBOCc_UsTB}(lQ&>kTa&zYfeq-bI_q(AW!lcO2BZ|&x|ay!aK#g
z$vfd~`fMb+2$x(q0GC=>IR=Uad#kk9@m&k2_w&RT%Klb&BzJs_+l>_7L_H-<d@#S8
zDXeQXb3$Tdt?z?V{-|#yzSA^BJn*1jl3((uIpJY1@wZ3%=iOU*R+*Zy)M#L;ds=yJ
zLH|y4%#XwDf$LNk2b8hYjYs+CZyern2$Jj0<v>d>TIIl)GW!GLYnT0E9a3f%p-A0R
zWV&~*oHBD~;M64dN}uO>APjOHGo#ur=I5w;OZkUk0c?I1$>Z(M9jXkN#P?Ww>GPs(
zF9wx08iEtC5;sFJRO0npnakcUN3GxWu%U$L5S(85rR%VzBRFXnXGi{Nm4uo3E08Y<
zv9Fwo7F>TPc6PKzQtz_4Yn{jlw%SRih0d@jl{n+e$C}1Wlw_PR&)XwP4QR-@l7)uJ
z9tPrSX1xmsvrO(J6m)-ndVk2b8Q!qjhdbHlpJi*AZn%d@ufS|`R8pkWWv(`zO+sdb
zc%KJ)b8xez38wBw$6ksVg<sHp#tC6MSV#p8JJKX!dGFEFg56xvF5GF77~Q>Tw$bX$
zLPokfF+2B`TkQXkGEMR5#hS>2DT$#ToQE4F`^-_TL9kS~y1)-i3#{JNMh&wySX(91
zh0yZc(aj=-C?dCcAPY+z2>u?(k)S^Cu?d;fI(nSoe?JoW=m{k{Khw23S&FU!5)K!T
zCNap?r}9aIM8?1%?jr%&jVjJPTZ9dpAMi(mqYakAEV?IXmzs-?DV{|ckw`cvd}(Zm
z2Ojq0D4EaZHZ4C4jWP(EA3jM*Xo>wTBBH(Wr_3)YZy61pC|3AN_wLG)e)27Ng-W3D
zu7H!L>)wq}Dx4^1MEyMcq%`W1+tnuuG(7~M@m?_%{AgMaF^6gbE(W(rNRRyhZ$y0H
zSJFMCtbTQeue^3zmIj|^M37W3zlGxU3lm}&BtlRNF;pGyag2sGtW(e!G+zR)i%^de
zI&aT<{#I{R4s;}^bI&p{U7Y8sF}e6QsxH9-*2CS<o7UVxB)XNW8{5*`Si&yraVVRc
z<gsNeiGKSq|M2gq?!ps+1IYUCPuf(<lK!jMbVwaU)hm#K8=lI!<~Sf~ntlqpx(&1+
z5>-!1@ZnMdI#VpOUd!TclxZ@8m10L(n*%bgS@-k5%m9*YjO``Ou=kpWj=Uy!bsNXQ
z`>Cha?Z-R}klUsj6As8J*?mEHSiCUhNoa2E5z-$K+h{tsHNH7a&#?RUBQOS5$fuB-
zN`l^HNeKLh<ph9dsko5A8-(=&6;PA;$A=(zP+UP`PMS1hvY#CpS$PbN?FA*~kkDjU
z0&4W!QmBX~_s|GO(r}8`;A|wgcgi`BIu<`^bPoR)RDS@{zD>&UQ%nT^7J=yKQi-lm
zVb8~?0;Sn@+Ck*ph6B};qH$zU=I_5s10D=gg^C3^0uv=%R(!?IZuw^DkTm{eRHRG6
zBHG~iaSMNgia6DgXzNWiv7yKU7*@r-CFaF;;?7kw6mD)xsw9fD6-E}Umdz3C7w~3b
zJG%?7Kg2LdCy0WV{f$Z_ow?ke9}B`|DD>8%cEVmj@w2%c_eH5r@s`{69I;L{=@q?8
z-+B2sxj4@WcrOX?2n_lzR9j!lRkD1KLHOnrgS3xXmc}W6M~Gd_4%UcItrQYL+Z&e%
zPsU?sKfDVdwCycPQ$XF0`2EglALx<HBy}mMg9yhap1cVP>c=nNpR6*)#rhQSq}$?k
z!*G`z1!*u`D|B2n@*BMNYdy`eyXx4#W3Q6kMJq`>!#HJheyO|P%Au&K9@fQx<5IvS
zzJ|=`ipL8r7}TYsouWs;*T%<vCbTdbl7AZ7I}*IP_Y-gUzOD^D?eMn>wLWF*uZSvB
zu0oc45`#Cp0h|HTlD*09)vG44`!{*uY(5M$o6%uZ;nO4sl)2!32U+7P$w9-hU*bSQ
zH-#QMmd^e?=lSjX!SM*<p3g+q2S)-nZI-CDrkd&+i^lZG{KlxcwrpcG2x$6_`8}8{
z&hj?}O=RQx6c1dtx`Mj+TJiM5rF8!ePK0w$2ofApUZ@Tak;sd_C!_=1u%BuPvoJs^
zTD#Qrg|{#(LgHdC@zvPchFIxn2Fx#6I8)lVK$+nV*Q3DDh^-t<`&npt1|z^-nZ{{a
zH6m57>9tUyOuBo!A*tT;He-BVPfs`MZg8DzQx?B6JfI_tAg<4+q~@0hpr}3oAJAD<
zZ@3b4$)v$&I<7CTZS6V!hG%KBm|i_EnA&;l;$CqcgFumGGA^RYG~JMuvJLov2luX0
zSvTdiX#db<7n?qqDJ7LrI(|8VlnVH5rfzyV&_p~7LQ3D;;VUn&r?n(*n*eHQ(%{2p
zdDKq;HfHN@q{4>UrBlbHeg*8Lk7lrJ)$H#`O@)LdF<AWT8d^Orbagdjfq>b-7EPE>
zB;}#sf+?gDpviJWMfH1apq`LNEI=Ir2B#Z4Dx;4Q#3>&|SX$7!5lb>2Ek-M_A{lV=
z!!aqh9=IlYE=yJ?(F#(RxCLU>1H*6$p<oWMi;pFB1OsZC;Pn>?4>K0Sdz?j_ref+z
zQcj=^Q2RbOTis=|=C*?lE>0{Mm>(hh{pI%KuHkA9sQKdyV>@KBnA=SMfw7ePMDp2v
zF3;KUyhPAgaKVzTIXo)@a|5QOjZ}r{Fc~oimeDU8bC|Pa9d-;1mL=YySXeqQRF9u*
zfeH2rXNG|$+Us@&f`d$IwZmw?Gb3A4XuG2WOZ*cEgP&VJy-IKT?yoYA@Ps*W+#Db9
znYkz?=bp14{-oS!`rw>{HQ#4x19AsSdT{(4?m*nRMZRk<nUCJLkP@$B17q9$6q~qJ
z>wTFn#2vu#$3uXK&5Y3b&t23hGvW;MQ2ap9TU~=vnl5=hd-gg30273BgH#SleYG_n
zW21)=$Zn2h*`9!rt_zNvtrz5(O-uF=Fm%Q00a&|b8ot%9CguA54boLhq_xVu9K)tu
zbv=Hp|Nbcx6##?}N0KAZ8@Q8W{(<f3dHM?)=?Is7g)8nyr7q_ZOD#Jmpt%(V{T3IA
z%FsSyHIzOVQYMoi|279$wnwV#7VX0vXkSer{JFMD@rs!ew4lbc{Nl92(#g3NDLq1!
zc8QkctP+m+Z0)VAp<X8uhGK2#G_sU{mS~6~lpQ0Yo<k*sZB6e$?cKsu%|i#+Opbxj
zUsZ0iFg#IgGQa{N_pe%k?CzM~?qC!y6=`V}CNVfz9+7K3q?-rU850(c-pcIhSWP29
z2*kWgg2%4rm;<k<EK2r5p<@FksVY9W(rzqZ-sHHLt^(%%G)W@($uBSDk}T5c0I0K5
zQ(uL)Q)2*UcRr01@(SrP;6`o`!H%dqEKlfX*hi+5IMgTH?~t6(g9~*&5IkK_{dr0;
zR?Mk~ldr+wU8uD?WVt+waJK5i4;jp4c8|hR@XW8(1&Yl9q@WlMog^V@jw?^u%#B#a
z2Kk6OJJaF92CMf)13B0x-0UTfHq~G=?*vC&DDEa}+!eS$mIBV~0IH{z9*S&uYTdRf
zv-q;&7XynuER99bL-syYTTS0OFp~}hF=wh|yCs(7i>BbbblVe9CeR(hsqM-HXp2tb
z3nkm3>q%5twBgD3wpA@6;nDRwSBNOUvNwwx=cg}YDn0OP%*<bmO}r&bAR!k9j>#4?
z7U&P=X5EF-VEuR7Vl09!=v>zII)|tTwEx(U1xSnWDz6!|OMc?Qj3M!qs@}7nDT5~*
zd%W^+@F*Qgf_&ENxVtnGPi{QZv~a3%j<0BDo+AMzS-3N1yfBJWpGqV<b&r;wdSA-n
zkIp!_Rdk*R3A6;VCd5GW2b2of)SP3EixyDO!MXrQE1csE=HfnLKD{cPr8UGp_k?Yu
zyVppdvJ6+_D4!Uol1rZztWpRz#AAp9j3fm=a&WFGUoJu)xPr;rXd?X7fSX{^K9SFT
z0s?^+Z32lcRC!P?0kRXgBG1<@s@emQhF2M}BLQIt|0H9GerMNx9i9&5P=HDY4X#@0
z0F@twoSs#dH~#e({7ey{a#>OqR^piTCX}XoWWX;Dn!YhnHgF#CM6UR3PdF)3d`&ov
zR+@lb8w}MVVd9$ckJ%R&$42f&&Jl1^@T1r@!u}GZ=cnyc;9q`RS<%q$BObad5yOK9
z0CM}7jSDo8R2TSu2^VL{W`DCXsAUUEBcGktaywLwYTkzrl@Mda9_pvP*D|!*4g%BV
zU=RQ9Fk%197e9h4P!Tktg1VeWgN&nZIUn3iRqc)t4+AHAh~;dFh?&RNTBLkyv7kO}
zCl9d=N|3U04mgyPP_nd`3=Qgy3%0qe#%?sW4;(G=?Pk@wd3TDI-X3Sy6q}+9Vm&HZ
zJ=r1h{3;Gmc5jZTxJA5)d?)O8#K6KL|Gr@FcY!XP!P#{yZ-hoeWB;a7Tgs~EHn)!4
zrfI-v_3Z#P*i^2MND$FM7|EL5_4mu|$Y)v*_TOOB2)nW4^g}n>!?vo^z8VUT?&LLh
zK}ew0cu0c;+`HSKquW1%ihShk%jsg+{&1Q@_bj6Dm~|fkO!C#&@kC#XOYxW<1i@Zp
zyo_J!zo3A`ZwF%XVIMZeLH#$uV6ObyCn7@Z{7qBf6d8vz_vcScLNACXcZDv>NKHkp
z+M}@Xmm9_byrU{GDmjd)7LeME4<%1p&M~xv>>!yKrZa0kl<Eeh_)Q0is%^(`oqlx_
zrlLvk7w@3Bkzec+T4>gl#9>p8Q{#Mg(V3=L)YWgJ3{bnFV+rU@LM5i@K<A#}&E(o&
zv!n=ExxuU(Y*y>gLQ5iGk}EKTG_LJc&|RPzUt!t^pP!#rfU&j6+u!MG!NcVB0|}Ni
zruY;B^`v1dQPIpshWec$+yv|N;kcxhiaE4(VDaY#Lkyj21{(E{&3gC?1Wz&o%dUo(
z&QA;!p^y3O!uy5`Cx~EYc$Z^^Y5u`>oK^T2<G7W6EnrO=KSGq}RxxSK?4UHohR|h*
z$aG3M095Q)i^U4gJznycb+M1FlsP#)TZ8OV;Y@OJ4>Gh{M}U`QkPOxdj;UYg$1u?B
z%=mregISbhqM^_S=S-avHwEW*e#U+bn2B^hJX$$+p?6;OSmqO-q(Z1Th-dJC9I(tO
z(2LfZrT^~8RHCQvRZH};=T$yyxe>ECV_BZN$Wbm79+!qSe(cM$DK)v$rU(>a2<2XK
z%mEDlCH<htZt&EeHQ7!xphu|D>F7y;H!^^_3pM6&>{o7_+ROZ+X5B?PRkdu60&H*s
z@@^2F5>{Ep=5HHm%_SMzn5zRVzVTumNjc8GN2-l7nvz48qN>zxOpY9DMbCmeO!wLH
zd>mrB&iX1?Y%)@`CG_io`3>@v-%pZP!$tauGr{6$zYkRG6O`38S<{%%haj2^FE+8~
zB(~C!w6!$Uj}sj?TttQp*-bZiJbnNtb00r+Jm+}<Rrq~K+da@2@(CYtEXn)>eZzN{
zzV|m6lf4LRxzn83qrV$bh@pU94seJeB;Or1wE@^m0iX(h*=HINo`q(p%lxE`0Nhk*
zBJV~cZ5qN%(j3p~r4q>x<L~)bBY~mG4L_XrRD->!JY`O-d=SArrEH_Cm7_o~J}q}a
z6Qd-S?IZUjDp;DL-G4^1tf|mHymGS?3J9-;n*~JBx<%Dk7me`H>Z2}rq8JS@xQ}<i
z_PQ%fX3rKQmu6gE4eO8~*i*c2;j06qRpjFInMw!nV=P;za1q#Na82#_EJchaWK2Os
zvx&+e^Z_k1gWkL08C%zK1NBXLjz$@qil$I>x3pHb1s)^rD*gZ`_%=>S%{oE-X<zKe
zBOpZJ!aQ(eS?-qlS{G0o99Laid{?=5p|-3*Os^betcl>@9@fn((Ylth%aXH9gLh*@
zR2>;eCS+yH3#wjM12eoVsukBYRx9@n0%OhJ^9_*p<D-=IfHRGK)@IjQlt?yfNbRW1
zdX4?$lBjJ#!Tre`N0D|O!u$7%q2k6kc$*sd&)<J{G)Y!**S^tUI_{v^`*vs$gW?>4
zvx~{0C7r^7_bS#~v}oHzHt3s;W@Q}#Pd=<5bnDPhF{?*rfsQoOr<ajTxN0-XYiXah
zG7hGieE>esAh*F|%Jnn$;2#YxJBI-aLrZ1m&?V4{61Q1v1ZOhs#hHNvhk2x2M2Cs;
z1uktqMFpn_RvPmFQ5uWXD2_s5ZzZ~tJU8c7ys4s|tW4M@A2HE@*5-_$ks_DO=2a0H
z+KJvfi=Yj^*%lbUh4f&KNi0dUY9O;}AT>tVf?aFCR_$|DP_zG<240%1NDE(3K@gyw
z;@apB1~6gXa)BD|;DC1O5G>&~4A{=seT5tL!UkkvT%mL(%>kBei{A;`ZdW$cjVo7W
zc)rQ<kLqpr0o5p($>tmy`s>)eraUaQp88J1ucqg$NfYp^RJairq4cUVu_Tx;4|qsU
z#Wrw}?H%Q><qD_=tW8WEMQ#^Rd(8Y+kT8UvF_8KZ*ca3oRZeZ>2s9?!0!3{bli+L*
z>b!M1+5?LKnii*wX9~$(uhx`hvyYVJLEh~ZeRsNSl`%=bF%6+()^-&trFzfECm<YK
zYYnqjkXGGRRl^5#e_~#Cr>-^`b0P}c&=8}xrh$>SE#<69t;JL;@cvG~=o-w!yWpSP
zB3aR-hHbLnf9^{RGMS1l(`9(_V01DMuY$)~>sd{W$6=+dGW9L_TIEcxh$Jl|bZkIx
znl!848dUXUSgs<8m0lA+;+9km&^s%4aXBGD7@@hy$L2BWtN!NS;3Bg8+?PSRk`eK6
z5W4)X^btU(m5CUkoN$RvYZ#@SCM}2_gCiH7xsSaFC=6FBjy7uoZQbx*bV6T$aP&UZ
zK&?P|K<{Lmu)=3IkjiWXx1$5m>42^Vy>+?drbTm2z^zt6Qi$fPY-oC>gD|_N2uQWy
z-gN9Leg85FrfdER!p+;B$1+Z>FHU@KXHg9giDpLQ#2ge8a(7U-{$pQvOpmy#c4({>
zRi<jH9%5Dv@27aDp6BEs>7nU%P{a#4siY9F{96=BYj1T$($-}in0Ca4<Iv~^kI8Z%
z^4UxE9a-#vq4#gv=?QW4=s<A-=#ulpKtdD8WvpBD!t3qp{GHe0hHdVQD>Y_8w!krY
z)9r&XAUG0!y45`YvQEZ%O=K<0{l1j8ffjwusOXW>_}h-yKJVe4A?%(bWVxwyD_DGs
z9iP*1d3qK<e2oMDK$&G9Q7Ial?w}Y&lV900!Y0&j$LKRLOO}KSJ~knx{XBA9cnRa=
zkjeWmd{k>rzAf^GG(Ux~>Dq%m+=l;s3`xG0rf7`P_w%2;DEZLbhkA)a-~9#9$S_Z5
zt6t})NkPhI)<y^65!ydx^U3PbHcn#FbK3DaDn`|amsg|a*3%qJU^Q2x%33*@5w+#B
z`V$y!xaiu|72H`QUO2CN-_tYXYSno=hw8Xf<JVE_af;B*C1fS32(xWs^KL<TD*-09
z!@Qhc@055B%v`?U90_fdwjIxXSIHkX%y}`p!Z}1_5F2X+-4%?W0e=VKzY!bw0oNx^
zMiP^&+n$H5$PZhMft(p&t6OsM9^Yt!v11C{^q_e~RzsY#GQTn+_;5$!SutA;)2G5|
zo{JbxC5FXKpw?t0F99?4%BK>A%#s7RGZQSpfH_Lg6{@9r-pfLTm`%$+a!+N+n(H;`
z{cR9Qd<Md$*lqMPpW{+NMJ@*OwN9I%ZBExV6Ay*8>!Zc!^>}n^+F<XVn1e|LojjJN
zh>B8Rxx+G?$VD>>OZG*V;#LqvUIX=FqkHurznLLkBUxKu2a_#WTHrJ{U8s|C{~=AC
z6plIZk|Yz4Y!!=VAv8wruJ>nK@Rw<(Qc&#w8tq1ifii;ROAY5FxkU_9a!^70d+{j6
zR<2-uwFF;?8ar>s8pAptwwOPXi+kGjY$qzrjli^m+Ll$WiL|_%c~1QEzF@qlWW}kK
z)imVom-A~<OhiI+;ggIx_9pTwzVBIRIlE~m`xB<_ZTR_5h*#sa1klH*XX_~>gFph0
zCC#H?I_nZWJX}e!54&RdI9GhC(-<7#!t^Th1bg;i`J_(N>BrvZtiEgCD9uxl<qBGC
zFOf?9L65EhSGtcNcT*?7f*^)Cb(`gF>zz8nj8Zmv_O&0-&eiiFzaByQK6J+_wT>?Q
zOI_s8Uh`@Li4Wx$BgOITRZnf6&up6dUEzY6((_;I<*uu4O~Mk&@BW`3Xode@7(t0=
zqxo701O!Ni07Ci~Mp)~c+x#}RwzK*dN&Gj4xa_`g*^p?Ud;O_$-UilOY7|jPMDFLV
z)VNNe?UY(@k=#(a;xbj|TPKW5nk55f6O>Y2diDuZfAFnMH%)`&j%7e{2SyeMkhm=X
zfV<W<KpT-Uk&qBGlk`Nr9`ydO53ar`>+QtVH$Mc{J2Gd=1`xo*uO@!gAE~bx$#kvt
zJbidcJzM)u?tnu^cdXSeX*PGb@5YUf^^Q7V81Z1KGdKLi_Pz9Ml+Poq_OJ)K{)m<M
zUwFRaIrhf<9Ndf=nQ$({dfr0v`H3%kxg5yXpF*zWy!-QKVX=~=$&-CMJ-61oh2R-P
z&(1{E1Av#gUc?`;ye8A`;IV{#Ek0T9A(zKE$k|{=I2x>x!MN2va4yD%GBjqfPD>Y)
z<83upe?LOuPhXRR^`cCc)VR`i_!-)FzYKNeZ1rg}dtAolvl2{wPhn4)cgrgyzdn@9
z`eeL6NE+MfdL1=xsz%UtRrlp|plp|B>wcy)B7`ZkLOi7JA?+iMroD{}!GH{A#8@`2
zVGs&4Fn@pX{zzPXj^xH>VgIh~CTq^EE;sy8xY~JvJ770x(_tV<39QC$#4-5%$mah-
zmZ8a96k-3_YU{MW!Wo2v4VBr_d_A-~k2Sx05f@YQSHk%5GW^jC3K1;ITr9LrhzlNn
zf^I|NQ(OCzsG$seg)r15LF6GhCS$PZa|CM#!Gank=K{ov4~_U<sgl%`Uq-xidV1zQ
zjN;?m2gDmYW-iD1qU<p9oKhqQy?i&@AF3CAq+3EVq=Fq1B{VrAlB|%BWNrIR9w!D1
zW4(T3G=|91vj@+)s@$7*J(cvC_vsO2WV5;OjA5|Ljw3A!)S!`!<5?Iw3U{Yz4CY(%
z4-o$P<z^|XZOK5~01p;?6LSiMVX<3Tw^>@3JVEE(2DnE=M@b0r9-Noz&Z45NCYbV8
z6C6M;=nD_LIh8`QgEzTQmHn&=FKD)WANTW_n|LL(l*gBP6vL0rqq@nXROMh+*@x4F
zmdDjNE`1<5H1FTFwLLpet{Mb{Qjdfyufe^U{R{y%FEZ8b2qPdnRfNy&-~aw*{l!nb
zeDwfbZ?7t&t}+2bx2WCexwI8nM&NY4x#qo^yJewswZ4_tqM7Y^&3_UkDJOdVn%r>W
zu!Ht1;i1@qgwJg~GnU9)IVlG7%SlKN&+n~SY>!ZQD&qGHW?99km$(z#Q+7L^OBRZi
zi8m3W)R@*E>y>z?&ZVu+e!8#FehRl~im{EcD!Iz<k<NbXF%qtih=7WK9h8Rzx2;*k
zPza1r-7(l5d)_j{;1Mp-{QO@q(c}~`(OQan-P2gz5T<N7G^T9#oXnDBkvDF9)8dCt
zw+O3!>GjT9KDob-_Z$Kj695ho_Cz*oU;10;i5ithPL{Wp3OG)oPwRDt&JtT^aGt`_
z7Lqn*^#$_wOLJi|rfTvGGz}j$(=Wy0@=kk-DZrK)hu%|)63Us3l+=`JmK`iOp_-PL
z083F@najY=q`g%jl+IZe0Q<dKTmH;IlUb)FTu8TEqscniV~e4yMfY=_qGe0w)_a~M
z+pawsfL+y8Kl|pQ(e5B#P0bb+T&?Zym8Ocd<d<4o`sjd~UMVo`vx9mXy7Q&##%0S!
za}KN7vc{83FWc$T2J5^<>u$0kSGDRt&Y%Br9{!K>_8$(}^gz-ci+Wq~=m71=z_AZ=
zYOwiS%0keue7-7Y2<_74hDrS?;^jKA3|`Y!a~H|c24?lP=8)*1k(Vd+wkI_l=xRk&
zy}f0WRf*FmN+W$e4q0@YlX^SNIy>rrD8+?yxGAw-O-q())oRwN7faPbzOttabSsxj
zlTu@oo8XPg#=7bMpuQw%s@NkyXf}Pk(3i0jhX!b6(XS8d?Zk8cQTA7bI|a|1OV)y7
z*fd?L|J<}#csJUtUzu!~r+>+yUsp{JaP6#^?oE@_*KJe4)Y+ZfsjFGaNY~l1#|C#A
z&~J_#>uW5YZ*0YEIqv4EhaMHkUuyUQS&sB!A<x@G$ey~80bKvjpqKwM=;OZznbU91
z8SUxd1705gV>3iHmpL34Yvqc?pu^nh5=|pyw{?7fUjr^j*grX*mK@XOUb?x#p0UnZ
z3)rH-=-0gd2U*i;DSCT8{}AASR>%KPI;`g{AKzI=n;^|Vto+mZ_Zk_knyY%&teZNz
z|LLjq4`%JDof-HVHPHXBzuzc&`q_+<G@Hvt`i(gk8)X+4`l>B_ETPf<Yt?Wca;3`-
z*s4<%2#~CmmPm~Y*NJ3UMxN~Fm5udskT7lR=dnYh9)lG7J7xTQB$jX%(ArkV+-GH;
zkQ<lB%uElb&Ymu%jAlz&Z2r!Ld|-iu^$^Y1vn|;k-PQ@$AnaS%pH5tO6n$f{M`a5*
zVn|{>AURysf|602OU8#<fADDY|Bf|TRjxJRT%lX-K=N{gxP)wJ<k}qSBk<!k^|!BT
z=f$t=Rxg|h0E_w1xMpuNL@?Z=+^(3zSzw7xJFm_mcW44MS~dc*y&A!7L_2qCn>%(@
zah<L_rfgUx8rKNcuXM;W{~;Rxhba9&#QHx(dbMcHMobEjn9V5z6RmVe%v$rtpvJ}}
z&~zc+5DDek$~kZ2itSQoH(M4L6P7z%4tF*@s@~zK!@td32t~pVypz40C-m=aW`~-G
zn3Oz*Jg-P_>WwP)PV3d1MK0bAhz+S;xSIPOaQ=(zl!a@jj4P`|a7zPLvE~0K2r}n?
zf_BZ}qyj+9HEA8R-I{`~@zYb9A>>MTt~i>v>nxWwx?9vQUaVFTIiGY&71=XQ_&2;J
zGt}n53+DVmqCVAZc)Imb^$*E+M;EXcnLH1*#PMnKBWX*FB^_sh!6*yFGgYgX$ozV7
zfbIvKG6M6LNSr(Cck5aqbaVc#F~hwf=fh)&Vo-dpAG^Gzg0vs=l$Ps1!oQ`V$>Q;p
z8?{);DB=(L>Vn(I%UP&N4;;xu__`YSYbB-=C@x<L3Xb_!ujTRYBN-Tz?<*~3Ei=aC
zTqzfqK4oH}-LPC0u4F!4Ss$d!l7s99hSCNFa?d`l(}(X+U14neXQ~hH|4hC7pQ$rB
z%Xto1ZzeIWe`<f6<w{;Eq^0jY-{z5RRI!=b4+HL`rK4*kJ-Tz$EtfUJj4jwKR6U`7
zELgZ`!8lp>#*msx*&iv`Lu|g&4G6P|%o1AT#kXfAY>yLCx4IcW<Z{zora&M;xJELX
z1q;_|*QWDCI|7L=Ijv>y+3>@=xP)g(ZJA@cWWBG8MY)ADo9s)Ofdud`eb)UTfX$q$
zZCg90$W|e$Q|MmU2>v&mI<||}`+mOQOK0cuQA2f#)Jb>k9H^sYyNXqF%4frB9kf$(
zh1B*UeyoxiO!mIzVQgdh4}6nZE-Y8IPoWA)*bwNecsB%Qm)KO5E0=X69Q>n=bYj=l
zC~@rwBFp&3IEk%zuBZ8&3r^gz^(b%}9sUhu2{aRgwsnR}x8X9dvz$|V>x0DM5>^12
zd#C&1)p=qnda(P=iYA#r$~jrvL^vo_6f7|6R)Dw1Us651#ij18(fMxd|45~e?c)8<
z+ynJnh1Z{Ss&`KJIvBtXlB_eETeiwJWJA^9g#Jyzll1-^Rxq*ai|79NX<RzeMbE>!
zbZ-$`8)q|OkPC=c??UZ@_58}Cm$@v^RPo<9@q_J8qEme8^Y)Vn5C1@L+KZ;$k1x4S
zlX!g;!ee0usV7><6o?HQ|E*-$b<nLu(XV)kDrN|6<P(Ceh^#HMH6Of~E8a?7PzlJs
z>kgA%6HXxVtMowpGj{H&lBK0zcZS*9P9u5J`<n-vU=8zxjI<k0Tyk4Atrm4y;<eRq
zrfxWwm37>s9|O@Qod>50uk~_vT!yp1?5~mN0)EWm((v|WI_Da*>2ykkg2Wd@Cbe6a
z>mWh<w&67Dd{=(m6=v_V{1<PS1ypj1%c7>PckF`D1;pC81U?A$3DQ}yRMosOrQdn|
zI2F>9d{Qsx@c;0NF>h<Ek}`i?aAbj8`|jq0l)0-$$bflGob?(F_p_}RoI2J?eX16+
zrZJr)vplmRv)-^H0=CAix!_hsx%7M+Zdt(YgIo73pG-=(FW7-Rx0iLU@h?P5|7#BZ
zS(>d<;!x9N-Q1<qU6pyup4wsqaQWgzJdqWn<`g;y)|5wYx%B=h*V0*(VCqo&DAzIT
z!f(_jtF3c5O%uH7$8KO;F2N#;uMWed3?S~CfJ{J;!V1kD!?ZYfxbuG%7vepfm^u72
z^jx!AztnmuM1Xkp_E8`f4){~cmNf+4iYmLL+SA1cvo$SX=%45(i^H62GiX`l#)cx(
zejC7X_mcTi|Ctix50F0}o4|3F#|}hp)b&{m>nmo5njvfl=``=wzdtu=i7{>C78~t+
z1)RPsv~;kw|636pj$7%qlSc`&nctaU;!vz}#{yPh!ccxL>)Dp}Kr2pE%JWr(-u+o#
zQh9>|!-UbU0e+McOfxP7cIcg#fuS5^@^>8rh_%G$t{&5qtu|zjbKf``2)NPB&rtF{
z1^fB#SRv!5Wg=y}^LX~}q|kO%F(g^@F^&;|h_jvt$#H7^)fYF>P?@k3uu>fnr1wvh
zHyDxu8}WJ%YKz?=11j3E1%S>gcon_cY(uZwN>etCSR8S$Z;Tj3BPd>GyMvasN|%kX
zf|>A;DC@t2t!&cbZi;L%Qe>#CCZ1*uIoZFvCFIyEqE8r#?0%a(-~dXxsxJ&(dhC|=
zn+d&)=T44DeP2Eb6)PbH{ul0zT8$S4sGPKODq38fKYfjOv!0!yY<M9>9I{g*gxG6G
zlVG%)D3%0Yq#(VGRyaZXJT&ZIyF4sc5nRxxusww0AP~%U-$PxT*W?O85fR^s$t3Zf
z>Eq=wyY75`yhbnpGr`1`S`M7nHN<rvo<EBav>PA7*kavfy5~g!4_3+vCJMpXl@JL_
z33p2NmP|M+;91xl)px(EL4k{exDB}OtvgIDH=~gPI>4bP5B!wHY33`NV>D`++gIz_
z4!CFYZ4Vj69ntC-$mq?X)T8|%APe&L90gSbKiD_pHVuIG8E``3-1O|aBbknz5R^(*
z<uHQ!wS83lr*dhx_x2|e2YD)@fGziE6-*t}mroj1Oe)IjFLZ_2F3!vMW*zNhsUYWo
zVShIz$}A_qG=kw5`!5m)OLyk154X-`BjiinYp=jLlJGOXc=M=?xxP^(|944{an$b*
zesNQSZ8^U-qT)NvejHz(JKi#i6ig{kGvG${&)Yy&Z0&2Wkb$|yhjx3s^>;g{Q@Tnx
zfngoMq;EI+F8Y;zEksGLOC_9VR{nTT$x^Xh*3FkCFdblUY5|$VQb4RgB5i6g3}fHO
ze31VaXGyc&{1R(4%FJu@v1|KnbgQm@hF*35ep@XVmi{J|7wJz{XP$Rn^O}>~E|yhQ
z$xG9n0<f-*oPYm!;0b2`HD+k&$kEY}9ID1nY>E|ow~?Xx91H{TbrT$^`<(lrZEhmg
zb!`0*fg(Bm?i9Bxm~vl^<x3PC?iy3u-A#;o3xXTh&?54y+i?uEHlWAB#p$@J8$qod
zQXKyCK{oE1IKiRaHmN|dbg1&8oVA@ZjA9B*(5`R|pG{K^L1uOr4@`!`O&M3HuNCgO
z*k<P%c)|tRrppi5yQ%Af6tM3|;?ciWliW{!R<8HvWQSHft`uZ8JhpT=B*k}Q%ERu7
zMc+4>qFA^z;kIDG#<VSxm}XJEF?KFkxHV%@t88n$#Pl!6pR%YoHeti^ss4ro2PPfp
z^<+jc`BvN4^HwbmD5fCs7CRo=213m<hqt&Q3)!@0IdAR(h3qH84AZz0>;^T`2te@-
z24{^+ua57xGK`aa$+}OiD%Wc+zPg-e!)0<9rCR`c6qLyfPiECh)>Gul;J$`seuCOU
zog6h>h5nX{V&}shj22#9@7qb{HMFzUvz5nHT+AKdgd=E7C`+&G3eyL7QQA<9_j^_g
zueie>hW8l+#*wexzoVlGwWG_o-lxCB&60*=b5UDEfU8KmS2-c55IxaM!7ffRBxt|2
zCq5rDf{zQOlAC*`)b?OXVov-ioC}LdM*i|#pD9MQ<W)S}S|kX)ESfcJxUZ&H?Qy3L
zASD>rSK0%ZypSv(58*|t1wWnoNU{~s!qf$=#n{GAE|MvscfHiS{35ec3>D;c^lyYX
z*<0}U^o|x8J_0%?V-qb}VFF&|Ds$F2b#cM2gKehiWUHHm@6+Ix>$PF>A-&%O<<?RQ
zteXQ^ddQmG<p<N3v&_1dG9YeRH2BOwDmA}W);*~4_t<Fcep)O7S1i^b^r<ZcJ3H<I
zr6J8qeI4f+7HH~Q<ME9yY@{QUW&|q7;u;e3u6i=oD8cRr<d`{x?yg4Lw2F7^p5GXX
z)B~?>%zm1@$mFqg;k0yG;tXumvSrQJgxjC@1EQ~czX(d(Nlu-(O3abdf|e1z<5U5+
zvvs*_vX#~^R&^T9kd`?8;PoSdKE39Q&NKX@L9tT6W7_OQF43X}<nX>M1V$8|E3edx
zAYd$1*KrN-p;K9n@-kHbIvcBx=~RjpW-8y=r<V=<D&vvsm(F_AJE`6~VItaqO!t1K
z*PA*T)?3aI`5}IPVKN$(m7(5&hhsD{oh}FRKXnCuJpihc$y4?<W_b9hLZB3FwTQlN
zhAdAO5)zgp2)nEy+_Z-|D4YVwm7&yCd7g{~a7Pb>ovgP_lc`SNWBPX(^trOvH&|KQ
zhymc9Ff{MLQcab{TOQS0UK+|q&a67LVDV4wu7DeD(-lPemjv$cGT?gixJ)C6QZqyU
zt<Y$&FMhn{*M3R}-T+EJR`iKLZ5<iVS)PeRNzWAgG6x#T`QkEs>c029<`0ADJ2C^b
zbOB-3o_pb&HmirMsM;Ihfx70KdKWZl+tofVh!NHoS3Zc(8rFQ-ft~Q|EL#%LIiV~W
z8d)mk%*!jBI_Fq*;eez|nlY1<E8+oyCj4Aon<^+@`*~^aUD=S@n3~$sL$33;H!oZ~
zo`oloKVz&CuaF>JrsUYhwGA1f#V~^prS=VOJ;J94u5?(O;po<0@k@j&ld0V7bpcQf
z55BqTB(E?#8dIhJvIl$HZ#a1QSt{O~uVb!89F4qejxUAn0MQbBU89^QWW?}Wa<6F#
z*q>Ki43qZ+T9A?PbP7V%U@A{vST=FDnQXzlwCNjA%ub3aolx81ze8s<Yj8ZJXn%0@
z^c<rW9!|=5BkT&^X0tH4-i2yF%B%4>|MmT``Yj4$s1m$}5y521)zZdV4xV~j6c3I2
zfqU}++w}YXi12*k9<P;H`Fq)9;Q~UC|56&J#{&ja(h_+Ej$yg0n{9%#6}*1G(GEi@
zfoc@c_L$Kz=pIIZPlwrav26Pd?=<(z51P%$Uya~Yzz0}kB#bN|CPbDWfv1gO*;bAY
zADFRmK8V+N|4irR2zB1I5>(CM;i{+CYyGA(Hf?MeGzRTvvSmzVlTL~j2XHB0KS#<w
z+zlU(*;^2NA>~6pA{g-i4TKcj#YcT<g3J@mqNpLqlw3E5_DT`0eS$pnzig(*hRTA5
z+s?W(t%`uNUmq4%F;tIYB<qf8Uj?}BjzfC(_`YCIN9%3}N*;Ude+ZkjN=eE2+&RRr
zReds890-OJct=ZQVu=&2nrsZ0ez6Rl;OcFQH>Ml!5Pq$N(Da~CYZPo&@lFatmfMIJ
zA*|wGeHYX4<L$u%mm|UN`U37eWkQ5ZVGGU@VsL=620Z`tt#9sL@%MX#`xuWmVn6&E
z&Z1v53|J1^J_cWtNN?q6kZiHRifm0H(BtR7?d^FG?=v?w;&Rbn2@7>48V9^&I~A+s
z9<j6(#aBo)*PGJR$uN`&0U?YmV<02?3*?bSnx$FXjiY9n-9i-VAVNaRrQuGI`w__e
zRRnfgDvVGREKjQzrxL=^-X~OfCk>`yy0JNnqrpok7H)8oNP!<uJ&u#P_?gFf+w6`<
zaE0GnWq6V#B|<vNksizP<B>9rM?{d!of9`LC1PvX%uW7ibnsQZp20Ws9ntl0Wa-F)
zU$gW;D9sHgjr4dptT#evU^2lXexGs7OzSkl0<2UG<s|4_v*$of(=K5(H+R-|o3WR<
z@j7R>b-@pJD|pD)ATF1F=XuUXU6DTvZK_LXwRZuVQXl!7IU!KSOIEtOf&F!iW2EN5
z90^Am$Mqbm+MYMGdQ9_kFhY=~zYi2lj=M+x-hcDx!G8rR_a0!)9dAbtnt45i(7oP?
zz~npSa=6wPsnO22M0lgBE<5Op_JI|s59YtDCtVZRIThEF)~OHYPVxaWc|33-6qNr)
z`e<GB?-Z!Gd2M;jt}PUJXHB0h(w#O#{kpxXRr*6dk7LOc&yD(p!{$AQu#)(0$J|&}
zcKtPW6#MOprGgV6(C9)TZJqKOO~sWA1oumfW5Iv`Sw|5h9%>9tjJDhl<ix=lT}*dv
z!}J5k>X#MiT>IpV-U@Qmv%))Hr91-AE8XoGTHY?UZg@5RnlxB8Q6L+dDqM?cr^La5
zM8Ce3hvs=8YhyYW!YFR``v4b@0mKKMc4{fLtWyupZ1Dk(6>aYM-gW+r%LQMFu{BS;
zIY08pHvYJ#jF-pdj{9oh;e#%DMX7C^+j!^*<c@u)O}o4|RMPUr+bLi{kfu+k+_y#I
zhX?4<viVA-Nd0v#wF1#a%KJnP_?-uI7JY@KR=Z=KZ~Vg?bfr=v6Z*mACSB_{3Uhx>
zZ@@2Vaed7Akvx>(#24gNdZN;h!4y~eZrWM=i+0PP&~1NkZAV^^F|n1=Q|YOWL3z8^
zb$`WKKeXQVoP(Wy&j&G|saDigb%v$rI{)WbOgkcveS|>+U<!iK=5!>Eh!Dx10$^qI
zrh(AWG#5r4JnZFW-SAlJL6Zkj4d#|R4|pji#w$<Frc~s_JBP)5%=&kRR=D%J<Oo|*
z9>ABWf$wHkVqKK_?-3deJ`<!!0G`+g8oCma=J+c{%f$G_dV^rh;SYM4*1gQrD;oq4
zcIP&yYv0NWoN2#tg-9cf4oTr_{7%kL^IQP6iv2D$+$rvLs%UwYY?A|IH}oY;EtMQ*
zfz_iXxV2*R(eSW?l8s&I_m*eWcH~E^2VQ4Mw5z+8Kj3cbU!38QXZ#2ilMVwPJr!=u
zMN{ZRr-@prc<X7^iX`>tF=||)%SI^VXdtZ*H2a~CS+}NYuB_ota)%2Yw?p!L`X-h*
zVs2T1TZ#%gJA>n85FA;El*d?wbjzd<qGy6O;}Di8R6b#8#JooQP(|d#;w~eoOPGs|
z{U~n(dL9r1925xAZf#RWO3B|`^}<EC&C_m7=c+L7Dw={nRlrhyUF&mSX_$Y5S;i^}
zN>!_nq$<1Ki3DGYGRoV|8Hs|v9<FQL9uQue{3RXXwGq?^rj!bj%|KRtaOqiB7&HO9
zX>=uH8FS~SbrOfSMK*mFi0sk*7$p*W69oCsKfser3u~<vM7#m$2M9H#DHr|)60o69
zA(den&ZdlReoZm;N_qNSRj>ER4~O9C7*b>vO3@FhD*H(m4(FBgEUH**LM7<owy>|a
z`M}cCXd8j5`v!_I1Lpw>aDRZ+k3x_VbBkF-3^g?95@f5$h~|Vo{2Br_m|qilgS|u*
z%|PdTFS)PB47lw#0|o-OW(B$cnwQ!+E-^0lsWzX*@$>i#O2p6H)N%l_v0L-h;6JHS
zV@YpKICElji3O{r+EUEr;!JS*H?ob@{Rb$aANSv&%)B79q}%9`H36|k`#~9TiDd2q
z?#HMV>G?rLvC`xAjOlqn^-eXQvmA<UIvsQ#VnQ76;!Gkd|8|^}82c%YI-tkn1MMJD
z>s5dkyH$6Z<B3Kak}y}&S1>b2GXZ=};W0u<JAr0n#Z|ZrJ9$;A5hq}cB~m=5J9&$u
z;#e4qW|0eXlSBH<Cp7#Hn~y17p1g2!M&eu#ZYM$;UD-Q^0A@kC{9B6n20}YYThj(i
zItxsTvJ2n;f{leOkMu~5boV71aLLqcdwl?M!j+Jn@~|DmRPe|%lHN#(<N?wv+#^SW
z@R;{IYmNSuwnMzx)d_!nEhXFho<6YL{x*UZ{O6<hyY^?aEucH_3;YES-Ab><d`Lim
z%x|56jIQ5IPB~)%35w@_&x>v3r_L(BAFcQCmSRYyG;Xu#jxE_U2wTO9fRw2&e7$U7
z60X-nm&cB+@Gc%d?}*H;;7@z;unV@1KK(X}FLt1g2s-p~+`x^Khfef++`8h}(jwc6
zi4~xK0urLJd%py*K!mX+gV>?TAzcse4I=Z_w52jDNW}u62jivmemum*rxYxV@uT@O
zXaO>o!Iye;^1x-x_(pln9&RVCuFGYQTpckA<FrKlF4EfkjR^8+ZJYb+=Qnqn8wQ3)
zS`tAeRk^wfoYvKaq_6uN@A1h^|2VJdC$v}pAEzt%t38>HgNapn$xf0@z%07XP9q%|
zeUjne9I}Atgo`r9_aSe4F(g|`M}3)icnEIEfkvy6G8>jAfl~B950zDF!nOUTQte3{
z-N61Uvz;u^HS(%99yTuw+!dBM0WrC7)vl&R2eW#6jQz794!lK`Fp438T<EA?6*r5`
z?#}mY{WUe?ptcZ+DC>6tHj@_<)g2Y<GVHJu7w&Rh816imFh4CwXaH7t7zW4=<=djn
z@2-Y~0}q+%2Bwdqlfq-N)P*;iKHMt-JceTVbYZw=>f$iPvoD3(g}%1imu*KUJ^pW^
zNw2uw_YOCM^c|aLWYw!Q${dYr^dmV$JjOh72sj9<wV5{qVGn8Em%bN0U!v*003Uun
z>b-OnPngPmGax*aKyLfjTOaH<(8y8`qED6~h|o6%`Y|_<SLV$LMdrV6ieX9&`;DAJ
zIRiCclzy#-ktx0DQ)K-JkdS`To#_bA`Vx@()q#cMVABstPOR~0%^|2_i9&V^eld7a
zv}!M<kX4dg)~^n^YfwG@6Zb9^KVQ9!L57dwW24guBk*Ct4Pk_!DQ`}IATbhAg*7;J
zl7hwSZBt{ESyzWE`J4K1pc_Fqqozcf7uxS#&4PUXgro9F!$_k1XW=cIXt{Y@FQA-Y
zO@*<AT_Cq{p<a!SR_^7YqYW~vPDNW53ulxc{`3K{lugPCLVCq>AV|ZMX^OQ*k>aiH
za~qb@4`M@w)tN1-+HPu-76_YYBpJ(JerLHV$VH>byBhgZ*Vp|7;AgI6d%QlUx)A{i
zKp0Ks(pSM80li;D8Q<LP{9t4wg+055$6>EXSgWHO;1rReEB?&{n>s&c60~?an{B|_
zS9QMv6M2CQQ5zZkB?y1bktQR<onKdBi;PX<L4loWR9pyDm~X3X(ib{|)2iXCCG0ub
z<50m;0MDGXsniWDWkS%!Uhf7GO`4*b5nTRA@JDhna*&~{;vpe4a^N*=J$|17@hau=
zH5%l(^S++RJ5D%+aAN%{@gssMCmk@kL4mZ{ew)pz>@pBXN!>_vfS-l@Mg4t9bxI;g
zcuC9IXu^KZS!4msJ$6X+zS`=YPV~EA61L648nMAB1YHl{*m0d)_9>P$W(E3Hsiw{F
zCr3%yIX=?$m_3b684$G??8vcf951N^Q*rjUETP!E7UY|<M1R3Ku_K|yWXhENo5c~c
zz;|!c)Cnd9#Wm?1$y+0jx!)_`xp#8gFV5i4T^oC#tP;E|$)4MRe7<%C{QWyZg5C5=
zj^lD>uc#-1njQ0bp(|KrB$|gvRe38xrMp1aI*;Gabjfl*Yql+r*{;_L4c87N-;U?v
zwM~`!6r4qcQb&^$X?3EcLQ8t#L$BlGU;B|=fkpjv2U?0JNfm+m%ZlN*Q&&t#-nTeI
zSE=TM?)OYaEUuKLa)Zw#h>Fo%w5Ev-g)#o(ccy5;?loNj?H_Ods7R)HIzh^+Pj8{W
zVe4(^MykW9SWgbkfm)&RbDUeKQeV~sQYagj)diWNTfOuOQ`|9tOw0>DTxW;KAhb#B
z30JWTQ{|oXjYzIEnzZxMPN6Lj>4>u7H`%&B6cUw}n(q9=`obC#^B>D5)!RzfnuT8#
z2BZaN|7lZb!Df`&1;;J1Qc0BP)I<^8M@yfFk?U@&SbGzxR$RS0#Z*KJ{r!4ULzk@A
zm{orR@ptArAi6cplT3G2F2znV@q-gveHov-y*1?N1cPbNr{CR&!|BQ_REE9X;DhWr
zP|T6vo^->%coGFAY4LNPgR)lTa{QY^hO@~wKc~bJ-4g?s<=iCKegb%M?mt~T`y@_<
zui9GifbdUt+W4>sgcT!$3_IAnUpC}cl6P`-qH#JkPI94)CHdkfqNbd~aYATm_={2l
z@fzr$B1s%vp~@WT&wA&mqJtzg%l)xAtJm}7Y%_?O7(CVf=0j=r$D+&-###)FJB8JY
zhLhUC0m7@we%Z=u@vHGs+gpC?IzY9RvrYUEk%-V0;e+WMiN$bWf3s{^m$O4GwxBhk
zfb-yORO{klt;Eg#&;)J0UULUpg0nm*PQdU*KMEg3o!K=}E?cm^-h?~BhCmA#g&Kmh
zgA!a#G9+Wd4G02-aVRN|f_(MD?-%46io?;yFb19rT@bPkecgiAAu?x(GWSa!G5uY$
zTg73ia_KaA*7(w>TsiN5c3Z7PvYfSP#wp?-`h-)Nq6<Fwy+-y{tmu?+PaHyFI0Ue7
zARLlH#x=14pRcqum|WVi*<FQ`_}!N_&;dGu7x_b-hAVn3$Nnnu%^6DDnCPc4KO!8B
z;X0(}3iheB;Zqql;!jG?W&3(Hl*~F_G<hG_c=DcN9Kv?cHg6cBkARnC@7YRRtyQ>X
zyO<n)G&u}mdw1?(A!`Fqtih~^_-WP>I+e0e`6Mw|-h64&yX**64kux_dh>jxGkQ+j
zA8SwTJrwk4V)PimtV12BJf8^cVxOk2)%FcXE(i4|N>5g<>hQs5#IZ5;u3&AvV$Q<2
z%bXPl%eLUsuY9>9x(YwYG1q6QytTn1J=%l6@*+AVeXVH7oC1ar<$DX~oGaB$jUTe$
zR@Uf6%j91bmF2%x)Z;vLOIGYBjUC1-jm8bLmi0gn$g(Cd5~Y*6Ny}(h9h^Xgj+3Nr
zBNgyU0&COMmc2M61JQPB82q6{EZws-q$qk<jd;|$MAN#`I&HrRB?1K(r!0$(rt@nk
zG=yu>7_=Jf8%69rGy&IH!di-YfHWB{Do2uUDz;ufvMs}X--M@`!clX^0uAj}QrjiT
z>5f4@WEF!|tr<565H%{t0-|^!QZZ0=>Wy%hul|uV*4x}?yih>GVA4^^)~Uu|%0e0I
z1@EeYnrh`T0X#%qGoefAjx$7bM`O_Drx=87nx-_(Q9N>}tJr=qsTK}8Df|tl!K%<U
zbdXz+1k1537a8y^+Amux(!Qyst#0|J8P6~&&d~-ZU-(!1j=x1y*aP{czq;ykXizuZ
zaxtK+tMsJwP;8e5I&9{=ep4nbcL>do-2lYA<2v8$=HJy12lK4uHj#SM>qcfq;d$rQ
zKp9E@KLDRVV84k_A!h2ZCM$;bcv(VL2vNUb*A-o;NStaKgNE&x0|HBSqg`v64ZGHB
zwOX}dz23H4-ClptW{_%|$SeU(f}#i;mF{tbLkM3|AxIz{uz&M`R4x80>^jzuZ+mUK
zNjlwOqc&{RhqYF#S!df`r{3*02mQL!=SQP;bQr`yoPHI3hPSbo3wqtQNV_#?TX1CT
zf`%V-;a?^(YbI%TTb)MRwyfsbdj0Fi_n=GsFC51i?=-xW-!15Kr)Rf29XR3k+g$?d
zQ*&7B4LY4#w^<+Bup4c*hl92CSy(?qBZH#rqKvxdaWExibr7QNGYLJ1AWYTb$wNOZ
zT36Z8JG{*;1p}iCq#JlJtnp-apT6B4EssFutFiSp2^agGE|k(8VB%S5XiP<^ICrl-
z*TWTz_c(eG@8`+ck>h~A3>I}XEL60oVa2Gc;+{4xw9_etAfVMeHiCHX(-)^lWC&Qv
znJZrr&YCUx%J9-tL+@t)2|v3Z5ey6~f109j?1wF4E3B9pu2f1qQUw8(C@0ZOP)c#K
z0Ib(>WV5XD3j*xA9)L5%ZGpuQRHSnamcbB$s>ZGr+bcZBJHI;7l#~gRi(^|QeXI#c
zjP$Htn%YboGQIOh@5bW}9hW6A4o6rk@cxYM16O1-+U%gDbx&nye)!zG%bBvXtkcBq
z+0CBagTrK}RcrOZ0n>AAr)G8fPP5l<xBLCUGDet>@8wgXsXSr0!8u@0?3>sA*W%`;
z#2(ukfL~`5d+bMIuh@>huPZp;8Of8nl4sYGJ_VO=aVTA|-ALT+kk0Av{^@uW3JG3d
zyaEEs5XkY3E^~NTXSVl%dFDa~5WV!v{CN)54bk>6ZZL?*@ZN<ZKAfg=3<W&O76!hF
zYz5phfS60_^|Oo-v?e|^zOAuqNFgOKjCcIQ*w$NC2>XuJSyLEJ9fpA@P|)ki8@#fq
zW9p8tXk;52>zs9zJ%y67XJL$2UK?<<v;!AV*Z`=PgMLifl_@Aw{2{z4Ss!<Y!wR3u
z3zeG&@6LuH%OW7#hwypW6-HGOSz8eBs;&iJHRO+i2T=9V^e*pL&jk*RW&j3&@rAAe
zGK*;PBkc*xkwb5k)7#{8T2-2Gd8a2cdgcvK*!n;>?i0kbrc>+wYDB#2*-a(czdhrX
zQJ3Z|`5p~djI_VN?jd%oG9B8__D3dsG|>&|a%bRK6WI2kFkn->U^qh&Nizf7r0KwR
ztSMUHAJ`Cp_FRG@<|2xi85Ch1NmE6lOsYc?Z4~qgiz_I^KbkWCg-s}f*|fIgvdauM
zVq(Lc%=${V?HpRdo+K}f3L3HH36CKQi{s?6?F9`~^^O7sSW)0lx)<)kTVIY66738e
zVgr}6MH$Y2?sz_aH)WTPj@@e)Ee1a{*sal2zS?NwV23fE;iXLVwXLrH3N4mJ4tx&-
zmnc{2^+f%Zj0D<t0ljtl#}yW8_Ft)Ai(*tVEkJ#H7}1hh<5R~?`64^3A%Z=Gb)<Xi
z@Fx)j6D)HyO^OJOhXCLx8wh=yyf07dy#^T6m&|(ft)A+ZhA9WIOz0(6ik`M(FbJ-#
zQzT`YF}X-)lSZXaV;$sGs~H{RuVX{j?OUOFSkTd^om4OBD<j!T!7dh?^6W0sk{Ml0
zGmd(hDHoW`1tt}bpwNO7tJ=s962{kvjV@KuJ8FFd#SO-~@O3j|CHtmz-FVTu^%_nM
zcNkCs^bVkJGZw7%L~YrE1&c~B-p|2<=X_kjf4;t-!TvV6czh%_ac?Qc0t<?t>cY`1
zB$_q;Y{YA3o>Ib|eRxd+fX?9v8TIx6Oj?cBem(q0)o5gPIoU!u6s=amu_T*`2B~Z(
zdli+2mfhtA-AK^PfqBI<OBnAn77~`eO&bEFvl3M+VX$*N^w6`q)JrKyc)XK|7qLFZ
zHy{E+Abmt8Lu&M?L1%M{v?wJ)rOU&URxIV949Zs(`XOpy$!R2$2qA+PXe>cExwVMP
zGMba(8b!M-d?AycujP2GWi#;?qrP8<11$U(xRpNJQ}Pe%EiY0o@JpT`%LRVn0>8w;
zlm_Gh%n>e;7&1q_(61+?Vg9n7#y;wX1xjrTV&+~}CH5%MT;km_yNv}aRc78u=>&^+
z{#Ag^M6|Z-EI6sKZegdT($dq#RnEXws;GpI7gc-rugAYAsv+5=YU2E)T4`oJ9M#B_
zpRx9Yf~RohNUQ(v|N5{0H#*hH$L9rY48##jwDEucf6=ikuML_h6-?7pGMi6f?r{Uj
zw(H12v@DJWjoIKyaC{PYyECvygBFVq0QoM~8}(X4NqgpxT>G8|%obE-k5sI|3xAxC
z<Y<2EDLw?JeWFIV#?oD+s1e&*ruYxn_gL|8SDF!6kVQDmOu-acW)cC1n8Yj!TJ@|<
zt7?_qd?0symg`aY>t#6D%T)EH+Ah`hqo{4ki+`_JI^%xpL|qzO4N*<t2lQt??3_gl
z;T!QnQI+lhsSb=P2`}tZTq=q$c!d|1c=Tv_m;AyLP-vz0+w2-9L#a0yMH)7Gai5E)
zUd>io$~Li%EuTXAEvrT>P<k-YETjWe6&L<#;Ih~%8KHf7GFbVN4*&c<b(a7HgQpQz
z6#-eCfhUh<8&);}&*8PmhpQ?g66azuksDW8PP}BKN_xoX)Esi}n8=ze6IJQ85t%%>
zYfhq&%E=d6GU#P?#%MrYO75gPO$KCSVu=$V;-xr|HNXc+weyMh6B=n}zT?jUoVdX5
z45r!&+G>sOsmYfA#lSzHCqdw5pmnh(pntC2Ym5HKbhF`0`f0Rwhh0f^QtdyZpQ+H|
zbSji?ICicBu8=>t7n_+q)$FiuoPaW!df>0%AmoRhqy)X>(5lg`H7#nzqOvZaSL!>u
zq=FINqRfYsf<mWa6+RbTLZ~mOXu$WPmNpPy!q#d8t3iWdSO~R4v~-3(F<YrFuqH2g
zI_P`U<>CCsa+AOP3hV;ESdO_MH`#eAf4Qmwb;feh1VXdHgzrxi=qIr&y8(2e$O;cM
z^ru-3dA<W1NGR~mB_k)ZH@v+wiNeqx@jl|6c1mU3f+m6|gs$ZQ_=>4ZnwQ=1zDy%F
z@pHIc^$cwm@kM*7B|BrS{=gUNq|ZBAHa{fR=>@^WtMb7zbtF^QL99!xp6W(*qMCes
zjrBAy(I5pm7|6%8N#-Lgc;0)m@XY~UyNJ^NJgP1TZzrV;kjZ<@rIuK?me|mtFfNfv
zk$mRoL|J=_0Z11#wIWDhm-)y-D##e4Z1YoexZD<9B=$%PH-DT)AIUYXRt?`usT2hr
zS?Cfrv0~@Qf6#h-DmgjBU#e|ol>TzzW)g3sr|XHXB)6LBm&t~s&t_~g6<fxr&ce;6
za(k-STE?<=X6o%1=@sH3>vDY3^paKPw?Sd-?nX#Ndg!H9!J5tkQa;Q+@rg&(nfVjg
zl7?Y*@-}T3Q2dCKQ5Caj3)H1n=Ejt;CSX9Nu*Us%#f6ntO$+OmNL9k+1;r^Qrj)8p
zIG2={rj4zXD+-lk;<Q+v*vZ24y&4U3Vx;k88oXZ!iIy&%SU~dJ@EUIZl$|3({OXzF
zCw={;d!KXDlB#ppxAG0w18TX@O%@*j)mYY23~2!({&#X8r9}lx%N6a&6^qk_rK!&Y
z_b$xtv2p{tn}GJq-mypa&sT7GS*XYOc|L*bQD5{)C>|LzngMx9Tn93=U^R-XLCK1e
z(=)Rc*nXo=OAQoMmugL>l}=RNqnGOJ0n{0$YXfjPb^IvW1@=JhSf=HekwDcp<;Z1P
zp0L<_%0`iYpN?8LS5@ogs%qVQCTcweKV&;Wt*zV)JOZ%0sHEE1ThdYx_Td;jty6bE
zbK<;kBf&!f&odlC!tK*qd*a%xge0_IW!Bo*pE7Ih5?N~-8_rrA&$FeSvG!@@KYDgK
zX=SK)b~f7h-0)1a!F<3zv8klA>Wp2*5+61mASrF;H_D{6GBwJiv}ICS)t@pc?F&sx
z+t^f6+Qxd5(l%B|N}H-%U`ctNNog&9g2S6=Y;R)j?(NG@lj&;BGFk0flGUET4ia``
zc+5Q-f<*ibJKTWg_lAd8;$&@&a1Men_hG;;5^hsE+k6%jxu2g(n%h)@<D(JGxGXHX
zd2iKYzmgw^Dmpp*O!03h#Xq%|#^u3*4>+61vs?6lNl%B&>;ozf;}@cP#b#$NdUa@a
zW6ccT2Fe>g&$$5SMVgkC3|$WcrbX)1xIt;!H%?~84H-?Sqh{=TE*#%Pxar}@y1r&V
z?v1%OM~fAWm4WidzBab*`4=6SZzziH-@!b9ufbuAexgcaW+Nrwb#%fEL=qT0yAzDW
z0mjG)^Tgh|K1<yZ>?_Y9i8b>WC=Zy`HxemC&IxJ#FsS-awnsc<Hk@*r>Pl6F5*|N>
zVeV*HZ?riws6KEr{;2H!@dv;|!5<4hPR>uiecRppk!4JQ!?3dWThB=smL`b>5Whk?
zLfzhv6k>vpaAH%FX;gZ~(TBZsEAV;IhRGU%4`(#dG0w0FrD-`b3(M$WV*q6d@hTBn
z_V>k*_auZ3PQdB#7+B`e5LCDV(E-B^ejIEzv3B>O??pBLl0_cio~YETL*@7v+&NHW
zL5VQW@n}1#I66EIj>waONmbPM-X#_VOJ_uwlQWjU^DSHMq+md3)<DyE;(a<5rP?Mz
zx%S<Zz~7!t+4t<i{5iYm8Q6?`s`}0@8ZC9ffWTr3-M~^mgK}3F0@FW2(P5;=JQc*k
zuS@0M<_jYj|F5sfl#$n;(!};OF#Po5#!^#)SGfSY762zk*nC~t5x{rPQ6ujh-C8c7
zghxc#-jt^%J&xJE(u*bgqfqa(mC(4BRgso@>j4ZIR-zA5B>kf~So_h)mC8__+-@Zr
z;|qpAWe0{M+`P~|6*-3S;EQ`@lL;Gh);GYl0FBw11KK%(B?k0AQ!G2Wje={0-mA`T
z_rk1qd#b6T@62XX_giew`N5iiKl8fqjI!D|r<A%(dez;6(y)Y&oV-sh_#AD7`C7$d
zs8ASLpQp9My#y5_+DcYw1q<Mx&q{WwE>E?Svxg*DT=^ED70;x#9&#y|Gx@0W@^CLt
zc+$hof3~Y9|I`F0hIP7tln#l+vD7T&JJ1?JL7&2^2P)}&6q|@54u_==w7l8U5g}8f
zbVNL+BO*^t%ReQZ{!L-R7KY+;Znu89#`WcuRMP04siW3qMaZ?o>yIUD!pyVJuioYw
zH1oFD^BXz#{6=ZdU$;H~9FT6rIcF#S;APwLlk6v4W-q~(-^kSJ$>F~MTRsPGfoYtH
zMU>@47#68nUSX;P8^3430PQaUi^T<IuxqG#a%S+D5EMrSZGrHN*zs9>25?n?zA9p9
zhgL<J>NoU5tnE{&Z6Vn!o7=%w&D6&5KBNmXaEDYnH1Ilv+F%`zwia6FF~ejsT+Ln;
zt>WTsGU+%5wctkCSboYV)CQoKBm1w)oXq-*hF{t%jP{B#)WSYlfeju2jN*e6x#T=v
zdJ&bR;BjXtAO1X$$AB^u_8;6d=AN=jL=;+q|I92NvMMhh(Ilfn8lui?DrhL05O<Em
zrw-GfS4xUpQei`nnue*pa$Lkvg5jLVR7z2j-aK;dLEpJ{<rBLG%x2JK&NtAWc)Di@
zOI{mi6uuD{>?880lXQP2u}F+L7Vv-^0dO%>E*Mxf`fw;3Q8E4?Hl-;)MtFysWe*L&
zyB8y79jBC~OBL<vwV~*&)K=*<DV-*z)1-8olui@6nJS$onQkea^N+U80!|GUdUSOT
zF7(v0@Zb_2pt##Zc`l)MSQZ@BcB?BpO_Ik`IGR1Q)1<MY(?l_Zm7ONVPOh7AnrK=M
zc(bL`M5adRG%1}XTkkZ{RZ^=uO_sC>E#W%J8c}pXp}6a$Xq#)$&)ecUY38_2nx*Sx
zEv}POG-nb6fPdgTAzztY@XA6E;K;uQp`;eom+ePM@*=M&v*6bHQJR^GJ~{lY@}rzY
z&J!@6vTX2gxpWv*I`E1-y~A*0fj<RM>V^=ODpUbjExp3PZzw<=4-D-n7#6r@Fiy>Q
zGQ&9f<kkWlfJ0Y1lo^bEcR#UUz4PIlQ@mh7(DJV3M#1nF!aQZfBs=W8fcIjk6Xq;g
zgCm7~N?f2a{*}g&p}rLM=It#et^kv3ykI=-4SR=I8ArYaruY9eF!crN_T`R|&XGfd
z{=43P8kI|cOoH2m=4jnHw)qcg(x;&XPrVTk9iJk7IsS(IwykjD;`5s5oLD1Szs||5
zM!zD+3E+;Qdwsc+NUd{bO~KI?MvbA)5qxxoYN--E-%HeswaszsBDH&HwoW$wsrh-I
zXBdz5eL-V5mUlSAQO^}ltzT#MV!swIpm1%4bW4WuVV}c4;HnBsF;@c1&w&3z=K@Q6
za&lHRK9XQQnqi>yIl2|XfmgGKn4~MiFmq=RrfFwii840t{tYY`i3qKtC-9E@0ixa~
z|0vtMgg*<KrLXrsnb<OWxVNY7_^)TboX<f{zAoE)`i<S)jOKs2IQDUg&T3t69CiK;
z=5t(VE|*n>C>Sb>g*D?Wo~1RGRvH_XdpObXfJ$fKvb0|+gCfcxc9khhFUZO=kLINg
zdBQs6jXxf^p4cK#3qZKd;p&3L7Ix;)8t%84O5yb)l_GCPME6;KzPR>DFNW6i`U+P-
zc~Pty-|s0nR_0UI|1<6}f9E356TqL7`Rvk*_fC8=OrRP2P_)oiH@I4c4sPbdPcAyu
z<Q(f?4m6Lo?gnNQlWzuoAdWj9mv;kS#@)c``UjRctW?BqVQ<Ajv37w<8@=Ut%+7;v
zZ!LPrUgtH(cBk<|t}-%ZS>Q(AyZMOXnzFCtRo8|Upg-4jv2uOg3Ri&weT(X3b}&Qc
zp7+g9u?UxUKDQXYkhBVeMf9QJ3(Xbb3yLAE3|}Z_Fy0J&LDOK*n=RoBGBry0LJ42k
zdia8_l3E(Ru&O6!2>?UZn8GHS#Q_XO+gyW&-WC8uD+j>PDgg}Z2QXkt;wjqL@Pvmq
zn=px(Z(I;-Of7`&cnszvm<8|$f~gQZ27xhjN91MW8<MQbE6N<YwfKfs=1Pzp{`TDy
zjZg<}0`34#aUw)%j-mvmLus;@Jb@=2{|@jjA-jVX;N5E|NJWZ+Ah04myI?rKd+-rs
z#79gBV^m(5^*ve-!4>Qol%A5YkNK{6@`2z6uQN`liI@hR1S|NyLAyUjW&r2~_Lk!;
z@bcOatoFggwdrj*5ma(T_yjwC!BZSrzy?akgF3;VBBmooua!X+=)J&i@mr@NxE#h=
ztTUg&#xNJ5+|k)h`cM-N(GO%iAX9LzVa}+8Lr8ijd*UQVC@T@5yJsJ4MG4=lTtD<5
zUG9AM_J3S_7kx|)yC}Yu2*D^hOr$oM&*ZloU(^yV6dbp>wuxW(hYx&+Qhexw!FLLt
z<IwxBqV00@&86{2CKvJYD^j{BwbK+oCctq^&^)TArurUUPM4W0#u@ULUqv&&h6(!!
z`hV(BkN~DH-J#(m&Y-;+rV|MVrJ6P7j}{3*ew~geGEACpt}X$`jGjQyBRO-A-^X&l
z(v6DN)H7nr#TL+F5j|F<NzRCbI?bxG8Yz>m+vtmmTw;s>Y%d^FPVP>!fmbTk995;f
zt7<oksZ%PfDs%V(rIi$?NQxc}d-H&+$3kq!-rhdfc~5h3S#nIGdN`T|@~tt4MdxwD
ztJG36T69()Vi8-<>?ZX^dTX-ka#)Z>R#+X^v947W3&V1RPPMbQ?zvmva+bS>Yfj>d
z6S?$~&L{MFP2KvYuh?#c?-!DizLp(HM%(#XW@G!4Cxq*h#>PN>OAo3D*e|W@;t2Hw
zN;1}`%bmXgT$v#y(+$W-agA00)0ya#JmiI)iql5!m7<9S-BPxb*)L9fot}mBr083`
znf%@*+miaX0Vz>UY}RuLrI|5xizg(5B(aJa)Y?Ffh^%Z55)kygf2S@}W{8mglqgUw
z6ewN7p9chVbBQk6oz4qEfJ*xFslh<iD*q`VLKiGP&k`K^NC;%H5<fKt%-B9WB@SG)
zkttcQ5DodB?ujyCdNcY2*)U^U{45!<1j;9<R3=AS6)2yC7Xh^9p@H(P6@l`KA*>9P
zFNQqY3{YMZ`Nf+pf$}lE31Gib3dl^K$~nm;O_F7;0ECm8)$!cMSBNufIs@CkdQAzj
zZjnj)jXy<TQZm_(s{a6cI>$x8BcpTHo4>_U9A(rWl|cFJ2g>UzsSN<-SHavZ0iVwr
zY1l-oIDEcnn`_Y9+XA0&=fLONC47E!@OeDf(6cp%bDVh8Jo>Ux@=1>56=g=;T9kY{
za~Vhuf16SA!;uBBIYg`bHp{&NlZAluI9A?bb^t7iz<4;6B%$*h^zJ3W?mqa!F`fL%
z!T#i1FbqS3pXAbPz?aS`tRDT7LnPx`@aj}Yz}LVW!n<>5R8A*9FhA<vALuAe<4ub~
zrIi?z(~10w!^9{|qY|ROc!r<xZH;`LAUSw3_E>nA&wi18zr09@HVY$(K`~|PvJ+Sh
zB!j9^w4TV(D?$cbdfxy>kRWF`&1r(>f`9bkeHxTq98ODs%ryxg4~nMO^xjjLtyN)0
z$}nc>i4TP+C0LaNbXGB(LTFV)*olEIz^ul?T7^B8#XY;HAuv?YSAG1Y&|vZYX5%o`
zJ%$cS5~Yx{r$%4R-aauJOTA^xz<R}SS;>jWps*gkT7!h5Ga+ZDIwMgulYH6aS_I;e
zx+I2u=_z2Hq8k*E_ooqoO<jzM4vjxeacj39pKdP~2V4l8bQLkcQjn!+B~#(sMC-aZ
zH&H$l@0Ms#5BHX8mEyRbBKGYm<K9Zt7nxq%SZX=|5wEZDJxAlhF1fBW0Mh`C)Mj=I
z23g#4E89aHoeLJQV{2B%{(FI_FF;2IZUCylCTqofnavl7`4am7si7VgFO*LS`k=7_
zKTG^Wi3KaMU@w*hODx#BNVpZcu*8CuSg<t*O-(w{z=8D8Sg`hrSTMy9R>p!A^RI0N
z3#RGc<js~?u$bN~v0z_hkNt>PQ*S?pB0C^nZ63gXXH)Bdr{D^xoYq)?umd<lOwl`B
zy92*z%?)a*QYu_so|=|_N{i$-1>#EJm(DrNN`=aLsaP;wCAE>DsjGOjmq3GMjWukd
zT^tQow9PeW?rlMXb#l;Poe~YUel*wzFh^g3#hGSkxw>_&tG8cIuRwi!0fL0DrZ5pN
z8xodeOI}gt#;t{fbuw3j<nXsTF|6f95xq~n5k@l!CB#4p!I-8t%@PRwNkL#ke|l$4
z9fNKfgMDxcBg_o!1tTXTUn~|J_+Jz4fc*ieKBI4q;nW`+<N0XjPT-p{9NLO#GE@Vw
z&@we(fEs`SpBfk8ATv)MMe$>P%sE4&(<#H3W+BE7Q>h=*h$f!-@fX--h9kfMuq=?6
z-ZAkw0xyBVZFFxO--CF#b|T53!=B0+UD1ah25O4p%_uTMj;$}`YG5Ij$o>+ch*DqL
z=is6A3zqd&L=B5Uq;M46OKe*K345eSY?&fRJceO4qpFgY$zjsIhb>(0{OW!2{JSu~
zR0<;Ymj0C>l#<T!Jf~~X?}}M}4dUs%@hA5eKAUgB)gRzs0qY1pW)X?q!1HN}=KG4G
z%_zxkL}uR7g^$4#GpfXD2$%$YgQJ7zQ}6*^S))<qZ@ZV5pZ;3;;fEpo`C;#`mA{_-
z<>U<Zy|5qzuPT?9&Yv$Y_tSsv{l};Ob$R*u^Pl(NzkjWKs{Qa8tDeEkyrS>-{tCt#
zLB&s(J7J@YAXxBn2XO+Tdk7nd_4^$vn#1%2<MV~6x`;$oBmArkIEYh(!4<GW3(80-
zbE~vxF@TQXeL4GKY%IAbijxF-LNGA>qX(Xlnt<K{1c>312-md;(-f+12`uLm(0SS^
zR<}YWhC$RYulP{_qre>S;xTl50=REKBdqKb(46|SRVvm^D%Qyoid8~_9bH2sOX85j
z`g_knUl+^a91iU%sCg;C;lPJuFm86C$Cn-how~tr{`>FuhqLLNsP?|q^csP1Ky~Os
zY2H})!ibj9JSKsld6Uhiv*3i~<PgR__){<-VJBmqFz}@H<Kv(T%cR03u<!*Z6@J4k
z3E8m%-hLgrBRHPWB5Oq-n##}|^j*DCe<8@kG9Pi7k9d>(6|U$7U`V3IT0lq&F)pz+
z>&Dh3y%AuEe`st?XGLs{VhAf^Yl=B4HiNCvbQJMsOKgoyjS^c^Vr#Y@TcfL_Hh`@u
z>fc)eO_Mdcu!&A_G)>Vq*PyGn1x?e<LDO_gG|eW^G$WRi^y<U|U;Y&m{$-<Ql5EH;
z%G|fL=$US&zE2K+tI#v2Ll`8@;Tsqh{Ci5HDY-160RURY(BRk&2z_kLz;5*geE{~9
zpa8fiI22SveQXZBYQtePEZ7py`DWPADg65jxrd=RA;<>9Ibo2cz&9+~#>gGJGs7CV
zaJst32Y}4+q>eZ|F)?i&I(5H$3)Xx>VrBM?*JR}1(OkzyU;%FsYV5z~)zIqCI*gH|
z;Gv5h`bdW0r}b>|gCXSd?(S|MEV1C_prSZE2<`*R0UJLo4`Y<S;Gp~Eep0s%V6BFq
zR}*OJ2J8e^Kr4hR1XttxD{us&qXAk54s)&$O?|K`1c>V{gX*sJL4N+u=LdW$lJD$>
zj3&T1UzqF6LaAf_j1oJu-$QT{vww|657|#a7hY{*joH5(-vD5TVMF0Bu_wUB9(!=(
z{sXzrVZYvi^>>7hyOonJFN$*&dGM+0DI>!ox{E3OnX8xrRVp7z0HCjP8bp8<y8wR@
zy!EF>`rY{)j_pK_X~VuG`P*1-GZ9AQ1lTHIt)<HRpL6ev@fM{oqX27!gKGpjf&1h_
zN-Y5OP@kqKN!P;f=@_U6eZ$i`0wo>nq3W@*`)&98MQy!?k0%>SJ<Dx{fBJN)YA*Yw
z)Gkjnry2r~62ur>3PM)GEOkKgbeju{FX)T9UJ9)gxq)NQi7=iOoA`Yco`jQB6hW!_
zL3mm->VJyWhyRYRf|)g)0WRv(r_Z|!+y2bk-b=Tx0)z13!hqc2up;5URFeU&Vb$Ym
zvTlmJP%-tax?nmIan4ZSj|sdUr7$ZooJo}P6zqN}Dkb22SZ4224PElNtzE(&jRtA4
zM4MTNmB^3H^B)2|aE{R@{Oim{5Kz*$4MpC1j#R+<nkYbXC`!@WxZ^s(z15gztO_0g
z*Y?!Cc0H)<U7wRF?6*@GNNFlogBUD>Du{hC)mQbm6+^;RhIK>06gHSAS{;5c53;uD
z^==v1jEwD7FOrg`UC#$%E9}}^*IJ&J`a-NJ<*Fv}Df`rZhQ5tKanj3Hx*e77jWx1h
z5zOqBN<}ZRa?5k5vjiItxOPwS*Y3%pwR^JK+C5pkc2Bl(?bchh7p>RYEA<ww(NAJ2
zP6GUvOH-Vkq*#UXlSwaNe))tHJ<Ur;96<x)--%|ky2`Xgla&JyEPwzskF@}R8O2Kc
zAEQGVSkQRs_&+(epc;*L48}??0M%s$>xKZ<`@L)kV7FI703R_P;S&u$SVq?>OtQo}
zT>=5A*By?l7AklhmmBrBEp)ksu0IatQ+m{P_W+c)Ss-B2u?kMbhXw+6R|EnohOjaa
zu$a$vGeAI1pEqx|1Om#`D1m?_5OC{(fVxU*BS65#Uj8M3e_5jmo9Gq?{uOO=4Z3+-
zfPcLl;9su<{%rvG$Aj{S>@Kh&eBqfClWfQ<%G|fLz`tImeoqenMP^c@m_CfC5r(pw
zq1cE7iI(A5_X5m^2RDYfgAri(D0w-1BkX7x8!}3ZEfQU?8WT(OjtVtLBGTl<004yU
z^AKDsW8}bYe-4fWBosJO-0^&Dcymm=5Yh@mfzdu-U@@So5n<#ED}<k+Hv$^CVpXoF
zQ3w1H%^x@I{x6b$FcS!XWw@_BDjE4lLVv|#f0WW0RW*3SY$AE&nSji40;Nc~{LFg2
zPJJ=VB@!QrHJw`bS0mzG&u%L6r}m6jsTmPfAJ~z#8m_T;2G6H8&r#yCZJ5Xmf27b}
zG(eEhXiP@69F>b)l{wBz;i+Uj{!z;psq{vM6C9t*$Q79rcjV!{itqh9b(#4DmhS*p
z_2W4Ys<1FpNmTxA{^G$Ck1^TusX_iHik~lYl@;~A9pUDfDm!vaugCeYEGr#x58zUK
zM!CvP#;}E)t<_7|>M8R!@OS;vODM=udI_JNmrx-Hc{vNJ#gDBo-0PLJD!_^Qp}k(c
z6}?`HA*}56DrRuljMq!k;KQ3Oy<RdkO0QSx_1b!`m#&i9gx9OMDQ^i!Sk?f;CVIsk
zVMW_qgSy@pM_50{5!NpqVe5B<u^(3$Z{{6Kfq^&IU$iGI$%nk6%zj(z3F~L-{N(Vr
zI)O~+=&Fo;yqO5Fal`k>9t%9ND{{YJzzle;&Lji>L>Ezj24?sic(`bX_l;O?nE}fx
z!=q}{kla%Y{OZVciszb12FqAm-Wl-$wC@J&8l=G$2kX>1j`uj~`?}n1EOtl449rMQ
zpALno7>wj5TC>A97<0qNyJ%hK0ljMR2->d<>)NkK-Qk!2buQu3ga*HQJkSW<IJBI9
z%me0p9K!Vbcj%X;8IA@PPBt(LSo!8~D5fDxVe;`Fsc1@-hXT`3U|NL_jK^4rjl?xy
zk&{Atlo*9}JoxBh<mC=$oMh$~@jF_O&d0M!7`i|F@@8{kJZv@$e!Y)6sBYl}F09b{
z)!d`)Cp%Cz7?L~ym--OgNwdS<DXfN|8L!ydvb&e?cS$0NGcBhM04^faO6(e>A!plR
zpSp5~<f|LZg7n0}oWKZmid8i~kYt6dFDT0Cej<arqOZx<WG{CDDD(rqF5XhqA@(3H
zIZ`Lpb0qUS&nLnxZ|dUs*&ih-d7c?K6g^)(&BfZ?*T4X-XU}jke8b@z4!f1h{GVZB
z4cWOZT%(P4o%cHC`)27K*h{+lh?e<vUpxgz>PF2m(G}1*ucbTu$}qVDnhjK1t-@th
z!GL^JxW|E2%^y}+fA*d^TB6v>y*O&r^IE^-aiSh}fzC?MSFXV23S6$hkCj}oT!G6K
zcuQbz`rD;-LE+RJ^C%=<Y9kgQ=IDk{-ugW>h^||P=732<1C^3oWoQoLrHAGyQ*)K6
zxft`6aXAVg?yAe@e>*vQ$kbe7oh}1%Y%w%3>E;C&=R-pi`zt~d6+>7Vnpn&OycuYs
zrU#xkTS60MYLw8#5}LU6&_rD&wMl5=QV578P>NY&4V&l}M=2I<a}An%TTqH-JqM;}
z)=Qk?`f-Xr!zoUDFe={9tT8&|UOG@Q#frRUj03k8sz^t#UIbDE*jBKjI|Q>j*tdl|
zgt@d}86v>@2>e5gnlbXP!E$_Y28+{>fV=rimHz7pafdg^nD7=FJ;M}DRrFIIk0u5a
zHUumlfmhl=@v#7dH@5B(Q%F;08R0!q`pH|%AyPyU^mpI-E_k(RS6F*B=IC}<@Y-0?
ztsu&}<@k26KMolQ1#5yZrQn8)Mh9b9rbgs|aI4_~bk2hMPHlFBx2j=Aecp$IDH;2>
zq-MeBXaXwCRQ6Y#?n6<#Hdz%F$$y;D@fjClHr4@sq&Nn|l;!~t(U(Gak<-b0@Gs<n
z7LBwAMGjt`6%|5)2YjToWsXGfXyCw7z=Eh^7!Ut)C*(CLg$7Nipe!BdRP8G7fz1Q0
z(!lIm<tXV?Q7}UAjuec&U9Yo<^zzJ5x)%bIegw4!2n<lI#^Ip^Fgd~$bjjEqxF@AW
zUGG0}f_Nc1KQ{l7IX|>coQ1MLWTzg0I(X&;iEhhgt;lX-&50|LsVe|=381|A7&(kA
z0f$^>XmU1(oRKMduV@0{gDJSE0?f8_8VD(yKoWHp^&*|&09h`beE=%U{K7n&$y@{p
zNRTE{_mN;`)Hxh!<Rp>|1)c3vLj|1hbCnwR!89(L2(E7zVg6(V`=84ySZ)0(^T%@9
zRV$z0Lgl)0M!&_n^=wJqT4Z2K)v6wsA{*gLQ>~AwE(Izm2K}L6Aiir3l_T5xFsP3k
z4ClZ9et$Td!pTD3JXIyZzVvdYNPeW6q38j;z3^w&C^bjWekJ};%$M$5<xNg5yyrha
zJA#=DKNuS$9t+FFJY^KE=O0Dud7*!vY+{~vr%{I7667dDZauw_TO|NUlTZqck$hCf
zCR-H%lyaY-<KUqoKxWJlwFCx8If|80Kt-J^o52BTJGgkmB@#%cMu`L}kw9CI1kzVj
z8^8i-`2Cgu{A3O(Y$G``9mr4dR@b7Yw+8lO=D~i<685vP@MOONeg>cg&ehwmu$h|C
zS$g5vA2UPdWH#Jh?2nnP^^*kH>Of^Alm}zzVqzY&z0sg#b1pK7%i$sghUr`QI{>4$
zePe*D<opIop7}0Vx~W0lBga!P2m&OBx-VH0pcy!$T+bfOp)2^kD*PH&jqBfC@Kf7k
zuyhZs8T&f*FCdW-)f4$}(Lv!RI&K-)@FkB0Cj%T2>n=i=04fCFB5aT5&#^oP9>RjV
zP+1UGBpgCC5(}aR^Mx0VDewqzQ3m+3u4!})J_FQeJGMrE)FtR}WbML(L}s29!9c%|
zJ0nt4#;t3K_wQg#LX$<lgUtp=LqJq;<Bu=`O@oI<W3)b<z@uHcPrE!uS~!as_zqYD
zgA{>uK|`1YYTtmFJz&ru7UT|QVTAkw9Ch!{fz5FGW*qnelz;{?Fph{punW)Nn7#{a
zgnuC;;orbY_!ltKF7+N^ZR(Dku>d?h5!nq~So{$U_O`L;FNZYz3;$ZCR~LN7f}Zgr
z=TvzjeM5pq*eOnyqz72`MT2|L0vWJL6kIHNjc(nYU%fA$f9FL{!SzPN#Ju$av^Yqu
z(TrTImE;BX*r=<VK<L1VhqtLp%~i8KUw<d}Di;_&Il87e!*h2A3;J|a<rMlzU@ZV$
zAU#5&p`eMb{sUB$f%^DxM20hj^2tGBR8yKgtphT<BcOOHIJqHz?HT*~vFQ%OvT4ov
zlJm~0NiNJJLFBkl3Tk0;B)~i@3NjTIIfI4n90sn4CZ!^JDs~Y@EMjqr$jHB=XipCm
zDyTJl6RH`xb{JbI_UTuu!Wb)vhn7-|Q_lSqlNS}iLTO38lnE7<;(@wkxq-a|bMVag
zdWs82`cqLHEY>p`yeLjfC6C85S&5N=RKQz&_YNon3sV%CkJ&OKxj_@<r&=S5XU5xL
z4M$D9^QU9b-%&#%MBtQMldmC*?EdXPF5%BUYTql^y(?Qic89|YaMHy(2+zW9QS8O;
z0mumKZmrS5E~QU;SpRaE(N7GxHwTK*1y2FNh>J02bzFDiKnscGR}1bIs;nUPF-en!
z9}+q<UNX|8QIC?`5U;UF#05*mYb2Om6yh21Fm)R8^&7B=OAUbR%1Z$P8P=%kCH<b9
z{A%XZXEE7hB3B+GR;=cp<1n@7h$+PQ;uD5?#4wg1=M{_?wSVyW&wGDDpp+?LrC|3M
zkSjc&E{>YIx3`~QIIck1hZ3iO{CyEdvCG&Jh5F@ixo$EZOtrdb;V4W6d5y`OkR;PC
zPwS_*X+!~9gZ6*}WvE`4Bvn{{Zv#6`4Y}U%#xp7S&qer)D}V<T*C)9VU#GGtxAWz8
zzTD1hZs(I5`665Rg{RMl+03tJA>Nv8ya1pV3`407HmN|TtKwA_iAfnwWw?CE#8++O
z<n3C-2skil^M+PiRyFKZ8b&TK<ZFp~`2>%TlBCH8`W(pp`a$)*GB0%*PxB!W^^s@q
zd0^^6+kiveIr5x0ECW&o$o)O0Ot(fK!1sh!>9s=Z&3bk=>vp$ZLhA)NN@#rvt$(($
zHCMQU@axC-4;h72?1YNk*MQQGO(ooMJtUdJ9bN%C(Yk9PRC!b50YbH=z-|chdhnYX
z=BhU}RHIn^rba<1+=gyy=)w_s!{tp4nHuFyjq;|(_TSXdR#Y3fsj&(ubD1j~X6|JR
zbBQY)g<D;V{@$7^9F4py9F6h{$NH~ue1r`Wdk}KPOTW9($PhM}|F-w;Mk9M2ND^RM
z?{07b@k4=#koGVcC>Eo8V~Rh~t7BW9!Br;wdtwb-I5A-}^MDNJBYI1MCy-w?lIchB
z%`+dT#HAhi8F--f(G9+cvXLOK<MP5<u=|NHYZyAtaYRm3@WhPWfTB@oEKKPY^AjZt
zDD$a)2(`vXe?*R;__fCZlImq#6^|~amKRKXCQo6!I3&8~3rA*z7~lQn!Z`Z%;^)(k
zCl~({ak}UK^ZerN2cr^6s|cS1VoNXh{0u(BJw)>ss7iy^9ZlT*U&!o@KP3z6-!<<h
zw15KwI2yXa4bAh)Z{JwVowh3nHe>gTip)`L3ifhB<%M3-^(VE?%$}LdnYnUMN{L$d
z=gC7?OOY!@?$JbU^3+7`$z(rGKyw+|B!R+^As47Zmw|vJ?~SFuun=Ss@4(s-7a7F@
z0*49MJYbpk{++tad;&X5x)dGHxj6uvyfA;xEB`is=L6hyeNCo}Tt4+ilrapSeGJ1b
z30x>8Hhrj|g{Ijmkrjd*C9<MKR;-My!1eU8&=sXS{2|=oN&6vM&K}$y-dNQgt{TPa
z?(l-v#SOW`buGNS;nE#0Q=@c;m+tWGcZX{$stvfqS26Q1;|_1+I<6Z_xWfy#x)%Mt
zHSX|co;$o*y2ID+4v%hTTpjy&9s*B-tHC|Ek50~BxLdrLA#^eyZm(OsnY|t)39zkh
zam({D93S;;W8^*>9B@ExtXtQo7Z(FE!w__aCB?PF;7sU>g(kpJJ~Nm@Gr*7nG!g*|
zm~h~5VH08g@GHZqKQ=sohMk-l7CQ!$VBa{I86-fU7&tbuR|aM*rLnL4q43X#-KrWO
zC3xzAFV4^v4~9q#Um>CiR_QuB99iIaLw70n_mi(SAvE5hg{e@j`ACk{2j6M5S9Ik|
z!5tCfCb{bn{f1EpFzO+!`@ebt#-%tpTiu(Via6L7f&6}tx`VxuLRz4&SN-mCC#)T9
zMdV0=mlXUj)F^S7=U7Jcq0dMWOVDgB3MP0=hSZZ2n|BYdnvN1InUw_)OTFfm`J@yH
zJ;+0aBqD|E?<?YjsI%B*l6#>CS0;0!c{c!T0_eEeeRN}95u-~H(?U3dB>zx!#W$WY
zPHySw_F6P%-CkFC<}Ka!#7zDKbHU}2PMi?R%!y-#=@9wzC8qDyf*?*$W1iNL&JIQb
zjW3w-=(_j9xf0>i*fOXJJQ<E;IRVv3oGi<0s7+Uh<F%pyA1=cf8GIpy{a8<2rOn3Y
zdI)thS+lyCXsH_wHcV@ubugo@Ix4yD*(uKnybjgo0);8SDNH$XMaM#hq_(TDxwYr?
zfEjLA*&f!3P%VsI@iVWvrlluU@Giq>(wm=jbTt>;-&3QKwcOHBs)cqA3?oxfDsrt4
zi_+Sko+LHlu^<;JkwH+A=eQPXm_6el{C5Pq8NnGVb&`pW3zwdX)^SmeKA(!PtBBhI
ztSPf;bur_q!m}jT>+JPg!I;&kyU;op1Bqa%kTt9f9v!7DxEB73)<F7`<7eUDj}&xh
z-9V;RK9cDJoFwPt63p~QplUL~D63(97B0ct17>=D;bY!@1yc{eP}h%KYL;<dLUNSo
zq!OK!_*2Gx*{--RC4TE6@LNeo7rJ;J9KY3E6~Cn##p?L2f^M)4;kR^Mk-Xs&za>+n
z#BY`Ot?kEeX)CG?;I~%v?Jfi1YUYBinoB^q3b(oz6}~kPu2vp|t5rg{9umS8+BaV~
zlB<;=donw2FOsX3y)q;Tu>D9bcSsWidh_uBEcxK4cYJ$}94B(V!rBIY4*}1DUlf&v
zz7LyJf<3V02fhui0(e8E#sX(XxW3KV`o_Gi)V<AsRfyV(fJhaAumb;7dyhM_gttU~
z*=YYCduxMT#c@u!Ftb4gY#fV5v3?}hvjk!#%+fUjU3-SOj*hkP0inN_hglg<9cPtE
z4(?E5o>+tBHehrSZ+<-r>5?Q>+Ohra*P{%NH22vl^E$)_5VrB^Fztl|Ap-a&xFJ&x
z>eSHah=eCsayP@1_cEw1e^kXlBI|*MWDbkDIQe|VkZ0`87NX8rkqCc88%y%%hF}(P
z&$O6Ehp|HZWvVnyfi5NTN)-=>q{!wK1r`BDS&$Be3syWciX5H8NW0UMOtv`K&qAfS
zMy%V?TC{{6Ez<dUldH1?NVA-t`X{vv<c&6GRVX;n$6OimMyk6|lmNj8fu-_RBei^(
z0+TMa6v``Mh(O!WT9~m4O6y<N%D1sK4}>HQElYwHg}jRlXGl50{;*Jna777GmI%U?
z4Oa~JS?SGXCTLN$Q_DjQ=0F7%WL<z5%o>cO3shQBb3nR4$h8isaGt&l>}mEK$AO}Y
z$d^E6Vn<k>IUXMEBMHD<0R36imuzfieZSFGfb&nB#mL0nzwN4n*72Np`6xx&0$>yq
zn9$mkFqGwDY^Wr)@o8O@#4iQoRB#2ubVf=sf#QrBW0=koUWqBtFwNo4g79(|V$TJ(
zpt{myJ+o$WwCn90-CAy$oiF@T!YfmMN_ge!pf0A+3P8Hv%}1lfX{xI0>J|O9uH;#3
z>s7d-6~V!Ub=HE0D}=O;XF<zOaJPvZXk}8p5?omrsQ~Uk3$F+0cqFMia-l~u^o??O
z<fDNrlfGy4x;{9#vb8F>QZ<Uz!IcF)(;EU;>Y@X9!zH*<rbY>_EWwrA53bZ!R2v0X
zt_#7j4BoPpi;Qe7fwwH&>RPn=*5EDMd3eiqiML!o-ZDUeoKU<aM)bOxVFINgnO<1~
z{}z4<Th|K*UA8j>Q0B?)1zonYSBxY9wiR?4-nC{+*d)3iaKR-8V38;?0FJcb8^Gog
zMi72jhS{!xb8!yhLBV(v8i!#2(mNXwM3JCxlclO-)(-FyQZoh(U13e9);$0|11tv4
z%L(Q<!_+W=k8TkB7W0t8cQCvk=3%u)b3(uDvFcUh4&`(-GA3aEVxMA#C@K_@q_iCP
z0-{!!w*zDEO?;?^!i@!a7vVAQORCdgN(VV*t2uPy9N&9nv~NUS;SqF+Ls;2|q5ETS
z|G2bQPSju5o6Ny^A$110g{1(3#`%uHLiZE6dojJ+4bp`U5L`<(eE*s?gv9f0kd$=*
zQ58I398ngCJOpcpn%3*}2TepKpiv@eUPT77GAQb)M~<iNEvDNuvQTbO?JO|s`MqaH
z&(T5~e<#4M@i!3!HY<yr0!<M4{;7BUN?>NLgfm|0!N=t>7-hKctA+_PQ<u~7Nm!N0
zc{fNWkuuxk1c)K4S1P;@A1$Sl1&SWMobGT~p#pU^BHs1vrV@624<TV@HS%JHZ<zZN
zo}z^aGXxTBGC;V(JG7}Xl3(FpVPzDw2<;Jl1pllWAZCr(!`6}mlNLIsD>TwDE(J-p
zkAVuGkK|;_MGT&~0OhHckwgfi4N6M9pQXI4lx^>6WY<e_#v0P;rI{@!n_i?{t69of
z;{6mbBaZ3CJ*Ga?;=*iy(28Z1S+ERd#pr-!b*IER2DeNZ%qqnuWiYGNf>|}nU{)bH
z%3xMyFsqk{x4?bELqb!ceaYG&Mk@xiQaaJ+!OR~Y10up5Wf<O2g>n-L1+HR07w+xV
z<J}3*tk^)fAybT2HOo8j9ZD+L9Sq&;C_S;d!`D-Pj&rG1I%f8nP3J1B4=pwF{VxM>
z6~?n8x0TtEqi(zgWH~URn-hwX?`(^PofI~-4`g=3cAMt}Q`xGFw7d%7o+ki89{B-r
zPB>W?7`)_>yh*Ujr_VVRsHIyjuP@d+_7ow%QV(%%6zr0Glz5PAUB_bo(y>HImkK%)
z9vn;5UKLBE8pY~ZqJj>W4Pl9NonE}*5=$ggqr?)GSfcI65@{={O<{=&I^mW<3$=4`
zJ?$mXLWNshi{9QEv`{AxEz~K|LJx=*8iJg`1ed6xg-j|0QRdC<MGbYb*M=kkUNUNk
zgIB`99ZZy%pJ_Qrkx?RwN<>jXM3G_WB8m)SIZV-Vh$6Y>gM%U#XZTZvH~DnA6PCrW
ze5{q_07nT3j2-|fT@C1TCHEicmJFYw@Uu&}sfA#SqM)Ux4Ox2dj8;_c)CeUeXt@|A
zEre1`jFx~WJ+c_Cj!e=MCM8m7Z6dXl94&@4mC}@!rhNPoldN0>Q#O8SY4lPx&O4&Z
zaWIpS=o<UtCcsPyCXPCmiF2YMsVtBkn^ZEPPz!ljh6%Efl|ZRfj2Wh5ed@6NiTbF@
zur%UNnf32kXZ<UIQV}^ypi~KzO8hB-QYBET1WJ`asS+qv0;SYmB=ny=I8dsyDo{!_
ziq(Nq1$|5#0!r!n`FO)6P)epo36v^<Qri!d(pFT@7%0`rg*0`R07?~ZbuD^(Yk*SS
zJfKv!1WK(1D0TkZPZ))N;9)%bk#S7Cd*dSz`h`bM>SoB8%y!$0f$C<f{Uial6$51n
ziGWA<270Y%M56%o4-~KsHhBgh4rV@Hjt8F+^De`affZm1OB&wD;LTVdBEZqquNTbV
zzt&VvIXNQM6g+2!1C#1qBXo-2&w^(HA9aC2gKW!-!U#=#oD~<ECz9d23Izb-fgh!(
zqAF(7eAB3MS1krsnt>tx3oNDJw}G+32*_8EBNs6?#0U^Qa62ENvu@x52H+mYGPdwG
z6{hcG<MOB1mgoM?x<8oHWSIkkogcuYe8Dte_uw*{k~?cOGN!0Qw89r1!yJRZFs+d&
z{W($qdVCzC`C392{W2e)4$o&!5biC&Z`kD7DBt4@!SGn{0)!xmJe99O!|^<oH~i5D
zcqF5h_Uq9L(a`HTP>FhQMJ7(z;ot^{!j=w=U&svkoSkg>E7|3aXbQ}&a%k)Vja=gF
z%5SBtLlUJ<CM?&f^p;T+UL?kOKDAFKNPJ5BL%DPEcNS!ROHl03hUx4X`};I0A^cMf
zl3+=<M5mP415R)7$i_yNY)*V0%f<$CbbHP7b1{!EG?ZBuxB<!rGmunu>1Y;}-B<LG
z(M{FHD+PP-S)tlJ)w`vp#k`@j;Q4oz^c<+aqezREF+}LDx(W87DACY}3}-$-K&M8?
zC$aK0*U&;ba>!FiNJ-wt*4Hb4SXsyce^!b6_X|0p8k6f7{$&x}UZwjO$3|ofv%08N
zi3`Kt!=EA{T7K4x(9%#}<K3nRE#`B{hof2(Q1px5jkZNU*$Mdwx7ZY&M~-1A_~L$}
ze)<!(L1E*_xD_As<*SPT;0O*1&XMN;;b&8Sr0er%0TA-S8a&0k9zs_<!#ESaetiFs
zl#1!n0_6I2s$!${1e!=bDlg=(d?7!1QpYpugZr7ftNNK#qgdU~RPY?XAwQF@ErmB+
z`k7>Elzyht&$Ru1CT&Hvw4Z5pv(hrYrEablsJn!3sc@@n(bZeyTk7TcmU^XcX%oJs
zGYq&7A_i<a^I@<4!d*<g3{jK0Z+l%#y=;x2B*3=1m~606T}KX;2^R}Y8Rf*CO|pLp
z(^h~>2bdMQOY=%VU6?35YJi&s8V6Sdznw3<O6ZUpf%9gu4=L=x*bSf$=rs~vDE4XI
z;UaDvA?wB)K3E)=yvCwZ2-f1gNjYe`!a?(K9y(~mBbwPfRYU2u;I)N+<gMpK?O}z)
z`>;L??7|Pne@L%m=J|9o%=W6@f(bwB%3i+f2m6yU_siC9g^^!=eH_fF0zZ_e51+*S
zA<}>;U<cV%JgcfL-S7VCcu6<MI;khkSi<j7m|kK36vPVOEud61zNN{OK_U(RO1uJf
zu>1*&?WcQwX#5GR<TtZ@6$hXLkyRA^lq!UeqEd-5NQDz`5|c6?jbbhwspnHQ&;83`
zn!<5cOLC}+DN*zDf=P+FqfX9PBv2aJ^d6=+s)l6~FH<e8+k4YHE`2vo#CNkW)W~yl
z;2e`7@dEPp)}mXo(u1S#mu-DxbfnSJZfx7OZQHhOO>9nVCllM4*tRCd#K}YxyW_9t
zocrT`cirwE-A`B7UcKJ^R_&*2@2ZNjk6KJjm2N2g&0xs8iKox&LpIjD7uN0SThrzG
zZ+g?!Z+d!2wG--RL%9vQT!GVDpSzge{83K;oZf2siVj;_Tx2EYwY5e4p)mE1mDbAB
zy4$^ndjX!0#js{6WTfYW{9IP-Io|a|<Bsd{0#XaMUB?FCo4NyFOj~O=p3)EmPK0RQ
zV4^A5+(KoBY=nT*#zK>bf9E!bl`a#3N8WJr@kDgFMflHUNRe*WfI6qul3%_7fsO1Q
z`(nE$w}*}IxA)&5%m#5G5PO&VpXGqoA~L6Z8S&g$q9Bx!U`mTTCnAF1n2Sd-zFoi!
zb3=m^obDY=!k2Ucy7kiJ(3L*$)|0*Tj$$;-B&JP*c&SgqUPp32s8f)$y=aVi_A}*)
z-c2;(yyXy`w+0RI(WWzeNY`FF|J>JAt9za4^<3539-4tu6}+5GPOk2d%VDB}z+Tc1
zy}Y|FkTOXh!{D53`K7zI9~r6mo?F#I9k!kQ)wa68RYP$avi%;Pjq#kQ%6quXR<~Tr
zR*y+>ded2NRZFAhM@B5MbtWt0vs?VY2c^RFzlAv_Fu(i=|NFG>8iyM!F*$;2;EyJT
z%!s2_oQy<)po_$T5lJ`h`Af8<cZ?ZLb$>K}kmc2ZFW*Nu4s09GLt)+e>^e5Kljh>2
zwhA*dtx0E-ZL|}Dy;PAhk!u*!)sP7I1SALRfKks??Kn*ceFN1YgX}~z0xIlP&bH6q
zggg%Z8B)2>@RWhsdYh?7RiqoD0giP@dlpPcOu^)u;O%<UOK9TcGVr%NdwE0@?YY@X
zcH)Eph#(EmFF+XC+=8CBYvAkUW<5wd_>iV90m<sw5c%#GTktG6V?1TZg;5#V?@Gyn
zUG_e1yka~gey4#CRKGwMlyLvjRXb-PB9Qa}HX^mCR20RWb+l<&9Q&G&5+(Vb@+~8)
zKKeQbZM_g5h~B5CXY#2LduiEPq_3rpEm1}vFgO+yvyiHagCpS-kSE3yjuhA$SE0z_
z5n1fK5WYV0CAhVo3a|Nb<6nUr;wr7)<4sTB17hZnG3FdWpK&pt(7q}s3PodFF5cd9
zH386>q!OZLwGt>XmC9*Y*$D?N8BPQ}=DApl?*97Z#-d6D;AvVS^)8gMm<Kv;gJo)S
zTt=>6Ge5Q|V&!@747_wqg&UOSy!}zA5<m?#n7xEdjo2%BAU7Q#CxE5RHHAKy-{0;}
zuAgt}XcxI99WQ8!qKzc_QdBw{RTRGw!*C3?!uBcp%CLA4Wk-+nx?*vBMpX#c+=u$l
z?92;SK&04H>{iv}(^ltF#@xw%*<SIv+MfOF3f)7KEQ<>99;IQ<Oo6Z0IbIPb&q!1$
z)=a^#{4rZg;UQQQTI$=7(uL=4Tg%;`M#r-doj3yaIp)WqB|;bbLn?a07XSXHH=-;x
zC0fg5k;L|`-8j5Q`(CdEQAY4pzF3;$oY=m=5K1j5+;UZ;FOC9S6_cfRam}Th!N{$`
z$WcybiZz*^k&cKsE@kvUpbje`%YoABuPB>*b-#~h|3N`IU$U;or%4lX<M8|}cDF&>
zI(6@yn_8KNG7s}&N{JkLcYA>WJa=#SJPDwAUDYA(0lD9F;ri!#E6o$vJ0^-qdpe>+
zfD+ZTvyT$hz83Un)#s0%v-t|WCfBB0fKds{*NE1GtGt%e<P@WBC#By5qi*1xdEN4O
zYzlGB5^<#TLhbT+ZP2a4_?f`?9p-)HM*azf0#+VeDn`W|7Vp(-1YV`4fKGMe;S^GE
zt^RELs*MtSe<UMY_q=F);T971_&S|qsW*fs2G%Czx`ST6hPuYquCCyE6;7o{^AXZr
zyfE0cfmHSHvVJ1bT~~e=(;rs${YK6<#+b@NbcdO)7Ab!!x|Bguzvmo{R9#@*<cpAZ
zUKP>5eEWm2yUEi;dlkuk|4lJb<a_8qrC2<3gyiIm3It|r3vv>-zF9HQEoW7tp|@IQ
zRUUb0prNLh6?0v-YaNyX==i{iWhi5_R=9YSJxv|Adta#Ep|Ll3w@({qzlFCa>*i^t
zN6zBuW^~m;cOz!?K-IU(m9DPF%j<R6MAr=laJsq}$D=*BVr{MIHzF#S9@Ab-gYv&f
zvpty(dx3#4+Rp?F`db;ZJ<(4l0MDF+`xE+}tv8G<jR(T!TL;=sJuVN8>K5Qp#@*w)
zgOyO)MSU1Dufj9vP>Ub#6ySU9nGUDp1tdj`4roP4c5~z^pWO*|{}d>(=UEkGxLgzJ
z`4|@%m<e_=QCR|QjiUT*USxXaahQz*4p!~-&VN|ow)V-^H68%=y8vt$92r*&FPM<2
zbSzDs+=2F$;P+?a3VmdpRmMbf<{>^tea)`P95BghE=An^JbFlDyD(L0|EmNN)@<n1
z;-}hHb@pW&d;#qTv)|h?CUhD<+yFwfdZgkYNm#b9r9ojejt5F?2@z;GmI!pe-<vQ~
zpSdA=hV&nzF{8+D+BTecgn;Mosn@_Hku)qW`BJ&XQDc*+Vm`pwO#!^W1|Q=$?eq%@
zPeB~iO(IzCZ=ePKMD!Du=@$c(Tt{j_-sMT%KSptC<7NoPAtb6m{D6&@*}_z~xh~th
zar)PprEamq%qDSued#XJ_{ou0Po-m;rIxBm<a$fDfN-pPi$26@gumM6w}=)%b?))w
z>7ckkWAE@G(L|rZO=gh)RGQbpG?DyM15t~ERmNb*Y*KYQBnj>nMnW&tk>q4zd{1-y
z&Q9S0;^vq--h9HX>GfM){}a9ah@0)#VSHrU5jW9nMt>9x{pKAu$EQl0|13M9b6d;N
z^fHa(OBrL(x#LS0pPjD$XSHY4iDkF3h~ng!qY(e*$Ks*f`qgaR&uwluhv(Tv&wkI%
zkM1hr&+x50rG_e^&KvUk4|vWE>dqwXwCqG?Zsu)^UH@0AH;4A;&8#Xj7&DOAa_KAY
zwAtVdU>X7>X6$8O$M&e*+4(}y^E>}9o^-QBSBz_H|J$$j=f`QsL%F`M-Rd`_+>2gI
zAF0oz{=8K0F?2sW1O8~upKfznlDe3Vs%=~xRcJ>%Ld5FNx=#yFvQA#$BqC^qG|3q<
z(N%5{Sg^sTQs6dE4c!Zno{)wG-=69kkCX^`@_6%O@G_oug)4r3ed0!f&rfnZ<^Jvv
zYggYbA!X5vX8oi<w6~EHC+;Q=mQ1=BA>*LFO0B!&v89gFf$yHtiwgS0Z|B4V4_LP1
zL?z!-ugw5quhl|WUrfyJX*4_?A$7j!;q5xNgc5E(D@few!s&xdz^jl8I7BYI<VI6p
z*t`02l{%jpgq#Hv7ieZsOwjol9;I~#o^EKh<4S{zWdE6hvsxx0gPXc+!(l`R(oFl^
zFMx8b0|9l!R^Dj;+i2?Az}9?4;3K_(tAeZQ)u=iH)^w9U69WM~lzej%L;B<QVI|_!
zbQ`nZH&qiin`MawWF4G@R)}WAv}92P0^T>bdM1wpgV+#+dZDml>vXy{14r1oK45XR
zkrlN}RtWW?YwP`d!PU!!=k*IoUHs1T9$uz}_IT*7VfD1}zu?_xZPE{CR|{*V;_=+;
zMAyoo4V&v#N1=fgz$mog6BPH|%EYUz%I$5%tDdL^e)@3|=)(}i;!1SwQ3&CHE_Lrh
zc|O0tS$YXH^#&`U;tO^qB+Y0-SsmU@&{vyHw3li^TRm4J%pACbXj5?!GGrk&4jSpL
zneok|3WQ5*&QhjZEPMKW=1IyZhJp<|^`NRHj<AdDP2r9^*Sx%3?4!i-TmK^A4BPbN
z*+Ss9@_Mu~)Xf-TO(RH{!i}~ezmn7|YiZ}^0<&&6E<55`2vH>BO!2?bZt;P&cip0h
zfp9gavCK;Ejlu2Ybg<QP_~<z0j9+O{NJy0p(Efee^ZF<GRtKSoO7wu&&}?Q(2tsv1
zhD*xuAoQ*Vp6-%A2;hIoj*6OkDp-rs=yG`J(F97L;i{PGKym;+u-WybdW@KE<{^Q_
z;2Yr%Eaq>x>4D#0>%mtL<kS<m9U0WH7UcB46^MTPL&(;hueX3NZ}yMnM?u!)?Q~|r
z>VCg4w~%wsXQ<{aNhZ2)-zPhbeQ19Hf5VUzu6m=%$qF{-Il0cIhp1M}ho0JQi$%WU
zXe}{i`XGq=SW_p$`Uj*8R`e!X@s2_~PL4H~akKEi@<b595c9ZLN18p+x2_&~<KBr`
zw`BWF&*W6s#;CGO$RuqGB8=pBcpqIU1uY~9^SOs42ZNX)sMfm?3aP0P_fyAZ+hVX6
z=JeEKQ}wW)2Yz`TXCZA+G>!n>Fyj}Pg(2;4K`zh*o)!!cC#lqa%gqzti5)xzJSTd-
zPK$rR<dN)(>p22mv8{I`^gApkY0qfcl_DlN$VI#0=W;g$zIKQ^1`;GI795P)+q~M&
z_cs6T5BN#JU+wgK+v^SAAFx%JhzGCW5Mn0aDM1A;qK5-?+;#*VV<DMD&~sf<n2F%Z
z_8s+DS2;s#a)*8FORX&(*PjquUj1VMv4a7({0P0Gfsf-gapz-4@!A@ran7tY3FlYZ
zxNDHK+6F*=H3F~%vtMZr^;*{*tdRSZe*r)#oC~(R3Wvq%Bs@E^+zF<Aqckl0t%D=g
z{nbchpIJ83qT?!mR63Ihrd*y7^qo|t_}y}U{nqq&$pDeMvuPdl=t4bPq#-@<m^QD&
zX9F8iB7wOq=Nmku@{#n0_)l^C+G*7$^1A#=@uG|r#k@vS#e63^hujCG0}$#qTp#K8
z+TIxb#uM)@s{|LWR2FzqTAD#iLFsh@AN60!XrpVlkg|e*9en>#9aeKO$_zgx!3DGb
zFerac;75?C+-~+LS<_t~6SHkI=>{>A{WZj~fzj2yS6Vj9mMiV)4I&~}<6!_!y8^EE
z6i=1>;R8<l1`n>bn3aStBWvq#BqBG~;I!j_SX#MN8Ip!4qw7mTd5)(kkd(5brojk8
z8D5Y+XU@lND4#R_U;-BGssc_k3P$4&c%l=h`4)YMsVRDxGhHoC1FadMLbLlEwhbPJ
zE+>FTV1y?PY@>d@^k8N^*Wc<1`beUl8dEV}(eE0FLxc_Gc987>e?jrb9uBhVx$pEN
z9vrDYDl6Cn^v!Za&PabN^(p&Az_;tU&M%3?25igDvIdkD62I*5*Q(ivu{oicXQv;E
z#N)n(tpdE9)XRcbp4SMwx>{SDE^VF85%L^*n_?^U&bkKX^hoi{(2w9;)B(wU&w*56
zmHvVGXJ2<IhZ9WLA|y$%yU7$7=WA4Zafv8|j9PG34ysx=H0-X9Z8Z&LSOs6lkK;J!
zYt^RtZ$DB1-v$TcL8SAir$0=hK9|9+bEpZl8zC4BKy(~;tm8J=6dJ3V&VL@4k4~Dk
z4w1AW6t4Pb{4lVUy)OvjPM<kr_bH!Pqi}IFicN?L^b3)sP9>S`fMSGEG2~jv>LHj-
zyJ}vCw7r5c<3Xny@YUUufP6S~D3AMbE6a{5Qi~^7S$e?Xger@ecf4mdFo;^oT<><0
z3*FA;@6LpVyCo!0%{utkG!$Bjes{2kbucX4H1wY-!IlF}Nr9yVH=0}DJQQe33XNkB
znMCL_|4a#1$?~-pizRDlSx#DOR$*;XN{dhl1Pa;Sq>;x2MGNZn0PNXPrA7NyX1HVP
zHm17cHo$6Se{h&?I85wfRF{YXAlNb&T);Lzq2AYnATzNub~{*mN^(vEP`UT#GR?$g
z@;)@-hT5rni;BcjZ0lwd4B0T3&}W4g?Cu>inys~Whqnxl<ArCRHOFn!q0P{??J%d3
zSAddkb5vBov`^18hjNs1+{$3Awrsa#US_GYM4+FfAw91*#aPRvps^SGU8hqC6_nog
zjnPhTVkVnDu&?n<EkS24n`)FHQoMdHjYiw5??Tm3(uD-<Sc7TSh)-(RN|M1>eu$Gw
zP!{oKsH0xUE)agunTbebnt&OhX@mc_^Fh$LNj)4Gccc{k%zjTu&Tu#=H}Fy-Zj}Nr
z<sQ``w2(8fGO~u#@_-`Z7K5Nmsz<zUNUir0epxl-ZfRrN;?3-gJ0qjN8wY3~Z}onT
z*dD$MAdc!;*Y<{r$)l&3&cVMy*W>26a%xXepJ?)PvP68t6e(DCjE`{Wg!G&=AI5@5
zq6LS9dSF>FZ6qPVE~NZM+WeCEtFTna26%6Fy|4AJ&STi=>OjW%{DwO*Qr6yj{Al1V
z#1!>;X+o@Njm%&IO9&)}Fem1LAWlsSjGSZ0g5hW+fmdyg<<umh23J8<M4+BE=AHw<
zMwXy@2Dqs|<!y3S4D)L6+cb=8jN{&?g+HPbsv^BCVuB4qY=GpL0$4miQra8{$HhTJ
ztY4X;2D`{hXB_4x;aPf~P8p03AaEeep-ji1Xl}^RsI6gKzALxf!R0!<Kw~);6~xQ+
z@)Dbs6RY-GM2i1VE@hA3gO_nHM~yBNjm1L-?Gj16I_i+X3ix3UF@8EOw@0erEFnY1
zN=g}zkR6TK;Gc_{3(H%Rn?o@Izp7Y3&Z*Vod?yJtLABsge&M$wL}BYnB!p8>1v`N9
zoyci}sZusEUvLCjlw>i3Pc4`aeG=uKC_2B}=;XM@?Oqdaj+af(GT|8Ugn$uYPS#w^
ziHExE)@P6xSNO%JnKQS<wIssLj>r0JKeyIi<JLt<iCwd`5V#YhjrTh{yS^;kGl5!!
zf1I;L9iwIG1D`?aQ~hQk<XT_lH4wiMJS<E;v5v$05RPcDfFALE#4<%&Lo)eVt_JCy
zKpPhjLTh?UYZ}c9YDKXo3I$;U({B!qajO^LZ2{>Ys6haR_qP8{4sl^B!tAX*umwq1
z(#Z%OSHi%AK&%@@mr1o&=LhAS^6gmTs(#HgLON7?{4e`!CgDA$wNIJMCFQS>Oyq*k
zf$8q)XU4$o{WZhD?ZdTzK*7B=@j$_YHS?a&g}!pnJ-N$)^xq-$t>D^r(Dlnm233R|
zYWyyOMsH~QBIPE8Qcn!~d_Ii7x4tuAJ>rT+(CcMNkWU`(c7l_@B9>No-HgXMN4KW<
z&#stU_~UgpqYc_sfV!E6HbGDf5bFrP<K8XmKsmmNjjX9+BX<(}pfwO%A0R(_22X?q
z*c%#EMGXhN%p>XX?sO>yIShxAf%&iZE10E=wp{QFkASQ_lI#(DcSs0*3LVPO+-rg}
zL=EK*yBQV5eShx(GewR5Oxt5xpoh&JvDK+COv7eZ^sIf)xhBg9CEtHlo{P$H_kq>P
z9GrXgF_(tmq>XRXp5_X?mqvclv9*QhB0DA8PIf!-M>hT0YW%qo5|q<%>?JzR)#Ar>
z`rL5s$h;`sLG5crioVt+LMLM3;AJ2GG)7@6+{5YKVjC}=7|izQ$gPrTNI7k0@%N7W
z%K!xHkO!CW9lD_Hf``W6hDRXD9yUT8TAY$Ss)wPcu7?Jr+-4!Glopf8cOiub?VyM*
z*r5n;YI5A-JTawXEH((QkJN8V206OjND@;Q9FS93wgnd9h3LywBKi4vJ=dIOC-rL-
zg@^u+>Jtg;s^Xzcj)Wbni_1YB_T`l)HWoiXMwAJzTCsN;QwC-R0D#UYI?B9PA?bQ`
zQ7$*NgaI&&Ns8zW9kqEdrR_-Eo~}lmca~>#s_9U44vp(6X|lknFg_44s%2)y^t0as
zBmn}L4HfIM>ZgT_9GV&BzZJWWwv}vIE1#GC1Xgd#Zg9k3R~%d^blV-=j$Cr`S(4>A
zEDziLu4|ip(xj@z+c*AnY!|F>#QuuokH{{$E!i=qy#<`1zR*(F9vq{^k7tUZJ_5QF
zy!}UwQF%SmIcGGDHK#RK)~zf!*urn=8CJX_WHo!}j7;S)`ZJxV)1lN%@mseBwbvc5
z2T9A~Z6~s!i%xRmO+*I?F_j&NL&p<5Y#uL8OqRNW*_`(7?`3Gdfs}(3T7V>)9JaGA
z@!+&&qh>TEY!-44Kq*+R7DlizaTl@4;4vuwx~V22D?xe(iNaV=pFYN$6?<P05d-~w
z3T%$-1tJ^g@AYkb#OZo%vasglyQjlQV&ci=ch4Rc>J|>FKb~UpK=PzygS#)i<8b-C
z+_l70tR`<hV+WQI$ew!8^-Pm|TDKO|aExrdTC&gd^t@VDpCE!-Ry{A1w4%iE^htL%
z!LboIl%FaijU;pLYcBjVl0=Ny$-MoA^*o-NS3T1|egTkk!7_5eZ$zTH_jE=LX3aj;
z7^2b?4c$@C<<+DU3yA<luuNA%quF<;a*(m`7eZfiDc02DA(S|Caz?y|hy=6vUw$W;
zxV=^`G`i3t6Zpf6kVuefboE4I;!X($=+tvfK?AB~#4y@*AsKDo_C=YK+&W^-$N$88
z{M9ST>N9+^Uk}fX4{-MlLuCk@{{h8O%(ZYr>US8;^{PBE#twath*Hx9j{G+y89b>%
zRM>+ihxN`k=XVGw#olVWsFrhHMA1+ya`?e7iraxSjQ0&0F(^CUKC5G}VJ7fGsIwz2
z2J>$cY({Pr;JI3C?r}CN53yYL#GpI|==Oz6_;1!iPCHsXe7_oMmk0T4T|%J;4-uV@
z>sIz4Ko4b6m5bSHX=c(Dk)jt1rcAP9z@T+DJjB8d4l^nKMygy46H&b)?P?`nWg-74
zhdq{};0w)SkEYXCah676^fjS4v1j~@F5G|tMgNq;Ihv#2;i!p>y$>IkfApqJg+G<l
zH`8qQ+;ed*h$YP|ot<bgok>OFFz|&DjMaQ6sDk+lI9)8>23TI+pD^23#Ru-kA4EmH
z$%6gP(&i~!E8l6OdeT}dv6!`p42*nb_a!z;fb!x<H=!JAxJ~Z!5X^{H{t@>#>*B83
z+6V>MRW$QhWsNBQ;solW9Ur9YKmu>{1w_PU>9<YvMl!@71leZI1*D27uoX}Q!U9w@
z0t8lmuJ9imzpG2M%wX*z2<+rSrxD>ICCq*meP<g<!TMAn9KN}>B4u%1R-KOVwX<A)
z^!}r&v6SOHmgxYuQ=kXgKp1HJM+2C5TH9XMn__SNn{4S^rz!jFp-M`jNUo8o2t4G*
z`4e+tvefs%M_Qmdy#$V48tZbprk=2s+FshR&U1OLg0L0ww<>?CC&pQ8ReN1@@5%#>
zu3MAm$PZZ>p>?8;Mm&yeJy<Zx%2l_!Gu|Oqr0q<p7N}c)+cYu87OzQvTQy2o&OkS)
z`wU<HE6L2|j75PnHKq22zw`SUhEAG>s@|!3R|xffL9mJ$<pi$25fy&|-sC3@-<AB<
z(UY(qcF%|5Y&W>~WUQ0lMx+$%slB?PiI@4;!9XV=NA)@uL<4XDKfw*~y#riZ%1no7
zT_XKhy}x+t`9T`wvJgoIcs#t(Z8&?ppvVD-b5Bq~71cRdKE!th?!k;5-<jt<Ddy10
z8bmH=aK^psd3Ve)6g_Q7cfK1P{%vqrkDU~Ip7SzHvay(X@e&yscW`2udv0i5>v3|t
zc32|{UbzRM@K#COXm2~Y1g{+4J^llcH5a+%6kIj?YZ{e>9b*Q+-VjvNX}LbQm40ur
z8_deMBE}0UcQmL-FEFTTtFGn57-=eF?YV(-^0`6t?Gy9hO?rcN!I1|bF=(jdTqgLb
z2gRw3$=!EZ+cR!lGes0caVJoiEQ(^zmxDY@$@Mm1rqy#|7VtUH;&J>CewKo(jq)pN
zPj&qLQwP=cV0tf%I*AbXbe6Ds$VSB?w1orhxSH3N@Z3c9r-%f+Yb|_IKGFsFurZiJ
zKvdm09tLcxw;j}ieIV6Ax1Zk(l%xi_EJm>`37ote=C5wha;Zkk@M!MxJD1#;VY|`F
zb`taZ?5{ttQs@tm&+F8}I}21evWG!`JeJ}^s0=0Gp-A$-S76F3rpmBlwuKxI8DH|#
z1ex!8sJcP_@EMk2_(HEj!XJOzM;3Bj>|?^YKW~-^17YL__<>9p>xYmF2<QorgJtgy
z=I6?+yZ>^dAq|j|DvAO~$h_VFTn^)y-gIbDdPDkHoC(%$ug0DcOP^})2{<gga6#zn
zUeka{a>58j^@Br+*I!}G`KQ^ap32z-x9`Yz;fev;<Rde)%~a}ekm7@|H%Yc3@%&AD
zF;hr=`{%ZcOJxS|He|Rm$LSm%Me<%ZRZ~-3^ls~Vk_;1FX5sYFAiv5D(nrwJ`gm|x
zgKf0gYZW*)PMV2EyE3dbL;2*MGrz^ZN|3M>tq}BIc~^(7-9pSWVAJ+sljXSvR|mV=
zCA6z8{&+y2>PY$dXLF#<K`3C5KS?diy~m|VR1oc(#@68GsFe*nS((lgQ7}UNFY{qG
zU<xX?<Ju^Q-WCa8{wXT9ZGU36B9Q}jYI@_1?kOf3OUpQn6%*8OkI7tsLv<R&n1B!z
z4!Vm11Uqt~9ZPeliPf}2xWg>ri~}RmjKYz4APallOJ_*7Zk<8TKHiK*r)pR>XIAIC
ziPf=3wKt0!*OJ5N-VDd57XDmrUei%HyBF19Ha};sE=;a$w76fdeL)|#axYPHC+bk=
z;=pl&=#e^PqO&MHvcr`I?)nHW3ja-x=iK0M*b;uQz<$-fKq5UJXG}QvLbXs|q;s?1
zt|YzDxu}GLOUb(*^sKKt50$c3F6f8FAYOF!b`p3tTgs_h%y-Nv&7mfT#shl8B+AZ5
z<nxnY8c7c)DDH7TmR=k8Z{;H2ie2M2(A={!)^2~WH~Go|OssO**iYG@O>_zQpIif5
z<TFAz%={OyqrW-vlOsHuz$hONVutH9A{T=nS5eZW;4BV+qt!;JiovKQk4Qqxm`=zt
z=s;uB9^K}w9~S)SLc^cHs0`iQ*%gE`|Jo;5{mDwk*5sCrRY4(EZX6F_t4+*Sj`a<S
zri3~C1`Rr`h0esNxN{DYl&lCs@n`7vpe7+d8kTfwWEfXFU6*x;HZybRI8aMqwgczX
zXYQ(eHb9H)ZN~cOg!`H|lKX=CP1nb~2H+tYxhT6!GAAAZTCG}?3@snM&N_2>wgYXl
zk^Hxuu>xfxCN?A-t>fIAXBm(O3AQriHa~z4s>+4MGl6GXP0Jw>jBgfnIu^3RYxW$x
z`=A1;k6r;cU|*QM$BL7&ZxaF|($1pb^tD$wwoex|e3><C&F?n8?}-&TTy{q)jFh?h
zzU9(UD}}q`5<gtERr#$0FH%2{fa#u3QvfM*JVl3<gDHM`Me5M1!og>uV_Vi{%PD>g
zGj#0sUUuY`Vm~=Oljv7I1b00knSwrk?h+3}R1@W8tmW=>%PD=KGY#FZ{($;vj~pN%
zpTDk-pn&bUU$^2H!Gz$1U$C}g7&yRK^pVU|QSb@QOf2*flIfLst^eLN+|d2rHQw;{
z?mN&B`R+T?Fz)?P5}^41{hL$fx#!#SWNEm5Y7w)^;aAZ?f0=KKb*vz5itV4_F{WM{
z%VYRzIhVmSI=N_vqqLk<OO#50{DvM$H$7}x<Srn9l7COmRati(U2zAod5SvE25Af^
z#^%xXb&8Z_m(o6yIFl?z`sMk<{g|YrYB=t|jqNDSwlh=-lDH=PPt%V{eiI~=o+hlH
zEADNp!>_jy!<r6bM(i6#+*kZy0DbNbsbzkJ-eHW^VVCTfj9e?{WEzh-M$6S%i%KV|
zn6(+SYm#BKOA<0dcG4q2I%q6`(Bj`6I-~ri%#nGwsvnwAg4#ECY1cw8gVaja|CqBh
zVn`XsYQ7s+XlJ{v;Q%7{O$c%@%<w}*{2=&1uInwFUoG01T!(-IePe)1HfJSiUrde)
zE&v(*LD%FA>D^@-q$ErsM7JDTXzO|)m+fwQG`t;1i&cCfiyjP{Fa5l(R9>$R3Li9t
z{zNV={V2ds%U=nd!mlrKPsis>GZH_WMlQ29s)&hPglB!zMo?Ea_iAN*+@RGrQV4KH
zEAP`b{~K=dSMUoJswlR=(-6QG`PIPV*=Ifft`Ty`zc6Kf;&(JY_e(TCdxA~YIt0Wb
zjI1-@45By6#sBf08reECCf>`ab4NR)WB&1aomfaw{)rpLDQMt&I2Y$3&txVLRGpQi
z@IFSwUhe3PP+7{=*APn@)kj`ng;euLaJ2#<?kK@ai%l3Qj2k-E55>xf+E5)ry2!_y
zw6$O<L^-sARrYiVDJwc!p1i6?oEU}hBOOaRA|$GxF`H79H(yxJ@dINkz<q@Gf*j*O
zio)E_S792&%|(Gat{XNP9lO83GGPua#}Dj={wyySoFWy`rc6N4?c^)Ym8Z5=9XZ-%
z=ZIdFr}XM%9N8=`XFP%*ge_P~rMIUk%tT1c+zQN8mxR+M+p7B{Qt`S`h_Rii6cHuc
zz<qa`s;W@Io}{%?2&Cf^8=)xSvP`qe09+_+DD9hOL1^8&MY(H}iude-aNSm@cF1li
z4(A+T!hWOU%w4o1<_wmJQX~fdG?DHKASkh#NJeV@4Pp{kK}N^2?^15+u&;3@PK*T>
zp356RGR*sBwPeEp2feXVCk|H=6?Tz*iRtGyF8YKO8CLqwE2RAM3Q4ub!@vatTD4R4
zkc1Pd>77UB*uzeXfT94l!i+^4j~kPvP*X6=+;a+u?0rlUK4e+O0}<UYz}&p&)Yq;A
z5d?C4DB-kQ(j)ku5U29!-2Iz%eJaiS-&Mw;PbT>!ak1;$T`bj*3RL!%UbydO-|@3{
zg#qTC=Uy(wPlHbO-B<8?M4+$hW<TiI@E!|k-xqY=#)ZYMH)Ct2gFfsTM_7CE+jtUF
zW3W5}zRnSCL{;?qY{2_q{CWlgWDF)E+ih@X{TEF+_Rhy}g-L(m?Z<L+ALYE@3j2aT
zzdY-^fc3lCxOeF4^Az2K*8#{miu1Pbh@-;_DI~9L{CD*@<`75QCT)p%+Z!=ty4=ti
zbrCe~zs1Z8zzf!9+O|lX$%vtFMU}3|Byda<jU&ug^JZ)srejNQ5+qyg2_RSnbCw?&
zc>2gnxm)eK$3drDz6_zIo2rG;r4=UI_(R_1yzCA8jVD%1^5K0159YonacxbRC?nRk
z8jCP<K=2H(o0gUH(~%Uxre;<7G+GWD+n+Ca;E8snMVzrZ>)R?mr<}7Br^os;|3-?Y
z2}&AX8t|y|8z<EJ^;rVRzg36)5r%oc0Y->~@VBG?8zmD0&7LW=a$_qb&j}4H$@uF!
zVW(KfuN=Z_4UTcVgOx(dmc9GsxYfGLK?W%DLjKe6DoW@bZjcQqFL!Wrf}hrt8X=9s
zOd~D3M1z}#Cv&{W!CG9zyD#<dvAbf5ACc1D#n?Lbt%5Q;?`Zv)^yt^_#oazaprY~3
zrX!B=V;KO5t-)*IZEBNH^A%uMs+|6<=M$%!UE|zA;dJB|#82DVU$c7!k2y))2Ketl
z8V&XJd$0c;>TBkFxfbdR3=tQz`Lp6@+waw{f1c+2YmnmnOVsg$dFGWlps-u;N)XT8
zIlmkGGJOmL3E?%L&e#7-*9T#*@Es?Z*J^&xLeZLR9u8_1er5nZA*8Xus3ojy7(DRf
z@NT=`t0CyiJMi)Ch}c^LZpPHRt<}=7aT)K|>e=D?^E-6Q9|J*Xmdj3VM-xt^1|f)Z
z2j0fPe0MMB?SYBF)_EqmtHLmTXYl$NmN@2jLb#6@OCd4TTBRzbtDX?<NpF8NHFU<Z
z?>ZCtO$kkbc8jawJImOP`45n_A#0yFZ9}A^F)U&AuW5XU#AD0a4C0bd0W+*H<*c@q
zJG(nOyO3_|&MaCXxY3V<@s?qz4tM|uowhpS!`}6n9`Y&dve(H?fJkgHi>8PXDCGQe
zl<bf+bQ%ftmOJ@Q_eb*AKx*NLG|_lEBKJGw64f)#xu5jd=Xa4hY8&{-pV@L&9H~f~
ze~p@TOl=1(EFx{K2j~JGLA9ZznCwFfCe!l2)MDdiz~U?fZx{`>aU{@?ac!xT^kaIp
zEmlfi9Sk_x>4_7-S_b)bD&;0_CuUgxJh5AVSb*omXwP!Y6_2`<VuMA``uvG3!+9}n
zn=y3wBe}@X2iyWhwF7fiJ}CQRQ@y0q!}LRe{#Ai(kZ9W@8IXjlcs?Gr)fD&vrNmwD
z@xntS1h$SB&~Kx$*DR-=8}94GNnVRmhm+!$PVfY*j-`Pl#{w(g)k@i?R_lCoi&zR`
z*wLE=7Me3ZW`p8ic4@sN7Ap%#%7m8rOFw~md;o@VzR*lO{%k__!Vle)d%Y*cJ2nYM
zXYi{(oQ{PA9<*+5xSoLn&$1h;f(}NBFbh#0+6}q_2@6{3A7A202YSYVs@gHQ9T!9;
zAYU4+!pqeQbfE+CC4a4Y1FW_fP)%EhdQYx;;BC6&U=W!aTs@3e>HDpaPNB7L(R-yx
z6jFmS$yt^@QJYW;r$KI0!4GK~*xDk0OPAJ-7Y10;I|FIhH|Tc%;G^Q%FqEerg?{5$
zxn8K(&nwUabFke6J!W4Y&Y8t|kx}<AgCC3xigcU77p#N-gGV>(6Sr6?cp)bEM0#8k
zEz*%(er7R_sV?(d;*~|AU5-d~)i*}eSTVyWT=SQ6j|t5tYyF>I(y&Tgk5s(*cq8&D
zu4t)o(KLz7$eCbx#22@hf^*=KLNTH~a&{L51+>Pzq@(_3>8BY85_sM>Xyun=SJrXP
zi?UWeNSL5#OLM5URswvbwtS2hbOX~QcYpD4be*+e-|61H>G{TwfZa*8@S1+K;k+d1
zL(ugAnx^K~X-^4i*=F1Vv*yv1@Au^u?_Dx7p||3g5AMNu4;fb3H23!)R9YUWiQ+{V
zM>xST1FO=5onX|5e&&O$5WMX@EnW{#LGuv=Uc^vh&C;pVCWfRCN%fHq$?hTm9otaz
z)gUbtp4<F1{9nEjQjsd8_m_YB!9$|M8iDVvo+yBJKnl@Xs^Byc_`nOMTw^(`O?WFI
z#Zu4+9EnZhV9DiblHI#8;kCAt%;UTRm|!k{sc#353@6ZGk*>5HpFmYvwN~6l*vn`h
zNg-CPCjGq=ug+ep8X{deh#$ZV(_PXrcFgkdoXWtq68r(tOtivc&&pDhNZrI!a^>f@
zw*%N63}v~|!qXCDs|=|gxplNXGF>Tw8?Ii3-rXeGfcAr&6f$ukc{imigCsA{;Ka0=
zs+)-+O;XmLnHizx-jRx`-G^PAtgO;|Ua=%8Nfu7bHeSU%S(0ArgYE8{Yf^?>`K%7_
zOvbu;Gs+x<X4hS)0<G=Ox5?>$MSFp<8pkz8v8Now4i6<xGNG$fdj*@kP(xoI<=fKm
zrMY~EwVGWJ6W)+={%gpT+M5;TA0I6?i)&3<gI^HFSK65+JFdrM@fQ{4r-^AV!S=?^
z-t|K);<m%VCQ~b*%~-=9vd8@}EMxrs3-%VnB;i}C%JsAnTb3;OCSPY(6jvESVPS}<
zicn-BLqPx0^wNCgx*CsaC>yEzWK{3pu?x@!zmOwJciKP%&?NC_I#EL}LIq4)P;p`?
zP(s4i=$F{B1b7qXX~rr7T*y0!9W9dY-r(B5Y}Scd`%naAkCPlS$n+Xke%t>$mGC#K
zmu~EWFgspY+6_7@0SlVtpDhoh0c{ziyfy<8Xv-`>TLvx1GtmnS1}02u0*`re95=?8
zO4}OLc`{A@vt@&n@zlnWLp**u2!6a*Wfs@xgmcdiRcs+pXQ@wg|A7^q6j_Y$u?jho
z-4HDzdA@qKjODQ^mvD7Z^T~O<p%XFPpJi1GWiWlEi7Z8*6Js7)gSAm=LibM=8qo?0
z*@YCNGgB8072+%~-%pm$Nr)L2n<wkqjdrc!Ldx5JV4IAuU$(pMV!AuD4PyeBwE*j{
zn*(oveC~3}KfiA;N?HBLAe;0`ukm;ss;v}ZbO^@eMQ<Mvseg8pk;2UC8piz8xwAuq
z8N3{)11XXTj=&8k#<cVm50RFd6&sn6mc}*KIz?4;)r=d>7|R%>xHA3z5Tp0FXxe+W
z+9$&_;d1L+6fT>0lBZqJ({P##At=RU{E$8_NW7JDBSU|}9}FD~oj@>x<pAGyu79%Q
zwcl+1nHuQ%&I%?RVNg#U^g`V~ATQpVWQDzi_>D3+Po^G{k7O~ppgJuJM5Fh+vV@A|
za;=&$IZXAH{ZfqIt5POLkkB?6d9K82&Mj(&Ir@0WqfFyecuWLL{-E{3B~Mg<g9?-R
zPYU`1nw(Wy|BCO>pZoiP!QFactY|xKuUsadisw+`&nR7%l-~4VKjD7w@a*i(=|9K@
zo$P`xlcCxjdPA^WI_Ih7KDGzN&0l;AI5755e&^@X*GW7<nkQmLDpUl<PJ+3Bu@lf1
z-B}MH6)x25R0VJ06zP5kar_rM3Fb<S?=%Z`#LKK9yx``yl*hklZx#e?+}@}M-4p}S
zcNAK|On8)+A!@)y<>>>h;}e4a9K{^7PG`5I0X5<X&d1Ha$z@M@ZbK;g8WB5P_+gos
zL7E8cEOI$wP;Eh*`m##qqbiz{1+#Vle>MEKK&g8lMj@TdMYX~JHz^~@5~St3Kx{?u
zG&D>FrMo6l-(r^BXys20TlV<%sA{HZn=+~t|J%VSa9T?O+Yq*iXepjy8d{K<(;P_%
ziK43t^;11Dk`!D#!wO-j!><85n-hLZ8-*fDz7&uhPAE`$M+Uk&>zSWCJ}YtuHPMza
z*T`ql{`9SMXBmlHVP-P!OPPp*(_%j>$-31t!-q~95?0jb^gnPKyMNkFIa%eG)^_ko
zu3RbQ{<w@&M|TURo8M%N-1H`)6;jtCe8+|49?r3~v6w<bN33Juw~Lg<tR_pEsHH_?
z3p0yBO^QL=l%~wcOThU)PQEIQMfJJz!YLnLzX08_L(tYN=<Kfe9L`Ve&X|YXxzM_N
zd=g%7$<=lfVehVZBo$x3a{7C*#C~I~DpR1TQ3l?$)umnIQyb4~T6E*?z^P8QL%(Kh
z8*XrWXSn^^1m+2T#>p+g=EM2(bP~#VX{R*^GFQkA3<okLDShlv4+>KiQ=-qZPJn2w
znvICs3gR*+MAB^tjv6xGI&^7B?O5`*1OMYRk)Xr3-CM(0o`6wCIT#t7*fe?A==iWT
zMu_$tLP0!G{7h-)Dm%YZIc<>?Z?%`u-SIkmrY`P!O{lpg(A^iDg*{=^`4h+6?~#Ql
zrp0m*;_b$97z%x>+2aWT|JPm{;S}L8^@gEfedyCfg!@1ym#z(ki*Ir{kx13)&bk*O
zAPCz-D_fua_E<3n%9g6T<wd)t57xe%!>(900ckFzjabl5a3`EfxQyQW#4n(cCt<ff
zgd1`U-y>Vqgwcsya|9b4skGJoqWg4arK1&Gn$(#0GP$>!|5QC#J&Ax42V^RYr&EXh
z5dPrM$v3RrU{xDOLbeYv;=V}U>TQfUPa71&H$Jh#S=JNA`DP(umZ+@eHCat^>qSUn
zT97^REcS5vD@8z7DQisj&gEhM6DIeetL>aCQ1{$j=xfXSqYL@VsNri1(D`v(Jc}>z
zf1j@__-bByxjU-x09^ly|ApVsZ?e)Rj8`y!|5zYef$4VbcA~jXV~&P((KBRIj^h8;
z^C7u=UlfxjRb>jQx~?OKdvwuKd~h=-f&jI1iPMgZn!08#>LXCA3Cw#7CwH;nSVIa7
zQE32wWZgkQw!K`Hc$=h@W@f#`=nz{?Ar$(l_kP1ARoS!}nUf*~!mHUReqbH33!Nk%
zO;zALq;|hh&8w`C*K$1yZt$hB@sTEIapjlaV|eZUsHA=EUbcSr`#7&22$!ziFEQ88
z9<FD6Mrt;~i#5i3exw<W;@1S58&mg&pWCxF32@RF^!)t6+sf=Ka#xsGaK=(0a4xDN
zkB2NY)5v<t>-})fC!g6%br4j@V}g^lR4Cj5eoi=>C$wZ?gSXAE6@2$QwP&Y=Z->(x
zt|;NW_&m)w{~QYMMhZuITmAg|t<(bdc2lsu@6=ZIP+%A?>ewe}Zj4UMH4C6;ZqLyA
zrrtA{XQLKzLe2h)iJ@+^vk@2&=!ciryLWRlos3ZiS{OD~I({p>{N+&7I}-zt?i?8E
z+=bX-x@pQDy0sc=0t1Dp^>mJ0_f`)Y*_e%7-9|J5GF_4|>3cEAi*e_o{!(@r&8L4K
zybqDU8WVCQ>8EC*uHP5tPoQBXcPKOmcE^#Kw0zkGe85-XcDwmsKyFsfx%J;OS3C(D
zoAk&lkd1ZT{Th&oEkDuiqPUU#;lNIhKzok6yd(Rdd8rGt_hrY!#=cIzKH49X$7t0C
ze9iTr=N~qePB~nm=V%hS|B$=J?2ujb<7)$M|MFg~djH|k-{S=%@1o=(a$t4(*v)es
zV+MqMb2u*%|Bx;YosBd)S%K|0U#R2Of08XtU9)iVZ7jI0;oRVVqX#qxqfPsfpTf{o
z{2_q>$qv<?XO8_C;oiH|$U;p5gfV<qHeYxy=TvY7kWQ}8Hs*{Ou~M-hvD_6g^YIo7
zi4r>?hR<gwx4)n$84|#ZZ+auNP54k#2)>(>TMR+X&~83nf7VIU-v0qVh3dvc5_kle
zRW_YdY`p4B6l}o|&=<6Uz62qvH4qv&=b=l}MBSz=!Zb6X5x2Pn&!rSO4?lXA9f)w~
zhlPh6P(jfRk2dHVJWKft4X*ij*bF=FtM)8eG6U@sZblOtztA5XVY>txep=gC!4o^S
z!9lPopt=`J@Ye9XfuARN>4{*5yv^g=lNG$v@Gzs6)YD5Uw0+rI+#-d&p*b4w4M>ML
zIC7S_FP>dJxj%RiJqthCrdg_QEyqf!D%?A?D7Oq<4Gff)Kc*5U^f80ph>B4*KK+cF
z$yOFC;+h{(Z8+q`yft{>AenMrh-=>#g-Ii5auDGO>KYkF{w8Slj#L=FLW<8}kXxLA
zxXJa{b3fG7LEBQx$f3IT<-NCyeSrUWK@Hj^zKn3QD-k>Sy2<-gs-!F~7V6J|sxb?=
zu1_8<DRl-f4&_f<OM5m8`Ct7joWx9-t}F6OgiBA&l|mKjng@_;4{%EgnnfUvdSQ|L
z^f=pe4!9f2IS$aGu_VqDJ=r$_5bRM<`d%Tuxc=SeJz$X&I{+d*!7bvz$bx4iITyei
zMGjuUT`~%5o<&XZ*I(roL9{BKnJEcCXmmh|$8s)3!#ZtD^i}k8WGJDZ?Qz5N#B}I5
z=_%*oq%*s%$lsj(Y3Zn8O#A1|iDT><=qb{a7dR0BD-YI4{*cs%=3_9YbNS6wa<7N<
zVH4_nheP8%b-M{F{ytpSt-Es~H`HK6eOfg4-`}|=DEg+hxkh<`JhA+%p)cqeoc!`?
zxTIcYsw+BVv*?G>+P>IURf})&cnUVfT{5LO>1jOD#|vM10w24ROF=*FAv^39#lO$e
zn+fJiBJ`uIY_dhKV~m__YF@{f(nBurOBH*$qV|?h`&M8`T;oOW%t}7g=bvt?q4Zi)
z_%dTJ`1uw;%ZWbpC7*s6NL-&s?=V9yKuZ-PyP^gZQoj~rND$*i3(WxgtK^>!tDyu~
zP`uJ$FG%|qCjymzCZ8S}ND!Y#3o$`1)HybLHsvV`Zg8DaZyu2dNHR`WWoBbEyV_VW
zHruUERph8n^9@ZG<+aZI)uk^8lwv%GVUCPgWvj8N^XJ2BttIav(9@f)EpNR$vt4dV
zxN)_yV{EPlD%Sj0u@0!HM_<tQU&XPpxr|lxd}ZsB43F=b;`ZjezaPJ!ENxa=67KVI
zw7XxoRn2j+RFoHl+68oXscTM&+$U_TkzvpBLrD*^&G*=s`rzeB?$$>fZv&Av5PAFu
z^#YMI5Gno#eXz~@n*b5ze^3|@*#Oap#6P`ZAhH0WmH(g;ws{93J}bPs{~*^>isK$b
zb=*`0#`EQrOSSpD;<%&bF@?W6v=6LSa*IoO%H+Tw?w%<|ZJt3Pxc$<?W~VFdMf<>J
zCG$_n{$C-tx#xd`?Ee+ATS@&BivL$AZLaknA;*7(999zlgzEnlYUex&Y?>ie847GK
zS>Z8L1$e`r=CcX3W@RnmZ2$em3{^4wX@U{A$v|`zM+rR&lP4H6&l}U#7o$?pky&&=
zPUk$`QaQn!k*RvJK2Z$M;e+A53eMBMED;G%N26fhK87dO7SAC!YANa`?#*2Qz!9{N
zPD1iuUI%?K19rclRe;6kFhDRsKtNzXx?QDoxk}C5b#OpH1d>2Nuz{cc?}xdorK!86
zrmcjfm93MlyREYmlbxHh)BigNEuoV>pacX2J{<}K^?!{J4;<Rj)YeJE($U2MIMn}9
ThlKj~EimBoJMguo=O6kX?q`m?

literal 0
HcmV?d00001

diff --git a/Solutions/Global Secure Access/Package/mainTemplate.json b/Solutions/Global Secure Access/Package/mainTemplate.json
index 0b5e05f3a7..18a4637428 100644
--- a/Solutions/Global Secure Access/Package/mainTemplate.json	
+++ b/Solutions/Global Secure Access/Package/mainTemplate.json	
@@ -49,7 +49,7 @@
     "email": "support@microsoft.com",
     "_email": "[variables('email')]",
     "_solutionName": "Global Secure Access",
-    "_solutionVersion": "3.0.0",
+    "_solutionVersion": "3.1.0",
     "solutionId": "azuresentinel.azure-sentinel-solution-globalsecureaccess",
     "_solutionId": "[variables('solutionId')]",
     "workbookVersion1": "1.0.1",
@@ -164,11 +164,11 @@
       "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','efd17c5f-5167-40f8-a1e9-0818940785d9','-', '2.2.6')))]"
     },
     "analyticRuleObject15": {
-      "analyticRuleVersion15": "2.0.7",
+      "analyticRuleVersion15": "1.0.5",
       "_analyticRulecontentId15": "30375d00-68cc-4f95-b89a-68064d566358",
       "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '30375d00-68cc-4f95-b89a-68064d566358')]",
       "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('30375d00-68cc-4f95-b89a-68064d566358')))]",
-      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','30375d00-68cc-4f95-b89a-68064d566358','-', '2.0.7')))]"
+      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','30375d00-68cc-4f95-b89a-68064d566358','-', '1.0.5')))]"
     },
     "analyticRuleObject16": {
       "analyticRuleVersion16": "2.0.7",
@@ -315,7 +315,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "GSAM365EnrichedEvents Workbook with template version 3.0.0",
+        "description": "GSAM365EnrichedEvents Workbook with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('workbookVersion1')]",
@@ -399,7 +399,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "GSANetworkTraffic Workbook with template version 3.0.0",
+        "description": "GSANetworkTraffic Workbook with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('workbookVersion2')]",
@@ -483,7 +483,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Identity - AfterHoursActivity_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Identity - AfterHoursActivity_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
@@ -511,10 +511,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
                   }
                 ],
                 "tactics": [
@@ -526,22 +526,22 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "AccountCustomEntity",
                         "identifier": "Name"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "IPCustomEntity",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -597,7 +597,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Identity - SharedSessions_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Identity - SharedSessions_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
@@ -625,10 +625,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
                   }
                 ],
                 "tactics": [
@@ -640,22 +640,22 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "AccountCustomEntity",
                         "identifier": "Name"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "IPCustomEntity",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -711,7 +711,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - exchange_auditlogdisabled_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - exchange_auditlogdisabled_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
@@ -739,10 +739,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -753,6 +759,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -766,17 +773,16 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -832,7 +838,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - External User added to Team and immediately uploads file_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - External User added to Team and immediately uploads file_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
@@ -860,10 +866,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Teams)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -874,6 +886,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "MemberAdded",
@@ -887,10 +900,10 @@
                         "columnName": "MemberAddedAccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserWhoAdded",
@@ -904,10 +917,10 @@
                         "columnName": "UserWhoAddedAccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserWhoDeleted",
@@ -921,17 +934,16 @@
                         "columnName": "UserWhoDeletedAccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -987,7 +999,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - ExternalUserAddedRemovedInTeams_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - ExternalUserAddedRemovedInTeams_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]",
@@ -1015,10 +1027,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Teams)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1029,6 +1047,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "MemberAdded_Removed",
@@ -1042,10 +1061,10 @@
                         "columnName": "MemberAdded_RemovedAccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserWhoAdded",
@@ -1059,10 +1078,10 @@
                         "columnName": "UserWhoAddedAccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserWhoDeleted",
@@ -1076,17 +1095,16 @@
                         "columnName": "UserWhoDeletedAccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -1142,7 +1160,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - Mail_redirect_via_ExO_transport_rule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - Mail_redirect_via_ExO_transport_rule_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]",
@@ -1170,10 +1188,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1186,6 +1210,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1199,17 +1224,16 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "IPAddress",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -1265,7 +1289,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - Malicious_Inbox_Rule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - Malicious_Inbox_Rule_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]",
@@ -1293,10 +1317,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1309,6 +1339,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1322,17 +1353,16 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIPAddress",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -1388,7 +1418,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - MultipleTeamsDeletes_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - MultipleTeamsDeletes_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]",
@@ -1416,10 +1446,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Teams)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1431,6 +1467,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1444,8 +1481,7 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   }
                 ]
               }
@@ -1501,7 +1537,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - Office_MailForwarding_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - Office_MailForwarding_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]",
@@ -1529,10 +1565,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1545,6 +1587,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1558,17 +1601,16 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -1624,7 +1666,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - office_policytampering_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - office_policytampering_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]",
@@ -1652,10 +1694,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1668,6 +1716,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1681,17 +1730,16 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -1747,7 +1795,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - Office_Uploaded_Executables_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - Office_Uploaded_Executables_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]",
@@ -1775,10 +1823,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1791,6 +1845,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1804,35 +1859,34 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "URL",
                     "fieldMappings": [
                       {
                         "columnName": "Site_Url",
                         "identifier": "Url"
                       }
-                    ],
-                    "entityType": "URL"
+                    ]
                   },
                   {
+                    "entityType": "File",
                     "fieldMappings": [
                       {
                         "columnName": "FileNames",
                         "identifier": "Name"
                       }
-                    ],
-                    "entityType": "File"
+                    ]
                   }
                 ]
               }
@@ -1888,7 +1942,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - RareOfficeOperations_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - RareOfficeOperations_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]",
@@ -1916,10 +1970,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -1932,6 +1992,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -1945,17 +2006,16 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIPOnly",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   }
                 ]
               }
@@ -2011,7 +2071,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - SharePoint_Downloads_byNewIP_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - SharePoint_Downloads_byNewIP_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]",
@@ -2039,10 +2099,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -2053,6 +2119,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -2066,26 +2133,25 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "URL",
                     "fieldMappings": [
                       {
                         "columnName": "Site_Url",
                         "identifier": "Url"
                       }
-                    ],
-                    "entityType": "URL"
+                    ]
                   }
                 ]
               }
@@ -2141,7 +2207,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - SharePoint_Downloads_byNewUserAgent_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - SharePoint_Downloads_byNewUserAgent_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]",
@@ -2169,10 +2235,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -2183,6 +2255,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -2196,26 +2269,25 @@
                         "columnName": "UserIdUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "URL",
                     "fieldMappings": [
                       {
                         "columnName": "Site_Url",
                         "identifier": "Url"
                       }
-                    ],
-                    "entityType": "URL"
+                    ]
                   }
                 ]
               }
@@ -2271,7 +2343,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - sharepoint_file_transfer_above_threshold_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - sharepoint_file_transfer_above_threshold_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]",
@@ -2299,10 +2371,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -2313,6 +2391,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -2326,45 +2405,44 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "File",
                     "fieldMappings": [
                       {
                         "columnName": "FileSample",
                         "identifier": "Name"
                       }
-                    ],
-                    "entityType": "File"
+                    ]
                   }
                 ],
                 "customDetails": {
-                  "FilesList": "fileslist",
-                  "TransferCount": "count_distinct_ObjectId"
+                  "TransferCount": "count_distinct_OfficeObjectId",
+                  "FilesList": "fileslist"
                 },
                 "incidentConfiguration": {
-                  "createIncident": true,
                   "groupingConfiguration": {
-                    "reopenClosedIncident": false,
-                    "groupByAlertDetails": [],
-                    "groupByCustomDetails": [],
-                    "lookbackDuration": "5h",
+                    "enabled": true,
+                    "lookbackDuration": "PT5H",
                     "groupByEntities": [
                       "Account"
                     ],
                     "matchingMethod": "Selected",
-                    "enabled": true
-                  }
+                    "reopenClosedIncident": false,
+                    "groupByCustomDetails": [],
+                    "groupByAlertDetails": []
+                  },
+                  "createIncident": true
                 }
               }
             },
@@ -2419,7 +2497,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Office 365 - sharepoint_file_transfer_folders_above_threshold_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Office 365 - sharepoint_file_transfer_folders_above_threshold_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]",
@@ -2447,10 +2525,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
                   }
                 ],
                 "tactics": [
@@ -2461,6 +2545,7 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "Account",
                     "fieldMappings": [
                       {
                         "columnName": "UserId",
@@ -2474,45 +2559,44 @@
                         "columnName": "AccountUPNSuffix",
                         "identifier": "UPNSuffix"
                       }
-                    ],
-                    "entityType": "Account"
+                    ]
                   },
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "ClientIP",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "File",
                     "fieldMappings": [
                       {
                         "columnName": "FileSample",
                         "identifier": "Name"
                       }
-                    ],
-                    "entityType": "File"
+                    ]
                   }
                 ],
                 "customDetails": {
-                  "FilesList": "fileslist",
-                  "TransferCount": "count_distinct_ObjectId"
+                  "TransferCount": "count_distinct_OfficeObjectId",
+                  "FilesList": "fileslist"
                 },
                 "incidentConfiguration": {
-                  "createIncident": true,
                   "groupingConfiguration": {
-                    "reopenClosedIncident": false,
-                    "groupByAlertDetails": [],
-                    "groupByCustomDetails": [],
-                    "lookbackDuration": "5h",
+                    "enabled": true,
+                    "lookbackDuration": "PT5H",
                     "groupByEntities": [
                       "Account"
                     ],
                     "matchingMethod": "Selected",
-                    "enabled": true
-                  }
+                    "reopenClosedIncident": false,
+                    "groupByCustomDetails": [],
+                    "groupByAlertDetails": []
+                  },
+                  "createIncident": true
                 }
               }
             },
@@ -2567,7 +2651,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "SWG - Abnormal Deny Rate_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "SWG - Abnormal Deny Rate_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]",
@@ -2595,10 +2679,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "NetworkAccessTrafficLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
                   }
                 ],
                 "tactics": [
@@ -2608,22 +2692,22 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "SourceIp",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "URL",
                     "fieldMappings": [
                       {
                         "columnName": "DestinationIp",
                         "identifier": "Url"
                       }
-                    ],
-                    "entityType": "URL"
+                    ]
                   }
                 ]
               }
@@ -2679,7 +2763,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "SWG - Abnormal Port to Protocol_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "SWG - Abnormal Port to Protocol_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]",
@@ -2707,10 +2791,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
                   }
                 ],
                 "tactics": [
@@ -2720,22 +2804,22 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "IPCustomEntity",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "URL",
                     "fieldMappings": [
                       {
                         "columnName": "FqdnCustomEntity",
                         "identifier": "Url"
                       }
-                    ],
-                    "entityType": "URL"
+                    ]
                   }
                 ]
               }
@@ -2791,7 +2875,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "SWG - Source IP Port Scan_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "SWG - Source IP Port Scan_AnalyticalRules Analytics Rule with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]",
@@ -2819,10 +2903,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
-                    "connectorId": "AzureActiveDirectory",
                     "dataTypes": [
                       "EnrichedMicrosoft365AuditLogs"
-                    ]
+                    ],
+                    "connectorId": "AzureActiveDirectory"
                   }
                 ],
                 "tactics": [
@@ -2833,22 +2917,22 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "IP",
                     "fieldMappings": [
                       {
                         "columnName": "SourceIp",
                         "identifier": "Address"
                       }
-                    ],
-                    "entityType": "IP"
+                    ]
                   },
                   {
+                    "entityType": "URL",
                     "fieldMappings": [
                       {
                         "columnName": "Fqdn",
                         "identifier": "Url"
                       }
-                    ],
-                    "entityType": "URL"
+                    ]
                   }
                 ]
               }
@@ -2904,7 +2988,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "AnomolousUserAccessingOtherUsersMailbox_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "AnomolousUserAccessingOtherUsersMailbox_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]",
@@ -2989,7 +3073,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ExternalUserAddedRemovedInTeams_HuntVersion_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "ExternalUserAddedRemovedInTeams_HuntVersion_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]",
@@ -3074,7 +3158,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ExternalUserFromNewOrgAddedToTeams_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "ExternalUserFromNewOrgAddedToTeams_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]",
@@ -3159,7 +3243,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Mail_redirect_via_ExO_transport_rule_hunting_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "Mail_redirect_via_ExO_transport_rule_hunting_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]",
@@ -3244,7 +3328,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "MultiTeamBot_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "MultiTeamBot_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]",
@@ -3329,7 +3413,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "MultiTeamOwner_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "MultiTeamOwner_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]",
@@ -3414,7 +3498,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "MultipleTeamsDeletes_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "MultipleTeamsDeletes_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]",
@@ -3499,7 +3583,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "NewBotAddedToTeams_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "NewBotAddedToTeams_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]",
@@ -3584,7 +3668,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "New_WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "New_WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]",
@@ -3669,7 +3753,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "OfficeMailForwarding_hunting_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "OfficeMailForwarding_hunting_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]",
@@ -3754,7 +3838,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "TeamsFilesUploaded_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "TeamsFilesUploaded_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]",
@@ -3839,7 +3923,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "UserAddToTeamsAndUploadsFile_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "UserAddToTeamsAndUploadsFile_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]",
@@ -3924,7 +4008,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]",
@@ -4009,7 +4093,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "double_file_ext_exes_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "double_file_ext_exes_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]",
@@ -4094,7 +4178,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "new_adminaccountactivity_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "new_adminaccountactivity_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]",
@@ -4179,7 +4263,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "new_sharepoint_downloads_by_IP_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "new_sharepoint_downloads_by_IP_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]",
@@ -4264,7 +4348,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "new_sharepoint_downloads_by_UserAgent_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "new_sharepoint_downloads_by_UserAgent_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]",
@@ -4349,7 +4433,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "nonowner_MailboxLogin_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "nonowner_MailboxLogin_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject18').huntingQueryVersion18]",
@@ -4434,7 +4518,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "powershell_or_nonbrowser_MailboxLogin_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "powershell_or_nonbrowser_MailboxLogin_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject19').huntingQueryVersion19]",
@@ -4519,7 +4603,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "sharepoint_downloads_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "sharepoint_downloads_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject20').huntingQueryVersion20]",
@@ -4604,7 +4688,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "MultipleUsersEmailForwardedToSameDestination_HuntingQueries Hunting Query with template version 3.0.0",
+        "description": "MultipleUsersEmailForwardedToSameDestination_HuntingQueries Hunting Query with template version 3.1.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('huntingQueryObject21').huntingQueryVersion21]",
@@ -4685,7 +4769,7 @@
       "apiVersion": "2023-04-01-preview",
       "location": "[parameters('workspace-location')]",
       "properties": {
-        "version": "3.0.0",
+        "version": "3.1.0",
         "kind": "Solution",
         "contentSchemaVersion": "3.0.0",
         "displayName": "Global Secure Access",

From b015a4228da06c82891d8520593b0b0b33109a5c Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Sun, 6 Oct 2024 14:53:45 +0300
Subject: [PATCH 18/27] update

---
 ... Mail_redirect_via_ExO_transport_rule.yaml |   27 +-
 ...repoint_file_transfer_above_threshold.yaml |   40 +-
 ...file_transfer_folders_above_threshold.yaml |   81 +-
 .../Global Secure Access/Package/3.1.0.zip    |  Bin 48462 -> 0 bytes
 .../Package/createUiDefinition.json           |  729 ---
 .../Package/mainTemplate.json                 | 5028 -----------------
 .../Package/testParameters.json               |   40 -
 ...repoint_file_transfer_above_threshold.yaml |    2 +-
 8 files changed, 75 insertions(+), 5872 deletions(-)
 delete mode 100644 Solutions/Global Secure Access/Package/3.1.0.zip
 delete mode 100644 Solutions/Global Secure Access/Package/createUiDefinition.json
 delete mode 100644 Solutions/Global Secure Access/Package/mainTemplate.json
 delete mode 100644 Solutions/Global Secure Access/Package/testParameters.json

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml
index d6a9ebb224..256c1fac3d 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml	
@@ -6,12 +6,12 @@ description: |
 severity: Medium
 status: Available
 requiredDataConnectors:
-  - connectorId: AzureActiveDirectory
-    dataTypes:
-      - EnrichedMicrosoft365AuditLogs
   - connectorId: Office365
     dataTypes:
       - OfficeActivity (Exchange)
+  - connectorId: AzureActiveDirectory
+    dataTypes:
+      - EnrichedMicrosoft365AuditLogs
 queryFrequency: 1h
 queryPeriod: 1h
 triggerOperator: gt
@@ -23,6 +23,7 @@ relevantTechniques:
   - T1114
   - T1020
 query: |
+  // OfficeActivity Query
   let officeActivityQuery = OfficeActivity
     | where OfficeWorkload == "Exchange"
     | where Operation in~ ("New-TransportRule", "Set-TransportRule")
@@ -40,30 +41,30 @@ query: |
     | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIP)[0]
     | extend From = ParsedParameters.From
     | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters
-    | extend AccountName = tostring(split(UserId, "@")[0]), 
+    | extend AccountName = tostring(split(UserId, "@")[0]),
              AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-
+  // EnrichedMicrosoft365AuditLogs Query
   let enrichedLogsQuery = EnrichedMicrosoft365AuditLogs
     | where Workload == "Exchange"
     | where Operation in~ ("New-TransportRule", "Set-TransportRule")
-    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (
+    | extend AdditionalProps = parse_json(AdditionalProperties)
+    | mv-apply DynamicParameters = todynamic(AdditionalProps.Parameters) on (
         summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))
       )
     | extend RuleName = case(
-        Operation =~ "Set-TransportRule", ObjectId,  // Assuming ObjectId maps to OfficeObjectId
+        Operation =~ "Set-TransportRule", ObjectId,
         Operation =~ "New-TransportRule", ParsedParameters.Name,
         "Unknown"
       )
-    | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))
+    | mv-expand ExpandedParameters = todynamic(AdditionalProps.Parameters)
     | where ExpandedParameters.Name in~ ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
     | extend RedirectTo = ExpandedParameters.Value
     | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?P<IPAddress>(\d+\.\d+\.\d+\.\d+)|[^\]]+)\]?([-:](?P<Port>\d+))?', dynamic(["IPAddress", "Port"]), ClientIp)[0]
     | extend From = ParsedParameters.From
-    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)
-    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters), UserAgent
-    | extend AccountName = tostring(split(UserId, "@")[0]), 
+    | extend UserAgent = tostring(AdditionalProps.UserAgent)
+    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProps.Parameters), UserAgent
+    | extend AccountName = tostring(split(UserId, "@")[0]),
              AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-
   // Combine both queries
   union isfuzzy=true officeActivityQuery, enrichedLogsQuery
   | summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo
@@ -83,4 +84,4 @@ entityMappings:
       - identifier: Address
         columnName: IPAddress
 version: 2.1.4
-kind: Scheduled
+kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 4d072b9dde..56ca53b9f8 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -1,7 +1,7 @@
 id: 30375d00-68cc-4f95-b89a-68064d566358
 name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  'Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.
+  'Identifies Office365 SharePoint file transfers above a certain threshold in a 15-minute time period.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
 severity: Medium
 status: Available
@@ -22,39 +22,37 @@ relevantTechniques:
   - T1020
 query: |
   let threshold = 5000;
-  
   // EnrichedMicrosoft365AuditLogs Query
   let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive") 
+      | where Workload has_any("SharePoint", "OneDrive")
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
       | extend ClientIP = ClientIp
-      | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) 
+      | summarize TransferCount = dcount(ObjectId), fileslist = make_set(ObjectId, 10000)
           by UserId, ClientIP, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
+      | where TransferCount >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),
+               strcat("SeeFilesListField_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]),
                AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  
   // OfficeActivity Query
   let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint" 
-      | where OfficeWorkload has_any("SharePoint", "OneDrive") 
+      | where EventSource == "SharePoint"
+      | where OfficeWorkload has_any("SharePoint", "OneDrive")
       | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) 
+      | summarize TransferCount = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000)
           by UserId, ClientIP, bin(TimeGenerated, 15m)
-      | where count_distinct_OfficeObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), 
+      | where TransferCount >= threshold
+      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),
+               strcat("SeeFilesListField_", tostring(hash(tostring(fileslist)))))
+      | extend AccountName = tostring(split(UserId, "@")[0]),
                AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-  
   // Combine Office and Enriched Logs
   let CombinedEvents = OfficeEvents
       | union EnrichedEvents
       | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;
-  
   // Final Output
   CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist
+      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, TransferCount, fileslist
       | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
@@ -74,7 +72,7 @@ entityMappings:
       - identifier: Name
         columnName: FileSample
 customDetails:
-  TransferCount: count_distinct_OfficeObjectId
+  TransferCount: TransferCount
   FilesList: fileslist
 incidentConfiguration:
   createIncident: true
@@ -84,8 +82,6 @@ incidentConfiguration:
     lookbackDuration: PT5H
     matchingMethod: Selected
     groupByEntities:
-    - Account
-    groupByAlertDetails: []
-    groupByCustomDetails: []
+      - Account
 version: 1.0.5
-kind: Scheduled
+kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml
index 500b037a4b..de4935de26 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml	
@@ -1,7 +1,7 @@
 id: abd6976d-8f71-4851-98c4-4d086201319c
 name: GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold
 description: |
-  'Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
+  'Identifies Office365 SharePoint file transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
 severity: Medium
 status: Available
 requiredDataConnectors:
@@ -20,39 +20,44 @@ tactics:
 relevantTechniques:
   - T1020
 query: |
-    let threshold = 5000;
-      // EnrichedMicrosoft365AuditLogs Query
-      let EnrichedEvents = EnrichedMicrosoft365AuditLogs
-      | where Workload has_any("SharePoint", "OneDrive")
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | extend UserAgent = tostring(AdditionalProperties["UserAgent"])
-      | summarize count_distinct_ObjectId = dcount(ObjectId), 
-                  fileslist = make_set(ObjectId, 10000), 
-                  any_UserAgent = any(UserAgent)
-        by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
-      | where count_distinct_ObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-      // OfficeActivity Query
-      let OfficeEvents = OfficeActivity
-      | where EventSource == "SharePoint"
-      | where OfficeWorkload has_any("SharePoint", "OneDrive")
-      | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
-      | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), 
-                  fileslist = make_set(OfficeObjectId, 10000), 
-                  any_UserAgent = any(UserAgent)
-        by UserId, ClientIP, bin(TimeGenerated, 15m)
-      | where count_distinct_OfficeObjectId >= threshold
-      | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField", "_", tostring(hash(tostring(fileslist)))))
-      | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1]);
-      // Combine Office and Enriched Logs
-      let CombinedEvents = OfficeEvents
-      | union EnrichedEvents
-      | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, any_UserAgent;
-      // Final Output
-      CombinedEvents
-      | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, UserAgent = any_UserAgent, count_distinct_ObjectId = coalesce(count_distinct_ObjectId, count_distinct_OfficeObjectId), fileslist
-      | order by TimeGenerated desc
+  let threshold = 5000;
+  // EnrichedMicrosoft365AuditLogs Query
+  let EnrichedEvents = EnrichedMicrosoft365AuditLogs
+    | where Workload has_any("SharePoint", "OneDrive")
+    | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+    | extend UserAgent = tostring(AdditionalProperties["UserAgent"])
+    | summarize count_distinct_ObjectId = dcount(ObjectId),
+                fileslist = make_set(ObjectId, 10000),
+                any_UserAgent = any(UserAgent)
+      by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)
+    | where count_distinct_ObjectId >= threshold
+    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),
+                 strcat("SeeFilesListField_", tostring(hash(tostring(fileslist)))))
+    | extend AccountName = tostring(split(UserId, "@")[0]),
+             AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // OfficeActivity Query
+  let OfficeEvents = OfficeActivity
+    | where EventSource == "SharePoint"
+    | where OfficeWorkload has_any("SharePoint", "OneDrive")
+    | where Operation has_any("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
+    | summarize count_distinct_ObjectId = dcount(OfficeObjectId),
+                fileslist = make_set(OfficeObjectId, 10000),
+                any_UserAgent = any(UserAgent)
+      by UserId, ClientIP, bin(TimeGenerated, 15m)
+    | where count_distinct_ObjectId >= threshold
+    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),
+                 strcat("SeeFilesListField_", tostring(hash(tostring(fileslist)))))
+    | extend AccountName = tostring(split(UserId, "@")[0]),
+             AccountUPNSuffix = tostring(split(UserId, "@")[1]);
+  // Combine Office and Enriched Logs
+  let CombinedEvents = OfficeEvents
+    | union EnrichedEvents
+    | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, any_UserAgent;
+  // Final Output
+  CombinedEvents
+    | extend TransferCount = count_distinct_ObjectId
+    | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, UserAgent = any_UserAgent, TransferCount, fileslist
+    | order by TimeGenerated desc
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -71,7 +76,7 @@ entityMappings:
       - identifier: Name
         columnName: FileSample
 customDetails:
-  TransferCount: count_distinct_OfficeObjectId
+  TransferCount: TransferCount
   FilesList: fileslist
 incidentConfiguration:
   createIncident: true
@@ -81,8 +86,6 @@ incidentConfiguration:
     lookbackDuration: PT5H
     matchingMethod: Selected
     groupByEntities:
-    - Account
-    groupByAlertDetails: []
-    groupByCustomDetails: []
-version: 2.0.7
+      - Account
+version: 2.0.8
 kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Package/3.1.0.zip b/Solutions/Global Secure Access/Package/3.1.0.zip
deleted file mode 100644
index b4bf1cfe08054024f9166a0bb0d954d371b7a4d1..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 48462
zcmY(pQ<Nsb*0o#KTejV0+qThFUAAr8wr$(CyKLLGaeD86e;4OAN8~eN&dA6SvF1{c
z1_eU}0s?{p>U0oOXDc#vQo{rS;)w$S!ua>p(7{;W$ymi)#Ms2##@xx=)`rf)(bncl
z`@&&EEakgb<pW+jBOCc_UsTB}(lQ&>kTa&zYfeq-bI_q(AW!lcO2BZ|&x|ay!aK#g
z$vfd~`fMb+2$x(q0GC=>IR=Uad#kk9@m&k2_w&RT%Klb&BzJs_+l>_7L_H-<d@#S8
zDXeQXb3$Tdt?z?V{-|#yzSA^BJn*1jl3((uIpJY1@wZ3%=iOU*R+*Zy)M#L;ds=yJ
zLH|y4%#XwDf$LNk2b8hYjYs+CZyern2$Jj0<v>d>TIIl)GW!GLYnT0E9a3f%p-A0R
zWV&~*oHBD~;M64dN}uO>APjOHGo#ur=I5w;OZkUk0c?I1$>Z(M9jXkN#P?Ww>GPs(
zF9wx08iEtC5;sFJRO0npnakcUN3GxWu%U$L5S(85rR%VzBRFXnXGi{Nm4uo3E08Y<
zv9Fwo7F>TPc6PKzQtz_4Yn{jlw%SRih0d@jl{n+e$C}1Wlw_PR&)XwP4QR-@l7)uJ
z9tPrSX1xmsvrO(J6m)-ndVk2b8Q!qjhdbHlpJi*AZn%d@ufS|`R8pkWWv(`zO+sdb
zc%KJ)b8xez38wBw$6ksVg<sHp#tC6MSV#p8JJKX!dGFEFg56xvF5GF77~Q>Tw$bX$
zLPokfF+2B`TkQXkGEMR5#hS>2DT$#ToQE4F`^-_TL9kS~y1)-i3#{JNMh&wySX(91
zh0yZc(aj=-C?dCcAPY+z2>u?(k)S^Cu?d;fI(nSoe?JoW=m{k{Khw23S&FU!5)K!T
zCNap?r}9aIM8?1%?jr%&jVjJPTZ9dpAMi(mqYakAEV?IXmzs-?DV{|ckw`cvd}(Zm
z2Ojq0D4EaZHZ4C4jWP(EA3jM*Xo>wTBBH(Wr_3)YZy61pC|3AN_wLG)e)27Ng-W3D
zu7H!L>)wq}Dx4^1MEyMcq%`W1+tnuuG(7~M@m?_%{AgMaF^6gbE(W(rNRRyhZ$y0H
zSJFMCtbTQeue^3zmIj|^M37W3zlGxU3lm}&BtlRNF;pGyag2sGtW(e!G+zR)i%^de
zI&aT<{#I{R4s;}^bI&p{U7Y8sF}e6QsxH9-*2CS<o7UVxB)XNW8{5*`Si&yraVVRc
z<gsNeiGKSq|M2gq?!ps+1IYUCPuf(<lK!jMbVwaU)hm#K8=lI!<~Sf~ntlqpx(&1+
z5>-!1@ZnMdI#VpOUd!TclxZ@8m10L(n*%bgS@-k5%m9*YjO``Ou=kpWj=Uy!bsNXQ
z`>Cha?Z-R}klUsj6As8J*?mEHSiCUhNoa2E5z-$K+h{tsHNH7a&#?RUBQOS5$fuB-
zN`l^HNeKLh<ph9dsko5A8-(=&6;PA;$A=(zP+UP`PMS1hvY#CpS$PbN?FA*~kkDjU
z0&4W!QmBX~_s|GO(r}8`;A|wgcgi`BIu<`^bPoR)RDS@{zD>&UQ%nT^7J=yKQi-lm
zVb8~?0;Sn@+Ck*ph6B};qH$zU=I_5s10D=gg^C3^0uv=%R(!?IZuw^DkTm{eRHRG6
zBHG~iaSMNgia6DgXzNWiv7yKU7*@r-CFaF;;?7kw6mD)xsw9fD6-E}Umdz3C7w~3b
zJG%?7Kg2LdCy0WV{f$Z_ow?ke9}B`|DD>8%cEVmj@w2%c_eH5r@s`{69I;L{=@q?8
z-+B2sxj4@WcrOX?2n_lzR9j!lRkD1KLHOnrgS3xXmc}W6M~Gd_4%UcItrQYL+Z&e%
zPsU?sKfDVdwCycPQ$XF0`2EglALx<HBy}mMg9yhap1cVP>c=nNpR6*)#rhQSq}$?k
z!*G`z1!*u`D|B2n@*BMNYdy`eyXx4#W3Q6kMJq`>!#HJheyO|P%Au&K9@fQx<5IvS
zzJ|=`ipL8r7}TYsouWs;*T%<vCbTdbl7AZ7I}*IP_Y-gUzOD^D?eMn>wLWF*uZSvB
zu0oc45`#Cp0h|HTlD*09)vG44`!{*uY(5M$o6%uZ;nO4sl)2!32U+7P$w9-hU*bSQ
zH-#QMmd^e?=lSjX!SM*<p3g+q2S)-nZI-CDrkd&+i^lZG{KlxcwrpcG2x$6_`8}8{
z&hj?}O=RQx6c1dtx`Mj+TJiM5rF8!ePK0w$2ofApUZ@Tak;sd_C!_=1u%BuPvoJs^
zTD#Qrg|{#(LgHdC@zvPchFIxn2Fx#6I8)lVK$+nV*Q3DDh^-t<`&npt1|z^-nZ{{a
zH6m57>9tUyOuBo!A*tT;He-BVPfs`MZg8DzQx?B6JfI_tAg<4+q~@0hpr}3oAJAD<
zZ@3b4$)v$&I<7CTZS6V!hG%KBm|i_EnA&;l;$CqcgFumGGA^RYG~JMuvJLov2luX0
zSvTdiX#db<7n?qqDJ7LrI(|8VlnVH5rfzyV&_p~7LQ3D;;VUn&r?n(*n*eHQ(%{2p
zdDKq;HfHN@q{4>UrBlbHeg*8Lk7lrJ)$H#`O@)LdF<AWT8d^Orbagdjfq>b-7EPE>
zB;}#sf+?gDpviJWMfH1apq`LNEI=Ir2B#Z4Dx;4Q#3>&|SX$7!5lb>2Ek-M_A{lV=
z!!aqh9=IlYE=yJ?(F#(RxCLU>1H*6$p<oWMi;pFB1OsZC;Pn>?4>K0Sdz?j_ref+z
zQcj=^Q2RbOTis=|=C*?lE>0{Mm>(hh{pI%KuHkA9sQKdyV>@KBnA=SMfw7ePMDp2v
zF3;KUyhPAgaKVzTIXo)@a|5QOjZ}r{Fc~oimeDU8bC|Pa9d-;1mL=YySXeqQRF9u*
zfeH2rXNG|$+Us@&f`d$IwZmw?Gb3A4XuG2WOZ*cEgP&VJy-IKT?yoYA@Ps*W+#Db9
znYkz?=bp14{-oS!`rw>{HQ#4x19AsSdT{(4?m*nRMZRk<nUCJLkP@$B17q9$6q~qJ
z>wTFn#2vu#$3uXK&5Y3b&t23hGvW;MQ2ap9TU~=vnl5=hd-gg30273BgH#SleYG_n
zW21)=$Zn2h*`9!rt_zNvtrz5(O-uF=Fm%Q00a&|b8ot%9CguA54boLhq_xVu9K)tu
zbv=Hp|Nbcx6##?}N0KAZ8@Q8W{(<f3dHM?)=?Is7g)8nyr7q_ZOD#Jmpt%(V{T3IA
z%FsSyHIzOVQYMoi|279$wnwV#7VX0vXkSer{JFMD@rs!ew4lbc{Nl92(#g3NDLq1!
zc8QkctP+m+Z0)VAp<X8uhGK2#G_sU{mS~6~lpQ0Yo<k*sZB6e$?cKsu%|i#+Opbxj
zUsZ0iFg#IgGQa{N_pe%k?CzM~?qC!y6=`V}CNVfz9+7K3q?-rU850(c-pcIhSWP29
z2*kWgg2%4rm;<k<EK2r5p<@FksVY9W(rzqZ-sHHLt^(%%G)W@($uBSDk}T5c0I0K5
zQ(uL)Q)2*UcRr01@(SrP;6`o`!H%dqEKlfX*hi+5IMgTH?~t6(g9~*&5IkK_{dr0;
zR?Mk~ldr+wU8uD?WVt+waJK5i4;jp4c8|hR@XW8(1&Yl9q@WlMog^V@jw?^u%#B#a
z2Kk6OJJaF92CMf)13B0x-0UTfHq~G=?*vC&DDEa}+!eS$mIBV~0IH{z9*S&uYTdRf
zv-q;&7XynuER99bL-syYTTS0OFp~}hF=wh|yCs(7i>BbbblVe9CeR(hsqM-HXp2tb
z3nkm3>q%5twBgD3wpA@6;nDRwSBNOUvNwwx=cg}YDn0OP%*<bmO}r&bAR!k9j>#4?
z7U&P=X5EF-VEuR7Vl09!=v>zII)|tTwEx(U1xSnWDz6!|OMc?Qj3M!qs@}7nDT5~*
zd%W^+@F*Qgf_&ENxVtnGPi{QZv~a3%j<0BDo+AMzS-3N1yfBJWpGqV<b&r;wdSA-n
zkIp!_Rdk*R3A6;VCd5GW2b2of)SP3EixyDO!MXrQE1csE=HfnLKD{cPr8UGp_k?Yu
zyVppdvJ6+_D4!Uol1rZztWpRz#AAp9j3fm=a&WFGUoJu)xPr;rXd?X7fSX{^K9SFT
z0s?^+Z32lcRC!P?0kRXgBG1<@s@emQhF2M}BLQIt|0H9GerMNx9i9&5P=HDY4X#@0
z0F@twoSs#dH~#e({7ey{a#>OqR^piTCX}XoWWX;Dn!YhnHgF#CM6UR3PdF)3d`&ov
zR+@lb8w}MVVd9$ckJ%R&$42f&&Jl1^@T1r@!u}GZ=cnyc;9q`RS<%q$BObad5yOK9
z0CM}7jSDo8R2TSu2^VL{W`DCXsAUUEBcGktaywLwYTkzrl@Mda9_pvP*D|!*4g%BV
zU=RQ9Fk%197e9h4P!Tktg1VeWgN&nZIUn3iRqc)t4+AHAh~;dFh?&RNTBLkyv7kO}
zCl9d=N|3U04mgyPP_nd`3=Qgy3%0qe#%?sW4;(G=?Pk@wd3TDI-X3Sy6q}+9Vm&HZ
zJ=r1h{3;Gmc5jZTxJA5)d?)O8#K6KL|Gr@FcY!XP!P#{yZ-hoeWB;a7Tgs~EHn)!4
zrfI-v_3Z#P*i^2MND$FM7|EL5_4mu|$Y)v*_TOOB2)nW4^g}n>!?vo^z8VUT?&LLh
zK}ew0cu0c;+`HSKquW1%ihShk%jsg+{&1Q@_bj6Dm~|fkO!C#&@kC#XOYxW<1i@Zp
zyo_J!zo3A`ZwF%XVIMZeLH#$uV6ObyCn7@Z{7qBf6d8vz_vcScLNACXcZDv>NKHkp
z+M}@Xmm9_byrU{GDmjd)7LeME4<%1p&M~xv>>!yKrZa0kl<Eeh_)Q0is%^(`oqlx_
zrlLvk7w@3Bkzec+T4>gl#9>p8Q{#Mg(V3=L)YWgJ3{bnFV+rU@LM5i@K<A#}&E(o&
zv!n=ExxuU(Y*y>gLQ5iGk}EKTG_LJc&|RPzUt!t^pP!#rfU&j6+u!MG!NcVB0|}Ni
zruY;B^`v1dQPIpshWec$+yv|N;kcxhiaE4(VDaY#Lkyj21{(E{&3gC?1Wz&o%dUo(
z&QA;!p^y3O!uy5`Cx~EYc$Z^^Y5u`>oK^T2<G7W6EnrO=KSGq}RxxSK?4UHohR|h*
z$aG3M095Q)i^U4gJznycb+M1FlsP#)TZ8OV;Y@OJ4>Gh{M}U`QkPOxdj;UYg$1u?B
z%=mregISbhqM^_S=S-avHwEW*e#U+bn2B^hJX$$+p?6;OSmqO-q(Z1Th-dJC9I(tO
z(2LfZrT^~8RHCQvRZH};=T$yyxe>ECV_BZN$Wbm79+!qSe(cM$DK)v$rU(>a2<2XK
z%mEDlCH<htZt&EeHQ7!xphu|D>F7y;H!^^_3pM6&>{o7_+ROZ+X5B?PRkdu60&H*s
z@@^2F5>{Ep=5HHm%_SMzn5zRVzVTumNjc8GN2-l7nvz48qN>zxOpY9DMbCmeO!wLH
zd>mrB&iX1?Y%)@`CG_io`3>@v-%pZP!$tauGr{6$zYkRG6O`38S<{%%haj2^FE+8~
zB(~C!w6!$Uj}sj?TttQp*-bZiJbnNtb00r+Jm+}<Rrq~K+da@2@(CYtEXn)>eZzN{
zzV|m6lf4LRxzn83qrV$bh@pU94seJeB;Or1wE@^m0iX(h*=HINo`q(p%lxE`0Nhk*
zBJV~cZ5qN%(j3p~r4q>x<L~)bBY~mG4L_XrRD->!JY`O-d=SArrEH_Cm7_o~J}q}a
z6Qd-S?IZUjDp;DL-G4^1tf|mHymGS?3J9-;n*~JBx<%Dk7me`H>Z2}rq8JS@xQ}<i
z_PQ%fX3rKQmu6gE4eO8~*i*c2;j06qRpjFInMw!nV=P;za1q#Na82#_EJchaWK2Os
zvx&+e^Z_k1gWkL08C%zK1NBXLjz$@qil$I>x3pHb1s)^rD*gZ`_%=>S%{oE-X<zKe
zBOpZJ!aQ(eS?-qlS{G0o99Laid{?=5p|-3*Os^betcl>@9@fn((Ylth%aXH9gLh*@
zR2>;eCS+yH3#wjM12eoVsukBYRx9@n0%OhJ^9_*p<D-=IfHRGK)@IjQlt?yfNbRW1
zdX4?$lBjJ#!Tre`N0D|O!u$7%q2k6kc$*sd&)<J{G)Y!**S^tUI_{v^`*vs$gW?>4
zvx~{0C7r^7_bS#~v}oHzHt3s;W@Q}#Pd=<5bnDPhF{?*rfsQoOr<ajTxN0-XYiXah
zG7hGieE>esAh*F|%Jnn$;2#YxJBI-aLrZ1m&?V4{61Q1v1ZOhs#hHNvhk2x2M2Cs;
z1uktqMFpn_RvPmFQ5uWXD2_s5ZzZ~tJU8c7ys4s|tW4M@A2HE@*5-_$ks_DO=2a0H
z+KJvfi=Yj^*%lbUh4f&KNi0dUY9O;}AT>tVf?aFCR_$|DP_zG<240%1NDE(3K@gyw
z;@apB1~6gXa)BD|;DC1O5G>&~4A{=seT5tL!UkkvT%mL(%>kBei{A;`ZdW$cjVo7W
zc)rQ<kLqpr0o5p($>tmy`s>)eraUaQp88J1ucqg$NfYp^RJairq4cUVu_Tx;4|qsU
z#Wrw}?H%Q><qD_=tW8WEMQ#^Rd(8Y+kT8UvF_8KZ*ca3oRZeZ>2s9?!0!3{bli+L*
z>b!M1+5?LKnii*wX9~$(uhx`hvyYVJLEh~ZeRsNSl`%=bF%6+()^-&trFzfECm<YK
zYYnqjkXGGRRl^5#e_~#Cr>-^`b0P}c&=8}xrh$>SE#<69t;JL;@cvG~=o-w!yWpSP
zB3aR-hHbLnf9^{RGMS1l(`9(_V01DMuY$)~>sd{W$6=+dGW9L_TIEcxh$Jl|bZkIx
znl!848dUXUSgs<8m0lA+;+9km&^s%4aXBGD7@@hy$L2BWtN!NS;3Bg8+?PSRk`eK6
z5W4)X^btU(m5CUkoN$RvYZ#@SCM}2_gCiH7xsSaFC=6FBjy7uoZQbx*bV6T$aP&UZ
zK&?P|K<{Lmu)=3IkjiWXx1$5m>42^Vy>+?drbTm2z^zt6Qi$fPY-oC>gD|_N2uQWy
z-gN9Leg85FrfdER!p+;B$1+Z>FHU@KXHg9giDpLQ#2ge8a(7U-{$pQvOpmy#c4({>
zRi<jH9%5Dv@27aDp6BEs>7nU%P{a#4siY9F{96=BYj1T$($-}in0Ca4<Iv~^kI8Z%
z^4UxE9a-#vq4#gv=?QW4=s<A-=#ulpKtdD8WvpBD!t3qp{GHe0hHdVQD>Y_8w!krY
z)9r&XAUG0!y45`YvQEZ%O=K<0{l1j8ffjwusOXW>_}h-yKJVe4A?%(bWVxwyD_DGs
z9iP*1d3qK<e2oMDK$&G9Q7Ial?w}Y&lV900!Y0&j$LKRLOO}KSJ~knx{XBA9cnRa=
zkjeWmd{k>rzAf^GG(Ux~>Dq%m+=l;s3`xG0rf7`P_w%2;DEZLbhkA)a-~9#9$S_Z5
zt6t})NkPhI)<y^65!ydx^U3PbHcn#FbK3DaDn`|amsg|a*3%qJU^Q2x%33*@5w+#B
z`V$y!xaiu|72H`QUO2CN-_tYXYSno=hw8Xf<JVE_af;B*C1fS32(xWs^KL<TD*-09
z!@Qhc@055B%v`?U90_fdwjIxXSIHkX%y}`p!Z}1_5F2X+-4%?W0e=VKzY!bw0oNx^
zMiP^&+n$H5$PZhMft(p&t6OsM9^Yt!v11C{^q_e~RzsY#GQTn+_;5$!SutA;)2G5|
zo{JbxC5FXKpw?t0F99?4%BK>A%#s7RGZQSpfH_Lg6{@9r-pfLTm`%$+a!+N+n(H;`
z{cR9Qd<Md$*lqMPpW{+NMJ@*OwN9I%ZBExV6Ay*8>!Zc!^>}n^+F<XVn1e|LojjJN
zh>B8Rxx+G?$VD>>OZG*V;#LqvUIX=FqkHurznLLkBUxKu2a_#WTHrJ{U8s|C{~=AC
z6plIZk|Yz4Y!!=VAv8wruJ>nK@Rw<(Qc&#w8tq1ifii;ROAY5FxkU_9a!^70d+{j6
zR<2-uwFF;?8ar>s8pAptwwOPXi+kGjY$qzrjli^m+Ll$WiL|_%c~1QEzF@qlWW}kK
z)imVom-A~<OhiI+;ggIx_9pTwzVBIRIlE~m`xB<_ZTR_5h*#sa1klH*XX_~>gFph0
zCC#H?I_nZWJX}e!54&RdI9GhC(-<7#!t^Th1bg;i`J_(N>BrvZtiEgCD9uxl<qBGC
zFOf?9L65EhSGtcNcT*?7f*^)Cb(`gF>zz8nj8Zmv_O&0-&eiiFzaByQK6J+_wT>?Q
zOI_s8Uh`@Li4Wx$BgOITRZnf6&up6dUEzY6((_;I<*uu4O~Mk&@BW`3Xode@7(t0=
zqxo701O!Ni07Ci~Mp)~c+x#}RwzK*dN&Gj4xa_`g*^p?Ud;O_$-UilOY7|jPMDFLV
z)VNNe?UY(@k=#(a;xbj|TPKW5nk55f6O>Y2diDuZfAFnMH%)`&j%7e{2SyeMkhm=X
zfV<W<KpT-Uk&qBGlk`Nr9`ydO53ar`>+QtVH$Mc{J2Gd=1`xo*uO@!gAE~bx$#kvt
zJbidcJzM)u?tnu^cdXSeX*PGb@5YUf^^Q7V81Z1KGdKLi_Pz9Ml+Poq_OJ)K{)m<M
zUwFRaIrhf<9Ndf=nQ$({dfr0v`H3%kxg5yXpF*zWy!-QKVX=~=$&-CMJ-61oh2R-P
z&(1{E1Av#gUc?`;ye8A`;IV{#Ek0T9A(zKE$k|{=I2x>x!MN2va4yD%GBjqfPD>Y)
z<83upe?LOuPhXRR^`cCc)VR`i_!-)FzYKNeZ1rg}dtAolvl2{wPhn4)cgrgyzdn@9
z`eeL6NE+MfdL1=xsz%UtRrlp|plp|B>wcy)B7`ZkLOi7JA?+iMroD{}!GH{A#8@`2
zVGs&4Fn@pX{zzPXj^xH>VgIh~CTq^EE;sy8xY~JvJ770x(_tV<39QC$#4-5%$mah-
zmZ8a96k-3_YU{MW!Wo2v4VBr_d_A-~k2Sx05f@YQSHk%5GW^jC3K1;ITr9LrhzlNn
zf^I|NQ(OCzsG$seg)r15LF6GhCS$PZa|CM#!Gank=K{ov4~_U<sgl%`Uq-xidV1zQ
zjN;?m2gDmYW-iD1qU<p9oKhqQy?i&@AF3CAq+3EVq=Fq1B{VrAlB|%BWNrIR9w!D1
zW4(T3G=|91vj@+)s@$7*J(cvC_vsO2WV5;OjA5|Ljw3A!)S!`!<5?Iw3U{Yz4CY(%
z4-o$P<z^|XZOK5~01p;?6LSiMVX<3Tw^>@3JVEE(2DnE=M@b0r9-Noz&Z45NCYbV8
z6C6M;=nD_LIh8`QgEzTQmHn&=FKD)WANTW_n|LL(l*gBP6vL0rqq@nXROMh+*@x4F
zmdDjNE`1<5H1FTFwLLpet{Mb{Qjdfyufe^U{R{y%FEZ8b2qPdnRfNy&-~aw*{l!nb
zeDwfbZ?7t&t}+2bx2WCexwI8nM&NY4x#qo^yJewswZ4_tqM7Y^&3_UkDJOdVn%r>W
zu!Ht1;i1@qgwJg~GnU9)IVlG7%SlKN&+n~SY>!ZQD&qGHW?99km$(z#Q+7L^OBRZi
zi8m3W)R@*E>y>z?&ZVu+e!8#FehRl~im{EcD!Iz<k<NbXF%qtih=7WK9h8Rzx2;*k
zPza1r-7(l5d)_j{;1Mp-{QO@q(c}~`(OQan-P2gz5T<N7G^T9#oXnDBkvDF9)8dCt
zw+O3!>GjT9KDob-_Z$Kj695ho_Cz*oU;10;i5ithPL{Wp3OG)oPwRDt&JtT^aGt`_
z7Lqn*^#$_wOLJi|rfTvGGz}j$(=Wy0@=kk-DZrK)hu%|)63Us3l+=`JmK`iOp_-PL
z083F@najY=q`g%jl+IZe0Q<dKTmH;IlUb)FTu8TEqscniV~e4yMfY=_qGe0w)_a~M
z+pawsfL+y8Kl|pQ(e5B#P0bb+T&?Zym8Ocd<d<4o`sjd~UMVo`vx9mXy7Q&##%0S!
za}KN7vc{83FWc$T2J5^<>u$0kSGDRt&Y%Br9{!K>_8$(}^gz-ci+Wq~=m71=z_AZ=
zYOwiS%0keue7-7Y2<_74hDrS?;^jKA3|`Y!a~H|c24?lP=8)*1k(Vd+wkI_l=xRk&
zy}f0WRf*FmN+W$e4q0@YlX^SNIy>rrD8+?yxGAw-O-q())oRwN7faPbzOttabSsxj
zlTu@oo8XPg#=7bMpuQw%s@NkyXf}Pk(3i0jhX!b6(XS8d?Zk8cQTA7bI|a|1OV)y7
z*fd?L|J<}#csJUtUzu!~r+>+yUsp{JaP6#^?oE@_*KJe4)Y+ZfsjFGaNY~l1#|C#A
z&~J_#>uW5YZ*0YEIqv4EhaMHkUuyUQS&sB!A<x@G$ey~80bKvjpqKwM=;OZznbU91
z8SUxd1705gV>3iHmpL34Yvqc?pu^nh5=|pyw{?7fUjr^j*grX*mK@XOUb?x#p0UnZ
z3)rH-=-0gd2U*i;DSCT8{}AASR>%KPI;`g{AKzI=n;^|Vto+mZ_Zk_knyY%&teZNz
z|LLjq4`%JDof-HVHPHXBzuzc&`q_+<G@Hvt`i(gk8)X+4`l>B_ETPf<Yt?Wca;3`-
z*s4<%2#~CmmPm~Y*NJ3UMxN~Fm5udskT7lR=dnYh9)lG7J7xTQB$jX%(ArkV+-GH;
zkQ<lB%uElb&Ymu%jAlz&Z2r!Ld|-iu^$^Y1vn|;k-PQ@$AnaS%pH5tO6n$f{M`a5*
zVn|{>AURysf|602OU8#<fADDY|Bf|TRjxJRT%lX-K=N{gxP)wJ<k}qSBk<!k^|!BT
z=f$t=Rxg|h0E_w1xMpuNL@?Z=+^(3zSzw7xJFm_mcW44MS~dc*y&A!7L_2qCn>%(@
zah<L_rfgUx8rKNcuXM;W{~;Rxhba9&#QHx(dbMcHMobEjn9V5z6RmVe%v$rtpvJ}}
z&~zc+5DDek$~kZ2itSQoH(M4L6P7z%4tF*@s@~zK!@td32t~pVypz40C-m=aW`~-G
zn3Oz*Jg-P_>WwP)PV3d1MK0bAhz+S;xSIPOaQ=(zl!a@jj4P`|a7zPLvE~0K2r}n?
zf_BZ}qyj+9HEA8R-I{`~@zYb9A>>MTt~i>v>nxWwx?9vQUaVFTIiGY&71=XQ_&2;J
zGt}n53+DVmqCVAZc)Imb^$*E+M;EXcnLH1*#PMnKBWX*FB^_sh!6*yFGgYgX$ozV7
zfbIvKG6M6LNSr(Cck5aqbaVc#F~hwf=fh)&Vo-dpAG^Gzg0vs=l$Ps1!oQ`V$>Q;p
z8?{);DB=(L>Vn(I%UP&N4;;xu__`YSYbB-=C@x<L3Xb_!ujTRYBN-Tz?<*~3Ei=aC
zTqzfqK4oH}-LPC0u4F!4Ss$d!l7s99hSCNFa?d`l(}(X+U14neXQ~hH|4hC7pQ$rB
z%Xto1ZzeIWe`<f6<w{;Eq^0jY-{z5RRI!=b4+HL`rK4*kJ-Tz$EtfUJj4jwKR6U`7
zELgZ`!8lp>#*msx*&iv`Lu|g&4G6P|%o1AT#kXfAY>yLCx4IcW<Z{zora&M;xJELX
z1q;_|*QWDCI|7L=Ijv>y+3>@=xP)g(ZJA@cWWBG8MY)ADo9s)Ofdud`eb)UTfX$q$
zZCg90$W|e$Q|MmU2>v&mI<||}`+mOQOK0cuQA2f#)Jb>k9H^sYyNXqF%4frB9kf$(
zh1B*UeyoxiO!mIzVQgdh4}6nZE-Y8IPoWA)*bwNecsB%Qm)KO5E0=X69Q>n=bYj=l
zC~@rwBFp&3IEk%zuBZ8&3r^gz^(b%}9sUhu2{aRgwsnR}x8X9dvz$|V>x0DM5>^12
zd#C&1)p=qnda(P=iYA#r$~jrvL^vo_6f7|6R)Dw1Us651#ij18(fMxd|45~e?c)8<
z+ynJnh1Z{Ss&`KJIvBtXlB_eETeiwJWJA^9g#Jyzll1-^Rxq*ai|79NX<RzeMbE>!
zbZ-$`8)q|OkPC=c??UZ@_58}Cm$@v^RPo<9@q_J8qEme8^Y)Vn5C1@L+KZ;$k1x4S
zlX!g;!ee0usV7><6o?HQ|E*-$b<nLu(XV)kDrN|6<P(Ceh^#HMH6Of~E8a?7PzlJs
z>kgA%6HXxVtMowpGj{H&lBK0zcZS*9P9u5J`<n-vU=8zxjI<k0Tyk4Atrm4y;<eRq
zrfxWwm37>s9|O@Qod>50uk~_vT!yp1?5~mN0)EWm((v|WI_Da*>2ykkg2Wd@Cbe6a
z>mWh<w&67Dd{=(m6=v_V{1<PS1ypj1%c7>PckF`D1;pC81U?A$3DQ}yRMosOrQdn|
zI2F>9d{Qsx@c;0NF>h<Ek}`i?aAbj8`|jq0l)0-$$bflGob?(F_p_}RoI2J?eX16+
zrZJr)vplmRv)-^H0=CAix!_hsx%7M+Zdt(YgIo73pG-=(FW7-Rx0iLU@h?P5|7#BZ
zS(>d<;!x9N-Q1<qU6pyup4wsqaQWgzJdqWn<`g;y)|5wYx%B=h*V0*(VCqo&DAzIT
z!f(_jtF3c5O%uH7$8KO;F2N#;uMWed3?S~CfJ{J;!V1kD!?ZYfxbuG%7vepfm^u72
z^jx!AztnmuM1Xkp_E8`f4){~cmNf+4iYmLL+SA1cvo$SX=%45(i^H62GiX`l#)cx(
zejC7X_mcTi|Ctix50F0}o4|3F#|}hp)b&{m>nmo5njvfl=``=wzdtu=i7{>C78~t+
z1)RPsv~;kw|636pj$7%qlSc`&nctaU;!vz}#{yPh!ccxL>)Dp}Kr2pE%JWr(-u+o#
zQh9>|!-UbU0e+McOfxP7cIcg#fuS5^@^>8rh_%G$t{&5qtu|zjbKf``2)NPB&rtF{
z1^fB#SRv!5Wg=y}^LX~}q|kO%F(g^@F^&;|h_jvt$#H7^)fYF>P?@k3uu>fnr1wvh
zHyDxu8}WJ%YKz?=11j3E1%S>gcon_cY(uZwN>etCSR8S$Z;Tj3BPd>GyMvasN|%kX
zf|>A;DC@t2t!&cbZi;L%Qe>#CCZ1*uIoZFvCFIyEqE8r#?0%a(-~dXxsxJ&(dhC|=
zn+d&)=T44DeP2Eb6)PbH{ul0zT8$S4sGPKODq38fKYfjOv!0!yY<M9>9I{g*gxG6G
zlVG%)D3%0Yq#(VGRyaZXJT&ZIyF4sc5nRxxusww0AP~%U-$PxT*W?O85fR^s$t3Zf
z>Eq=wyY75`yhbnpGr`1`S`M7nHN<rvo<EBav>PA7*kavfy5~g!4_3+vCJMpXl@JL_
z33p2NmP|M+;91xl)px(EL4k{exDB}OtvgIDH=~gPI>4bP5B!wHY33`NV>D`++gIz_
z4!CFYZ4Vj69ntC-$mq?X)T8|%APe&L90gSbKiD_pHVuIG8E``3-1O|aBbknz5R^(*
z<uHQ!wS83lr*dhx_x2|e2YD)@fGziE6-*t}mroj1Oe)IjFLZ_2F3!vMW*zNhsUYWo
zVShIz$}A_qG=kw5`!5m)OLyk154X-`BjiinYp=jLlJGOXc=M=?xxP^(|944{an$b*
zesNQSZ8^U-qT)NvejHz(JKi#i6ig{kGvG${&)Yy&Z0&2Wkb$|yhjx3s^>;g{Q@Tnx
zfngoMq;EI+F8Y;zEksGLOC_9VR{nTT$x^Xh*3FkCFdblUY5|$VQb4RgB5i6g3}fHO
ze31VaXGyc&{1R(4%FJu@v1|KnbgQm@hF*35ep@XVmi{J|7wJz{XP$Rn^O}>~E|yhQ
z$xG9n0<f-*oPYm!;0b2`HD+k&$kEY}9ID1nY>E|ow~?Xx91H{TbrT$^`<(lrZEhmg
zb!`0*fg(Bm?i9Bxm~vl^<x3PC?iy3u-A#;o3xXTh&?54y+i?uEHlWAB#p$@J8$qod
zQXKyCK{oE1IKiRaHmN|dbg1&8oVA@ZjA9B*(5`R|pG{K^L1uOr4@`!`O&M3HuNCgO
z*k<P%c)|tRrppi5yQ%Af6tM3|;?ciWliW{!R<8HvWQSHft`uZ8JhpT=B*k}Q%ERu7
zMc+4>qFA^z;kIDG#<VSxm}XJEF?KFkxHV%@t88n$#Pl!6pR%YoHeti^ss4ro2PPfp
z^<+jc`BvN4^HwbmD5fCs7CRo=213m<hqt&Q3)!@0IdAR(h3qH84AZz0>;^T`2te@-
z24{^+ua57xGK`aa$+}OiD%Wc+zPg-e!)0<9rCR`c6qLyfPiECh)>Gul;J$`seuCOU
zog6h>h5nX{V&}shj22#9@7qb{HMFzUvz5nHT+AKdgd=E7C`+&G3eyL7QQA<9_j^_g
zueie>hW8l+#*wexzoVlGwWG_o-lxCB&60*=b5UDEfU8KmS2-c55IxaM!7ffRBxt|2
zCq5rDf{zQOlAC*`)b?OXVov-ioC}LdM*i|#pD9MQ<W)S}S|kX)ESfcJxUZ&H?Qy3L
zASD>rSK0%ZypSv(58*|t1wWnoNU{~s!qf$=#n{GAE|MvscfHiS{35ec3>D;c^lyYX
z*<0}U^o|x8J_0%?V-qb}VFF&|Ds$F2b#cM2gKehiWUHHm@6+Ix>$PF>A-&%O<<?RQ
zteXQ^ddQmG<p<N3v&_1dG9YeRH2BOwDmA}W);*~4_t<Fcep)O7S1i^b^r<ZcJ3H<I
zr6J8qeI4f+7HH~Q<ME9yY@{QUW&|q7;u;e3u6i=oD8cRr<d`{x?yg4Lw2F7^p5GXX
z)B~?>%zm1@$mFqg;k0yG;tXumvSrQJgxjC@1EQ~czX(d(Nlu-(O3abdf|e1z<5U5+
zvvs*_vX#~^R&^T9kd`?8;PoSdKE39Q&NKX@L9tT6W7_OQF43X}<nX>M1V$8|E3edx
zAYd$1*KrN-p;K9n@-kHbIvcBx=~RjpW-8y=r<V=<D&vvsm(F_AJE`6~VItaqO!t1K
z*PA*T)?3aI`5}IPVKN$(m7(5&hhsD{oh}FRKXnCuJpihc$y4?<W_b9hLZB3FwTQlN
zhAdAO5)zgp2)nEy+_Z-|D4YVwm7&yCd7g{~a7Pb>ovgP_lc`SNWBPX(^trOvH&|KQ
zhymc9Ff{MLQcab{TOQS0UK+|q&a67LVDV4wu7DeD(-lPemjv$cGT?gixJ)C6QZqyU
zt<Y$&FMhn{*M3R}-T+EJR`iKLZ5<iVS)PeRNzWAgG6x#T`QkEs>c029<`0ADJ2C^b
zbOB-3o_pb&HmirMsM;Ihfx70KdKWZl+tofVh!NHoS3Zc(8rFQ-ft~Q|EL#%LIiV~W
z8d)mk%*!jBI_Fq*;eez|nlY1<E8+oyCj4Aon<^+@`*~^aUD=S@n3~$sL$33;H!oZ~
zo`oloKVz&CuaF>JrsUYhwGA1f#V~^prS=VOJ;J94u5?(O;po<0@k@j&ld0V7bpcQf
z55BqTB(E?#8dIhJvIl$HZ#a1QSt{O~uVb!89F4qejxUAn0MQbBU89^QWW?}Wa<6F#
z*q>Ki43qZ+T9A?PbP7V%U@A{vST=FDnQXzlwCNjA%ub3aolx81ze8s<Yj8ZJXn%0@
z^c<rW9!|=5BkT&^X0tH4-i2yF%B%4>|MmT``Yj4$s1m$}5y521)zZdV4xV~j6c3I2
zfqU}++w}YXi12*k9<P;H`Fq)9;Q~UC|56&J#{&ja(h_+Ej$yg0n{9%#6}*1G(GEi@
zfoc@c_L$Kz=pIIZPlwrav26Pd?=<(z51P%$Uya~Yzz0}kB#bN|CPbDWfv1gO*;bAY
zADFRmK8V+N|4irR2zB1I5>(CM;i{+CYyGA(Hf?MeGzRTvvSmzVlTL~j2XHB0KS#<w
z+zlU(*;^2NA>~6pA{g-i4TKcj#YcT<g3J@mqNpLqlw3E5_DT`0eS$pnzig(*hRTA5
z+s?W(t%`uNUmq4%F;tIYB<qf8Uj?}BjzfC(_`YCIN9%3}N*;Ude+ZkjN=eE2+&RRr
zReds890-OJct=ZQVu=&2nrsZ0ez6Rl;OcFQH>Ml!5Pq$N(Da~CYZPo&@lFatmfMIJ
zA*|wGeHYX4<L$u%mm|UN`U37eWkQ5ZVGGU@VsL=620Z`tt#9sL@%MX#`xuWmVn6&E
z&Z1v53|J1^J_cWtNN?q6kZiHRifm0H(BtR7?d^FG?=v?w;&Rbn2@7>48V9^&I~A+s
z9<j6(#aBo)*PGJR$uN`&0U?YmV<02?3*?bSnx$FXjiY9n-9i-VAVNaRrQuGI`w__e
zRRnfgDvVGREKjQzrxL=^-X~OfCk>`yy0JNnqrpok7H)8oNP!<uJ&u#P_?gFf+w6`<
zaE0GnWq6V#B|<vNksizP<B>9rM?{d!of9`LC1PvX%uW7ibnsQZp20Ws9ntl0Wa-F)
zU$gW;D9sHgjr4dptT#evU^2lXexGs7OzSkl0<2UG<s|4_v*$of(=K5(H+R-|o3WR<
z@j7R>b-@pJD|pD)ATF1F=XuUXU6DTvZK_LXwRZuVQXl!7IU!KSOIEtOf&F!iW2EN5
z90^Am$Mqbm+MYMGdQ9_kFhY=~zYi2lj=M+x-hcDx!G8rR_a0!)9dAbtnt45i(7oP?
zz~npSa=6wPsnO22M0lgBE<5Op_JI|s59YtDCtVZRIThEF)~OHYPVxaWc|33-6qNr)
z`e<GB?-Z!Gd2M;jt}PUJXHB0h(w#O#{kpxXRr*6dk7LOc&yD(p!{$AQu#)(0$J|&}
zcKtPW6#MOprGgV6(C9)TZJqKOO~sWA1oumfW5Iv`Sw|5h9%>9tjJDhl<ix=lT}*dv
z!}J5k>X#MiT>IpV-U@Qmv%))Hr91-AE8XoGTHY?UZg@5RnlxB8Q6L+dDqM?cr^La5
zM8Ce3hvs=8YhyYW!YFR``v4b@0mKKMc4{fLtWyupZ1Dk(6>aYM-gW+r%LQMFu{BS;
zIY08pHvYJ#jF-pdj{9oh;e#%DMX7C^+j!^*<c@u)O}o4|RMPUr+bLi{kfu+k+_y#I
zhX?4<viVA-Nd0v#wF1#a%KJnP_?-uI7JY@KR=Z=KZ~Vg?bfr=v6Z*mACSB_{3Uhx>
zZ@@2Vaed7Akvx>(#24gNdZN;h!4y~eZrWM=i+0PP&~1NkZAV^^F|n1=Q|YOWL3z8^
zb$`WKKeXQVoP(Wy&j&G|saDigb%v$rI{)WbOgkcveS|>+U<!iK=5!>Eh!Dx10$^qI
zrh(AWG#5r4JnZFW-SAlJL6Zkj4d#|R4|pji#w$<Frc~s_JBP)5%=&kRR=D%J<Oo|*
z9>ABWf$wHkVqKK_?-3deJ`<!!0G`+g8oCma=J+c{%f$G_dV^rh;SYM4*1gQrD;oq4
zcIP&yYv0NWoN2#tg-9cf4oTr_{7%kL^IQP6iv2D$+$rvLs%UwYY?A|IH}oY;EtMQ*
zfz_iXxV2*R(eSW?l8s&I_m*eWcH~E^2VQ4Mw5z+8Kj3cbU!38QXZ#2ilMVwPJr!=u
zMN{ZRr-@prc<X7^iX`>tF=||)%SI^VXdtZ*H2a~CS+}NYuB_ota)%2Yw?p!L`X-h*
zVs2T1TZ#%gJA>n85FA;El*d?wbjzd<qGy6O;}Di8R6b#8#JooQP(|d#;w~eoOPGs|
z{U~n(dL9r1925xAZf#RWO3B|`^}<EC&C_m7=c+L7Dw={nRlrhyUF&mSX_$Y5S;i^}
zN>!_nq$<1Ki3DGYGRoV|8Hs|v9<FQL9uQue{3RXXwGq?^rj!bj%|KRtaOqiB7&HO9
zX>=uH8FS~SbrOfSMK*mFi0sk*7$p*W69oCsKfser3u~<vM7#m$2M9H#DHr|)60o69
zA(den&ZdlReoZm;N_qNSRj>ER4~O9C7*b>vO3@FhD*H(m4(FBgEUH**LM7<owy>|a
z`M}cCXd8j5`v!_I1Lpw>aDRZ+k3x_VbBkF-3^g?95@f5$h~|Vo{2Br_m|qilgS|u*
z%|PdTFS)PB47lw#0|o-OW(B$cnwQ!+E-^0lsWzX*@$>i#O2p6H)N%l_v0L-h;6JHS
zV@YpKICElji3O{r+EUEr;!JS*H?ob@{Rb$aANSv&%)B79q}%9`H36|k`#~9TiDd2q
z?#HMV>G?rLvC`xAjOlqn^-eXQvmA<UIvsQ#VnQ76;!Gkd|8|^}82c%YI-tkn1MMJD
z>s5dkyH$6Z<B3Kak}y}&S1>b2GXZ=};W0u<JAr0n#Z|ZrJ9$;A5hq}cB~m=5J9&$u
z;#e4qW|0eXlSBH<Cp7#Hn~y17p1g2!M&eu#ZYM$;UD-Q^0A@kC{9B6n20}YYThj(i
zItxsTvJ2n;f{leOkMu~5boV71aLLqcdwl?M!j+Jn@~|DmRPe|%lHN#(<N?wv+#^SW
z@R;{IYmNSuwnMzx)d_!nEhXFho<6YL{x*UZ{O6<hyY^?aEucH_3;YES-Ab><d`Lim
z%x|56jIQ5IPB~)%35w@_&x>v3r_L(BAFcQCmSRYyG;Xu#jxE_U2wTO9fRw2&e7$U7
z60X-nm&cB+@Gc%d?}*H;;7@z;unV@1KK(X}FLt1g2s-p~+`x^Khfef++`8h}(jwc6
zi4~xK0urLJd%py*K!mX+gV>?TAzcse4I=Z_w52jDNW}u62jivmemum*rxYxV@uT@O
zXaO>o!Iye;^1x-x_(pln9&RVCuFGYQTpckA<FrKlF4EfkjR^8+ZJYb+=Qnqn8wQ3)
zS`tAeRk^wfoYvKaq_6uN@A1h^|2VJdC$v}pAEzt%t38>HgNapn$xf0@z%07XP9q%|
zeUjne9I}Atgo`r9_aSe4F(g|`M}3)icnEIEfkvy6G8>jAfl~B950zDF!nOUTQte3{
z-N61Uvz;u^HS(%99yTuw+!dBM0WrC7)vl&R2eW#6jQz794!lK`Fp438T<EA?6*r5`
z?#}mY{WUe?ptcZ+DC>6tHj@_<)g2Y<GVHJu7w&Rh816imFh4CwXaH7t7zW4=<=djn
z@2-Y~0}q+%2Bwdqlfq-N)P*;iKHMt-JceTVbYZw=>f$iPvoD3(g}%1imu*KUJ^pW^
zNw2uw_YOCM^c|aLWYw!Q${dYr^dmV$JjOh72sj9<wV5{qVGn8Em%bN0U!v*003Uun
z>b-OnPngPmGax*aKyLfjTOaH<(8y8`qED6~h|o6%`Y|_<SLV$LMdrV6ieX9&`;DAJ
zIRiCclzy#-ktx0DQ)K-JkdS`To#_bA`Vx@()q#cMVABstPOR~0%^|2_i9&V^eld7a
zv}!M<kX4dg)~^n^YfwG@6Zb9^KVQ9!L57dwW24guBk*Ct4Pk_!DQ`}IATbhAg*7;J
zl7hwSZBt{ESyzWE`J4K1pc_Fqqozcf7uxS#&4PUXgro9F!$_k1XW=cIXt{Y@FQA-Y
zO@*<AT_Cq{p<a!SR_^7YqYW~vPDNW53ulxc{`3K{lugPCLVCq>AV|ZMX^OQ*k>aiH
za~qb@4`M@w)tN1-+HPu-76_YYBpJ(JerLHV$VH>byBhgZ*Vp|7;AgI6d%QlUx)A{i
zKp0Ks(pSM80li;D8Q<LP{9t4wg+055$6>EXSgWHO;1rReEB?&{n>s&c60~?an{B|_
zS9QMv6M2CQQ5zZkB?y1bktQR<onKdBi;PX<L4loWR9pyDm~X3X(ib{|)2iXCCG0ub
z<50m;0MDGXsniWDWkS%!Uhf7GO`4*b5nTRA@JDhna*&~{;vpe4a^N*=J$|17@hau=
zH5%l(^S++RJ5D%+aAN%{@gssMCmk@kL4mZ{ew)pz>@pBXN!>_vfS-l@Mg4t9bxI;g
zcuC9IXu^KZS!4msJ$6X+zS`=YPV~EA61L648nMAB1YHl{*m0d)_9>P$W(E3Hsiw{F
zCr3%yIX=?$m_3b684$G??8vcf951N^Q*rjUETP!E7UY|<M1R3Ku_K|yWXhENo5c~c
zz;|!c)Cnd9#Wm?1$y+0jx!)_`xp#8gFV5i4T^oC#tP;E|$)4MRe7<%C{QWyZg5C5=
zj^lD>uc#-1njQ0bp(|KrB$|gvRe38xrMp1aI*;Gabjfl*Yql+r*{;_L4c87N-;U?v
zwM~`!6r4qcQb&^$X?3EcLQ8t#L$BlGU;B|=fkpjv2U?0JNfm+m%ZlN*Q&&t#-nTeI
zSE=TM?)OYaEUuKLa)Zw#h>Fo%w5Ev-g)#o(ccy5;?loNj?H_Ods7R)HIzh^+Pj8{W
zVe4(^MykW9SWgbkfm)&RbDUeKQeV~sQYagj)diWNTfOuOQ`|9tOw0>DTxW;KAhb#B
z30JWTQ{|oXjYzIEnzZxMPN6Lj>4>u7H`%&B6cUw}n(q9=`obC#^B>D5)!RzfnuT8#
z2BZaN|7lZb!Df`&1;;J1Qc0BP)I<^8M@yfFk?U@&SbGzxR$RS0#Z*KJ{r!4ULzk@A
zm{orR@ptArAi6cplT3G2F2znV@q-gveHov-y*1?N1cPbNr{CR&!|BQ_REE9X;DhWr
zP|T6vo^->%coGFAY4LNPgR)lTa{QY^hO@~wKc~bJ-4g?s<=iCKegb%M?mt~T`y@_<
zui9GifbdUt+W4>sgcT!$3_IAnUpC}cl6P`-qH#JkPI94)CHdkfqNbd~aYATm_={2l
z@fzr$B1s%vp~@WT&wA&mqJtzg%l)xAtJm}7Y%_?O7(CVf=0j=r$D+&-###)FJB8JY
zhLhUC0m7@we%Z=u@vHGs+gpC?IzY9RvrYUEk%-V0;e+WMiN$bWf3s{^m$O4GwxBhk
zfb-yORO{klt;Eg#&;)J0UULUpg0nm*PQdU*KMEg3o!K=}E?cm^-h?~BhCmA#g&Kmh
zgA!a#G9+Wd4G02-aVRN|f_(MD?-%46io?;yFb19rT@bPkecgiAAu?x(GWSa!G5uY$
zTg73ia_KaA*7(w>TsiN5c3Z7PvYfSP#wp?-`h-)Nq6<Fwy+-y{tmu?+PaHyFI0Ue7
zARLlH#x=14pRcqum|WVi*<FQ`_}!N_&;dGu7x_b-hAVn3$Nnnu%^6DDnCPc4KO!8B
z;X0(}3iheB;Zqql;!jG?W&3(Hl*~F_G<hG_c=DcN9Kv?cHg6cBkARnC@7YRRtyQ>X
zyO<n)G&u}mdw1?(A!`Fqtih~^_-WP>I+e0e`6Mw|-h64&yX**64kux_dh>jxGkQ+j
zA8SwTJrwk4V)PimtV12BJf8^cVxOk2)%FcXE(i4|N>5g<>hQs5#IZ5;u3&AvV$Q<2
z%bXPl%eLUsuY9>9x(YwYG1q6QytTn1J=%l6@*+AVeXVH7oC1ar<$DX~oGaB$jUTe$
zR@Uf6%j91bmF2%x)Z;vLOIGYBjUC1-jm8bLmi0gn$g(Cd5~Y*6Ny}(h9h^Xgj+3Nr
zBNgyU0&COMmc2M61JQPB82q6{EZws-q$qk<jd;|$MAN#`I&HrRB?1K(r!0$(rt@nk
zG=yu>7_=Jf8%69rGy&IH!di-YfHWB{Do2uUDz;ufvMs}X--M@`!clX^0uAj}QrjiT
z>5f4@WEF!|tr<565H%{t0-|^!QZZ0=>Wy%hul|uV*4x}?yih>GVA4^^)~Uu|%0e0I
z1@EeYnrh`T0X#%qGoefAjx$7bM`O_Drx=87nx-_(Q9N>}tJr=qsTK}8Df|tl!K%<U
zbdXz+1k1537a8y^+Amux(!Qyst#0|J8P6~&&d~-ZU-(!1j=x1y*aP{czq;ykXizuZ
zaxtK+tMsJwP;8e5I&9{=ep4nbcL>do-2lYA<2v8$=HJy12lK4uHj#SM>qcfq;d$rQ
zKp9E@KLDRVV84k_A!h2ZCM$;bcv(VL2vNUb*A-o;NStaKgNE&x0|HBSqg`v64ZGHB
zwOX}dz23H4-ClptW{_%|$SeU(f}#i;mF{tbLkM3|AxIz{uz&M`R4x80>^jzuZ+mUK
zNjlwOqc&{RhqYF#S!df`r{3*02mQL!=SQP;bQr`yoPHI3hPSbo3wqtQNV_#?TX1CT
zf`%V-;a?^(YbI%TTb)MRwyfsbdj0Fi_n=GsFC51i?=-xW-!15Kr)Rf29XR3k+g$?d
zQ*&7B4LY4#w^<+Bup4c*hl92CSy(?qBZH#rqKvxdaWExibr7QNGYLJ1AWYTb$wNOZ
zT36Z8JG{*;1p}iCq#JlJtnp-apT6B4EssFutFiSp2^agGE|k(8VB%S5XiP<^ICrl-
z*TWTz_c(eG@8`+ck>h~A3>I}XEL60oVa2Gc;+{4xw9_etAfVMeHiCHX(-)^lWC&Qv
znJZrr&YCUx%J9-tL+@t)2|v3Z5ey6~f109j?1wF4E3B9pu2f1qQUw8(C@0ZOP)c#K
z0Ib(>WV5XD3j*xA9)L5%ZGpuQRHSnamcbB$s>ZGr+bcZBJHI;7l#~gRi(^|QeXI#c
zjP$Htn%YboGQIOh@5bW}9hW6A4o6rk@cxYM16O1-+U%gDbx&nye)!zG%bBvXtkcBq
z+0CBagTrK}RcrOZ0n>AAr)G8fPP5l<xBLCUGDet>@8wgXsXSr0!8u@0?3>sA*W%`;
z#2(ukfL~`5d+bMIuh@>huPZp;8Of8nl4sYGJ_VO=aVTA|-ALT+kk0Av{^@uW3JG3d
zyaEEs5XkY3E^~NTXSVl%dFDa~5WV!v{CN)54bk>6ZZL?*@ZN<ZKAfg=3<W&O76!hF
zYz5phfS60_^|Oo-v?e|^zOAuqNFgOKjCcIQ*w$NC2>XuJSyLEJ9fpA@P|)ki8@#fq
zW9p8tXk;52>zs9zJ%y67XJL$2UK?<<v;!AV*Z`=PgMLifl_@Aw{2{z4Ss!<Y!wR3u
z3zeG&@6LuH%OW7#hwypW6-HGOSz8eBs;&iJHRO+i2T=9V^e*pL&jk*RW&j3&@rAAe
zGK*;PBkc*xkwb5k)7#{8T2-2Gd8a2cdgcvK*!n;>?i0kbrc>+wYDB#2*-a(czdhrX
zQJ3Z|`5p~djI_VN?jd%oG9B8__D3dsG|>&|a%bRK6WI2kFkn->U^qh&Nizf7r0KwR
ztSMUHAJ`Cp_FRG@<|2xi85Ch1NmE6lOsYc?Z4~qgiz_I^KbkWCg-s}f*|fIgvdauM
zVq(Lc%=${V?HpRdo+K}f3L3HH36CKQi{s?6?F9`~^^O7sSW)0lx)<)kTVIY66738e
zVgr}6MH$Y2?sz_aH)WTPj@@e)Ee1a{*sal2zS?NwV23fE;iXLVwXLrH3N4mJ4tx&-
zmnc{2^+f%Zj0D<t0ljtl#}yW8_Ft)Ai(*tVEkJ#H7}1hh<5R~?`64^3A%Z=Gb)<Xi
z@Fx)j6D)HyO^OJOhXCLx8wh=yyf07dy#^T6m&|(ft)A+ZhA9WIOz0(6ik`M(FbJ-#
zQzT`YF}X-)lSZXaV;$sGs~H{RuVX{j?OUOFSkTd^om4OBD<j!T!7dh?^6W0sk{Ml0
zGmd(hDHoW`1tt}bpwNO7tJ=s962{kvjV@KuJ8FFd#SO-~@O3j|CHtmz-FVTu^%_nM
zcNkCs^bVkJGZw7%L~YrE1&c~B-p|2<=X_kjf4;t-!TvV6czh%_ac?Qc0t<?t>cY`1
zB$_q;Y{YA3o>Ib|eRxd+fX?9v8TIx6Oj?cBem(q0)o5gPIoU!u6s=amu_T*`2B~Z(
zdli+2mfhtA-AK^PfqBI<OBnAn77~`eO&bEFvl3M+VX$*N^w6`q)JrKyc)XK|7qLFZ
zHy{E+Abmt8Lu&M?L1%M{v?wJ)rOU&URxIV949Zs(`XOpy$!R2$2qA+PXe>cExwVMP
zGMba(8b!M-d?AycujP2GWi#;?qrP8<11$U(xRpNJQ}Pe%EiY0o@JpT`%LRVn0>8w;
zlm_Gh%n>e;7&1q_(61+?Vg9n7#y;wX1xjrTV&+~}CH5%MT;km_yNv}aRc78u=>&^+
z{#Ag^M6|Z-EI6sKZegdT($dq#RnEXws;GpI7gc-rugAYAsv+5=YU2E)T4`oJ9M#B_
zpRx9Yf~RohNUQ(v|N5{0H#*hH$L9rY48##jwDEucf6=ikuML_h6-?7pGMi6f?r{Uj
zw(H12v@DJWjoIKyaC{PYyECvygBFVq0QoM~8}(X4NqgpxT>G8|%obE-k5sI|3xAxC
z<Y<2EDLw?JeWFIV#?oD+s1e&*ruYxn_gL|8SDF!6kVQDmOu-acW)cC1n8Yj!TJ@|<
zt7?_qd?0symg`aY>t#6D%T)EH+Ah`hqo{4ki+`_JI^%xpL|qzO4N*<t2lQt??3_gl
z;T!QnQI+lhsSb=P2`}tZTq=q$c!d|1c=Tv_m;AyLP-vz0+w2-9L#a0yMH)7Gai5E)
zUd>io$~Li%EuTXAEvrT>P<k-YETjWe6&L<#;Ih~%8KHf7GFbVN4*&c<b(a7HgQpQz
z6#-eCfhUh<8&);}&*8PmhpQ?g66azuksDW8PP}BKN_xoX)Esi}n8=ze6IJQ85t%%>
zYfhq&%E=d6GU#P?#%MrYO75gPO$KCSVu=$V;-xr|HNXc+weyMh6B=n}zT?jUoVdX5
z45r!&+G>sOsmYfA#lSzHCqdw5pmnh(pntC2Ym5HKbhF`0`f0Rwhh0f^QtdyZpQ+H|
zbSji?ICicBu8=>t7n_+q)$FiuoPaW!df>0%AmoRhqy)X>(5lg`H7#nzqOvZaSL!>u
zq=FINqRfYsf<mWa6+RbTLZ~mOXu$WPmNpPy!q#d8t3iWdSO~R4v~-3(F<YrFuqH2g
zI_P`U<>CCsa+AOP3hV;ESdO_MH`#eAf4Qmwb;feh1VXdHgzrxi=qIr&y8(2e$O;cM
z^ru-3dA<W1NGR~mB_k)ZH@v+wiNeqx@jl|6c1mU3f+m6|gs$ZQ_=>4ZnwQ=1zDy%F
z@pHIc^$cwm@kM*7B|BrS{=gUNq|ZBAHa{fR=>@^WtMb7zbtF^QL99!xp6W(*qMCes
zjrBAy(I5pm7|6%8N#-Lgc;0)m@XY~UyNJ^NJgP1TZzrV;kjZ<@rIuK?me|mtFfNfv
zk$mRoL|J=_0Z11#wIWDhm-)y-D##e4Z1YoexZD<9B=$%PH-DT)AIUYXRt?`usT2hr
zS?Cfrv0~@Qf6#h-DmgjBU#e|ol>TzzW)g3sr|XHXB)6LBm&t~s&t_~g6<fxr&ce;6
za(k-STE?<=X6o%1=@sH3>vDY3^paKPw?Sd-?nX#Ndg!H9!J5tkQa;Q+@rg&(nfVjg
zl7?Y*@-}T3Q2dCKQ5Caj3)H1n=Ejt;CSX9Nu*Us%#f6ntO$+OmNL9k+1;r^Qrj)8p
zIG2={rj4zXD+-lk;<Q+v*vZ24y&4U3Vx;k88oXZ!iIy&%SU~dJ@EUIZl$|3({OXzF
zCw={;d!KXDlB#ppxAG0w18TX@O%@*j)mYY23~2!({&#X8r9}lx%N6a&6^qk_rK!&Y
z_b$xtv2p{tn}GJq-mypa&sT7GS*XYOc|L*bQD5{)C>|LzngMx9Tn93=U^R-XLCK1e
z(=)Rc*nXo=OAQoMmugL>l}=RNqnGOJ0n{0$YXfjPb^IvW1@=JhSf=HekwDcp<;Z1P
zp0L<_%0`iYpN?8LS5@ogs%qVQCTcweKV&;Wt*zV)JOZ%0sHEE1ThdYx_Td;jty6bE
zbK<;kBf&!f&odlC!tK*qd*a%xge0_IW!Bo*pE7Ih5?N~-8_rrA&$FeSvG!@@KYDgK
zX=SK)b~f7h-0)1a!F<3zv8klA>Wp2*5+61mASrF;H_D{6GBwJiv}ICS)t@pc?F&sx
z+t^f6+Qxd5(l%B|N}H-%U`ctNNog&9g2S6=Y;R)j?(NG@lj&;BGFk0flGUET4ia``
zc+5Q-f<*ibJKTWg_lAd8;$&@&a1Men_hG;;5^hsE+k6%jxu2g(n%h)@<D(JGxGXHX
zd2iKYzmgw^Dmpp*O!03h#Xq%|#^u3*4>+61vs?6lNl%B&>;ozf;}@cP#b#$NdUa@a
zW6ccT2Fe>g&$$5SMVgkC3|$WcrbX)1xIt;!H%?~84H-?Sqh{=TE*#%Pxar}@y1r&V
z?v1%OM~fAWm4WidzBab*`4=6SZzziH-@!b9ufbuAexgcaW+Nrwb#%fEL=qT0yAzDW
z0mjG)^Tgh|K1<yZ>?_Y9i8b>WC=Zy`HxemC&IxJ#FsS-awnsc<Hk@*r>Pl6F5*|N>
zVeV*HZ?riws6KEr{;2H!@dv;|!5<4hPR>uiecRppk!4JQ!?3dWThB=smL`b>5Whk?
zLfzhv6k>vpaAH%FX;gZ~(TBZsEAV;IhRGU%4`(#dG0w0FrD-`b3(M$WV*q6d@hTBn
z_V>k*_auZ3PQdB#7+B`e5LCDV(E-B^ejIEzv3B>O??pBLl0_cio~YETL*@7v+&NHW
zL5VQW@n}1#I66EIj>waONmbPM-X#_VOJ_uwlQWjU^DSHMq+md3)<DyE;(a<5rP?Mz
zx%S<Zz~7!t+4t<i{5iYm8Q6?`s`}0@8ZC9ffWTr3-M~^mgK}3F0@FW2(P5;=JQc*k
zuS@0M<_jYj|F5sfl#$n;(!};OF#Po5#!^#)SGfSY762zk*nC~t5x{rPQ6ujh-C8c7
zghxc#-jt^%J&xJE(u*bgqfqa(mC(4BRgso@>j4ZIR-zA5B>kf~So_h)mC8__+-@Zr
z;|qpAWe0{M+`P~|6*-3S;EQ`@lL;Gh);GYl0FBw11KK%(B?k0AQ!G2Wje={0-mA`T
z_rk1qd#b6T@62XX_giew`N5iiKl8fqjI!D|r<A%(dez;6(y)Y&oV-sh_#AD7`C7$d
zs8ASLpQp9My#y5_+DcYw1q<Mx&q{WwE>E?Svxg*DT=^ED70;x#9&#y|Gx@0W@^CLt
zc+$hof3~Y9|I`F0hIP7tln#l+vD7T&JJ1?JL7&2^2P)}&6q|@54u_==w7l8U5g}8f
zbVNL+BO*^t%ReQZ{!L-R7KY+;Znu89#`WcuRMP04siW3qMaZ?o>yIUD!pyVJuioYw
zH1oFD^BXz#{6=ZdU$;H~9FT6rIcF#S;APwLlk6v4W-q~(-^kSJ$>F~MTRsPGfoYtH
zMU>@47#68nUSX;P8^3430PQaUi^T<IuxqG#a%S+D5EMrSZGrHN*zs9>25?n?zA9p9
zhgL<J>NoU5tnE{&Z6Vn!o7=%w&D6&5KBNmXaEDYnH1Ilv+F%`zwia6FF~ejsT+Ln;
zt>WTsGU+%5wctkCSboYV)CQoKBm1w)oXq-*hF{t%jP{B#)WSYlfeju2jN*e6x#T=v
zdJ&bR;BjXtAO1X$$AB^u_8;6d=AN=jL=;+q|I92NvMMhh(Ilfn8lui?DrhL05O<Em
zrw-GfS4xUpQei`nnue*pa$Lkvg5jLVR7z2j-aK;dLEpJ{<rBLG%x2JK&NtAWc)Di@
zOI{mi6uuD{>?880lXQP2u}F+L7Vv-^0dO%>E*Mxf`fw;3Q8E4?Hl-;)MtFysWe*L&
zyB8y79jBC~OBL<vwV~*&)K=*<DV-*z)1-8olui@6nJS$onQkea^N+U80!|GUdUSOT
zF7(v0@Zb_2pt##Zc`l)MSQZ@BcB?BpO_Ik`IGR1Q)1<MY(?l_Zm7ONVPOh7AnrK=M
zc(bL`M5adRG%1}XTkkZ{RZ^=uO_sC>E#W%J8c}pXp}6a$Xq#)$&)ecUY38_2nx*Sx
zEv}POG-nb6fPdgTAzztY@XA6E;K;uQp`;eom+ePM@*=M&v*6bHQJR^GJ~{lY@}rzY
z&J!@6vTX2gxpWv*I`E1-y~A*0fj<RM>V^=ODpUbjExp3PZzw<=4-D-n7#6r@Fiy>Q
zGQ&9f<kkWlfJ0Y1lo^bEcR#UUz4PIlQ@mh7(DJV3M#1nF!aQZfBs=W8fcIjk6Xq;g
zgCm7~N?f2a{*}g&p}rLM=It#et^kv3ykI=-4SR=I8ArYaruY9eF!crN_T`R|&XGfd
z{=43P8kI|cOoH2m=4jnHw)qcg(x;&XPrVTk9iJk7IsS(IwykjD;`5s5oLD1Szs||5
zM!zD+3E+;Qdwsc+NUd{bO~KI?MvbA)5qxxoYN--E-%HeswaszsBDH&HwoW$wsrh-I
zXBdz5eL-V5mUlSAQO^}ltzT#MV!swIpm1%4bW4WuVV}c4;HnBsF;@c1&w&3z=K@Q6
za&lHRK9XQQnqi>yIl2|XfmgGKn4~MiFmq=RrfFwii840t{tYY`i3qKtC-9E@0ixa~
z|0vtMgg*<KrLXrsnb<OWxVNY7_^)TboX<f{zAoE)`i<S)jOKs2IQDUg&T3t69CiK;
z=5t(VE|*n>C>Sb>g*D?Wo~1RGRvH_XdpObXfJ$fKvb0|+gCfcxc9khhFUZO=kLINg
zdBQs6jXxf^p4cK#3qZKd;p&3L7Ix;)8t%84O5yb)l_GCPME6;KzPR>DFNW6i`U+P-
zc~Pty-|s0nR_0UI|1<6}f9E356TqL7`Rvk*_fC8=OrRP2P_)oiH@I4c4sPbdPcAyu
z<Q(f?4m6Lo?gnNQlWzuoAdWj9mv;kS#@)c``UjRctW?BqVQ<Ajv37w<8@=Ut%+7;v
zZ!LPrUgtH(cBk<|t}-%ZS>Q(AyZMOXnzFCtRo8|Upg-4jv2uOg3Ri&weT(X3b}&Qc
zp7+g9u?UxUKDQXYkhBVeMf9QJ3(Xbb3yLAE3|}Z_Fy0J&LDOK*n=RoBGBry0LJ42k
zdia8_l3E(Ru&O6!2>?UZn8GHS#Q_XO+gyW&-WC8uD+j>PDgg}Z2QXkt;wjqL@Pvmq
zn=px(Z(I;-Of7`&cnszvm<8|$f~gQZ27xhjN91MW8<MQbE6N<YwfKfs=1Pzp{`TDy
zjZg<}0`34#aUw)%j-mvmLus;@Jb@=2{|@jjA-jVX;N5E|NJWZ+Ah04myI?rKd+-rs
z#79gBV^m(5^*ve-!4>Qol%A5YkNK{6@`2z6uQN`liI@hR1S|NyLAyUjW&r2~_Lk!;
z@bcOatoFggwdrj*5ma(T_yjwC!BZSrzy?akgF3;VBBmooua!X+=)J&i@mr@NxE#h=
ztTUg&#xNJ5+|k)h`cM-N(GO%iAX9LzVa}+8Lr8ijd*UQVC@T@5yJsJ4MG4=lTtD<5
zUG9AM_J3S_7kx|)yC}Yu2*D^hOr$oM&*ZloU(^yV6dbp>wuxW(hYx&+Qhexw!FLLt
z<IwxBqV00@&86{2CKvJYD^j{BwbK+oCctq^&^)TArurUUPM4W0#u@ULUqv&&h6(!!
z`hV(BkN~DH-J#(m&Y-;+rV|MVrJ6P7j}{3*ew~geGEACpt}X$`jGjQyBRO-A-^X&l
z(v6DN)H7nr#TL+F5j|F<NzRCbI?bxG8Yz>m+vtmmTw;s>Y%d^FPVP>!fmbTk995;f
zt7<oksZ%PfDs%V(rIi$?NQxc}d-H&+$3kq!-rhdfc~5h3S#nIGdN`T|@~tt4MdxwD
ztJG36T69()Vi8-<>?ZX^dTX-ka#)Z>R#+X^v947W3&V1RPPMbQ?zvmva+bS>Yfj>d
z6S?$~&L{MFP2KvYuh?#c?-!DizLp(HM%(#XW@G!4Cxq*h#>PN>OAo3D*e|W@;t2Hw
zN;1}`%bmXgT$v#y(+$W-agA00)0ya#JmiI)iql5!m7<9S-BPxb*)L9fot}mBr083`
znf%@*+miaX0Vz>UY}RuLrI|5xizg(5B(aJa)Y?Ffh^%Z55)kygf2S@}W{8mglqgUw
z6ewN7p9chVbBQk6oz4qEfJ*xFslh<iD*q`VLKiGP&k`K^NC;%H5<fKt%-B9WB@SG)
zkttcQ5DodB?ujyCdNcY2*)U^U{45!<1j;9<R3=AS6)2yC7Xh^9p@H(P6@l`KA*>9P
zFNQqY3{YMZ`Nf+pf$}lE31Gib3dl^K$~nm;O_F7;0ECm8)$!cMSBNufIs@CkdQAzj
zZjnj)jXy<TQZm_(s{a6cI>$x8BcpTHo4>_U9A(rWl|cFJ2g>UzsSN<-SHavZ0iVwr
zY1l-oIDEcnn`_Y9+XA0&=fLONC47E!@OeDf(6cp%bDVh8Jo>Ux@=1>56=g=;T9kY{
za~Vhuf16SA!;uBBIYg`bHp{&NlZAluI9A?bb^t7iz<4;6B%$*h^zJ3W?mqa!F`fL%
z!T#i1FbqS3pXAbPz?aS`tRDT7LnPx`@aj}Yz}LVW!n<>5R8A*9FhA<vALuAe<4ub~
zrIi?z(~10w!^9{|qY|ROc!r<xZH;`LAUSw3_E>nA&wi18zr09@HVY$(K`~|PvJ+Sh
zB!j9^w4TV(D?$cbdfxy>kRWF`&1r(>f`9bkeHxTq98ODs%ryxg4~nMO^xjjLtyN)0
z$}nc>i4TP+C0LaNbXGB(LTFV)*olEIz^ul?T7^B8#XY;HAuv?YSAG1Y&|vZYX5%o`
zJ%$cS5~Yx{r$%4R-aauJOTA^xz<R}SS;>jWps*gkT7!h5Ga+ZDIwMgulYH6aS_I;e
zx+I2u=_z2Hq8k*E_ooqoO<jzM4vjxeacj39pKdP~2V4l8bQLkcQjn!+B~#(sMC-aZ
zH&H$l@0Ms#5BHX8mEyRbBKGYm<K9Zt7nxq%SZX=|5wEZDJxAlhF1fBW0Mh`C)Mj=I
z23g#4E89aHoeLJQV{2B%{(FI_FF;2IZUCylCTqofnavl7`4am7si7VgFO*LS`k=7_
zKTG^Wi3KaMU@w*hODx#BNVpZcu*8CuSg<t*O-(w{z=8D8Sg`hrSTMy9R>p!A^RI0N
z3#RGc<js~?u$bN~v0z_hkNt>PQ*S?pB0C^nZ63gXXH)Bdr{D^xoYq)?umd<lOwl`B
zy92*z%?)a*QYu_so|=|_N{i$-1>#EJm(DrNN`=aLsaP;wCAE>DsjGOjmq3GMjWukd
zT^tQow9PeW?rlMXb#l;Poe~YUel*wzFh^g3#hGSkxw>_&tG8cIuRwi!0fL0DrZ5pN
z8xodeOI}gt#;t{fbuw3j<nXsTF|6f95xq~n5k@l!CB#4p!I-8t%@PRwNkL#ke|l$4
z9fNKfgMDxcBg_o!1tTXTUn~|J_+Jz4fc*ieKBI4q;nW`+<N0XjPT-p{9NLO#GE@Vw
z&@we(fEs`SpBfk8ATv)MMe$>P%sE4&(<#H3W+BE7Q>h=*h$f!-@fX--h9kfMuq=?6
z-ZAkw0xyBVZFFxO--CF#b|T53!=B0+UD1ah25O4p%_uTMj;$}`YG5Ij$o>+ch*DqL
z=is6A3zqd&L=B5Uq;M46OKe*K345eSY?&fRJceO4qpFgY$zjsIhb>(0{OW!2{JSu~
zR0<;Ymj0C>l#<T!Jf~~X?}}M}4dUs%@hA5eKAUgB)gRzs0qY1pW)X?q!1HN}=KG4G
z%_zxkL}uR7g^$4#GpfXD2$%$YgQJ7zQ}6*^S))<qZ@ZV5pZ;3;;fEpo`C;#`mA{_-
z<>U<Zy|5qzuPT?9&Yv$Y_tSsv{l};Ob$R*u^Pl(NzkjWKs{Qa8tDeEkyrS>-{tCt#
zLB&s(J7J@YAXxBn2XO+Tdk7nd_4^$vn#1%2<MV~6x`;$oBmArkIEYh(!4<GW3(80-
zbE~vxF@TQXeL4GKY%IAbijxF-LNGA>qX(Xlnt<K{1c>312-md;(-f+12`uLm(0SS^
zR<}YWhC$RYulP{_qre>S;xTl50=REKBdqKb(46|SRVvm^D%Qyoid8~_9bH2sOX85j
z`g_knUl+^a91iU%sCg;C;lPJuFm86C$Cn-how~tr{`>FuhqLLNsP?|q^csP1Ky~Os
zY2H})!ibj9JSKsld6Uhiv*3i~<PgR__){<-VJBmqFz}@H<Kv(T%cR03u<!*Z6@J4k
z3E8m%-hLgrBRHPWB5Oq-n##}|^j*DCe<8@kG9Pi7k9d>(6|U$7U`V3IT0lq&F)pz+
z>&Dh3y%AuEe`st?XGLs{VhAf^Yl=B4HiNCvbQJMsOKgoyjS^c^Vr#Y@TcfL_Hh`@u
z>fc)eO_Mdcu!&A_G)>Vq*PyGn1x?e<LDO_gG|eW^G$WRi^y<U|U;Y&m{$-<Ql5EH;
z%G|fL=$US&zE2K+tI#v2Ll`8@;Tsqh{Ci5HDY-160RURY(BRk&2z_kLz;5*geE{~9
zpa8fiI22SveQXZBYQtePEZ7py`DWPADg65jxrd=RA;<>9Ibo2cz&9+~#>gGJGs7CV
zaJst32Y}4+q>eZ|F)?i&I(5H$3)Xx>VrBM?*JR}1(OkzyU;%FsYV5z~)zIqCI*gH|
z;Gv5h`bdW0r}b>|gCXSd?(S|MEV1C_prSZE2<`*R0UJLo4`Y<S;Gp~Eep0s%V6BFq
zR}*OJ2J8e^Kr4hR1XttxD{us&qXAk54s)&$O?|K`1c>V{gX*sJL4N+u=LdW$lJD$>
zj3&T1UzqF6LaAf_j1oJu-$QT{vww|657|#a7hY{*joH5(-vD5TVMF0Bu_wUB9(!=(
z{sXzrVZYvi^>>7hyOonJFN$*&dGM+0DI>!ox{E3OnX8xrRVp7z0HCjP8bp8<y8wR@
zy!EF>`rY{)j_pK_X~VuG`P*1-GZ9AQ1lTHIt)<HRpL6ev@fM{oqX27!gKGpjf&1h_
zN-Y5OP@kqKN!P;f=@_U6eZ$i`0wo>nq3W@*`)&98MQy!?k0%>SJ<Dx{fBJN)YA*Yw
z)Gkjnry2r~62ur>3PM)GEOkKgbeju{FX)T9UJ9)gxq)NQi7=iOoA`Yco`jQB6hW!_
zL3mm->VJyWhyRYRf|)g)0WRv(r_Z|!+y2bk-b=Tx0)z13!hqc2up;5URFeU&Vb$Ym
zvTlmJP%-tax?nmIan4ZSj|sdUr7$ZooJo}P6zqN}Dkb22SZ4224PElNtzE(&jRtA4
zM4MTNmB^3H^B)2|aE{R@{Oim{5Kz*$4MpC1j#R+<nkYbXC`!@WxZ^s(z15gztO_0g
z*Y?!Cc0H)<U7wRF?6*@GNNFlogBUD>Du{hC)mQbm6+^;RhIK>06gHSAS{;5c53;uD
z^==v1jEwD7FOrg`UC#$%E9}}^*IJ&J`a-NJ<*Fv}Df`rZhQ5tKanj3Hx*e77jWx1h
z5zOqBN<}ZRa?5k5vjiItxOPwS*Y3%pwR^JK+C5pkc2Bl(?bchh7p>RYEA<ww(NAJ2
zP6GUvOH-Vkq*#UXlSwaNe))tHJ<Ur;96<x)--%|ky2`Xgla&JyEPwzskF@}R8O2Kc
zAEQGVSkQRs_&+(epc;*L48}??0M%s$>xKZ<`@L)kV7FI703R_P;S&u$SVq?>OtQo}
zT>=5A*By?l7AklhmmBrBEp)ksu0IatQ+m{P_W+c)Ss-B2u?kMbhXw+6R|EnohOjaa
zu$a$vGeAI1pEqx|1Om#`D1m?_5OC{(fVxU*BS65#Uj8M3e_5jmo9Gq?{uOO=4Z3+-
zfPcLl;9su<{%rvG$Aj{S>@Kh&eBqfClWfQ<%G|fLz`tImeoqenMP^c@m_CfC5r(pw
zq1cE7iI(A5_X5m^2RDYfgAri(D0w-1BkX7x8!}3ZEfQU?8WT(OjtVtLBGTl<004yU
z^AKDsW8}bYe-4fWBosJO-0^&Dcymm=5Yh@mfzdu-U@@So5n<#ED}<k+Hv$^CVpXoF
zQ3w1H%^x@I{x6b$FcS!XWw@_BDjE4lLVv|#f0WW0RW*3SY$AE&nSji40;Nc~{LFg2
zPJJ=VB@!QrHJw`bS0mzG&u%L6r}m6jsTmPfAJ~z#8m_T;2G6H8&r#yCZJ5Xmf27b}
zG(eEhXiP@69F>b)l{wBz;i+Uj{!z;psq{vM6C9t*$Q79rcjV!{itqh9b(#4DmhS*p
z_2W4Ys<1FpNmTxA{^G$Ck1^TusX_iHik~lYl@;~A9pUDfDm!vaugCeYEGr#x58zUK
zM!CvP#;}E)t<_7|>M8R!@OS;vODM=udI_JNmrx-Hc{vNJ#gDBo-0PLJD!_^Qp}k(c
z6}?`HA*}56DrRuljMq!k;KQ3Oy<RdkO0QSx_1b!`m#&i9gx9OMDQ^i!Sk?f;CVIsk
zVMW_qgSy@pM_50{5!NpqVe5B<u^(3$Z{{6Kfq^&IU$iGI$%nk6%zj(z3F~L-{N(Vr
zI)O~+=&Fo;yqO5Fal`k>9t%9ND{{YJzzle;&Lji>L>Ezj24?sic(`bX_l;O?nE}fx
z!=q}{kla%Y{OZVciszb12FqAm-Wl-$wC@J&8l=G$2kX>1j`uj~`?}n1EOtl449rMQ
zpALno7>wj5TC>A97<0qNyJ%hK0ljMR2->d<>)NkK-Qk!2buQu3ga*HQJkSW<IJBI9
z%me0p9K!Vbcj%X;8IA@PPBt(LSo!8~D5fDxVe;`Fsc1@-hXT`3U|NL_jK^4rjl?xy
zk&{Atlo*9}JoxBh<mC=$oMh$~@jF_O&d0M!7`i|F@@8{kJZv@$e!Y)6sBYl}F09b{
z)!d`)Cp%Cz7?L~ym--OgNwdS<DXfN|8L!ydvb&e?cS$0NGcBhM04^faO6(e>A!plR
zpSp5~<f|LZg7n0}oWKZmid8i~kYt6dFDT0Cej<arqOZx<WG{CDDD(rqF5XhqA@(3H
zIZ`Lpb0qUS&nLnxZ|dUs*&ih-d7c?K6g^)(&BfZ?*T4X-XU}jke8b@z4!f1h{GVZB
z4cWOZT%(P4o%cHC`)27K*h{+lh?e<vUpxgz>PF2m(G}1*ucbTu$}qVDnhjK1t-@th
z!GL^JxW|E2%^y}+fA*d^TB6v>y*O&r^IE^-aiSh}fzC?MSFXV23S6$hkCj}oT!G6K
zcuQbz`rD;-LE+RJ^C%=<Y9kgQ=IDk{-ugW>h^||P=732<1C^3oWoQoLrHAGyQ*)K6
zxft`6aXAVg?yAe@e>*vQ$kbe7oh}1%Y%w%3>E;C&=R-pi`zt~d6+>7Vnpn&OycuYs
zrU#xkTS60MYLw8#5}LU6&_rD&wMl5=QV578P>NY&4V&l}M=2I<a}An%TTqH-JqM;}
z)=Qk?`f-Xr!zoUDFe={9tT8&|UOG@Q#frRUj03k8sz^t#UIbDE*jBKjI|Q>j*tdl|
zgt@d}86v>@2>e5gnlbXP!E$_Y28+{>fV=rimHz7pafdg^nD7=FJ;M}DRrFIIk0u5a
zHUumlfmhl=@v#7dH@5B(Q%F;08R0!q`pH|%AyPyU^mpI-E_k(RS6F*B=IC}<@Y-0?
ztsu&}<@k26KMolQ1#5yZrQn8)Mh9b9rbgs|aI4_~bk2hMPHlFBx2j=Aecp$IDH;2>
zq-MeBXaXwCRQ6Y#?n6<#Hdz%F$$y;D@fjClHr4@sq&Nn|l;!~t(U(Gak<-b0@Gs<n
z7LBwAMGjt`6%|5)2YjToWsXGfXyCw7z=Eh^7!Ut)C*(CLg$7Nipe!BdRP8G7fz1Q0
z(!lIm<tXV?Q7}UAjuec&U9Yo<^zzJ5x)%bIegw4!2n<lI#^Ip^Fgd~$bjjEqxF@AW
zUGG0}f_Nc1KQ{l7IX|>coQ1MLWTzg0I(X&;iEhhgt;lX-&50|LsVe|=381|A7&(kA
z0f$^>XmU1(oRKMduV@0{gDJSE0?f8_8VD(yKoWHp^&*|&09h`beE=%U{K7n&$y@{p
zNRTE{_mN;`)Hxh!<Rp>|1)c3vLj|1hbCnwR!89(L2(E7zVg6(V`=84ySZ)0(^T%@9
zRV$z0Lgl)0M!&_n^=wJqT4Z2K)v6wsA{*gLQ>~AwE(Izm2K}L6Aiir3l_T5xFsP3k
z4ClZ9et$Td!pTD3JXIyZzVvdYNPeW6q38j;z3^w&C^bjWekJ};%$M$5<xNg5yyrha
zJA#=DKNuS$9t+FFJY^KE=O0Dud7*!vY+{~vr%{I7667dDZauw_TO|NUlTZqck$hCf
zCR-H%lyaY-<KUqoKxWJlwFCx8If|80Kt-J^o52BTJGgkmB@#%cMu`L}kw9CI1kzVj
z8^8i-`2Cgu{A3O(Y$G``9mr4dR@b7Yw+8lO=D~i<685vP@MOONeg>cg&ehwmu$h|C
zS$g5vA2UPdWH#Jh?2nnP^^*kH>Of^Alm}zzVqzY&z0sg#b1pK7%i$sghUr`QI{>4$
zePe*D<opIop7}0Vx~W0lBga!P2m&OBx-VH0pcy!$T+bfOp)2^kD*PH&jqBfC@Kf7k
zuyhZs8T&f*FCdW-)f4$}(Lv!RI&K-)@FkB0Cj%T2>n=i=04fCFB5aT5&#^oP9>RjV
zP+1UGBpgCC5(}aR^Mx0VDewqzQ3m+3u4!})J_FQeJGMrE)FtR}WbML(L}s29!9c%|
zJ0nt4#;t3K_wQg#LX$<lgUtp=LqJq;<Bu=`O@oI<W3)b<z@uHcPrE!uS~!as_zqYD
zgA{>uK|`1YYTtmFJz&ru7UT|QVTAkw9Ch!{fz5FGW*qnelz;{?Fph{punW)Nn7#{a
zgnuC;;orbY_!ltKF7+N^ZR(Dku>d?h5!nq~So{$U_O`L;FNZYz3;$ZCR~LN7f}Zgr
z=TvzjeM5pq*eOnyqz72`MT2|L0vWJL6kIHNjc(nYU%fA$f9FL{!SzPN#Ju$av^Yqu
z(TrTImE;BX*r=<VK<L1VhqtLp%~i8KUw<d}Di;_&Il87e!*h2A3;J|a<rMlzU@ZV$
zAU#5&p`eMb{sUB$f%^DxM20hj^2tGBR8yKgtphT<BcOOHIJqHz?HT*~vFQ%OvT4ov
zlJm~0NiNJJLFBkl3Tk0;B)~i@3NjTIIfI4n90sn4CZ!^JDs~Y@EMjqr$jHB=XipCm
zDyTJl6RH`xb{JbI_UTuu!Wb)vhn7-|Q_lSqlNS}iLTO38lnE7<;(@wkxq-a|bMVag
zdWs82`cqLHEY>p`yeLjfC6C85S&5N=RKQz&_YNon3sV%CkJ&OKxj_@<r&=S5XU5xL
z4M$D9^QU9b-%&#%MBtQMldmC*?EdXPF5%BUYTql^y(?Qic89|YaMHy(2+zW9QS8O;
z0mumKZmrS5E~QU;SpRaE(N7GxHwTK*1y2FNh>J02bzFDiKnscGR}1bIs;nUPF-en!
z9}+q<UNX|8QIC?`5U;UF#05*mYb2Om6yh21Fm)R8^&7B=OAUbR%1Z$P8P=%kCH<b9
z{A%XZXEE7hB3B+GR;=cp<1n@7h$+PQ;uD5?#4wg1=M{_?wSVyW&wGDDpp+?LrC|3M
zkSjc&E{>YIx3`~QIIck1hZ3iO{CyEdvCG&Jh5F@ixo$EZOtrdb;V4W6d5y`OkR;PC
zPwS_*X+!~9gZ6*}WvE`4Bvn{{Zv#6`4Y}U%#xp7S&qer)D}V<T*C)9VU#GGtxAWz8
zzTD1hZs(I5`665Rg{RMl+03tJA>Nv8ya1pV3`407HmN|TtKwA_iAfnwWw?CE#8++O
z<n3C-2skil^M+PiRyFKZ8b&TK<ZFp~`2>%TlBCH8`W(pp`a$)*GB0%*PxB!W^^s@q
zd0^^6+kiveIr5x0ECW&o$o)O0Ot(fK!1sh!>9s=Z&3bk=>vp$ZLhA)NN@#rvt$(($
zHCMQU@axC-4;h72?1YNk*MQQGO(ooMJtUdJ9bN%C(Yk9PRC!b50YbH=z-|chdhnYX
z=BhU}RHIn^rba<1+=gyy=)w_s!{tp4nHuFyjq;|(_TSXdR#Y3fsj&(ubD1j~X6|JR
zbBQY)g<D;V{@$7^9F4py9F6h{$NH~ue1r`Wdk}KPOTW9($PhM}|F-w;Mk9M2ND^RM
z?{07b@k4=#koGVcC>Eo8V~Rh~t7BW9!Br;wdtwb-I5A-}^MDNJBYI1MCy-w?lIchB
z%`+dT#HAhi8F--f(G9+cvXLOK<MP5<u=|NHYZyAtaYRm3@WhPWfTB@oEKKPY^AjZt
zDD$a)2(`vXe?*R;__fCZlImq#6^|~amKRKXCQo6!I3&8~3rA*z7~lQn!Z`Z%;^)(k
zCl~({ak}UK^ZerN2cr^6s|cS1VoNXh{0u(BJw)>ss7iy^9ZlT*U&!o@KP3z6-!<<h
zw15KwI2yXa4bAh)Z{JwVowh3nHe>gTip)`L3ifhB<%M3-^(VE?%$}LdnYnUMN{L$d
z=gC7?OOY!@?$JbU^3+7`$z(rGKyw+|B!R+^As47Zmw|vJ?~SFuun=Ss@4(s-7a7F@
z0*49MJYbpk{++tad;&X5x)dGHxj6uvyfA;xEB`is=L6hyeNCo}Tt4+ilrapSeGJ1b
z30x>8Hhrj|g{Ijmkrjd*C9<MKR;-My!1eU8&=sXS{2|=oN&6vM&K}$y-dNQgt{TPa
z?(l-v#SOW`buGNS;nE#0Q=@c;m+tWGcZX{$stvfqS26Q1;|_1+I<6Z_xWfy#x)%Mt
zHSX|co;$o*y2ID+4v%hTTpjy&9s*B-tHC|Ek50~BxLdrLA#^eyZm(OsnY|t)39zkh
zam({D93S;;W8^*>9B@ExtXtQo7Z(FE!w__aCB?PF;7sU>g(kpJJ~Nm@Gr*7nG!g*|
zm~h~5VH08g@GHZqKQ=sohMk-l7CQ!$VBa{I86-fU7&tbuR|aM*rLnL4q43X#-KrWO
zC3xzAFV4^v4~9q#Um>CiR_QuB99iIaLw70n_mi(SAvE5hg{e@j`ACk{2j6M5S9Ik|
z!5tCfCb{bn{f1EpFzO+!`@ebt#-%tpTiu(Via6L7f&6}tx`VxuLRz4&SN-mCC#)T9
zMdV0=mlXUj)F^S7=U7Jcq0dMWOVDgB3MP0=hSZZ2n|BYdnvN1InUw_)OTFfm`J@yH
zJ;+0aBqD|E?<?YjsI%B*l6#>CS0;0!c{c!T0_eEeeRN}95u-~H(?U3dB>zx!#W$WY
zPHySw_F6P%-CkFC<}Ka!#7zDKbHU}2PMi?R%!y-#=@9wzC8qDyf*?*$W1iNL&JIQb
zjW3w-=(_j9xf0>i*fOXJJQ<E;IRVv3oGi<0s7+Uh<F%pyA1=cf8GIpy{a8<2rOn3Y
zdI)thS+lyCXsH_wHcV@ubugo@Ix4yD*(uKnybjgo0);8SDNH$XMaM#hq_(TDxwYr?
zfEjLA*&f!3P%VsI@iVWvrlluU@Giq>(wm=jbTt>;-&3QKwcOHBs)cqA3?oxfDsrt4
zi_+Sko+LHlu^<;JkwH+A=eQPXm_6el{C5Pq8NnGVb&`pW3zwdX)^SmeKA(!PtBBhI
ztSPf;bur_q!m}jT>+JPg!I;&kyU;op1Bqa%kTt9f9v!7DxEB73)<F7`<7eUDj}&xh
z-9V;RK9cDJoFwPt63p~QplUL~D63(97B0ct17>=D;bY!@1yc{eP}h%KYL;<dLUNSo
zq!OK!_*2Gx*{--RC4TE6@LNeo7rJ;J9KY3E6~Cn##p?L2f^M)4;kR^Mk-Xs&za>+n
z#BY`Ot?kEeX)CG?;I~%v?Jfi1YUYBinoB^q3b(oz6}~kPu2vp|t5rg{9umS8+BaV~
zlB<;=donw2FOsX3y)q;Tu>D9bcSsWidh_uBEcxK4cYJ$}94B(V!rBIY4*}1DUlf&v
zz7LyJf<3V02fhui0(e8E#sX(XxW3KV`o_Gi)V<AsRfyV(fJhaAumb;7dyhM_gttU~
z*=YYCduxMT#c@u!Ftb4gY#fV5v3?}hvjk!#%+fUjU3-SOj*hkP0inN_hglg<9cPtE
z4(?E5o>+tBHehrSZ+<-r>5?Q>+Ohra*P{%NH22vl^E$)_5VrB^Fztl|Ap-a&xFJ&x
z>eSHah=eCsayP@1_cEw1e^kXlBI|*MWDbkDIQe|VkZ0`87NX8rkqCc88%y%%hF}(P
z&$O6Ehp|HZWvVnyfi5NTN)-=>q{!wK1r`BDS&$Be3syWciX5H8NW0UMOtv`K&qAfS
zMy%V?TC{{6Ez<dUldH1?NVA-t`X{vv<c&6GRVX;n$6OimMyk6|lmNj8fu-_RBei^(
z0+TMa6v``Mh(O!WT9~m4O6y<N%D1sK4}>HQElYwHg}jRlXGl50{;*Jna777GmI%U?
z4Oa~JS?SGXCTLN$Q_DjQ=0F7%WL<z5%o>cO3shQBb3nR4$h8isaGt&l>}mEK$AO}Y
z$d^E6Vn<k>IUXMEBMHD<0R36imuzfieZSFGfb&nB#mL0nzwN4n*72Np`6xx&0$>yq
zn9$mkFqGwDY^Wr)@o8O@#4iQoRB#2ubVf=sf#QrBW0=koUWqBtFwNo4g79(|V$TJ(
zpt{myJ+o$WwCn90-CAy$oiF@T!YfmMN_ge!pf0A+3P8Hv%}1lfX{xI0>J|O9uH;#3
z>s7d-6~V!Ub=HE0D}=O;XF<zOaJPvZXk}8p5?omrsQ~Uk3$F+0cqFMia-l~u^o??O
z<fDNrlfGy4x;{9#vb8F>QZ<Uz!IcF)(;EU;>Y@X9!zH*<rbY>_EWwrA53bZ!R2v0X
zt_#7j4BoPpi;Qe7fwwH&>RPn=*5EDMd3eiqiML!o-ZDUeoKU<aM)bOxVFINgnO<1~
z{}z4<Th|K*UA8j>Q0B?)1zonYSBxY9wiR?4-nC{+*d)3iaKR-8V38;?0FJcb8^Gog
zMi72jhS{!xb8!yhLBV(v8i!#2(mNXwM3JCxlclO-)(-FyQZoh(U13e9);$0|11tv4
z%L(Q<!_+W=k8TkB7W0t8cQCvk=3%u)b3(uDvFcUh4&`(-GA3aEVxMA#C@K_@q_iCP
z0-{!!w*zDEO?;?^!i@!a7vVAQORCdgN(VV*t2uPy9N&9nv~NUS;SqF+Ls;2|q5ETS
z|G2bQPSju5o6Ny^A$110g{1(3#`%uHLiZE6dojJ+4bp`U5L`<(eE*s?gv9f0kd$=*
zQ58I398ngCJOpcpn%3*}2TepKpiv@eUPT77GAQb)M~<iNEvDNuvQTbO?JO|s`MqaH
z&(T5~e<#4M@i!3!HY<yr0!<M4{;7BUN?>NLgfm|0!N=t>7-hKctA+_PQ<u~7Nm!N0
zc{fNWkuuxk1c)K4S1P;@A1$Sl1&SWMobGT~p#pU^BHs1vrV@624<TV@HS%JHZ<zZN
zo}z^aGXxTBGC;V(JG7}Xl3(FpVPzDw2<;Jl1pllWAZCr(!`6}mlNLIsD>TwDE(J-p
zkAVuGkK|;_MGT&~0OhHckwgfi4N6M9pQXI4lx^>6WY<e_#v0P;rI{@!n_i?{t69of
z;{6mbBaZ3CJ*Ga?;=*iy(28Z1S+ERd#pr-!b*IER2DeNZ%qqnuWiYGNf>|}nU{)bH
z%3xMyFsqk{x4?bELqb!ceaYG&Mk@xiQaaJ+!OR~Y10up5Wf<O2g>n-L1+HR07w+xV
z<J}3*tk^)fAybT2HOo8j9ZD+L9Sq&;C_S;d!`D-Pj&rG1I%f8nP3J1B4=pwF{VxM>
z6~?n8x0TtEqi(zgWH~URn-hwX?`(^PofI~-4`g=3cAMt}Q`xGFw7d%7o+ki89{B-r
zPB>W?7`)_>yh*Ujr_VVRsHIyjuP@d+_7ow%QV(%%6zr0Glz5PAUB_bo(y>HImkK%)
z9vn;5UKLBE8pY~ZqJj>W4Pl9NonE}*5=$ggqr?)GSfcI65@{={O<{=&I^mW<3$=4`
zJ?$mXLWNshi{9QEv`{AxEz~K|LJx=*8iJg`1ed6xg-j|0QRdC<MGbYb*M=kkUNUNk
zgIB`99ZZy%pJ_Qrkx?RwN<>jXM3G_WB8m)SIZV-Vh$6Y>gM%U#XZTZvH~DnA6PCrW
ze5{q_07nT3j2-|fT@C1TCHEicmJFYw@Uu&}sfA#SqM)Ux4Ox2dj8;_c)CeUeXt@|A
zEre1`jFx~WJ+c_Cj!e=MCM8m7Z6dXl94&@4mC}@!rhNPoldN0>Q#O8SY4lPx&O4&Z
zaWIpS=o<UtCcsPyCXPCmiF2YMsVtBkn^ZEPPz!ljh6%Efl|ZRfj2Wh5ed@6NiTbF@
zur%UNnf32kXZ<UIQV}^ypi~KzO8hB-QYBET1WJ`asS+qv0;SYmB=ny=I8dsyDo{!_
ziq(Nq1$|5#0!r!n`FO)6P)epo36v^<Qri!d(pFT@7%0`rg*0`R07?~ZbuD^(Yk*SS
zJfKv!1WK(1D0TkZPZ))N;9)%bk#S7Cd*dSz`h`bM>SoB8%y!$0f$C<f{Uial6$51n
ziGWA<270Y%M56%o4-~KsHhBgh4rV@Hjt8F+^De`affZm1OB&wD;LTVdBEZqquNTbV
zzt&VvIXNQM6g+2!1C#1qBXo-2&w^(HA9aC2gKW!-!U#=#oD~<ECz9d23Izb-fgh!(
zqAF(7eAB3MS1krsnt>tx3oNDJw}G+32*_8EBNs6?#0U^Qa62ENvu@x52H+mYGPdwG
z6{hcG<MOB1mgoM?x<8oHWSIkkogcuYe8Dte_uw*{k~?cOGN!0Qw89r1!yJRZFs+d&
z{W($qdVCzC`C392{W2e)4$o&!5biC&Z`kD7DBt4@!SGn{0)!xmJe99O!|^<oH~i5D
zcqF5h_Uq9L(a`HTP>FhQMJ7(z;ot^{!j=w=U&svkoSkg>E7|3aXbQ}&a%k)Vja=gF
z%5SBtLlUJ<CM?&f^p;T+UL?kOKDAFKNPJ5BL%DPEcNS!ROHl03hUx4X`};I0A^cMf
zl3+=<M5mP415R)7$i_yNY)*V0%f<$CbbHP7b1{!EG?ZBuxB<!rGmunu>1Y;}-B<LG
z(M{FHD+PP-S)tlJ)w`vp#k`@j;Q4oz^c<+aqezREF+}LDx(W87DACY}3}-$-K&M8?
zC$aK0*U&;ba>!FiNJ-wt*4Hb4SXsyce^!b6_X|0p8k6f7{$&x}UZwjO$3|ofv%08N
zi3`Kt!=EA{T7K4x(9%#}<K3nRE#`B{hof2(Q1px5jkZNU*$Mdwx7ZY&M~-1A_~L$}
ze)<!(L1E*_xD_As<*SPT;0O*1&XMN;;b&8Sr0er%0TA-S8a&0k9zs_<!#ESaetiFs
zl#1!n0_6I2s$!${1e!=bDlg=(d?7!1QpYpugZr7ftNNK#qgdU~RPY?XAwQF@ErmB+
z`k7>Elzyht&$Ru1CT&Hvw4Z5pv(hrYrEablsJn!3sc@@n(bZeyTk7TcmU^XcX%oJs
zGYq&7A_i<a^I@<4!d*<g3{jK0Z+l%#y=;x2B*3=1m~606T}KX;2^R}Y8Rf*CO|pLp
z(^h~>2bdMQOY=%VU6?35YJi&s8V6Sdznw3<O6ZUpf%9gu4=L=x*bSf$=rs~vDE4XI
z;UaDvA?wB)K3E)=yvCwZ2-f1gNjYe`!a?(K9y(~mBbwPfRYU2u;I)N+<gMpK?O}z)
z`>;L??7|Pne@L%m=J|9o%=W6@f(bwB%3i+f2m6yU_siC9g^^!=eH_fF0zZ_e51+*S
zA<}>;U<cV%JgcfL-S7VCcu6<MI;khkSi<j7m|kK36vPVOEud61zNN{OK_U(RO1uJf
zu>1*&?WcQwX#5GR<TtZ@6$hXLkyRA^lq!UeqEd-5NQDz`5|c6?jbbhwspnHQ&;83`
zn!<5cOLC}+DN*zDf=P+FqfX9PBv2aJ^d6=+s)l6~FH<e8+k4YHE`2vo#CNkW)W~yl
z;2e`7@dEPp)}mXo(u1S#mu-DxbfnSJZfx7OZQHhOO>9nVCllM4*tRCd#K}YxyW_9t
zocrT`cirwE-A`B7UcKJ^R_&*2@2ZNjk6KJjm2N2g&0xs8iKox&LpIjD7uN0SThrzG
zZ+g?!Z+d!2wG--RL%9vQT!GVDpSzge{83K;oZf2siVj;_Tx2EYwY5e4p)mE1mDbAB
zy4$^ndjX!0#js{6WTfYW{9IP-Io|a|<Bsd{0#XaMUB?FCo4NyFOj~O=p3)EmPK0RQ
zV4^A5+(KoBY=nT*#zK>bf9E!bl`a#3N8WJr@kDgFMflHUNRe*WfI6qul3%_7fsO1Q
z`(nE$w}*}IxA)&5%m#5G5PO&VpXGqoA~L6Z8S&g$q9Bx!U`mTTCnAF1n2Sd-zFoi!
zb3=m^obDY=!k2Ucy7kiJ(3L*$)|0*Tj$$;-B&JP*c&SgqUPp32s8f)$y=aVi_A}*)
z-c2;(yyXy`w+0RI(WWzeNY`FF|J>JAt9za4^<3539-4tu6}+5GPOk2d%VDB}z+Tc1
zy}Y|FkTOXh!{D53`K7zI9~r6mo?F#I9k!kQ)wa68RYP$avi%;Pjq#kQ%6quXR<~Tr
zR*y+>ded2NRZFAhM@B5MbtWt0vs?VY2c^RFzlAv_Fu(i=|NFG>8iyM!F*$;2;EyJT
z%!s2_oQy<)po_$T5lJ`h`Af8<cZ?ZLb$>K}kmc2ZFW*Nu4s09GLt)+e>^e5Kljh>2
zwhA*dtx0E-ZL|}Dy;PAhk!u*!)sP7I1SALRfKks??Kn*ceFN1YgX}~z0xIlP&bH6q
zggg%Z8B)2>@RWhsdYh?7RiqoD0giP@dlpPcOu^)u;O%<UOK9TcGVr%NdwE0@?YY@X
zcH)Eph#(EmFF+XC+=8CBYvAkUW<5wd_>iV90m<sw5c%#GTktG6V?1TZg;5#V?@Gyn
zUG_e1yka~gey4#CRKGwMlyLvjRXb-PB9Qa}HX^mCR20RWb+l<&9Q&G&5+(Vb@+~8)
zKKeQbZM_g5h~B5CXY#2LduiEPq_3rpEm1}vFgO+yvyiHagCpS-kSE3yjuhA$SE0z_
z5n1fK5WYV0CAhVo3a|Nb<6nUr;wr7)<4sTB17hZnG3FdWpK&pt(7q}s3PodFF5cd9
zH386>q!OZLwGt>XmC9*Y*$D?N8BPQ}=DApl?*97Z#-d6D;AvVS^)8gMm<Kv;gJo)S
zTt=>6Ge5Q|V&!@747_wqg&UOSy!}zA5<m?#n7xEdjo2%BAU7Q#CxE5RHHAKy-{0;}
zuAgt}XcxI99WQ8!qKzc_QdBw{RTRGw!*C3?!uBcp%CLA4Wk-+nx?*vBMpX#c+=u$l
z?92;SK&04H>{iv}(^ltF#@xw%*<SIv+MfOF3f)7KEQ<>99;IQ<Oo6Z0IbIPb&q!1$
z)=a^#{4rZg;UQQQTI$=7(uL=4Tg%;`M#r-doj3yaIp)WqB|;bbLn?a07XSXHH=-;x
zC0fg5k;L|`-8j5Q`(CdEQAY4pzF3;$oY=m=5K1j5+;UZ;FOC9S6_cfRam}Th!N{$`
z$WcybiZz*^k&cKsE@kvUpbje`%YoABuPB>*b-#~h|3N`IU$U;or%4lX<M8|}cDF&>
zI(6@yn_8KNG7s}&N{JkLcYA>WJa=#SJPDwAUDYA(0lD9F;ri!#E6o$vJ0^-qdpe>+
zfD+ZTvyT$hz83Un)#s0%v-t|WCfBB0fKds{*NE1GtGt%e<P@WBC#By5qi*1xdEN4O
zYzlGB5^<#TLhbT+ZP2a4_?f`?9p-)HM*azf0#+VeDn`W|7Vp(-1YV`4fKGMe;S^GE
zt^RELs*MtSe<UMY_q=F);T971_&S|qsW*fs2G%Czx`ST6hPuYquCCyE6;7o{^AXZr
zyfE0cfmHSHvVJ1bT~~e=(;rs${YK6<#+b@NbcdO)7Ab!!x|Bguzvmo{R9#@*<cpAZ
zUKP>5eEWm2yUEi;dlkuk|4lJb<a_8qrC2<3gyiIm3It|r3vv>-zF9HQEoW7tp|@IQ
zRUUb0prNLh6?0v-YaNyX==i{iWhi5_R=9YSJxv|Adta#Ep|Ll3w@({qzlFCa>*i^t
zN6zBuW^~m;cOz!?K-IU(m9DPF%j<R6MAr=laJsq}$D=*BVr{MIHzF#S9@Ab-gYv&f
zvpty(dx3#4+Rp?F`db;ZJ<(4l0MDF+`xE+}tv8G<jR(T!TL;=sJuVN8>K5Qp#@*w)
zgOyO)MSU1Dufj9vP>Ub#6ySU9nGUDp1tdj`4roP4c5~z^pWO*|{}d>(=UEkGxLgzJ
z`4|@%m<e_=QCR|QjiUT*USxXaahQz*4p!~-&VN|ow)V-^H68%=y8vt$92r*&FPM<2
zbSzDs+=2F$;P+?a3VmdpRmMbf<{>^tea)`P95BghE=An^JbFlDyD(L0|EmNN)@<n1
z;-}hHb@pW&d;#qTv)|h?CUhD<+yFwfdZgkYNm#b9r9ojejt5F?2@z;GmI!pe-<vQ~
zpSdA=hV&nzF{8+D+BTecgn;Mosn@_Hku)qW`BJ&XQDc*+Vm`pwO#!^W1|Q=$?eq%@
zPeB~iO(IzCZ=ePKMD!Du=@$c(Tt{j_-sMT%KSptC<7NoPAtb6m{D6&@*}_z~xh~th
zar)PprEamq%qDSued#XJ_{ou0Po-m;rIxBm<a$fDfN-pPi$26@gumM6w}=)%b?))w
z>7ckkWAE@G(L|rZO=gh)RGQbpG?DyM15t~ERmNb*Y*KYQBnj>nMnW&tk>q4zd{1-y
z&Q9S0;^vq--h9HX>GfM){}a9ah@0)#VSHrU5jW9nMt>9x{pKAu$EQl0|13M9b6d;N
z^fHa(OBrL(x#LS0pPjD$XSHY4iDkF3h~ng!qY(e*$Ks*f`qgaR&uwluhv(Tv&wkI%
zkM1hr&+x50rG_e^&KvUk4|vWE>dqwXwCqG?Zsu)^UH@0AH;4A;&8#Xj7&DOAa_KAY
zwAtVdU>X7>X6$8O$M&e*+4(}y^E>}9o^-QBSBz_H|J$$j=f`QsL%F`M-Rd`_+>2gI
zAF0oz{=8K0F?2sW1O8~upKfznlDe3Vs%=~xRcJ>%Ld5FNx=#yFvQA#$BqC^qG|3q<
z(N%5{Sg^sTQs6dE4c!Zno{)wG-=69kkCX^`@_6%O@G_oug)4r3ed0!f&rfnZ<^Jvv
zYggYbA!X5vX8oi<w6~EHC+;Q=mQ1=BA>*LFO0B!&v89gFf$yHtiwgS0Z|B4V4_LP1
zL?z!-ugw5quhl|WUrfyJX*4_?A$7j!;q5xNgc5E(D@few!s&xdz^jl8I7BYI<VI6p
z*t`02l{%jpgq#Hv7ieZsOwjol9;I~#o^EKh<4S{zWdE6hvsxx0gPXc+!(l`R(oFl^
zFMx8b0|9l!R^Dj;+i2?Az}9?4;3K_(tAeZQ)u=iH)^w9U69WM~lzej%L;B<QVI|_!
zbQ`nZH&qiin`MawWF4G@R)}WAv}92P0^T>bdM1wpgV+#+dZDml>vXy{14r1oK45XR
zkrlN}RtWW?YwP`d!PU!!=k*IoUHs1T9$uz}_IT*7VfD1}zu?_xZPE{CR|{*V;_=+;
zMAyoo4V&v#N1=fgz$mog6BPH|%EYUz%I$5%tDdL^e)@3|=)(}i;!1SwQ3&CHE_Lrh
zc|O0tS$YXH^#&`U;tO^qB+Y0-SsmU@&{vyHw3li^TRm4J%pACbXj5?!GGrk&4jSpL
zneok|3WQ5*&QhjZEPMKW=1IyZhJp<|^`NRHj<AdDP2r9^*Sx%3?4!i-TmK^A4BPbN
z*+Ss9@_Mu~)Xf-TO(RH{!i}~ezmn7|YiZ}^0<&&6E<55`2vH>BO!2?bZt;P&cip0h
zfp9gavCK;Ejlu2Ybg<QP_~<z0j9+O{NJy0p(Efee^ZF<GRtKSoO7wu&&}?Q(2tsv1
zhD*xuAoQ*Vp6-%A2;hIoj*6OkDp-rs=yG`J(F97L;i{PGKym;+u-WybdW@KE<{^Q_
z;2Yr%Eaq>x>4D#0>%mtL<kS<m9U0WH7UcB46^MTPL&(;hueX3NZ}yMnM?u!)?Q~|r
z>VCg4w~%wsXQ<{aNhZ2)-zPhbeQ19Hf5VUzu6m=%$qF{-Il0cIhp1M}ho0JQi$%WU
zXe}{i`XGq=SW_p$`Uj*8R`e!X@s2_~PL4H~akKEi@<b595c9ZLN18p+x2_&~<KBr`
zw`BWF&*W6s#;CGO$RuqGB8=pBcpqIU1uY~9^SOs42ZNX)sMfm?3aP0P_fyAZ+hVX6
z=JeEKQ}wW)2Yz`TXCZA+G>!n>Fyj}Pg(2;4K`zh*o)!!cC#lqa%gqzti5)xzJSTd-
zPK$rR<dN)(>p22mv8{I`^gApkY0qfcl_DlN$VI#0=W;g$zIKQ^1`;GI795P)+q~M&
z_cs6T5BN#JU+wgK+v^SAAFx%JhzGCW5Mn0aDM1A;qK5-?+;#*VV<DMD&~sf<n2F%Z
z_8s+DS2;s#a)*8FORX&(*PjquUj1VMv4a7({0P0Gfsf-gapz-4@!A@ran7tY3FlYZ
zxNDHK+6F*=H3F~%vtMZr^;*{*tdRSZe*r)#oC~(R3Wvq%Bs@E^+zF<Aqckl0t%D=g
z{nbchpIJ83qT?!mR63Ihrd*y7^qo|t_}y}U{nqq&$pDeMvuPdl=t4bPq#-@<m^QD&
zX9F8iB7wOq=Nmku@{#n0_)l^C+G*7$^1A#=@uG|r#k@vS#e63^hujCG0}$#qTp#K8
z+TIxb#uM)@s{|LWR2FzqTAD#iLFsh@AN60!XrpVlkg|e*9en>#9aeKO$_zgx!3DGb
zFerac;75?C+-~+LS<_t~6SHkI=>{>A{WZj~fzj2yS6Vj9mMiV)4I&~}<6!_!y8^EE
z6i=1>;R8<l1`n>bn3aStBWvq#BqBG~;I!j_SX#MN8Ip!4qw7mTd5)(kkd(5brojk8
z8D5Y+XU@lND4#R_U;-BGssc_k3P$4&c%l=h`4)YMsVRDxGhHoC1FadMLbLlEwhbPJ
zE+>FTV1y?PY@>d@^k8N^*Wc<1`beUl8dEV}(eE0FLxc_Gc987>e?jrb9uBhVx$pEN
z9vrDYDl6Cn^v!Za&PabN^(p&Az_;tU&M%3?25igDvIdkD62I*5*Q(ivu{oicXQv;E
z#N)n(tpdE9)XRcbp4SMwx>{SDE^VF85%L^*n_?^U&bkKX^hoi{(2w9;)B(wU&w*56
zmHvVGXJ2<IhZ9WLA|y$%yU7$7=WA4Zafv8|j9PG34ysx=H0-X9Z8Z&LSOs6lkK;J!
zYt^RtZ$DB1-v$TcL8SAir$0=hK9|9+bEpZl8zC4BKy(~;tm8J=6dJ3V&VL@4k4~Dk
z4w1AW6t4Pb{4lVUy)OvjPM<kr_bH!Pqi}IFicN?L^b3)sP9>S`fMSGEG2~jv>LHj-
zyJ}vCw7r5c<3Xny@YUUufP6S~D3AMbE6a{5Qi~^7S$e?Xger@ecf4mdFo;^oT<><0
z3*FA;@6LpVyCo!0%{utkG!$Bjes{2kbucX4H1wY-!IlF}Nr9yVH=0}DJQQe33XNkB
znMCL_|4a#1$?~-pizRDlSx#DOR$*;XN{dhl1Pa;Sq>;x2MGNZn0PNXPrA7NyX1HVP
zHm17cHo$6Se{h&?I85wfRF{YXAlNb&T);Lzq2AYnATzNub~{*mN^(vEP`UT#GR?$g
z@;)@-hT5rni;BcjZ0lwd4B0T3&}W4g?Cu>inys~Whqnxl<ArCRHOFn!q0P{??J%d3
zSAddkb5vBov`^18hjNs1+{$3Awrsa#US_GYM4+FfAw91*#aPRvps^SGU8hqC6_nog
zjnPhTVkVnDu&?n<EkS24n`)FHQoMdHjYiw5??Tm3(uD-<Sc7TSh)-(RN|M1>eu$Gw
zP!{oKsH0xUE)agunTbebnt&OhX@mc_^Fh$LNj)4Gccc{k%zjTu&Tu#=H}Fy-Zj}Nr
z<sQ``w2(8fGO~u#@_-`Z7K5Nmsz<zUNUir0epxl-ZfRrN;?3-gJ0qjN8wY3~Z}onT
z*dD$MAdc!;*Y<{r$)l&3&cVMy*W>26a%xXepJ?)PvP68t6e(DCjE`{Wg!G&=AI5@5
zq6LS9dSF>FZ6qPVE~NZM+WeCEtFTna26%6Fy|4AJ&STi=>OjW%{DwO*Qr6yj{Al1V
z#1!>;X+o@Njm%&IO9&)}Fem1LAWlsSjGSZ0g5hW+fmdyg<<umh23J8<M4+BE=AHw<
zMwXy@2Dqs|<!y3S4D)L6+cb=8jN{&?g+HPbsv^BCVuB4qY=GpL0$4miQra8{$HhTJ
ztY4X;2D`{hXB_4x;aPf~P8p03AaEeep-ji1Xl}^RsI6gKzALxf!R0!<Kw~);6~xQ+
z@)Dbs6RY-GM2i1VE@hA3gO_nHM~yBNjm1L-?Gj16I_i+X3ix3UF@8EOw@0erEFnY1
zN=g}zkR6TK;Gc_{3(H%Rn?o@Izp7Y3&Z*Vod?yJtLABsge&M$wL}BYnB!p8>1v`N9
zoyci}sZusEUvLCjlw>i3Pc4`aeG=uKC_2B}=;XM@?Oqdaj+af(GT|8Ugn$uYPS#w^
ziHExE)@P6xSNO%JnKQS<wIssLj>r0JKeyIi<JLt<iCwd`5V#YhjrTh{yS^;kGl5!!
zf1I;L9iwIG1D`?aQ~hQk<XT_lH4wiMJS<E;v5v$05RPcDfFALE#4<%&Lo)eVt_JCy
zKpPhjLTh?UYZ}c9YDKXo3I$;U({B!qajO^LZ2{>Ys6haR_qP8{4sl^B!tAX*umwq1
z(#Z%OSHi%AK&%@@mr1o&=LhAS^6gmTs(#HgLON7?{4e`!CgDA$wNIJMCFQS>Oyq*k
zf$8q)XU4$o{WZhD?ZdTzK*7B=@j$_YHS?a&g}!pnJ-N$)^xq-$t>D^r(Dlnm233R|
zYWyyOMsH~QBIPE8Qcn!~d_Ii7x4tuAJ>rT+(CcMNkWU`(c7l_@B9>No-HgXMN4KW<
z&#stU_~UgpqYc_sfV!E6HbGDf5bFrP<K8XmKsmmNjjX9+BX<(}pfwO%A0R(_22X?q
z*c%#EMGXhN%p>XX?sO>yIShxAf%&iZE10E=wp{QFkASQ_lI#(DcSs0*3LVPO+-rg}
zL=EK*yBQV5eShx(GewR5Oxt5xpoh&JvDK+COv7eZ^sIf)xhBg9CEtHlo{P$H_kq>P
z9GrXgF_(tmq>XRXp5_X?mqvclv9*QhB0DA8PIf!-M>hT0YW%qo5|q<%>?JzR)#Ar>
z`rL5s$h;`sLG5crioVt+LMLM3;AJ2GG)7@6+{5YKVjC}=7|izQ$gPrTNI7k0@%N7W
z%K!xHkO!CW9lD_Hf``W6hDRXD9yUT8TAY$Ss)wPcu7?Jr+-4!Glopf8cOiub?VyM*
z*r5n;YI5A-JTawXEH((QkJN8V206OjND@;Q9FS93wgnd9h3LywBKi4vJ=dIOC-rL-
zg@^u+>Jtg;s^Xzcj)Wbni_1YB_T`l)HWoiXMwAJzTCsN;QwC-R0D#UYI?B9PA?bQ`
zQ7$*NgaI&&Ns8zW9kqEdrR_-Eo~}lmca~>#s_9U44vp(6X|lknFg_44s%2)y^t0as
zBmn}L4HfIM>ZgT_9GV&BzZJWWwv}vIE1#GC1Xgd#Zg9k3R~%d^blV-=j$Cr`S(4>A
zEDziLu4|ip(xj@z+c*AnY!|F>#QuuokH{{$E!i=qy#<`1zR*(F9vq{^k7tUZJ_5QF
zy!}UwQF%SmIcGGDHK#RK)~zf!*urn=8CJX_WHo!}j7;S)`ZJxV)1lN%@mseBwbvc5
z2T9A~Z6~s!i%xRmO+*I?F_j&NL&p<5Y#uL8OqRNW*_`(7?`3Gdfs}(3T7V>)9JaGA
z@!+&&qh>TEY!-44Kq*+R7DlizaTl@4;4vuwx~V22D?xe(iNaV=pFYN$6?<P05d-~w
z3T%$-1tJ^g@AYkb#OZo%vasglyQjlQV&ci=ch4Rc>J|>FKb~UpK=PzygS#)i<8b-C
z+_l70tR`<hV+WQI$ew!8^-Pm|TDKO|aExrdTC&gd^t@VDpCE!-Ry{A1w4%iE^htL%
z!LboIl%FaijU;pLYcBjVl0=Ny$-MoA^*o-NS3T1|egTkk!7_5eZ$zTH_jE=LX3aj;
z7^2b?4c$@C<<+DU3yA<luuNA%quF<;a*(m`7eZfiDc02DA(S|Caz?y|hy=6vUw$W;
zxV=^`G`i3t6Zpf6kVuefboE4I;!X($=+tvfK?AB~#4y@*AsKDo_C=YK+&W^-$N$88
z{M9ST>N9+^Uk}fX4{-MlLuCk@{{h8O%(ZYr>US8;^{PBE#twath*Hx9j{G+y89b>%
zRM>+ihxN`k=XVGw#olVWsFrhHMA1+ya`?e7iraxSjQ0&0F(^CUKC5G}VJ7fGsIwz2
z2J>$cY({Pr;JI3C?r}CN53yYL#GpI|==Oz6_;1!iPCHsXe7_oMmk0T4T|%J;4-uV@
z>sIz4Ko4b6m5bSHX=c(Dk)jt1rcAP9z@T+DJjB8d4l^nKMygy46H&b)?P?`nWg-74
zhdq{};0w)SkEYXCah676^fjS4v1j~@F5G|tMgNq;Ihv#2;i!p>y$>IkfApqJg+G<l
zH`8qQ+;ed*h$YP|ot<bgok>OFFz|&DjMaQ6sDk+lI9)8>23TI+pD^23#Ru-kA4EmH
z$%6gP(&i~!E8l6OdeT}dv6!`p42*nb_a!z;fb!x<H=!JAxJ~Z!5X^{H{t@>#>*B83
z+6V>MRW$QhWsNBQ;solW9Ur9YKmu>{1w_PU>9<YvMl!@71leZI1*D27uoX}Q!U9w@
z0t8lmuJ9imzpG2M%wX*z2<+rSrxD>ICCq*meP<g<!TMAn9KN}>B4u%1R-KOVwX<A)
z^!}r&v6SOHmgxYuQ=kXgKp1HJM+2C5TH9XMn__SNn{4S^rz!jFp-M`jNUo8o2t4G*
z`4e+tvefs%M_Qmdy#$V48tZbprk=2s+FshR&U1OLg0L0ww<>?CC&pQ8ReN1@@5%#>
zu3MAm$PZZ>p>?8;Mm&yeJy<Zx%2l_!Gu|Oqr0q<p7N}c)+cYu87OzQvTQy2o&OkS)
z`wU<HE6L2|j75PnHKq22zw`SUhEAG>s@|!3R|xffL9mJ$<pi$25fy&|-sC3@-<AB<
z(UY(qcF%|5Y&W>~WUQ0lMx+$%slB?PiI@4;!9XV=NA)@uL<4XDKfw*~y#riZ%1no7
zT_XKhy}x+t`9T`wvJgoIcs#t(Z8&?ppvVD-b5Bq~71cRdKE!th?!k;5-<jt<Ddy10
z8bmH=aK^psd3Ve)6g_Q7cfK1P{%vqrkDU~Ip7SzHvay(X@e&yscW`2udv0i5>v3|t
zc32|{UbzRM@K#COXm2~Y1g{+4J^llcH5a+%6kIj?YZ{e>9b*Q+-VjvNX}LbQm40ur
z8_deMBE}0UcQmL-FEFTTtFGn57-=eF?YV(-^0`6t?Gy9hO?rcN!I1|bF=(jdTqgLb
z2gRw3$=!EZ+cR!lGes0caVJoiEQ(^zmxDY@$@Mm1rqy#|7VtUH;&J>CewKo(jq)pN
zPj&qLQwP=cV0tf%I*AbXbe6Ds$VSB?w1orhxSH3N@Z3c9r-%f+Yb|_IKGFsFurZiJ
zKvdm09tLcxw;j}ieIV6Ax1Zk(l%xi_EJm>`37ote=C5wha;Zkk@M!MxJD1#;VY|`F
zb`taZ?5{ttQs@tm&+F8}I}21evWG!`JeJ}^s0=0Gp-A$-S76F3rpmBlwuKxI8DH|#
z1ex!8sJcP_@EMk2_(HEj!XJOzM;3Bj>|?^YKW~-^17YL__<>9p>xYmF2<QorgJtgy
z=I6?+yZ>^dAq|j|DvAO~$h_VFTn^)y-gIbDdPDkHoC(%$ug0DcOP^})2{<gga6#zn
zUeka{a>58j^@Br+*I!}G`KQ^ap32z-x9`Yz;fev;<Rde)%~a}ekm7@|H%Yc3@%&AD
zF;hr=`{%ZcOJxS|He|Rm$LSm%Me<%ZRZ~-3^ls~Vk_;1FX5sYFAiv5D(nrwJ`gm|x
zgKf0gYZW*)PMV2EyE3dbL;2*MGrz^ZN|3M>tq}BIc~^(7-9pSWVAJ+sljXSvR|mV=
zCA6z8{&+y2>PY$dXLF#<K`3C5KS?diy~m|VR1oc(#@68GsFe*nS((lgQ7}UNFY{qG
zU<xX?<Ju^Q-WCa8{wXT9ZGU36B9Q}jYI@_1?kOf3OUpQn6%*8OkI7tsLv<R&n1B!z
z4!Vm11Uqt~9ZPeliPf}2xWg>ri~}RmjKYz4APallOJ_*7Zk<8TKHiK*r)pR>XIAIC
ziPf=3wKt0!*OJ5N-VDd57XDmrUei%HyBF19Ha};sE=;a$w76fdeL)|#axYPHC+bk=
z;=pl&=#e^PqO&MHvcr`I?)nHW3ja-x=iK0M*b;uQz<$-fKq5UJXG}QvLbXs|q;s?1
zt|YzDxu}GLOUb(*^sKKt50$c3F6f8FAYOF!b`p3tTgs_h%y-Nv&7mfT#shl8B+AZ5
z<nxnY8c7c)DDH7TmR=k8Z{;H2ie2M2(A={!)^2~WH~Go|OssO**iYG@O>_zQpIif5
z<TFAz%={OyqrW-vlOsHuz$hONVutH9A{T=nS5eZW;4BV+qt!;JiovKQk4Qqxm`=zt
z=s;uB9^K}w9~S)SLc^cHs0`iQ*%gE`|Jo;5{mDwk*5sCrRY4(EZX6F_t4+*Sj`a<S
zri3~C1`Rr`h0esNxN{DYl&lCs@n`7vpe7+d8kTfwWEfXFU6*x;HZybRI8aMqwgczX
zXYQ(eHb9H)ZN~cOg!`H|lKX=CP1nb~2H+tYxhT6!GAAAZTCG}?3@snM&N_2>wgYXl
zk^Hxuu>xfxCN?A-t>fIAXBm(O3AQriHa~z4s>+4MGl6GXP0Jw>jBgfnIu^3RYxW$x
z`=A1;k6r;cU|*QM$BL7&ZxaF|($1pb^tD$wwoex|e3><C&F?n8?}-&TTy{q)jFh?h
zzU9(UD}}q`5<gtERr#$0FH%2{fa#u3QvfM*JVl3<gDHM`Me5M1!og>uV_Vi{%PD>g
zGj#0sUUuY`Vm~=Oljv7I1b00knSwrk?h+3}R1@W8tmW=>%PD=KGY#FZ{($;vj~pN%
zpTDk-pn&bUU$^2H!Gz$1U$C}g7&yRK^pVU|QSb@QOf2*flIfLst^eLN+|d2rHQw;{
z?mN&B`R+T?Fz)?P5}^41{hL$fx#!#SWNEm5Y7w)^;aAZ?f0=KKb*vz5itV4_F{WM{
z%VYRzIhVmSI=N_vqqLk<OO#50{DvM$H$7}x<Srn9l7COmRati(U2zAod5SvE25Af^
z#^%xXb&8Z_m(o6yIFl?z`sMk<{g|YrYB=t|jqNDSwlh=-lDH=PPt%V{eiI~=o+hlH
zEADNp!>_jy!<r6bM(i6#+*kZy0DbNbsbzkJ-eHW^VVCTfj9e?{WEzh-M$6S%i%KV|
zn6(+SYm#BKOA<0dcG4q2I%q6`(Bj`6I-~ri%#nGwsvnwAg4#ECY1cw8gVaja|CqBh
zVn`XsYQ7s+XlJ{v;Q%7{O$c%@%<w}*{2=&1uInwFUoG01T!(-IePe)1HfJSiUrde)
zE&v(*LD%FA>D^@-q$ErsM7JDTXzO|)m+fwQG`t;1i&cCfiyjP{Fa5l(R9>$R3Li9t
z{zNV={V2ds%U=nd!mlrKPsis>GZH_WMlQ29s)&hPglB!zMo?Ea_iAN*+@RGrQV4KH
zEAP`b{~K=dSMUoJswlR=(-6QG`PIPV*=Ifft`Ty`zc6Kf;&(JY_e(TCdxA~YIt0Wb
zjI1-@45By6#sBf08reECCf>`ab4NR)WB&1aomfaw{)rpLDQMt&I2Y$3&txVLRGpQi
z@IFSwUhe3PP+7{=*APn@)kj`ng;euLaJ2#<?kK@ai%l3Qj2k-E55>xf+E5)ry2!_y
zw6$O<L^-sARrYiVDJwc!p1i6?oEU}hBOOaRA|$GxF`H79H(yxJ@dINkz<q@Gf*j*O
zio)E_S792&%|(Gat{XNP9lO83GGPua#}Dj={wyySoFWy`rc6N4?c^)Ym8Z5=9XZ-%
z=ZIdFr}XM%9N8=`XFP%*ge_P~rMIUk%tT1c+zQN8mxR+M+p7B{Qt`S`h_Rii6cHuc
zz<qa`s;W@Io}{%?2&Cf^8=)xSvP`qe09+_+DD9hOL1^8&MY(H}iude-aNSm@cF1li
z4(A+T!hWOU%w4o1<_wmJQX~fdG?DHKASkh#NJeV@4Pp{kK}N^2?^15+u&;3@PK*T>
zp356RGR*sBwPeEp2feXVCk|H=6?Tz*iRtGyF8YKO8CLqwE2RAM3Q4ub!@vatTD4R4
zkc1Pd>77UB*uzeXfT94l!i+^4j~kPvP*X6=+;a+u?0rlUK4e+O0}<UYz}&p&)Yq;A
z5d?C4DB-kQ(j)ku5U29!-2Iz%eJaiS-&Mw;PbT>!ak1;$T`bj*3RL!%UbydO-|@3{
zg#qTC=Uy(wPlHbO-B<8?M4+$hW<TiI@E!|k-xqY=#)ZYMH)Ct2gFfsTM_7CE+jtUF
zW3W5}zRnSCL{;?qY{2_q{CWlgWDF)E+ih@X{TEF+_Rhy}g-L(m?Z<L+ALYE@3j2aT
zzdY-^fc3lCxOeF4^Az2K*8#{miu1Pbh@-;_DI~9L{CD*@<`75QCT)p%+Z!=ty4=ti
zbrCe~zs1Z8zzf!9+O|lX$%vtFMU}3|Byda<jU&ug^JZ)srejNQ5+qyg2_RSnbCw?&
zc>2gnxm)eK$3drDz6_zIo2rG;r4=UI_(R_1yzCA8jVD%1^5K0159YonacxbRC?nRk
z8jCP<K=2H(o0gUH(~%Uxre;<7G+GWD+n+Ca;E8snMVzrZ>)R?mr<}7Br^os;|3-?Y
z2}&AX8t|y|8z<EJ^;rVRzg36)5r%oc0Y->~@VBG?8zmD0&7LW=a$_qb&j}4H$@uF!
zVW(KfuN=Z_4UTcVgOx(dmc9GsxYfGLK?W%DLjKe6DoW@bZjcQqFL!Wrf}hrt8X=9s
zOd~D3M1z}#Cv&{W!CG9zyD#<dvAbf5ACc1D#n?Lbt%5Q;?`Zv)^yt^_#oazaprY~3
zrX!B=V;KO5t-)*IZEBNH^A%uMs+|6<=M$%!UE|zA;dJB|#82DVU$c7!k2y))2Ketl
z8V&XJd$0c;>TBkFxfbdR3=tQz`Lp6@+waw{f1c+2YmnmnOVsg$dFGWlps-u;N)XT8
zIlmkGGJOmL3E?%L&e#7-*9T#*@Es?Z*J^&xLeZLR9u8_1er5nZA*8Xus3ojy7(DRf
z@NT=`t0CyiJMi)Ch}c^LZpPHRt<}=7aT)K|>e=D?^E-6Q9|J*Xmdj3VM-xt^1|f)Z
z2j0fPe0MMB?SYBF)_EqmtHLmTXYl$NmN@2jLb#6@OCd4TTBRzbtDX?<NpF8NHFU<Z
z?>ZCtO$kkbc8jawJImOP`45n_A#0yFZ9}A^F)U&AuW5XU#AD0a4C0bd0W+*H<*c@q
zJG(nOyO3_|&MaCXxY3V<@s?qz4tM|uowhpS!`}6n9`Y&dve(H?fJkgHi>8PXDCGQe
zl<bf+bQ%ftmOJ@Q_eb*AKx*NLG|_lEBKJGw64f)#xu5jd=Xa4hY8&{-pV@L&9H~f~
ze~p@TOl=1(EFx{K2j~JGLA9ZznCwFfCe!l2)MDdiz~U?fZx{`>aU{@?ac!xT^kaIp
zEmlfi9Sk_x>4_7-S_b)bD&;0_CuUgxJh5AVSb*omXwP!Y6_2`<VuMA``uvG3!+9}n
zn=y3wBe}@X2iyWhwF7fiJ}CQRQ@y0q!}LRe{#Ai(kZ9W@8IXjlcs?Gr)fD&vrNmwD
z@xntS1h$SB&~Kx$*DR-=8}94GNnVRmhm+!$PVfY*j-`Pl#{w(g)k@i?R_lCoi&zR`
z*wLE=7Me3ZW`p8ic4@sN7Ap%#%7m8rOFw~md;o@VzR*lO{%k__!Vle)d%Y*cJ2nYM
zXYi{(oQ{PA9<*+5xSoLn&$1h;f(}NBFbh#0+6}q_2@6{3A7A202YSYVs@gHQ9T!9;
zAYU4+!pqeQbfE+CC4a4Y1FW_fP)%EhdQYx;;BC6&U=W!aTs@3e>HDpaPNB7L(R-yx
z6jFmS$yt^@QJYW;r$KI0!4GK~*xDk0OPAJ-7Y10;I|FIhH|Tc%;G^Q%FqEerg?{5$
zxn8K(&nwUabFke6J!W4Y&Y8t|kx}<AgCC3xigcU77p#N-gGV>(6Sr6?cp)bEM0#8k
zEz*%(er7R_sV?(d;*~|AU5-d~)i*}eSTVyWT=SQ6j|t5tYyF>I(y&Tgk5s(*cq8&D
zu4t)o(KLz7$eCbx#22@hf^*=KLNTH~a&{L51+>Pzq@(_3>8BY85_sM>Xyun=SJrXP
zi?UWeNSL5#OLM5URswvbwtS2hbOX~QcYpD4be*+e-|61H>G{TwfZa*8@S1+K;k+d1
zL(ugAnx^K~X-^4i*=F1Vv*yv1@Au^u?_Dx7p||3g5AMNu4;fb3H23!)R9YUWiQ+{V
zM>xST1FO=5onX|5e&&O$5WMX@EnW{#LGuv=Uc^vh&C;pVCWfRCN%fHq$?hTm9otaz
z)gUbtp4<F1{9nEjQjsd8_m_YB!9$|M8iDVvo+yBJKnl@Xs^Byc_`nOMTw^(`O?WFI
z#Zu4+9EnZhV9DiblHI#8;kCAt%;UTRm|!k{sc#353@6ZGk*>5HpFmYvwN~6l*vn`h
zNg-CPCjGq=ug+ep8X{deh#$ZV(_PXrcFgkdoXWtq68r(tOtivc&&pDhNZrI!a^>f@
zw*%N63}v~|!qXCDs|=|gxplNXGF>Tw8?Ii3-rXeGfcAr&6f$ukc{imigCsA{;Ka0=
zs+)-+O;XmLnHizx-jRx`-G^PAtgO;|Ua=%8Nfu7bHeSU%S(0ArgYE8{Yf^?>`K%7_
zOvbu;Gs+x<X4hS)0<G=Ox5?>$MSFp<8pkz8v8Now4i6<xGNG$fdj*@kP(xoI<=fKm
zrMY~EwVGWJ6W)+={%gpT+M5;TA0I6?i)&3<gI^HFSK65+JFdrM@fQ{4r-^AV!S=?^
z-t|K);<m%VCQ~b*%~-=9vd8@}EMxrs3-%VnB;i}C%JsAnTb3;OCSPY(6jvESVPS}<
zicn-BLqPx0^wNCgx*CsaC>yEzWK{3pu?x@!zmOwJciKP%&?NC_I#EL}LIq4)P;p`?
zP(s4i=$F{B1b7qXX~rr7T*y0!9W9dY-r(B5Y}Scd`%naAkCPlS$n+Xke%t>$mGC#K
zmu~EWFgspY+6_7@0SlVtpDhoh0c{ziyfy<8Xv-`>TLvx1GtmnS1}02u0*`re95=?8
zO4}OLc`{A@vt@&n@zlnWLp**u2!6a*Wfs@xgmcdiRcs+pXQ@wg|A7^q6j_Y$u?jho
z-4HDzdA@qKjODQ^mvD7Z^T~O<p%XFPpJi1GWiWlEi7Z8*6Js7)gSAm=LibM=8qo?0
z*@YCNGgB8072+%~-%pm$Nr)L2n<wkqjdrc!Ldx5JV4IAuU$(pMV!AuD4PyeBwE*j{
zn*(oveC~3}KfiA;N?HBLAe;0`ukm;ss;v}ZbO^@eMQ<Mvseg8pk;2UC8piz8xwAuq
z8N3{)11XXTj=&8k#<cVm50RFd6&sn6mc}*KIz?4;)r=d>7|R%>xHA3z5Tp0FXxe+W
z+9$&_;d1L+6fT>0lBZqJ({P##At=RU{E$8_NW7JDBSU|}9}FD~oj@>x<pAGyu79%Q
zwcl+1nHuQ%&I%?RVNg#U^g`V~ATQpVWQDzi_>D3+Po^G{k7O~ppgJuJM5Fh+vV@A|
za;=&$IZXAH{ZfqIt5POLkkB?6d9K82&Mj(&Ir@0WqfFyecuWLL{-E{3B~Mg<g9?-R
zPYU`1nw(Wy|BCO>pZoiP!QFactY|xKuUsadisw+`&nR7%l-~4VKjD7w@a*i(=|9K@
zo$P`xlcCxjdPA^WI_Ih7KDGzN&0l;AI5755e&^@X*GW7<nkQmLDpUl<PJ+3Bu@lf1
z-B}MH6)x25R0VJ06zP5kar_rM3Fb<S?=%Z`#LKK9yx``yl*hklZx#e?+}@}M-4p}S
zcNAK|On8)+A!@)y<>>>h;}e4a9K{^7PG`5I0X5<X&d1Ha$z@M@ZbK;g8WB5P_+gos
zL7E8cEOI$wP;Eh*`m##qqbiz{1+#Vle>MEKK&g8lMj@TdMYX~JHz^~@5~St3Kx{?u
zG&D>FrMo6l-(r^BXys20TlV<%sA{HZn=+~t|J%VSa9T?O+Yq*iXepjy8d{K<(;P_%
ziK43t^;11Dk`!D#!wO-j!><85n-hLZ8-*fDz7&uhPAE`$M+Uk&>zSWCJ}YtuHPMza
z*T`ql{`9SMXBmlHVP-P!OPPp*(_%j>$-31t!-q~95?0jb^gnPKyMNkFIa%eG)^_ko
zu3RbQ{<w@&M|TURo8M%N-1H`)6;jtCe8+|49?r3~v6w<bN33Juw~Lg<tR_pEsHH_?
z3p0yBO^QL=l%~wcOThU)PQEIQMfJJz!YLnLzX08_L(tYN=<Kfe9L`Ve&X|YXxzM_N
zd=g%7$<=lfVehVZBo$x3a{7C*#C~I~DpR1TQ3l?$)umnIQyb4~T6E*?z^P8QL%(Kh
z8*XrWXSn^^1m+2T#>p+g=EM2(bP~#VX{R*^GFQkA3<okLDShlv4+>KiQ=-qZPJn2w
znvICs3gR*+MAB^tjv6xGI&^7B?O5`*1OMYRk)Xr3-CM(0o`6wCIT#t7*fe?A==iWT
zMu_$tLP0!G{7h-)Dm%YZIc<>?Z?%`u-SIkmrY`P!O{lpg(A^iDg*{=^`4h+6?~#Ql
zrp0m*;_b$97z%x>+2aWT|JPm{;S}L8^@gEfedyCfg!@1ym#z(ki*Ir{kx13)&bk*O
zAPCz-D_fua_E<3n%9g6T<wd)t57xe%!>(900ckFzjabl5a3`EfxQyQW#4n(cCt<ff
zgd1`U-y>Vqgwcsya|9b4skGJoqWg4arK1&Gn$(#0GP$>!|5QC#J&Ax42V^RYr&EXh
z5dPrM$v3RrU{xDOLbeYv;=V}U>TQfUPa71&H$Jh#S=JNA`DP(umZ+@eHCat^>qSUn
zT97^REcS5vD@8z7DQisj&gEhM6DIeetL>aCQ1{$j=xfXSqYL@VsNri1(D`v(Jc}>z
zf1j@__-bByxjU-x09^ly|ApVsZ?e)Rj8`y!|5zYef$4VbcA~jXV~&P((KBRIj^h8;
z^C7u=UlfxjRb>jQx~?OKdvwuKd~h=-f&jI1iPMgZn!08#>LXCA3Cw#7CwH;nSVIa7
zQE32wWZgkQw!K`Hc$=h@W@f#`=nz{?Ar$(l_kP1ARoS!}nUf*~!mHUReqbH33!Nk%
zO;zALq;|hh&8w`C*K$1yZt$hB@sTEIapjlaV|eZUsHA=EUbcSr`#7&22$!ziFEQ88
z9<FD6Mrt;~i#5i3exw<W;@1S58&mg&pWCxF32@RF^!)t6+sf=Ka#xsGaK=(0a4xDN
zkB2NY)5v<t>-})fC!g6%br4j@V}g^lR4Cj5eoi=>C$wZ?gSXAE6@2$QwP&Y=Z->(x
zt|;NW_&m)w{~QYMMhZuITmAg|t<(bdc2lsu@6=ZIP+%A?>ewe}Zj4UMH4C6;ZqLyA
zrrtA{XQLKzLe2h)iJ@+^vk@2&=!ciryLWRlos3ZiS{OD~I({p>{N+&7I}-zt?i?8E
z+=bX-x@pQDy0sc=0t1Dp^>mJ0_f`)Y*_e%7-9|J5GF_4|>3cEAi*e_o{!(@r&8L4K
zybqDU8WVCQ>8EC*uHP5tPoQBXcPKOmcE^#Kw0zkGe85-XcDwmsKyFsfx%J;OS3C(D
zoAk&lkd1ZT{Th&oEkDuiqPUU#;lNIhKzok6yd(Rdd8rGt_hrY!#=cIzKH49X$7t0C
ze9iTr=N~qePB~nm=V%hS|B$=J?2ujb<7)$M|MFg~djH|k-{S=%@1o=(a$t4(*v)es
zV+MqMb2u*%|Bx;YosBd)S%K|0U#R2Of08XtU9)iVZ7jI0;oRVVqX#qxqfPsfpTf{o
z{2_q>$qv<?XO8_C;oiH|$U;p5gfV<qHeYxy=TvY7kWQ}8Hs*{Ou~M-hvD_6g^YIo7
zi4r>?hR<gwx4)n$84|#ZZ+auNP54k#2)>(>TMR+X&~83nf7VIU-v0qVh3dvc5_kle
zRW_YdY`p4B6l}o|&=<6Uz62qvH4qv&=b=l}MBSz=!Zb6X5x2Pn&!rSO4?lXA9f)w~
zhlPh6P(jfRk2dHVJWKft4X*ij*bF=FtM)8eG6U@sZblOtztA5XVY>txep=gC!4o^S
z!9lPopt=`J@Ye9XfuARN>4{*5yv^g=lNG$v@Gzs6)YD5Uw0+rI+#-d&p*b4w4M>ML
zIC7S_FP>dJxj%RiJqthCrdg_QEyqf!D%?A?D7Oq<4Gff)Kc*5U^f80ph>B4*KK+cF
z$yOFC;+h{(Z8+q`yft{>AenMrh-=>#g-Ii5auDGO>KYkF{w8Slj#L=FLW<8}kXxLA
zxXJa{b3fG7LEBQx$f3IT<-NCyeSrUWK@Hj^zKn3QD-k>Sy2<-gs-!F~7V6J|sxb?=
zu1_8<DRl-f4&_f<OM5m8`Ct7joWx9-t}F6OgiBA&l|mKjng@_;4{%EgnnfUvdSQ|L
z^f=pe4!9f2IS$aGu_VqDJ=r$_5bRM<`d%Tuxc=SeJz$X&I{+d*!7bvz$bx4iITyei
zMGjuUT`~%5o<&XZ*I(roL9{BKnJEcCXmmh|$8s)3!#ZtD^i}k8WGJDZ?Qz5N#B}I5
z=_%*oq%*s%$lsj(Y3Zn8O#A1|iDT><=qb{a7dR0BD-YI4{*cs%=3_9YbNS6wa<7N<
zVH4_nheP8%b-M{F{ytpSt-Es~H`HK6eOfg4-`}|=DEg+hxkh<`JhA+%p)cqeoc!`?
zxTIcYsw+BVv*?G>+P>IURf})&cnUVfT{5LO>1jOD#|vM10w24ROF=*FAv^39#lO$e
zn+fJiBJ`uIY_dhKV~m__YF@{f(nBurOBH*$qV|?h`&M8`T;oOW%t}7g=bvt?q4Zi)
z_%dTJ`1uw;%ZWbpC7*s6NL-&s?=V9yKuZ-PyP^gZQoj~rND$*i3(WxgtK^>!tDyu~
zP`uJ$FG%|qCjymzCZ8S}ND!Y#3o$`1)HybLHsvV`Zg8DaZyu2dNHR`WWoBbEyV_VW
zHruUERph8n^9@ZG<+aZI)uk^8lwv%GVUCPgWvj8N^XJ2BttIav(9@f)EpNR$vt4dV
zxN)_yV{EPlD%Sj0u@0!HM_<tQU&XPpxr|lxd}ZsB43F=b;`ZjezaPJ!ENxa=67KVI
zw7XxoRn2j+RFoHl+68oXscTM&+$U_TkzvpBLrD*^&G*=s`rzeB?$$>fZv&Av5PAFu
z^#YMI5Gno#eXz~@n*b5ze^3|@*#Oap#6P`ZAhH0WmH(g;ws{93J}bPs{~*^>isK$b
zb=*`0#`EQrOSSpD;<%&bF@?W6v=6LSa*IoO%H+Tw?w%<|ZJt3Pxc$<?W~VFdMf<>J
zCG$_n{$C-tx#xd`?Ee+ATS@&BivL$AZLaknA;*7(999zlgzEnlYUex&Y?>ie847GK
zS>Z8L1$e`r=CcX3W@RnmZ2$em3{^4wX@U{A$v|`zM+rR&lP4H6&l}U#7o$?pky&&=
zPUk$`QaQn!k*RvJK2Z$M;e+A53eMBMED;G%N26fhK87dO7SAC!YANa`?#*2Qz!9{N
zPD1iuUI%?K19rclRe;6kFhDRsKtNzXx?QDoxk}C5b#OpH1d>2Nuz{cc?}xdorK!86
zrmcjfm93MlyREYmlbxHh)BigNEuoV>pacX2J{<}K^?!{J4;<Rj)YeJE($U2MIMn}9
ThlKj~EimBoJMguo=O6kX?q`m?

diff --git a/Solutions/Global Secure Access/Package/createUiDefinition.json b/Solutions/Global Secure Access/Package/createUiDefinition.json
deleted file mode 100644
index 82cdf541e4..0000000000
--- a/Solutions/Global Secure Access/Package/createUiDefinition.json	
+++ /dev/null
@@ -1,729 +0,0 @@
-{
-  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
-  "handler": "Microsoft.Azure.CreateUIDef",
-  "version": "0.1.2-preview",
-  "parameters": {
-    "config": {
-      "isWizard": false,
-      "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/gsa.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Global%20Secure%20Access/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Global Secure Access](https://aka.ms/GlobalSecureAccess) is a [domain solution](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution requires one of the product solutions below.\n\n**Prerequisite:**\n\nInstall one or more of the listed solutions to unlock the value provided by this solution.\n1. Microsoft Entra ID \n\n**Underlying Microsoft Technologies used:**\n\nThis solution depends on the following technologies, and some of these dependencies may either be in Preview state or might result in additional ingestion or operational costs:\n1. Product solutions as described above\n\n\n**Workbooks:** 2, **Analytic Rules:** 19, **Hunting Queries:** 21\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
-        "subscription": {
-          "resourceProviders": [
-            "Microsoft.OperationsManagement/solutions",
-            "Microsoft.OperationalInsights/workspaces/providers/alertRules",
-            "Microsoft.Insights/workbooks",
-            "Microsoft.Logic/workflows"
-          ]
-        },
-        "location": {
-          "metadata": {
-            "hidden": "Hiding location, we get it from the log analytics workspace"
-          },
-          "visible": false
-        },
-        "resourceGroup": {
-          "allowExisting": true
-        }
-      }
-    },
-    "basics": [
-      {
-        "name": "getLAWorkspace",
-        "type": "Microsoft.Solutions.ArmApiControl",
-        "toolTip": "This filters by workspaces that exist in the Resource Group selected",
-        "condition": "[greater(length(resourceGroup().name),0)]",
-        "request": {
-          "method": "GET",
-          "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
-        }
-      },
-      {
-        "name": "workspace",
-        "type": "Microsoft.Common.DropDown",
-        "label": "Workspace",
-        "placeholder": "Select a workspace",
-        "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
-        "constraints": {
-          "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
-          "required": true
-        },
-        "visible": true
-      }
-    ],
-    "steps": [
-      {
-        "name": "workbooks",
-        "label": "Workbooks",
-        "subLabel": {
-          "preValidation": "Configure the workbooks",
-          "postValidation": "Done"
-        },
-        "bladeTitle": "Workbooks",
-        "elements": [
-          {
-            "name": "workbooks-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences."
-            }
-          },
-          {
-            "name": "workbooks-link",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
-              }
-            }
-          },
-          {
-            "name": "workbook1",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Global Secure Access Enriched M365 Logs",
-            "elements": [
-              {
-                "name": "workbook1-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats."
-                }
-              }
-            ]
-          },
-          {
-            "name": "workbook2",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Global Secure Access Traffic Logs",
-            "elements": [
-              {
-                "name": "workbook2-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats."
-                }
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "name": "analytics",
-        "label": "Analytics",
-        "subLabel": {
-          "preValidation": "Configure the analytics",
-          "postValidation": "Done"
-        },
-        "bladeTitle": "Analytics",
-        "elements": [
-          {
-            "name": "analytics-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in the Manage solution view."
-            }
-          },
-          {
-            "name": "analytics-link",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
-              }
-            }
-          },
-          {
-            "name": "analytic1",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Connections Outside Operational Hours",
-            "elements": [
-              {
-                "name": "analytic1-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query identifies connections that occur outside of the defined operational hours. It helps in monitoring and flagging any unusual activity that may occur during non-business hours, indicating potential security concerns or policy violations."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic2",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect IP Address Changes and Overlapping Sessions",
-            "elements": [
-              {
-                "name": "analytic2-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query identifies network sessions based on DeviceId and UserPrincipalName, then checks for changed IP addresses and overlapping session times."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic3",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
-            "elements": [
-              {
-                "name": "analytic3-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic4",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
-            "elements": [
-              {
-                "name": "analytic4-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic5",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
-            "elements": [
-              {
-                "name": "analytic5-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic6",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
-            "elements": [
-              {
-                "name": "analytic6-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies when an Exchange Online transport rule is configured to forward emails.\nThis could indicate an adversary mailbox configured to collect mail from multiple user accounts."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic7",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Malicious Inbox Rule",
-            "elements": [
-              {
-                "name": "analytic7-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\nThis is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic8",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
-            "elements": [
-              {
-                "name": "analytic8-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This detection flags the occurrences of deleting multiple teams within a day.\nThis data is a part of Office 365 Connector in Microsoft Sentinel."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic9",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
-            "elements": [
-              {
-                "name": "analytic9-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic10",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Office Policy Tampering",
-            "elements": [
-              {
-                "name": "analytic10-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies if any tampering is done to either audit log, ATP Safelink, SafeAttachment, AntiPhish, or Dlp policy. \nAn adversary may use this technique to evade detection or avoid other policy-based defenses.\nReferences: https://docs.microsoft.com/powershell/module/exchange/advanced-threat-protection/remove-antiphishrule?view=exchange-ps."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic11",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
-            "elements": [
-              {
-                "name": "analytic11-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive.\nList currently includes exe, inf, gzip, cmd, bat file extensions.\nAdditionally, identifies when a given user is uploading these files to another user's workspace.\nThis may be an indication of a staging location for malware or other malicious activity."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic12",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
-            "elements": [
-              {
-                "name": "analytic12-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies Office operations that are typically rare and can provide capabilities useful to attackers."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic13",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
-            "elements": [
-              {
-                "name": "analytic13-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic14",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
-            "elements": [
-              {
-                "name": "analytic14-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%)."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic15",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
-            "elements": [
-              {
-                "name": "analytic15-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic16",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
-            "elements": [
-              {
-                "name": "analytic16-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic17",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Abnormal Deny Rate for Source to Destination IP",
-            "elements": [
-              {
-                "name": "analytic17-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, initial access, or C2, where an attacker tries to exploit the same vulnerability on machines in the organization but is being blocked by firewall rules."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic18",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Protocol Changes for Destination Ports",
-            "elements": [
-              {
-                "name": "analytic18-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic19",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Source IP Scanning Multiple Open Ports",
-            "elements": [
-              {
-                "name": "analytic19-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial access."
-                }
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "name": "huntingqueries",
-        "label": "Hunting Queries",
-        "bladeTitle": "Hunting Queries",
-        "elements": [
-          {
-            "name": "huntingqueries-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in the Manage solution view."
-            }
-          },
-          {
-            "name": "huntingqueries-link",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
-              }
-            }
-          },
-          {
-            "name": "huntingquery1",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
-            "elements": [
-              {
-                "name": "huntingquery1-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery2",
-            "type": "Microsoft.Common.Section",
-            "label": "External User Added and Removed in a Short Timeframe",
-            "elements": [
-              {
-                "name": "huntingquery2-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query identifies external user accounts that are added to a Team and then removed within one hour. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery3",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
-            "elements": [
-              {
-                "name": "huntingquery3-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery4",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
-            "elements": [
-              {
-                "name": "huntingquery4-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies when Exchange Online transport rule is configured to forward emails.\nThis could be an adversary mailbox configured to collect mail from multiple user accounts. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery5",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Bots added to multiple teams",
-            "elements": [
-              {
-                "name": "huntingquery5-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query helps identify bots added to multiple Teams in a short space of time. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery6",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - User made Owner of multiple teams",
-            "elements": [
-              {
-                "name": "huntingquery6-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query identifies users who have been made Owner of multiple Teams. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery7",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
-            "elements": [
-              {
-                "name": "huntingquery7-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query identifies where multiple Teams have been deleted by a single user in a short timeframe. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery8",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
-            "elements": [
-              {
-                "name": "huntingquery8-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query helps identify new, and potentially unapproved applications or bots being added to Teams. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery9",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
-            "elements": [
-              {
-                "name": "huntingquery9-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This identifies new Windows Reserved Filenames on Office services like SharePoint and OneDrive in the past 7 days. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery10",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
-            "elements": [
-              {
-                "name": "huntingquery10-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Adversaries often abuse email-forwarding rules to monitor victim activities, steal information, and gain intelligence on the victim or their organization. This query highlights cases where user mail is being forwarded, including to external domains. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery11",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
-            "elements": [
-              {
-                "name": "huntingquery11-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query identifies files uploaded to SharePoint via a Teams chat and\nsummarizes users and IP addresses that have accessed these files. This allows for \nidentification of anomalous file sharing patterns. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery12",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
-            "elements": [
-              {
-                "name": "huntingquery12-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query identifies users who are added to a Teams Channel or Teams chat\nand within 1 minute of being added upload a file via the chat. This might be\nan indicator of suspicious activity. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery13",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
-            "elements": [
-              {
-                "name": "huntingquery13-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This identifies Windows Reserved Filenames on Office services like SharePoint and OneDrive. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery14",
-            "type": "Microsoft.Common.Section",
-            "label": "Exes with double file extension and access summary",
-            "elements": [
-              {
-                "name": "huntingquery14-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Provides a summary of executable files with double file extensions in SharePoint \n and the users and IP addresses that have accessed them. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery15",
-            "type": "Microsoft.Common.Section",
-            "label": "New Admin Account Activity Seen Which Was Not Seen Historically",
-            "elements": [
-              {
-                "name": "huntingquery15-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This will help you discover any new admin account activity which was seen and were not seen historically.\nAny new accounts seen in the results can be validated and investigated for any suspicious activities. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery16",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
-            "elements": [
-              {
-                "name": "huntingquery16-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Shows SharePoint upload/download volume by IPs with high-risk ASNs. New IPs with volume spikes may be unauthorized and exfiltrating documents. This hunting query depends on AzureActiveDirectory AzureActiveDirectory data connector (SigninLogs EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery17",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
-            "elements": [
-              {
-                "name": "huntingquery17-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Tracking via user agent is one way to differentiate between types of connecting device.\nIn homogeneous enterprise environments the user agent associated with an attacker device may stand out as unusual. This hunting query depends on AzureActiveDirectory AzureActiveDirectory data connector (SigninLogs EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery18",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Non-owner mailbox login activity",
-            "elements": [
-              {
-                "name": "huntingquery18-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Finds non-owner mailbox access by admin/delegate permissions. Whitelist valid users and check others for unauthorized access. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery19",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
-            "elements": [
-              {
-                "name": "huntingquery19-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects mailbox login from Exchange PowerShell. All accounts can use it by default, but admins can change it. Whitelist benign activities. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery20",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
-            "elements": [
-              {
-                "name": "huntingquery20-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "New user agents associated with a client IP for SharePoint file uploads/downloads. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery21",
-            "type": "Microsoft.Common.Section",
-            "label": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
-            "elements": [
-              {
-                "name": "huntingquery21-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
-                }
-              }
-            ]
-          }
-        ]
-      }
-    ],
-    "outputs": {
-      "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
-      "location": "[location()]",
-      "workspace": "[basics('workspace')]"
-    }
-  }
-}
diff --git a/Solutions/Global Secure Access/Package/mainTemplate.json b/Solutions/Global Secure Access/Package/mainTemplate.json
deleted file mode 100644
index 18a4637428..0000000000
--- a/Solutions/Global Secure Access/Package/mainTemplate.json	
+++ /dev/null
@@ -1,5028 +0,0 @@
-{
-  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-  "contentVersion": "1.0.0.0",
-  "metadata": {
-    "author": "Microsoft - support@microsoft.com",
-    "comments": "Solution template for Global Secure Access"
-  },
-  "parameters": {
-    "location": {
-      "type": "string",
-      "minLength": 1,
-      "defaultValue": "[resourceGroup().location]",
-      "metadata": {
-        "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
-      }
-    },
-    "workspace-location": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
-      }
-    },
-    "workspace": {
-      "defaultValue": "",
-      "type": "string",
-      "metadata": {
-        "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
-      }
-    },
-    "workbook1-name": {
-      "type": "string",
-      "defaultValue": "Microsoft Global Secure Access Enriched M365 Logs",
-      "minLength": 1,
-      "metadata": {
-        "description": "Name for the workbook"
-      }
-    },
-    "workbook2-name": {
-      "type": "string",
-      "defaultValue": "Microsoft Global Secure Access Traffic Logs",
-      "minLength": 1,
-      "metadata": {
-        "description": "Name for the workbook"
-      }
-    }
-  },
-  "variables": {
-    "email": "support@microsoft.com",
-    "_email": "[variables('email')]",
-    "_solutionName": "Global Secure Access",
-    "_solutionVersion": "3.1.0",
-    "solutionId": "azuresentinel.azure-sentinel-solution-globalsecureaccess",
-    "_solutionId": "[variables('solutionId')]",
-    "workbookVersion1": "1.0.1",
-    "workbookContentId1": "GSAM365EnrichedEvents",
-    "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
-    "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
-    "_workbookContentId1": "[variables('workbookContentId1')]",
-    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
-    "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
-    "workbookVersion2": "1.0.1",
-    "workbookContentId2": "GSANetworkTraffic",
-    "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]",
-    "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]",
-    "_workbookContentId2": "[variables('workbookContentId2')]",
-    "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]",
-    "analyticRuleObject1": {
-      "analyticRuleVersion1": "1.0.0",
-      "_analyticRulecontentId1": "4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa",
-      "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa')]",
-      "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa')))]",
-      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa','-', '1.0.0')))]"
-    },
-    "analyticRuleObject2": {
-      "analyticRuleVersion2": "1.0.0",
-      "_analyticRulecontentId2": "57abf863-1c1e-46c6-85b2-35370b712c1e",
-      "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '57abf863-1c1e-46c6-85b2-35370b712c1e')]",
-      "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('57abf863-1c1e-46c6-85b2-35370b712c1e')))]",
-      "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','57abf863-1c1e-46c6-85b2-35370b712c1e','-', '1.0.0')))]"
-    },
-    "analyticRuleObject3": {
-      "analyticRuleVersion3": "2.0.8",
-      "_analyticRulecontentId3": "dc451755-8ab3-4059-b805-e454c45d1d44",
-      "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'dc451755-8ab3-4059-b805-e454c45d1d44')]",
-      "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('dc451755-8ab3-4059-b805-e454c45d1d44')))]",
-      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','dc451755-8ab3-4059-b805-e454c45d1d44','-', '2.0.8')))]"
-    },
-    "analyticRuleObject4": {
-      "analyticRuleVersion4": "2.1.3",
-      "_analyticRulecontentId4": "4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac",
-      "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac')]",
-      "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac')))]",
-      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac','-', '2.1.3')))]"
-    },
-    "analyticRuleObject5": {
-      "analyticRuleVersion5": "2.1.4",
-      "_analyticRulecontentId5": "1a8f1297-23a4-4f09-a20b-90af8fc3641a",
-      "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1a8f1297-23a4-4f09-a20b-90af8fc3641a')]",
-      "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1a8f1297-23a4-4f09-a20b-90af8fc3641a')))]",
-      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1a8f1297-23a4-4f09-a20b-90af8fc3641a','-', '2.1.4')))]"
-    },
-    "analyticRuleObject6": {
-      "analyticRuleVersion6": "2.1.4",
-      "_analyticRulecontentId6": "edcfc2e0-3134-434c-8074-9101c530d419",
-      "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'edcfc2e0-3134-434c-8074-9101c530d419')]",
-      "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('edcfc2e0-3134-434c-8074-9101c530d419')))]",
-      "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','edcfc2e0-3134-434c-8074-9101c530d419','-', '2.1.4')))]"
-    },
-    "analyticRuleObject7": {
-      "analyticRuleVersion7": "2.0.6",
-      "_analyticRulecontentId7": "a9c76c8d-f60d-49ec-9b1f-bdfee6db3807",
-      "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a9c76c8d-f60d-49ec-9b1f-bdfee6db3807')]",
-      "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a9c76c8d-f60d-49ec-9b1f-bdfee6db3807')))]",
-      "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a9c76c8d-f60d-49ec-9b1f-bdfee6db3807','-', '2.0.6')))]"
-    },
-    "analyticRuleObject8": {
-      "analyticRuleVersion8": "2.0.6",
-      "_analyticRulecontentId8": "db60e4b6-a845-4f28-a18c-94ebbaad6c6c",
-      "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'db60e4b6-a845-4f28-a18c-94ebbaad6c6c')]",
-      "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('db60e4b6-a845-4f28-a18c-94ebbaad6c6c')))]",
-      "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','db60e4b6-a845-4f28-a18c-94ebbaad6c6c','-', '2.0.6')))]"
-    },
-    "analyticRuleObject9": {
-      "analyticRuleVersion9": "2.0.5",
-      "_analyticRulecontentId9": "d75e8289-d1cb-44d4-bd59-2f44a9172478",
-      "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd75e8289-d1cb-44d4-bd59-2f44a9172478')]",
-      "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d75e8289-d1cb-44d4-bd59-2f44a9172478')))]",
-      "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d75e8289-d1cb-44d4-bd59-2f44a9172478','-', '2.0.5')))]"
-    },
-    "analyticRuleObject10": {
-      "analyticRuleVersion10": "2.0.6",
-      "_analyticRulecontentId10": "0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb",
-      "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb')]",
-      "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb')))]",
-      "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb','-', '2.0.6')))]"
-    },
-    "analyticRuleObject11": {
-      "analyticRuleVersion11": "2.0.7",
-      "_analyticRulecontentId11": "178c62b4-d5e5-40f5-8eab-7fccd0051e7a",
-      "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '178c62b4-d5e5-40f5-8eab-7fccd0051e7a')]",
-      "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('178c62b4-d5e5-40f5-8eab-7fccd0051e7a')))]",
-      "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','178c62b4-d5e5-40f5-8eab-7fccd0051e7a','-', '2.0.7')))]"
-    },
-    "analyticRuleObject12": {
-      "analyticRuleVersion12": "2.0.7",
-      "_analyticRulecontentId12": "433c254d-4b84-46f7-99ec-9dfefb5f6a7b",
-      "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '433c254d-4b84-46f7-99ec-9dfefb5f6a7b')]",
-      "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('433c254d-4b84-46f7-99ec-9dfefb5f6a7b')))]",
-      "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','433c254d-4b84-46f7-99ec-9dfefb5f6a7b','-', '2.0.7')))]"
-    },
-    "analyticRuleObject13": {
-      "analyticRuleVersion13": "2.0.6",
-      "_analyticRulecontentId13": "7460e34e-4c99-47b2-b7c0-c42e339fc586",
-      "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7460e34e-4c99-47b2-b7c0-c42e339fc586')]",
-      "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7460e34e-4c99-47b2-b7c0-c42e339fc586')))]",
-      "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7460e34e-4c99-47b2-b7c0-c42e339fc586','-', '2.0.6')))]"
-    },
-    "analyticRuleObject14": {
-      "analyticRuleVersion14": "2.2.6",
-      "_analyticRulecontentId14": "efd17c5f-5167-40f8-a1e9-0818940785d9",
-      "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'efd17c5f-5167-40f8-a1e9-0818940785d9')]",
-      "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('efd17c5f-5167-40f8-a1e9-0818940785d9')))]",
-      "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','efd17c5f-5167-40f8-a1e9-0818940785d9','-', '2.2.6')))]"
-    },
-    "analyticRuleObject15": {
-      "analyticRuleVersion15": "1.0.5",
-      "_analyticRulecontentId15": "30375d00-68cc-4f95-b89a-68064d566358",
-      "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '30375d00-68cc-4f95-b89a-68064d566358')]",
-      "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('30375d00-68cc-4f95-b89a-68064d566358')))]",
-      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','30375d00-68cc-4f95-b89a-68064d566358','-', '1.0.5')))]"
-    },
-    "analyticRuleObject16": {
-      "analyticRuleVersion16": "2.0.7",
-      "_analyticRulecontentId16": "abd6976d-8f71-4851-98c4-4d086201319c",
-      "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'abd6976d-8f71-4851-98c4-4d086201319c')]",
-      "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('abd6976d-8f71-4851-98c4-4d086201319c')))]",
-      "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','abd6976d-8f71-4851-98c4-4d086201319c','-', '2.0.7')))]"
-    },
-    "analyticRuleObject17": {
-      "analyticRuleVersion17": "1.0.0",
-      "_analyticRulecontentId17": "e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b",
-      "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b')]",
-      "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b')))]",
-      "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b','-', '1.0.0')))]"
-    },
-    "analyticRuleObject18": {
-      "analyticRuleVersion18": "1.0.0",
-      "_analyticRulecontentId18": "f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a",
-      "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a')]",
-      "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a')))]",
-      "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a','-', '1.0.0')))]"
-    },
-    "analyticRuleObject19": {
-      "analyticRuleVersion19": "1.0.0",
-      "_analyticRulecontentId19": "82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1",
-      "analyticRuleId19": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1')]",
-      "analyticRuleTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1')))]",
-      "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1','-', '1.0.0')))]"
-    },
-    "huntingQueryObject1": {
-      "huntingQueryVersion1": "2.0.2",
-      "_huntingQuerycontentId1": "271e8881-3044-4332-a5f4-42264c2e0315",
-      "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('271e8881-3044-4332-a5f4-42264c2e0315')))]"
-    },
-    "huntingQueryObject2": {
-      "huntingQueryVersion2": "2.0.1",
-      "_huntingQuerycontentId2": "119d9e1c-afcc-4d23-b239-cdb4e7bf851c",
-      "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('119d9e1c-afcc-4d23-b239-cdb4e7bf851c')))]"
-    },
-    "huntingQueryObject3": {
-      "huntingQueryVersion3": "2.0.2",
-      "_huntingQuerycontentId3": "6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45",
-      "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45')))]"
-    },
-    "huntingQueryObject4": {
-      "huntingQueryVersion4": "2.0.2",
-      "_huntingQuerycontentId4": "9891684a-1e3a-4546-9403-3439513cbc70",
-      "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9891684a-1e3a-4546-9403-3439513cbc70')))]"
-    },
-    "huntingQueryObject5": {
-      "huntingQueryVersion5": "2.0.1",
-      "_huntingQuerycontentId5": "9eb64924-ec8d-44d0-b1f2-10665150fb74",
-      "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9eb64924-ec8d-44d0-b1f2-10665150fb74')))]"
-    },
-    "huntingQueryObject6": {
-      "huntingQueryVersion6": "2.0.2",
-      "_huntingQuerycontentId6": "558f15dd-3171-4b11-bf24-31c0610a20e0",
-      "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('558f15dd-3171-4b11-bf24-31c0610a20e0')))]"
-    },
-    "huntingQueryObject7": {
-      "huntingQueryVersion7": "2.0.2",
-      "_huntingQuerycontentId7": "64990414-b015-4edf-bef0-343b741e68c5",
-      "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('64990414-b015-4edf-bef0-343b741e68c5')))]"
-    },
-    "huntingQueryObject8": {
-      "huntingQueryVersion8": "2.0.2",
-      "_huntingQuerycontentId8": "bf76e508-9282-4cf1-9cc1-5c20c3dea2ee",
-      "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bf76e508-9282-4cf1-9cc1-5c20c3dea2ee')))]"
-    },
-    "huntingQueryObject9": {
-      "huntingQueryVersion9": "2.0.2",
-      "_huntingQuerycontentId9": "641ecd2d-27c9-4f05-8433-8205096b09fc",
-      "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('641ecd2d-27c9-4f05-8433-8205096b09fc')))]"
-    },
-    "huntingQueryObject10": {
-      "huntingQueryVersion10": "2.0.2",
-      "_huntingQuerycontentId10": "d49fc965-aef3-49f6-89ad-10cc4697eb5b",
-      "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d49fc965-aef3-49f6-89ad-10cc4697eb5b')))]"
-    },
-    "huntingQueryObject11": {
-      "huntingQueryVersion11": "2.0.2",
-      "_huntingQuerycontentId11": "90e198a9-efb6-4719-ad89-81b8e93633a7",
-      "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('90e198a9-efb6-4719-ad89-81b8e93633a7')))]"
-    },
-    "huntingQueryObject12": {
-      "huntingQueryVersion12": "2.0.2",
-      "_huntingQuerycontentId12": "3d6d0c04-7337-40cf-ace6-c471d442356d",
-      "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3d6d0c04-7337-40cf-ace6-c471d442356d')))]"
-    },
-    "huntingQueryObject13": {
-      "huntingQueryVersion13": "2.0.2",
-      "_huntingQuerycontentId13": "61c28cd7-3139-4731-8ea7-2cbbeabb4684",
-      "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('61c28cd7-3139-4731-8ea7-2cbbeabb4684')))]"
-    },
-    "huntingQueryObject14": {
-      "huntingQueryVersion14": "2.0.1",
-      "_huntingQuerycontentId14": "d12580c2-1474-4125-a8a3-553f50d91215",
-      "huntingQueryTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d12580c2-1474-4125-a8a3-553f50d91215')))]"
-    },
-    "huntingQueryObject15": {
-      "huntingQueryVersion15": "2.0.1",
-      "_huntingQuerycontentId15": "723c5f46-133f-4f1e-ada6-5c138f811d75",
-      "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('723c5f46-133f-4f1e-ada6-5c138f811d75')))]"
-    },
-    "huntingQueryObject16": {
-      "huntingQueryVersion16": "2.0.2",
-      "_huntingQuerycontentId16": "e3d24cfd-b2a1-4ba7-8f80-0360892f9d57",
-      "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3d24cfd-b2a1-4ba7-8f80-0360892f9d57')))]"
-    },
-    "huntingQueryObject17": {
-      "huntingQueryVersion17": "2.0.2",
-      "_huntingQuerycontentId17": "f2367171-1514-4c67-88ef-27434b6a1093",
-      "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f2367171-1514-4c67-88ef-27434b6a1093')))]"
-    },
-    "huntingQueryObject18": {
-      "huntingQueryVersion18": "2.0.1",
-      "_huntingQuerycontentId18": "0a8f410d-38b5-4d75-90da-32b472b97230",
-      "huntingQueryTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a8f410d-38b5-4d75-90da-32b472b97230')))]"
-    },
-    "huntingQueryObject19": {
-      "huntingQueryVersion19": "2.0.2",
-      "_huntingQuerycontentId19": "49a4f65a-fe18-408e-afec-042fde93d3ce",
-      "huntingQueryTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('49a4f65a-fe18-408e-afec-042fde93d3ce')))]"
-    },
-    "huntingQueryObject20": {
-      "huntingQueryVersion20": "2.0.2",
-      "_huntingQuerycontentId20": "e8ae1375-4640-430c-ae8e-2514d09c71eb",
-      "huntingQueryTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e8ae1375-4640-430c-ae8e-2514d09c71eb')))]"
-    },
-    "huntingQueryObject21": {
-      "huntingQueryVersion21": "2.0.2",
-      "_huntingQuerycontentId21": "a1551ae4-f61c-4bca-9c57-4d0d681db2e9",
-      "huntingQueryTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a1551ae4-f61c-4bca-9c57-4d0d681db2e9')))]"
-    },
-    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
-  },
-  "resources": [
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('workbookTemplateSpecName1')]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "GSAM365EnrichedEvents Workbook with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('workbookVersion1')]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.Insights/workbooks",
-              "name": "[variables('workbookContentId1')]",
-              "location": "[parameters('workspace-location')]",
-              "kind": "shared",
-              "apiVersion": "2021-08-01",
-              "metadata": {
-                "description": "This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats."
-              },
-              "properties": {
-                "displayName": "[parameters('workbook1-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Enriched Microsoft 365 logs Workbook (Preview)\\n---\\n\\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::all\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The Log Analytic Workspace In Which To Execute The Queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| summarize Count = count() by UserId\\r\\n| order by Count desc, UserId asc\\r\\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"e841bafb-6437-4d29-84ac-ba16c5a6d901\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"ac5f2082-50bc-4739-bdf2-20c93b613671\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"SharePoint/OneDrive Insights\",\"subTarget\":\"Threat\",\"style\":\"link\"},{\"id\":\"dc2778e7-739b-44ba-9ae4-c81901277f57\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Exchange Online Insights\",\"subTarget\":\"ThreatEXO\",\"style\":\"link\"},{\"id\":\"666111e2-54ff-4fa4-a648-11a5c8c0235b\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Teams Insights\",\"subTarget\":\"ThreatTeams\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Exchange\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Exchange\\\")\\r\\n| summarize [\\\"Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Count\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Set-AdminAuditLogConfig\\\", \\\"Set-OrganizationConfig\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Audit Of Critical Configuration Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Set-TransportRule\\\", \\\"Set-AtpPolicyForO365\\\", \\\"Set-MalwareFilterRule\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Changes In Email Security Policies\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Add-RoleGroupMember\\\", \\\"Remove-ManagementRoleAssignment\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Monitoring Role Group Membership Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"New-TenantAllowBlockListSpoofitems\\\", \\\"Remove-TenantAllowBlockListSpoofitems\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Spoofing Settings Management Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"New-SafeAttachmentPolicy\\\", \\\"Set-SafeAttachmentPolicy\\\", \\\"Set-SafeAttachmentRule\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Safe Attachments Policy Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatEXO\"},\"name\":\"group - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs | where Workload == \\\"Exchange\\\" | where Operation in (\\\"Add-MailboxFolderPermission\\\", \\\"Add-RoleGroupMember\\\", \\\"New-TransportRule\\\", \\\"Remove-ManagementRoleAssignment\\\", \\\"Set-TransportRule\\\") | summarize Count = count(), Users = makeset(UserId) by Operation | order by Count desc\",\"size\":0,\"title\":\"Permission changes and security policy updates\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"seltab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatEXO\"},\"name\":\"query - 13\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Teams\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Teams\\\")\\r\\n| summarize [\\\"Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Count\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatTeams\"},\"name\":\"group - 10\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\",\\\"SPO/OneDrive\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"numberOfMetrics\":19,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| summarize [\\\"Event Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Event Count\\\"] desc\\r\\n\",\"size\":2,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 20\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"group - 20\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| where Operation in (\\\"MemberAdded\\\", \\\"MemberRemoved\\\", \\\"TeamDeleted\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Changes In Team Memberships\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatTeams\"},\"customWidth\":\"50\",\"name\":\"query - 11\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RiskyExtensions = dynamic([\\\"exe\\\", \\\"msi\\\", \\\"bat\\\", \\\"cmd\\\", \\\"com\\\", \\\"scr\\\", \\\"pif\\\", \\\"ps1\\\", \\\"vbs\\\", \\\"js\\\", \\\"jse\\\", \\\"wsf\\\", \\\"docm\\\", \\\"xlsm\\\", \\\"pptm\\\", \\\"dll\\\", \\\"ocx\\\", \\\"cpl\\\", \\\"app\\\", \\\"vb\\\", \\\"reg\\\", \\\"inf\\\", \\\"hta\\\"]);\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"SPO/OneDrive\\\")\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend [\\\"File Extension\\\"] = tostring(parse_json(AdditionalProperties).SourceFileExtension)\\r\\n| where [\\\"File Extension\\\"] in (RiskyExtensions)\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, [\\\"File Extension\\\"], Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], [\\\"File Extension\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], [\\\"File Extension\\\"], Operation, Count\\r\\n\",\"size\":0,\"title\":\"Risky File Operations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| where Operation in (\\\"FileRecycled\\\", \\\"FileDownloaded\\\", \\\"FileUploaded\\\", \\\"FileCreated\\\", \\\"File Modified\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Bulk File Events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"SPO/OneDrive\\\")\\r\\n| where Operation == \\\"FileDeletedFirstStageRecycleBin\\\"\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by bin(Timestamp, 1h), [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n| where Count > 1\\r\\n\",\"size\":0,\"title\":\" Bulk File Deletion Operations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileDeletions\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let baselinePeriod = 30d;\\r\\nlet detectionWindow = 1h;\\r\\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs\\r\\n| where TimeGenerated >= ago(baselinePeriod)\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| where Operation == \\\"FileDownloaded\\\"\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by bin(Timestamp, detectionWindow), [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Bulk File Download\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DownloadCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 4\"}]},\"name\":\"group - 9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n      | where tostring(Country) != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"minSize\":20,\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"numberOfMetrics\":8,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| summarize [\\\"Event Count\\\"] = count() by [\\\"Time Generated\\\"] = TimeGenerated, [\\\"User\\\"] = UserId, [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem, [\\\"Workload\\\"] = Workload\\r\\n| order by [\\\"Time Generated\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 1\"}]},\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| project \\r\\n    Operation, \\r\\n    UserId, \\r\\n    Workload, \\r\\n    SourceIp, \\r\\n    DeviceId, \\r\\n    TimeGenerated, \\r\\n    Details = pack_all(),\\r\\n    OS = tostring(DeviceOperatingSystem)\\r\\n| extend Workload = tostring(Workload)\\r\\n| extend WorkloadStatus = case(\\r\\n    Workload == \\\"Exchange\\\", \\\"Exchange\\\",\\r\\n    Workload == \\\"Teams\\\", \\\"Teams\\\",\\r\\n    Workload == \\\"SharePoint\\\", \\\"SharePoint\\\",\\r\\n    \\\"Other\\\"\\r\\n);\\r\\n\\r\\nlet appData = data\\r\\n| summarize \\r\\n    TotalCount = count(), \\r\\n    ExchangeCount = countif(Workload == \\\"Exchange\\\"), \\r\\n    TeamsCount = countif(Workload == \\\"Teams\\\"), \\r\\n    SharePointCount = countif(Workload == \\\"SharePoint\\\"), \\r\\n    OtherCount = countif(Workload == \\\"Other\\\") \\r\\n    by UserId\\r\\n| where UserId != ''\\r\\n| join kind=inner (\\r\\n    data\\r\\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId\\r\\n    | project-away TimeGenerated\\r\\n  ) on UserId\\r\\n| order by TotalCount desc, UserId asc\\r\\n| project UserId, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\\r\\n| serialize Id = row_number();\\r\\n\\r\\ndata\\r\\n| summarize \\r\\n    TotalCount = count(), \\r\\n    ExchangeCount = countif(Workload == \\\"Exchange\\\"), \\r\\n    TeamsCount = countif(Workload == \\\"Teams\\\"), \\r\\n    SharePointCount = countif(Workload == \\\"SharePoint\\\"), \\r\\n    OtherCount = countif(Workload == \\\"Other\\\") \\r\\n    by UserId, SourceIp = tostring(SourceIp)\\r\\n| join kind=inner (\\r\\n    data\\r\\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId, SourceIp\\r\\n    | project-away TimeGenerated\\r\\n  ) on UserId, SourceIp\\r\\n| order by TotalCount desc, UserId asc\\r\\n| project UserId, SourceIp, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\\r\\n| serialize Id = row_number(1000000)\\r\\n| join kind=inner (appData) on UserId\\r\\n| project Id, Name = SourceIp, Type = 'Client IP', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = Id1\\r\\n| union (\\r\\n    appData \\r\\n    | project Id, Name = UserId, Type = 'Operating System', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = -1\\r\\n  )\\r\\n| order by ['Events Count'] desc, Name asc\\r\\n\",\"size\":2,\"title\":\"Activity Log\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5},{\"columnMatch\":\"Type\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Other Count\",\"formatter\":5},{\"columnMatch\":\"ParentId\",\"formatter\":5},{\"columnMatch\":\"Operation Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Exchange Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},{\"columnMatch\":\"Teams Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"purple\"}},{\"columnMatch\":\"SharePoint Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\"}},{\"columnMatch\":\"Details\",\"formatter\":5,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\"}}},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<br />\\r\\n💡 _Click on a segment of the pie chart to explore more details_\"},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| extend \\r\\n    OS = coalesce(DeviceOperatingSystem, \\\"Unknown OS\\\"),\\r\\n    OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \\\"Unknown Version\\\")\\r\\n| summarize DeviceCount = count() by OS, OSVersion\\r\\n| order by DeviceCount desc\\r\\n\",\"size\":3,\"title\":\"Devices Accessing M365\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"Parampie\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend \\r\\n    [\\\"Operating System\\\"] = coalesce(DeviceOperatingSystem, \\\"Unknown OS\\\"),\\r\\n    [\\\"OS Version\\\"] = coalesce(tostring(DeviceOperatingSystemVersion), \\\"Unknown Version\\\"),\\r\\n    [\\\"Device ID\\\"] = coalesce(tostring(DeviceId), \\\"Unknown DeviceId\\\")\\r\\n| where [\\\"Operating System\\\"] == dynamic({Parampie}).label\\r\\n| summarize [\\\"Device Count\\\"] = count() by [\\\"Operating System\\\"], [\\\"OS Version\\\"], [\\\"Device ID\\\"]\\r\\n| order by [\\\"Device Count\\\"] desc\\r\\n\",\"size\":2,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":1}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"OperatingSystem\",\"OSVersion\"],\"expandTopLevel\":false}}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},{\"parameterName\":\"Parampie\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 1\"}]},\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let BusinessHoursStart = 8; // 8 AM\\r\\nlet BusinessHoursEnd = 18; // 6 PM\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs \\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend HourOfDay = hourofday(TimeGenerated)\\r\\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\\r\\n| summarize [\\\"Off-Hour Activities\\\"] = count() by [\\\"User ID\\\"] = UserId, [\\\"Date\\\"] = bin(TimeGenerated, 1d), [\\\"Operation\\\"]\\r\\n| order by [\\\"Off-Hour Activities\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Activity Outside Standard Working Hours (8:00 - 18:00)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\n| summarize Count = count() by bin(TimeGenerated, 1h)\\n| order by TimeGenerated asc\\n\",\"size\":0,\"title\":\"Microsoft 365 Transactions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"unstackedbar\"},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"}],\"fallbackResourceIds\":[\"Global Secure Access\"],\"fromTemplateId\":\"GSA Enriched Microsoft 365 logs\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
-                "version": "1.0",
-                "sourceId": "[variables('workspaceResourceId')]",
-                "category": "sentinel"
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
-              "properties": {
-                "description": "@{workbookKey=GSAM365EnrichedEvents; logoFileName=gsa.svg; description=This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Global Secure Access Enriched M365 Logs; templateRelativePath=GSAM365EnrichedEvents.json; provider=Microsoft}.description",
-                "parentId": "[variables('workbookId1')]",
-                "contentId": "[variables('_workbookContentId1')]",
-                "kind": "Workbook",
-                "version": "[variables('workbookVersion1')]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                },
-                "dependencies": {
-                  "operator": "AND",
-                  "criteria": [
-                    {
-                      "contentId": "AzureActiveDirectory",
-                      "kind": "DataConnector"
-                    }
-                  ]
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('_workbookContentId1')]",
-        "contentKind": "Workbook",
-        "displayName": "[parameters('workbook1-name')]",
-        "contentProductId": "[variables('_workbookcontentProductId1')]",
-        "id": "[variables('_workbookcontentProductId1')]",
-        "version": "[variables('workbookVersion1')]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('workbookTemplateSpecName2')]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "GSANetworkTraffic Workbook with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('workbookVersion2')]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.Insights/workbooks",
-              "name": "[variables('workbookContentId2')]",
-              "location": "[parameters('workspace-location')]",
-              "kind": "shared",
-              "apiVersion": "2021-08-01",
-              "metadata": {
-                "description": "This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats."
-              },
-              "properties": {
-                "displayName": "[parameters('workbook2-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Network Traffic Insights Workbook (Preview)\\n---\\nInformation in the dashboard is based on log data\\n\\n\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::all\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The Log Analytic Workspace In Which To Execute The Queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":2592000000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"NetworkAccessTraffic\\r\\n| summarize Count = count() by UserPrincipalName\\r\\n| order by Count desc, UserPrincipalName asc\\r\\n| project Value = UserPrincipalName, Label = strcat(UserPrincipalName, ' - ', Count, ' Logs'), Selected = false\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"527af4d2-3089-4aa4-9fbb-48ec697db20d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WebCategories\",\"label\":\"Web Categories\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"NetworkAccessTraffic\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| order by Count desc, firstCategory asc\\r\\n| project Value = firstCategory, Label = strcat(firstCategory, ' - ', Count, ' Logs')\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"2b2cd1be-9d25-412c-8444-f005c4789b55\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"cc3e67f2-f20f-4430-8dee-d0773b90d9ce\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"All Traffic\",\"subTarget\":\"AllTraffic\",\"style\":\"link\"},{\"id\":\"5ae54b5a-ac7b-4b7a-a1e1-1e574625caa3\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"URL Lookup\",\"subTarget\":\"URLLookup\",\"style\":\"link\"},{\"id\":\"68c566f8-957e-4a3f-8b66-730fc24135fb\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Insights\",\"subTarget\":\"Security\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkAccessTrafficData = NetworkAccessTraffic\\r\\n| where SourceIp != \\\"\\\" and isnotempty(SourceIp)\\r\\n| summarize arg_max(TimeGenerated, *) by SourceIp, TenantId;\\r\\n\\r\\nlet SigninLogsData = SigninLogs\\r\\n| where IPAddress != \\\"\\\" and isnotempty(IPAddress)\\r\\n| summarize arg_max(TimeGenerated, *) by IPAddress, TenantId, UserId, CorrelationId;\\r\\n\\r\\nSigninLogsData\\r\\n| join kind=leftanti (\\r\\n    NetworkAccessTrafficData\\r\\n    | where SourceIp != \\\"\\\" and isnotempty(SourceIp)\\r\\n) on $left.IPAddress == $right.SourceIp and $left.TenantId == $right.TenantId\\r\\n| project TimeGenerated, IPAddress, UserId, UserPrincipalName, AppDisplayName, DeviceDetail.deviceId\\r\\n\",\"size\":0,\"title\":\"Sign-ins Outside Global Secure Access\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Security\"},\"name\":\"group - 10\"},{\"type\":1,\"content\":{\"json\":\"💡 Type the URL for detailed analysis\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"text - 10\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ec8c38c8-3064-4921-8dcd-a69d3895599b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"URL\",\"type\":1,\"typeSettings\":{\"isSearchBox\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"parameters - 9\"},{\"type\":1,\"content\":{\"json\":\"# Web Categories\"},\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let CategoryData = NetworkAccessTraffic \\r\\n| where DestinationFqdn contains \\\"{URL}\\\"  // Filters logs based on the provided URL parameter\\r\\n| extend CategoriesList = split(DestinationWebCategories, \\\",\\\")  // Split categories into a list\\r\\n| mv-expand Category = CategoriesList  // Expand the list into individual rows\\r\\n| extend Category = trim_start(\\\" \\\", trim_end(\\\" \\\", tostring(Category)))  // Trim leading and trailing spaces\\r\\n| extend Category = iff(TrafficType == \\\"microsoft365\\\", \\\"Microsoft M365\\\", Category)  // Set category to \\\"Microsoft M365\\\" if TrafficType is \\\"microsoft365\\\"\\r\\n| summarize UniqueCategories = make_set(Category);  // Create a set of unique categories\\r\\n\\r\\nCategoryData\\r\\n| extend \\r\\n    PrimaryCategory = iff(array_length(UniqueCategories) > 0, tostring(UniqueCategories[0]), \\\"None\\\")\\r\\n| project \\r\\n    col1 = PrimaryCategory,\\r\\n    snapshot = \\\"Primary Category\\\"\\r\\n\\r\\n| union (\\r\\n    CategoryData\\r\\n    | extend \\r\\n        SecondaryCategory = iff(array_length(UniqueCategories) > 1, tostring(UniqueCategories[1]), \\\"None\\\")\\r\\n    | project \\r\\n        col1 = SecondaryCategory,\\r\\n        snapshot = \\\"Secondary Category\\\"\\r\\n)\\r\\n\\r\\n| order by snapshot asc\\r\\n\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\"},\"leftContent\":{\"columnMatch\":\"col1\",\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"# Traffic Access Details\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkData = NetworkAccessTraffic\\r\\n| where DestinationFqdn contains \\\"{URL}\\\";  // Filters logs based on the provided URL parameter\\r\\n\\r\\nNetworkData\\r\\n| summarize \\r\\n    UniqueUsers = dcount(UserPrincipalName),\\r\\n    UniqueDevices = dcount(DeviceId),    \\r\\n    TotalAllow = countif(Action == \\\"Allow\\\"),\\r\\n    TotalBlock = countif(Action == \\\"Block\\\")\\r\\n| project \\r\\n    col1 = UniqueUsers, \\r\\n    snapshot = \\\"Unique Users\\\"\\r\\n| union (NetworkData\\r\\n    | summarize UniqueDevices = dcount(DeviceId)\\r\\n    | project col1 = UniqueDevices, snapshot = \\\"Unique Devices\\\")\\r\\n| union (NetworkData\\r\\n    | summarize TotalAllow = countif(Action == \\\"Allow\\\")\\r\\n    | project col1 = TotalAllow, snapshot = \\\"Total Allow\\\")\\r\\n| union (NetworkData\\r\\n    | summarize TotalBlock = countif(Action == \\\"Block\\\")\\r\\n    | project col1 = TotalBlock, snapshot = \\\"Total Block\\\")\\r\\n| order by snapshot asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"name\":\"query - 14\"},{\"type\":1,\"content\":{\"json\":\"# Bandwidth Usage\"},\"name\":\"text - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkData = NetworkAccessTraffic\\r\\n| where DestinationFqdn contains \\\"{URL}\\\";  // Filters logs based on the provided URL parameter\\r\\n\\r\\nNetworkData\\r\\n| summarize \\r\\n    TotalSent = sum(SentBytes),\\r\\n    TotalReceived = sum(ReceivedBytes),\\r\\n    TotalBandwidth = sum(SentBytes + ReceivedBytes)\\r\\n| extend \\r\\n    TotalSentMB = round(TotalSent / 1024.0 / 1024.0, 2),\\r\\n    TotalReceivedMB = round(TotalReceived / 1024.0 / 1024.0, 2),\\r\\n    TotalBandwidthMB = round(TotalBandwidth / 1024.0 / 1024.0, 2)\\r\\n| project \\r\\n    TotalSentMB,\\r\\n    TotalReceivedMB,\\r\\n    TotalBandwidthMB\\r\\n| extend dummy = 1\\r\\n| project-away dummy\\r\\n| mv-expand \\r\\n    Column = pack_array(\\\"TotalSentMB\\\", \\\"TotalReceivedMB\\\", \\\"TotalBandwidthMB\\\"),\\r\\n    Value = pack_array(TotalSentMB, TotalReceivedMB, TotalBandwidthMB)\\r\\n| extend \\r\\n    snapshot = case(\\r\\n        Column == \\\"TotalSentMB\\\", \\\"Total Sent (MB)\\\",\\r\\n        Column == \\\"TotalReceivedMB\\\", \\\"Total Received (MB)\\\",\\r\\n        Column == \\\"TotalBandwidthMB\\\", \\\"Total Bandwidth (MB)\\\",\\r\\n        \\\"Unknown\\\"\\r\\n    ),\\r\\n    col1 = iff(Value < 0.01, 0.00, Value)\\r\\n| project-away Column, Value\\r\\n| order by snapshot asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"# Traffic Logs (filtered)\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where DestinationFqdn contains \\\"{URL}\\\"\\r\\n| project \\r\\n    Timestamp = TimeGenerated,\\r\\n    User = UserPrincipalName,\\r\\n    [\\\"Source IP\\\"] = SourceIp,\\r\\n    [\\\"Destination IP\\\"] = DestinationIp,\\r\\n    [\\\"Destination Port\\\"] = DestinationPort,\\r\\n    [\\\"Destination FQDN\\\"] = DestinationFqdn,\\r\\n    Action = case(\\r\\n        tolower(Action) == \\\"allow\\\", \\\"🟢 Allow\\\", \\r\\n        tolower(Action) == \\\"block\\\", \\\"🔴 Block\\\", \\r\\n        tolower(Action) // This returns the action in lowercase if it doesn't match \\\"allow\\\" or \\\"block\\\"\\r\\n    ),\\r\\n    [\\\"Policy Name\\\"] = PolicyName,\\r\\n    [\\\"Policy Rule ID\\\"] = PolicyRuleId,\\r\\n    [\\\"Received Bytes\\\"] = ReceivedBytes,\\r\\n    [\\\"Sent Bytes\\\"] = SentBytes,\\r\\n    [\\\"Device OS\\\"] = DeviceOperatingSystem    \\r\\n| order by Timestamp desc\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"name\":\"query - 13\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"group - URL Lookup\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| project \\r\\n    Timestamp = TimeGenerated,\\r\\n    User = UserPrincipalName,\\r\\n    [\\\"Source IP\\\"] = SourceIp,\\r\\n    [\\\"Destination IP\\\"] = DestinationIp,\\r\\n    [\\\"Destination Port\\\"] = DestinationPort,\\r\\n    [\\\"Destination FQDN\\\"] = DestinationFqdn,\\r\\n    Action = case(\\r\\n        tolower(Action) == \\\"allow\\\", \\\"🟢 Allow\\\", \\r\\n        tolower(Action) == \\\"block\\\", \\\"🔴 Block\\\", \\r\\n        tolower(Action) // This returns the action in lowercase if it doesn't match \\\"allow\\\" or \\\"block\\\"\\r\\n    ),\\r\\n    [\\\"Policy Name\\\"] = PolicyName,\\r\\n    [\\\"Web Category\\\"] = DestinationWebCategories,\\r\\n    [\\\"Transport Protocol\\\"] = TransportProtocol,\\r\\n    [\\\"Traffic Type\\\"] = TrafficType,\\r\\n    [\\\"Received Bytes\\\"] = ReceivedBytes,\\r\\n    [\\\"Sent Bytes\\\"] = SentBytes,\\r\\n    [\\\"Device OS\\\"] = DeviceOperatingSystem,\\r\\n    [\\\"Policy Rule ID\\\"] = PolicyRuleId\\r\\n| order by Timestamp desc\\r\\n\",\"size\":3,\"title\":\"Traffic Logs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"AllTraffic\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Unique Users\\nNetworkAccessTraffic\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\\n| project SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\n| summarize UniqueUsers=dcount(Country)\\n| extend snapshot = \\\"Total Locations\\\"\\n| project col1 = UniqueUsers, snapshot\\n\\n// Union with Unique Devices\\n| union (\\n    NetworkAccessTraffic\\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\\n    | extend BytesInGB = todouble(SentBytes + ReceivedBytes) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\n    | summarize TotalBytesGB = sum(BytesInGB)\\n    | extend snapshot = \\\"Total Bytes (GB)\\\"\\n    | project col1 =   tolong(TotalBytesGB), snapshot\\n)\\n\\n// Union with Total Internet Access\\n| union (\\n    NetworkAccessTraffic\\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\\n    | summarize TotalTransactions = count()\\n    | extend snapshot = \\\"Total Transactions\\\"\\n    | project col1 = TotalTransactions, snapshot\\n)\\n\\n// Union with Total Private Access\\n// Order by Snapshot for consistent tile ordering on dashboard\\n| order by snapshot\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"ExistingClients\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"ExistingClients\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"ExistingClients\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend BytesIn = todouble(SentBytes + ReceivedBytes) / (1024 * 1024)  // Convert bytes to Mbytes\\r\\n| summarize TotalBytesMB = sum(BytesIn) by bin(TimeGenerated, 1h), TrafficType\\r\\n| order by bin(TimeGenerated, 1h) asc, TrafficType asc\\r\\n| project TimeGenerated, TrafficType, TotalBytesMB\\r\\n\",\"size\":2,\"title\":\"Usage Over Time (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 0\"}]},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\\r\\n| project  TimeGenerated, SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| where Country != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\",\"size\":3,\"title\":\"Locations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"allow\\\" and DestinationWebCategories != '' // Filter for allowed traffic\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Top Allowed Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"block\\\" and DestinationWebCategories != '' // Filter for blocked traffic\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":3,\"title\":\"Top Blocked Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic  \\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"block\\\" and DestinationFqdn != ''  // Filter for blocked traffic with non-empty Destination FQDN\\r\\n| summarize Count = count() by [\\\"Destination FQDN\\\"] = DestinationFqdn, [\\\"Destination Web Categories\\\"] = DestinationWebCategories, [\\\"Policy Name\\\"] = PolicyName\\r\\n| order by Count\\r\\n\",\"size\":0,\"title\":\"Top Blocked Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":1000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_3\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_3\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where SentBytes > 0\\r\\n| where tolower(Action) != \\\"block\\\"\\r\\n| summarize \\r\\n    Count = count(), \\r\\n    [\\\"Sent Bytes\\\"] = sum(SentBytes), \\r\\n    [\\\"Received Bytes\\\"] = sum(ReceivedBytes), \\r\\n    [\\\"Total Bytes\\\"] = sum(ReceivedBytes + SentBytes) \\r\\n    by [\\\"Destination FQDN\\\"] = DestinationFqdn\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Top Allowed Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"magenta\"}},{\"columnMatch\":\"Recived\",\"formatter\":4,\"formatOptions\":{\"palette\":\"turquoise\"}},{\"columnMatch\":\"Total\",\"formatter\":4,\"formatOptions\":{\"palette\":\"pink\"}},{\"columnMatch\":\"Sent\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":1000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_1\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where TransportProtocol != ''\\r\\n| summarize Count = count() by toupper(TransportProtocol)\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Protocol Distribution\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"group - 4\"}],\"fallbackResourceIds\":[\"Global Secure Access\"],\"fromTemplateId\":\"GSA Network Traffic Insights\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
-                "version": "1.0",
-                "sourceId": "[variables('workspaceResourceId')]",
-                "category": "sentinel"
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]",
-              "properties": {
-                "description": "@{workbookKey=GSANetworkTraffic; logoFileName=gsa.svg; description=This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Global Secure Access Traffic Logs; templateRelativePath=GSANetworkTraffic.json; subtitle=; provider=Microsoft}.description",
-                "parentId": "[variables('workbookId2')]",
-                "contentId": "[variables('_workbookContentId2')]",
-                "kind": "Workbook",
-                "version": "[variables('workbookVersion2')]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                },
-                "dependencies": {
-                  "operator": "AND",
-                  "criteria": [
-                    {
-                      "contentId": "AzureActiveDirectory",
-                      "kind": "DataConnector"
-                    }
-                  ]
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('_workbookContentId2')]",
-        "contentKind": "Workbook",
-        "displayName": "[parameters('workbook2-name')]",
-        "contentProductId": "[variables('_workbookcontentProductId2')]",
-        "id": "[variables('_workbookcontentProductId2')]",
-        "version": "[variables('workbookVersion2')]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Identity - AfterHoursActivity_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query identifies connections that occur outside of the defined operational hours. It helps in monitoring and flagging any unusual activity that may occur during non-business hours, indicating potential security concerns or policy violations.",
-                "displayName": "Detect Connections Outside Operational Hours",
-                "enabled": false,
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet operational_start_hour = 8; // Start of operational hours (8 AM)\nlet operational_end_hour = 18; // End of operational hours (6 PM)\nNetworkAccessTraffic\n| where TimeGenerated between(starttime .. endtime)\n| extend HourOfDay = datetime_part('hour', TimeGenerated)\n| where HourOfDay < operational_start_hour or HourOfDay >= operational_end_hour\n| project TimeGenerated, UserPrincipalName, SourceIp, DestinationIp, DestinationPort, Action, DeviceId, DeviceOperatingSystem, ConnectionId\n| extend IPCustomEntity = SourceIp, AccountCustomEntity = UserPrincipalName\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT24H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  }
-                ],
-                "tactics": [
-                  "InitialAccess"
-                ],
-                "techniques": [
-                  "T1078",
-                  "T1133"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "AccountCustomEntity",
-                        "identifier": "Name"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "IPCustomEntity",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 1",
-                "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
-                "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect Connections Outside Operational Hours",
-        "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
-        "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
-        "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Identity - SharedSessions_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query identifies network sessions based on DeviceId and UserPrincipalName, then checks for changed IP addresses and overlapping session times.",
-                "displayName": "Detect IP Address Changes and Overlapping Sessions",
-                "enabled": false,
-                "query": "// Identify sessions\nlet sessions = \n  NetworkAccessTraffic\n  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SourceIps = make_set(SourceIp) by DeviceId, UserPrincipalName, SessionId\n  | sort by StartTime asc;\n// Check for changed IP addresses and overlapping session times\nsessions\n  | extend PreviousSourceIps = prev(SourceIps, 1)\n  | extend PreviousEndTime = prev(EndTime, 1)\n  | extend PreviousDeviceId = prev(DeviceId, 1)\n  | extend PreviousUserPrincipalName = prev(UserPrincipalName, 1)\n  | where DeviceId == PreviousDeviceId and UserPrincipalName == PreviousUserPrincipalName\n  | where set_difference(SourceIps, PreviousSourceIps) != dynamic([]) // Check if the current and previous IP sets differ\n  | where PreviousEndTime > StartTime // Check for overlapping session times\n  | project DeviceId, UserPrincipalName, SourceIps, PreviousSourceIps, StartTime, EndTime, PreviousEndTime\n  | extend IPCustomEntity = tostring(array_slice(SourceIps, 0, 1)[0]), PreviousIPCustomEntity = tostring(array_slice(PreviousSourceIps, 0, 1)[0]), AccountCustomEntity = UserPrincipalName\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT24H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  }
-                ],
-                "tactics": [
-                  "InitialAccess"
-                ],
-                "techniques": [
-                  "T1078",
-                  "T1133"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "AccountCustomEntity",
-                        "identifier": "Name"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "IPCustomEntity",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 2",
-                "parentId": "[variables('analyticRuleObject2').analyticRuleId2]",
-                "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject2').analyticRuleVersion2]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect IP Address Changes and Overlapping Sessions",
-        "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
-        "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
-        "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - exchange_auditlogdisabled_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses.",
-                "displayName": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
-                "enabled": false,
-                "query": "// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"Exchange\" \n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    // Only admin or global-admin can disable audit logging\n    | where Operation =~ \"Set-AdminAuditLogConfig\"\n    | extend ParsedParameters = parse_json(Parameters)\n    | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)\n    | where AdminAuditLogEnabledValue =~ \"False\"\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue\n    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), \n                        iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), UserId))\n    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n    | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"Exchange\"\n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    | where Operation =~ \"Set-AdminAuditLogConfig\"\n    | extend ParsedParameters = parse_json(AdditionalProperties.Parameters)\n    | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)\n    | where AdminAuditLogEnabledValue =~ \"False\"\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue\n    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), \n                        iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), UserId))\n    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n    | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n// Combine Office and Enriched Events and Deduplicate\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;\n// Project Final Output\nCombinedEvents\n    | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Exchange)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1562"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 3",
-                "parentId": "[variables('analyticRuleObject3').analyticRuleId3]",
-                "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject3').analyticRuleVersion3]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
-        "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
-        "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
-        "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - External User added to Team and immediately uploads file_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity.",
-                "displayName": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
-                "enabled": false,
-                "query": "let fileAccessThreshold = 10;\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend MemberAdded = tostring(parse_json(Members)[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName\n    | join kind=inner (\n        OfficeActivity\n        | where OfficeWorkload =~ \"MicrosoftTeams\"\n        | where Operation =~ \"MemberRemoved\"\n        | extend MemberAdded = tostring(parse_json(Members)[0].UPN)\n        | where MemberAdded contains \"#EXT#\"\n        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName\n    ) on MemberAdded\n    | where TimeDeleted > TimeAdded\n    | join kind=inner (\n        OfficeActivity\n        | where RecordType == \"SharePointFileOperation\"\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | where Operation == \"FileUploaded\"\n        | extend MemberAdded = UserId\n        | join kind=inner (\n            OfficeActivity\n            | where RecordType == \"SharePointFileOperation\"\n            | where Operation == \"FileAccessed\"\n            | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n            | summarize FileAccessCount = count() by OfficeObjectId\n            | where FileAccessCount > fileAccessThreshold\n        ) on OfficeObjectId\n    ) on MemberAdded\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where Workload =~ \"MicrosoftTeams\"\n        | where Operation =~ \"MemberRemoved\"\n        | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n        | where MemberAdded contains \"#EXT#\"\n        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    ) on MemberAdded, TeamName\n    | where TimeDeleted > TimeAdded\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where RecordType == \"SharePointFileOperation\"\n        | where Operation == \"FileUploaded\"\n        | extend MemberAdded = UserId, SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | join kind=inner (\n            EnrichedMicrosoft365AuditLogs\n            | where RecordType == \"SharePointFileOperation\"\n            | where Operation == \"FileAccessed\"\n            | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n            | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n            | summarize FileAccessCount = count() by ObjectId, TeamName\n            | where FileAccessCount > fileAccessThreshold\n        ) on ObjectId, TeamName\n    ) on MemberAdded, TeamName\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// Combine Office and Enriched Events and Deduplicate\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeAdded, *) by MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// Project Final Output\nCombinedEvents\n    | extend MemberAddedAccountName = tostring(split(MemberAdded, \"@\")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, \"@\")[1])\n    | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n    | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, MemberAddedAccountName, MemberAddedAccountUPNSuffix, UserWhoAddedAccountName, UserWhoAddedAccountUPNSuffix, UserWhoDeletedAccountName, UserWhoDeletedAccountUPNSuffix\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Low",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Teams)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "InitialAccess"
-                ],
-                "techniques": [
-                  "T1566"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "MemberAdded",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "MemberAddedAccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "MemberAddedAccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserWhoAdded",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "UserWhoAddedAccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "UserWhoAddedAccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserWhoDeleted",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "UserWhoDeletedAccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "UserWhoDeletedAccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 4",
-                "parentId": "[variables('analyticRuleObject4').analyticRuleId4]",
-                "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject4').analyticRuleVersion4]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
-        "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
-        "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
-        "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - ExternalUserAddedRemovedInTeams_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour.",
-                "displayName": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
-                "enabled": false,
-                "query": "let TeamsAddDelOffice = (Op:string){\n  OfficeActivity\n  | where OfficeWorkload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where Members has (\"#EXT#\")\n  | mv-expand Members\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName, ClientIP\n};\nlet TeamsAddDelEnriched = (Op:string){\n  EnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where tostring(AdditionalProperties.Members) has (\"#EXT#\")\n  | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), ClientIP = SourceIp\n};\nlet TeamsAddOffice = TeamsAddDelOffice(\"MemberAdded\")\n  | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDelOffice = TeamsAddDelOffice(\"MemberRemoved\")\n  | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nlet TeamsAddEnriched = TeamsAddDelEnriched(\"MemberAdded\")\n  | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDelEnriched = TeamsAddDelEnriched(\"MemberRemoved\")\n  | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nlet TeamsAdd = TeamsAddOffice\n  | union TeamsAddEnriched\n  | project TimeAdded, Operation, MemberAdded, UserWhoAdded, TeamName, ClientIP;\nlet TeamsDel = TeamsDelOffice\n  | union TeamsDelEnriched\n  | project TimeDeleted, Operation, MemberRemoved, UserWhoDeleted, TeamName, ClientIP;\nTeamsAdd\n| join kind=inner (TeamsDel) on $left.MemberAdded == $right.MemberRemoved\n| where TimeDeleted > TimeAdded\n| project TimeAdded, TimeDeleted, MemberAdded_Removed = MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, ClientIP\n| extend MemberAdded_RemovedAccountName = tostring(split(MemberAdded_Removed, \"@\")[0]), MemberAdded_RemovedAccountUPNSuffix = tostring(split(MemberAdded_Removed, \"@\")[1])\n| extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n| extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Low",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Teams)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1136"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "MemberAdded_Removed",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "MemberAdded_RemovedAccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "MemberAdded_RemovedAccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserWhoAdded",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "UserWhoAddedAccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "UserWhoAddedAccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserWhoDeleted",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "UserWhoDeletedAccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "UserWhoDeletedAccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 5",
-                "parentId": "[variables('analyticRuleObject5').analyticRuleId5]",
-                "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject5').analyticRuleVersion5]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
-        "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
-        "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
-        "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - Mail_redirect_via_ExO_transport_rule_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies when an Exchange Online transport rule is configured to forward emails.\nThis could indicate an adversary mailbox configured to collect mail from multiple user accounts.",
-                "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
-                "enabled": false,
-                "query": "let officeActivityQuery = OfficeActivity\n  | where OfficeWorkload == \"Exchange\"\n  | where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n  | mv-apply DynamicParameters = todynamic(Parameters) on (\n      summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | extend RuleName = case(\n      Operation =~ \"Set-TransportRule\", OfficeObjectId,\n      Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n      \"Unknown\"\n    )\n  | mv-expand ExpandedParameters = todynamic(Parameters)\n  | where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n  | extend RedirectTo = ExpandedParameters.Value\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n  | extend From = ParsedParameters.From\n  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), \n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\nlet enrichedLogsQuery = EnrichedMicrosoft365AuditLogs\n  | where Workload == \"Exchange\"\n  | where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n  | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n      summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | extend RuleName = case(\n      Operation =~ \"Set-TransportRule\", ObjectId,  // Assuming ObjectId maps to OfficeObjectId\n      Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n      \"Unknown\"\n    )\n  | mv-expand ExpandedParameters = todynamic(tostring(AdditionalProperties.Parameters))\n  | where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n  | extend RedirectTo = ExpandedParameters.Value\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n  | extend From = ParsedParameters.From\n  | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProperties.Parameters), UserAgent\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), \n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine both queries\nunion isfuzzy=true officeActivityQuery, enrichedLogsQuery\n| summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo\n| project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix\n| order by TimeGenerated desc;\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Exchange)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Collection",
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1114",
-                  "T1020"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "IPAddress",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 6",
-                "parentId": "[variables('analyticRuleObject6').analyticRuleId6]",
-                "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject6').analyticRuleVersion6]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
-        "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
-        "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
-        "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - Malicious_Inbox_Rule_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\nThis is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/",
-                "displayName": "GSA Enriched Office 365 - Malicious Inbox Rule",
-                "enabled": false,
-                "query": "let Keywords = dynamic([\"helpdesk\", \"alert\", \"suspicious\", \"fake\", \"malicious\", \"phishing\", \"spam\", \"do not click\", \"do not open\", \"hijacked\", \"Fatal\"]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n  | where OfficeWorkload =~ \"Exchange\" \n  | where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n  | where Parameters has \"Deleted Items\" or Parameters has \"Junk Email\" or Parameters has \"DeleteMessage\"\n  | extend Events = todynamic(Parameters)\n  | parse Events with * \"SubjectContainsWords\" SubjectContainsWords '}'*\n  | parse Events with * \"BodyContainsWords\" BodyContainsWords '}'*\n  | parse Events with * \"SubjectOrBodyContainsWords\" SubjectOrBodyContainsWords '}'*\n  | where SubjectContainsWords has_any (Keywords)\n      or BodyContainsWords has_any (Keywords)\n      or SubjectOrBodyContainsWords has_any (Keywords)\n  | extend ClientIPAddress = case(\n      ClientIP has \".\", tostring(split(ClientIP, \":\")[0]),\n      ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))),\n      ClientIP\n    )\n  | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))\n  | extend RuleDetail = case(\n      OfficeObjectId contains '/', tostring(split(OfficeObjectId, '/')[-1]),\n      OfficeObjectId contains '\\\\', tostring(split(OfficeObjectId, '\\\\')[-1]),\n      \"Unknown\"\n    )\n  | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, OriginatingServer, OfficeObjectId, RuleDetail\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend OriginatingServerName = tostring(split(OriginatingServer, \" \")[0]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"Exchange\"\n  | where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n  | where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Deleted Items\" \n      or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Junk Email\" \n      or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"DeleteMessage\"\n  | extend Events = parse_json(tostring(AdditionalProperties)).Parameters\n  | extend SubjectContainsWords = tostring(Events.SubjectContainsWords), \n           BodyContainsWords = tostring(Events.BodyContainsWords), \n           SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)\n  | where SubjectContainsWords has_any (Keywords) \n      or BodyContainsWords has_any (Keywords) \n      or SubjectOrBodyContainsWords has_any (Keywords)\n  | extend ClientIPAddress = case(\n      ClientIp has \".\", tostring(split(ClientIp, \":\")[0]),\n      ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n      ClientIp\n    )\n  | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))\n  | extend RuleDetail = case(\n      ObjectId contains '/', tostring(split(ObjectId, '/')[-1]),\n      ObjectId contains '\\\\', tostring(split(ObjectId, '\\\\')[-1]),\n      \"Unknown\"\n    )\n  | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, ObjectId, RuleDetail\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine and Deduplicate\nlet CombinedEvents = OfficeEvents\n  | union EnrichedEvents\n  | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIPAddress;\n\n// Final Output\nCombinedEvents\n  | project StartTimeUtc, EndTimeUtc, Operation, UserId, ClientIPAddress, ResultStatus, Keyword, RuleDetail, AccountName, AccountUPNSuffix;\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Exchange)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Persistence",
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1098",
-                  "T1078"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIPAddress",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 7",
-                "parentId": "[variables('analyticRuleObject7').analyticRuleId7]",
-                "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject7').analyticRuleVersion7]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Malicious Inbox Rule",
-        "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
-        "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
-        "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - MultipleTeamsDeletes_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This detection flags the occurrences of deleting multiple teams within a day.\nThis data is a part of Office 365 Connector in Microsoft Sentinel.",
-                "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
-                "enabled": false,
-                "query": "// Set the maximum number of deleted teams to flag suspicious activity\nlet max_delete_count = 3;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId\n    | where array_length(DeletedTeams) > max_delete_count\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId\n    | where array_length(DeletedTeams) > max_delete_count\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DeletedTeams, UserId, AccountName, AccountUPNSuffix\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Low",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Teams)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Impact"
-                ],
-                "techniques": [
-                  "T1485",
-                  "T1489"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 8",
-                "parentId": "[variables('analyticRuleObject8').analyticRuleId8]",
-                "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject8').analyticRuleVersion8]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
-        "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
-        "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
-        "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - Office_MailForwarding_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.",
-                "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
-                "enabled": false,
-                "query": "// Set query parameters\nlet queryfrequency = 1d;\nlet queryperiod = 7d;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(queryperiod)\n    | where Workload =~ \"Exchange\"\n    // Uncomment or adjust the following line based on actual field usage\n    // | where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")\n    | where tostring(AdditionalProperties.Parameters) has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n      )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated > ago(queryperiod)\n    | where OfficeWorkload =~ \"Exchange\"\n    // Uncomment or adjust the following line based on actual field usage\n    // | where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")\n    | where Parameters has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n      )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by tostring(DestinationMailAddress), ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DestinationMailAddress, ClientIP, DistinctUserCount, UserId, Ports, EventCount, AccountName, AccountUPNSuffix\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P7D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Exchange)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Collection",
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1114",
-                  "T1020"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 9",
-                "parentId": "[variables('analyticRuleObject9').analyticRuleId9]",
-                "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject9').analyticRuleVersion9]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
-        "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
-        "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
-        "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - office_policytampering_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies if any tampering is done to either audit log, ATP Safelink, SafeAttachment, AntiPhish, or Dlp policy. \nAn adversary may use this technique to evade detection or avoid other policy-based defenses.\nReferences: https://docs.microsoft.com/powershell/module/exchange/advanced-threat-protection/remove-antiphishrule?view=exchange-ps.",
-                "displayName": "GSA Enriched Office 365 - Office Policy Tampering",
-                "enabled": false,
-                "query": "// Query for EnrichedMicrosoft365AuditLogs\nlet enrichedOpList = EnrichedMicrosoft365AuditLogs \n    | summarize by Operation\n    | where Operation has_any (\"Remove\", \"Disable\")\n    | where Operation contains \"AntiPhish\" \n        or Operation contains \"SafeAttachment\" \n        or Operation contains \"SafeLinks\" \n        or Operation contains \"Dlp\" \n        or Operation contains \"Audit\"\n    | summarize make_set(Operation, 500);\n\nlet enrichedLogs = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"ExchangeAdmin\"\n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    | where Operation in~ (enrichedOpList)\n    | extend ClientIPOnly = case( \n        ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), \n        ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n        ClientIp\n      )  \n    | extend Port = case(\n        ClientIp has \".\", tostring(split(ClientIp, \":\")[1]),\n        ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]),\n        \"\"\n      )\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Query for OfficeActivity\nlet officeOpList = OfficeActivity \n    | summarize by Operation\n    | where Operation has_any (\"Remove\", \"Disable\")\n    | where Operation contains \"AntiPhish\" \n        or Operation contains \"SafeAttachment\" \n        or Operation contains \"SafeLinks\" \n        or Operation contains \"Dlp\" \n        or Operation contains \"Audit\"\n    | summarize make_set(Operation, 500);\n\nlet officeLogs = OfficeActivity\n    | where RecordType =~ \"ExchangeAdmin\"\n    | where UserType in~ (\"Admin\",\"DcAdmin\")\n    | where Operation in~ (officeOpList)\n    | extend ClientIPOnly = case( \n        ClientIP has \".\", tostring(split(ClientIP,\":\")[0]), \n        ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP,\"]\")[0]))),\n        ClientIP\n      )  \n    | extend Port = case(\n        ClientIP has \".\", tostring(split(ClientIP,\":\")[1]),\n        ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]),\n        \"\"\n      )\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Enriched Logs and Office Activity Logs\nunion isfuzzy=true enrichedLogs, officeLogs\n| summarize StartTimeUtc = min(StartTimeUtc), EndTimeUtc = max(EndTimeUtc), TotalOperationCount = sum(OperationCount) \n    by Operation, UserType, UserId, ClientIP, Port, ResultStatus, Parameters, AccountName, AccountUPNSuffix\n| order by StartTimeUtc desc;\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (Exchange)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Persistence",
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1098",
-                  "T1562"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 10",
-                "parentId": "[variables('analyticRuleObject10').analyticRuleId10]",
-                "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject10').analyticRuleVersion10]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Office Policy Tampering",
-        "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
-        "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
-        "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - Office_Uploaded_Executables_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive.\nList currently includes exe, inf, gzip, cmd, bat file extensions.\nAdditionally, identifies when a given user is uploading these files to another user's workspace.\nThis may be an indication of a staging location for malware or other malicious activity.",
-                "displayName": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
-                "enabled": false,
-                "query": "// Set query parameters\nlet threshold = 2;\nlet uploadOp = 'FileUploaded';\n// Extensions that are interesting. Add/Remove to this list as you see fit\nlet execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);\nlet starttime = 8d;\nlet endtime = 1d;\n\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated >= ago(endtime)\n    | where Operation =~ uploadOp\n    | where SourceFileExtension has_any (execExt)\n    | extend RecordType = coalesce(tostring(RecordType), \"UnknownRecordType\")  // Ensure RecordType is a string\n    | project TimeGenerated, OfficeId, OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName\n    | join kind=leftanti (\n        OfficeActivity\n        | where TimeGenerated between (ago(starttime) .. ago(endtime))\n        | where Operation =~ uploadOp\n        | where SourceFileExtension has_any (execExt)\n        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName\n        // Uncomment the line below to enforce the threshold\n        //| where PrevSeenCount > threshold\n        | mvexpand SourceRelativeUrl, UserId\n        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId\n    ) on SourceFileName, SourceRelativeUrl, UserId\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string\n    by OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated >= ago(endtime)\n    | where Operation == uploadOp\n    | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n    | where SourceFileExtension in (execExt)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend RecordType = coalesce(tostring(RecordType), \"UnknownRecordType\")  // Ensure RecordType is a string\n    | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName\n    | join kind=leftanti (\n        EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (ago(starttime) .. ago(endtime))\n        | where Operation == uploadOp\n        | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n        | where SourceFileExtension in (execExt)\n        | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n        // Uncomment the line below to enforce the threshold\n        //| where PrevSeenCount > threshold\n        | mvexpand SourceRelativeUrl, UserId\n        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId\n    ) on SourceFileName, SourceRelativeUrl, UserId\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(tostring(SourceRelativeUrl), 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string\n    by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Office and Enriched Logs\nlet CombinedEvents = EnrichedEvents\n    | union isfuzzy=true OfficeEvents\n    | summarize arg_min(StartTime, *) by tostring(FileNames), UserId, Site_Url, tostring(RecordType)  // Ensure FileNames and RecordType are strings\n    | order by StartTime desc;\n\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder, FileNames, UserAgents, AccountName, AccountUPNSuffix;\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P8D",
-                "severity": "Low",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (SharePoint)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "CommandAndControl",
-                  "LateralMovement"
-                ],
-                "techniques": [
-                  "T1105",
-                  "T1570"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "URL",
-                    "fieldMappings": [
-                      {
-                        "columnName": "Site_Url",
-                        "identifier": "Url"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "File",
-                    "fieldMappings": [
-                      {
-                        "columnName": "FileNames",
-                        "identifier": "Name"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 11",
-                "parentId": "[variables('analyticRuleObject11').analyticRuleId11]",
-                "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject11').analyticRuleVersion11]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
-        "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
-        "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
-        "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - RareOfficeOperations_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies Office operations that are typically rare and can provide capabilities useful to attackers.",
-                "displayName": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
-                "enabled": false,
-                "query": "// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\n    and not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') \n         and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n    | extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIP)[0])\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\n    and not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') \n         and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n    | extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIp)[0])\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by Operation, UserId, ClientIPOnly;\n\n// Final Output\nCombinedEvents\n    | project TimeGenerated, Operation, UserId, AccountName, AccountUPNSuffix, ClientIPOnly\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Low",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Persistence",
-                  "Collection"
-                ],
-                "techniques": [
-                  "T1098",
-                  "T1114"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIPOnly",
-                        "identifier": "Address"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 12",
-                "parentId": "[variables('analyticRuleObject12').analyticRuleId12]",
-                "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject12').analyticRuleVersion12]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
-        "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
-        "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
-        "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - SharePoint_Downloads_byNewIP_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25.",
-                "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
-                "enabled": false,
-                "query": "let threshold = 25;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n\n// Define a baseline of normal user behavior for OfficeActivity\nlet userBaselineOffice = OfficeActivity\n    | where TimeGenerated between(ago(starttime)..ago(endtime))\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | summarize Count = count() by UserId, Operation, Site_Url, ClientIP\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIP;\n\n// Get recent user activity for OfficeActivity\nlet recentUserActivityOffice = OfficeActivity\n    | where TimeGenerated > ago(endtime)\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIP, OfficeObjectId, OfficeWorkload, UserAgent;\n\n// Define a baseline of normal user behavior for EnrichedMicrosoft365AuditLogs\nlet userBaselineEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(ago(starttime)..ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | summarize Count = count() by UserId, Operation, Site_Url, ClientIp\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;\n\n// Get recent user activity for EnrichedMicrosoft365AuditLogs\nlet recentUserActivityEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;\n\n// Combine user baselines and recent activity, calculate deviation, and deduplicate\nlet UserBehaviorAnalysis = userBaselineOffice\n    | join kind=inner (recentUserActivityOffice) on UserId, Operation, Site_Url, ClientIP\n    | union (userBaselineEnriched | join kind=inner (recentUserActivityEnriched) on UserId, Operation, Site_Url, ClientIp)\n    | extend Deviation = abs(RecentCount - AvgCount) / AvgCount;\n\n// Filter for significant deviations\nUserBehaviorAnalysis\n    | where Deviation > threshold\n    | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIP, Site_Url, ObjectId, OfficeObjectId, OfficeWorkload, Workload, UserAgent, Deviation, Count = RecentCount\n    | order by Count desc, ClientIP asc, Operation asc, UserId asc\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P14D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (SharePoint)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1030"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "URL",
-                    "fieldMappings": [
-                      {
-                        "columnName": "Site_Url",
-                        "identifier": "Url"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 13",
-                "parentId": "[variables('analyticRuleObject13').analyticRuleId13]",
-                "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject13').analyticRuleVersion13]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
-        "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
-        "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
-        "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - SharePoint_Downloads_byNewUserAgent_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).",
-                "displayName": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
-                "enabled": false,
-                "query": "let threshold = 5;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n\n// OfficeActivity - Base Events\nlet BaseeventsOffice = OfficeActivity\n    | where TimeGenerated between (ago(starttime)..ago(endtime))\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent);\n\n// OfficeActivity - Frequent User Agents\nlet FrequentUAOffice = BaseeventsOffice\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n\n// OfficeActivity - User Baseline\nlet UserBaseLineOffice = BaseeventsOffice\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n\n// OfficeActivity - Recent User Activity\nlet RecentActivityOffice = OfficeActivity\n    | where TimeGenerated > ago(endtime)\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | where UserAgent in~ (FrequentUAOffice)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()\n        by RecordType, Operation, UserAgent, UserType, UserId, ClientIP , OfficeWorkload, Site_Url;\n\n// EnrichedMicrosoft365AuditLogs - Base Events\nlet BaseeventsEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(starttime)..ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent);\n\n// EnrichedMicrosoft365AuditLogs - Frequent User Agents\nlet FrequentUAEnriched = BaseeventsEnriched\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n\n// EnrichedMicrosoft365AuditLogs - User Baseline\nlet UserBaseLineEnriched = BaseeventsEnriched\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n\n// EnrichedMicrosoft365AuditLogs - Recent User Activity\nlet RecentActivityEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | extend  ClientIP = ClientIp\n    | where isnotempty(UserAgent)\n    | where UserAgent in (FrequentUAEnriched)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()\n        by RecordType, Operation, UserAgent, UserId,ClientIP, Site_Url;\n\n// Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate\nlet UserBehaviorAnalysisOffice = UserBaseLineOffice\n    | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n\nlet UserBehaviorAnalysisEnriched = UserBaseLineEnriched\n    | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n\n// Combine Office and Enriched Logs\nlet CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice\n    | union UserBehaviorAnalysisEnriched;\n\n// Filter and Format Final Results\nCombinedUserBehaviorAnalysis\n    | where Deviation > 0.25\n    | extend UserIdName = tostring(split(UserId, '@')[0]), \n             UserIdUPNSuffix = tostring(split(UserId, '@')[1])\n    | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url\n    | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P14D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (SharePoint)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1030"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "UserIdName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "UserIdUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "URL",
-                    "fieldMappings": [
-                      {
-                        "columnName": "Site_Url",
-                        "identifier": "Url"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 14",
-                "parentId": "[variables('analyticRuleObject14').analyticRuleId14]",
-                "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject14').analyticRuleVersion14]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
-        "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
-        "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
-        "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - sharepoint_file_transfer_above_threshold_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies Office365 Sharepoint File Transfers above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
-                "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
-                "enabled": false,
-                "query": "let threshold = 5000;\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload has_any(\"SharePoint\", \"OneDrive\") \n    | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n    | extend ClientIP = ClientIp\n    | summarize count_distinct_ObjectId = dcount(ObjectId), fileslist = make_set(ObjectId, 10000) \n        by UserId, ClientIP, bin(TimeGenerated, 15m)\n    | where count_distinct_ObjectId >= threshold\n    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where EventSource == \"SharePoint\" \n    | where OfficeWorkload has_any(\"SharePoint\", \"OneDrive\") \n    | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n    | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000) \n        by UserId, ClientIP, bin(TimeGenerated, 15m)\n    | where count_distinct_OfficeObjectId >= threshold\n    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;\n\n// Final Output\nCombinedEvents\n    | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, count_distinct_ObjectId, fileslist\n    | order by TimeGenerated desc\n",
-                "queryFrequency": "PT15M",
-                "queryPeriod": "PT15M",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (SharePoint)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1020"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "File",
-                    "fieldMappings": [
-                      {
-                        "columnName": "FileSample",
-                        "identifier": "Name"
-                      }
-                    ]
-                  }
-                ],
-                "customDetails": {
-                  "TransferCount": "count_distinct_OfficeObjectId",
-                  "FilesList": "fileslist"
-                },
-                "incidentConfiguration": {
-                  "groupingConfiguration": {
-                    "enabled": true,
-                    "lookbackDuration": "PT5H",
-                    "groupByEntities": [
-                      "Account"
-                    ],
-                    "matchingMethod": "Selected",
-                    "reopenClosedIncident": false,
-                    "groupByCustomDetails": [],
-                    "groupByAlertDetails": []
-                  },
-                  "createIncident": true
-                }
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 15",
-                "parentId": "[variables('analyticRuleObject15').analyticRuleId15]",
-                "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject15').analyticRuleVersion15]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
-        "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
-        "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
-        "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Office 365 - sharepoint_file_transfer_folders_above_threshold_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies Office365 Sharepoint File Transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
-                "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
-                "enabled": false,
-                "query": "let threshold = 5000;\n  // EnrichedMicrosoft365AuditLogs Query\n  let EnrichedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload has_any(\"SharePoint\", \"OneDrive\")\n  | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n  | extend UserAgent = tostring(AdditionalProperties[\"UserAgent\"])\n  | summarize count_distinct_ObjectId = dcount(ObjectId), \n              fileslist = make_set(ObjectId, 10000), \n              any_UserAgent = any(UserAgent)\n    by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)\n  | where count_distinct_ObjectId >= threshold\n  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // OfficeActivity Query\n  let OfficeEvents = OfficeActivity\n  | where EventSource == \"SharePoint\"\n  | where OfficeWorkload has_any(\"SharePoint\", \"OneDrive\")\n  | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n  | summarize count_distinct_OfficeObjectId = dcount(OfficeObjectId), \n              fileslist = make_set(OfficeObjectId, 10000), \n              any_UserAgent = any(UserAgent)\n    by UserId, ClientIP, bin(TimeGenerated, 15m)\n  | where count_distinct_OfficeObjectId >= threshold\n  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat(\"SeeFilesListField\", \"_\", tostring(hash(tostring(fileslist)))))\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Combine Office and Enriched Logs\n  let CombinedEvents = OfficeEvents\n  | union EnrichedEvents\n  | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, any_UserAgent;\n  // Final Output\n  CombinedEvents\n  | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, UserAgent = any_UserAgent, count_distinct_ObjectId = coalesce(count_distinct_ObjectId, count_distinct_OfficeObjectId), fileslist\n  | order by TimeGenerated desc\n",
-                "queryFrequency": "PT15M",
-                "queryPeriod": "PT15M",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  },
-                  {
-                    "dataTypes": [
-                      "OfficeActivity (SharePoint)"
-                    ],
-                    "connectorId": "Office365"
-                  }
-                ],
-                "tactics": [
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1020"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "Account",
-                    "fieldMappings": [
-                      {
-                        "columnName": "UserId",
-                        "identifier": "FullName"
-                      },
-                      {
-                        "columnName": "AccountName",
-                        "identifier": "Name"
-                      },
-                      {
-                        "columnName": "AccountUPNSuffix",
-                        "identifier": "UPNSuffix"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "ClientIP",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "File",
-                    "fieldMappings": [
-                      {
-                        "columnName": "FileSample",
-                        "identifier": "Name"
-                      }
-                    ]
-                  }
-                ],
-                "customDetails": {
-                  "TransferCount": "count_distinct_OfficeObjectId",
-                  "FilesList": "fileslist"
-                },
-                "incidentConfiguration": {
-                  "groupingConfiguration": {
-                    "enabled": true,
-                    "lookbackDuration": "PT5H",
-                    "groupByEntities": [
-                      "Account"
-                    ],
-                    "matchingMethod": "Selected",
-                    "reopenClosedIncident": false,
-                    "groupByCustomDetails": [],
-                    "groupByAlertDetails": []
-                  },
-                  "createIncident": true
-                }
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 16",
-                "parentId": "[variables('analyticRuleObject16').analyticRuleId16]",
-                "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject16').analyticRuleVersion16]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
-        "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
-        "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
-        "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SWG - Abnormal Deny Rate_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, initial access, or C2, where an attacker tries to exploit the same vulnerability on machines in the organization but is being blocked by firewall rules.",
-                "displayName": "Detect Abnormal Deny Rate for Source to Destination IP",
-                "enabled": false,
-                "query": "let NumOfStdsThreshold = 3;\nlet LearningPeriod = 5d;\nlet BinTime = 1h;\nlet MinThreshold = 5.0;\nlet MinLearningBuckets = 5;\nlet TrafficLogs = NetworkAccessTraffic\n  | where Action == 'Denied'\n  | where isnotempty(DestinationIp) and isnotempty(SourceIp);\nlet LearningSrcIpDenyRate = TrafficLogs\n  | where TimeGenerated between (ago(LearningPeriod + 1d) .. ago(1d))\n  | summarize count() by SourceIp, bin(TimeGenerated, BinTime), DestinationIp\n  | summarize LearningTimeSrcIpDenyRateAvg = avg(count_), LearningTimeSrcIpDenyRateStd = stdev(count_), LearningTimeBuckets = count() by SourceIp, DestinationIp\n  | where LearningTimeBuckets > MinLearningBuckets;\nlet AlertTimeSrcIpDenyRate = TrafficLogs\n  | where TimeGenerated between (ago(1h) .. now())\n  | summarize AlertTimeSrcIpDenyRateCount = count() by SourceIp, DestinationIp;\nAlertTimeSrcIpDenyRate\n  | join kind=leftouter (LearningSrcIpDenyRate) on SourceIp, DestinationIp\n  | extend LearningThreshold = max_of(LearningTimeSrcIpDenyRateAvg + NumOfStdsThreshold * LearningTimeSrcIpDenyRateStd, MinThreshold)\n  | where AlertTimeSrcIpDenyRateCount > LearningThreshold\n  | project SourceIp, DestinationIp, AlertTimeSrcIpDenyRateCount, LearningThreshold    \n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT25H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 1,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "NetworkAccessTrafficLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  }
-                ],
-                "tactics": [
-                  "InitialAccess",
-                  "Exfiltration",
-                  "CommandAndControl"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "SourceIp",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "URL",
-                    "fieldMappings": [
-                      {
-                        "columnName": "DestinationIp",
-                        "identifier": "Url"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 17",
-                "parentId": "[variables('analyticRuleObject17').analyticRuleId17]",
-                "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject17').analyticRuleVersion17]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect Abnormal Deny Rate for Source to Destination IP",
-        "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
-        "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
-        "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SWG - Abnormal Port to Protocol_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes.",
-                "displayName": "Detect Protocol Changes for Destination Ports",
-                "enabled": false,
-                "query": "let LearningPeriod = 7d;\nlet RunTime = 1d;\nlet StartLearningPeriod = ago(LearningPeriod + RunTime);\nlet EndRunTime = ago(RunTime);\nlet LearningPortToProtocol = \n  NetworkAccessTraffic\n  | where TimeGenerated between (StartLearningPeriod .. EndRunTime)\n  | where isnotempty(DestinationPort)\n  | summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;\nlet AlertTimePortToProtocol = \n  NetworkAccessTraffic\n  | where TimeGenerated between (EndRunTime .. now())\n  | where isnotempty(DestinationPort)\n  | summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;\nAlertTimePortToProtocol\n  | join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort and $left.SourceIp == $right.SourceIp and $left.DestinationFqdn == $right.DestinationFqdn\n  | where isnull(LearningTimeProtocol) or LearningTimeProtocol != AlertTimeProtocol\n  | project AlertTimeDstPort, AlertTimeProtocol, LearningTimeProtocol, SourceIp, DestinationFqdn\n  | extend IPCustomEntity = SourceIp, FqdnCustomEntity = DestinationFqdn\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "P8D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 1,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion",
-                  "Exfiltration",
-                  "CommandAndControl"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "IPCustomEntity",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "URL",
-                    "fieldMappings": [
-                      {
-                        "columnName": "FqdnCustomEntity",
-                        "identifier": "Url"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 18",
-                "parentId": "[variables('analyticRuleObject18').analyticRuleId18]",
-                "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject18').analyticRuleVersion18]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect Protocol Changes for Destination Ports",
-        "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
-        "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
-        "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject19').analyticRuleTemplateSpecName19]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SWG - Source IP Port Scan_AnalyticalRules Analytics Rule with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial access.",
-                "displayName": "Detect Source IP Scanning Multiple Open Ports",
-                "enabled": false,
-                "query": "let port_scan_time = 30s;\nlet min_ports_threshold = 100;\nNetworkAccessTraffic\n| where TimeGenerated > ago(1d)\n| where Action == 'Allowed'\n| summarize PortsScanned = dcount(DestinationPort) by SourceIp, bin(TimeGenerated, port_scan_time)\n| where PortsScanned > min_ports_threshold\n| project SourceIp, PortsScanned, TimeGenerated\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 1,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "dataTypes": [
-                      "EnrichedMicrosoft365AuditLogs"
-                    ],
-                    "connectorId": "AzureActiveDirectory"
-                  }
-                ],
-                "tactics": [
-                  "Discovery"
-                ],
-                "techniques": [
-                  "T1046"
-                ],
-                "entityMappings": [
-                  {
-                    "entityType": "IP",
-                    "fieldMappings": [
-                      {
-                        "columnName": "SourceIp",
-                        "identifier": "Address"
-                      }
-                    ]
-                  },
-                  {
-                    "entityType": "URL",
-                    "fieldMappings": [
-                      {
-                        "columnName": "Fqdn",
-                        "identifier": "Url"
-                      }
-                    ]
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject19').analyticRuleId19,'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Analytics Rule 19",
-                "parentId": "[variables('analyticRuleObject19').analyticRuleId19]",
-                "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject19').analyticRuleVersion19]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect Source IP Scanning Multiple Open Ports",
-        "contentProductId": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
-        "id": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
-        "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AnomolousUserAccessingOtherUsersMailbox_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_1",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 2);\nlet user_threshold = 1;    // Threshold for number of mailboxes accessed\nlet folder_threshold = 5;  // Threshold for number of mailbox folders accessed\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between (ago(lookback)..starttime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    | join kind=rightanti (\n        OfficeActivity\n        | where TimeGenerated between (starttime..endtime)\n        | where Operation =~ \"MailItemsAccessed\"\n        | where ResultStatus =~ \"Succeeded\"\n        | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    ) on MailboxOwnerUPN, UserId\n    | where isnotempty(Folders)\n    | mv-expand parse_json(Folders)\n    | extend folders = tostring(Folders.Path)\n    | extend ClientIP = iif(Client_IPAddress startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, Client_IPAddress), Client_IPAddress)\n    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n    | extend folder_count = array_length(set_folders)\n    | extend user_count = array_length(set_MailboxGuid)\n    | where user_count > user_threshold or folder_count > folder_threshold\n    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n    | sort by user_count desc\n    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(lookback)..starttime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    | join kind=rightanti (\n        EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (starttime..endtime)\n        | where Operation =~ \"MailItemsAccessed\"\n        | where ResultStatus =~ \"Succeeded\"\n        | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n        | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    ) on MailboxOwnerUPN, UserId\n    | where isnotempty(tostring(parse_json(AdditionalProperties).Folders))\n    | mv-expand Folders = parse_json(AdditionalProperties).Folders\n    | extend folders = tostring(Folders.Path)\n    | extend ClientIP = iif(ClientIp startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, ClientIp), ClientIp)\n    | extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)\n    | extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)\n    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n    | extend folder_count = array_length(set_folders)\n    | extend user_count = array_length(set_MailboxGuid)\n    | where user_count > user_threshold or folder_count > folder_threshold\n    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n    | sort by user_count desc\n    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders, AccountName, AccountUPNSuffix\n    | order by user_count desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114.002"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 1",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]",
-                "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject1').huntingQueryVersion1]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ExternalUserAddedRemovedInTeams_HuntVersion_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_2",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "External User Added and Removed in a Short Timeframe",
-                "category": "Hunting Queries",
-                "query": "// If you want to look at user added further than 7 days ago adjust this value\n// If you want to change the timeframe of how quickly accounts need to be added and removed change this value\nlet time_delta = 1h;\nEnrichedMicrosoft365AuditLogs\n| where Workload == \"MicrosoftTeams\"\n| where Operation == \"MemberAdded\"\n| extend UPN = tostring(parse_json(tostring(AdditionalProperties)).UPN) // Assuming UPN is stored in AdditionalProperties\n| where UPN contains \"#EXT#\"\n| project TimeAdded = TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), TeamGuid = tostring(parse_json(tostring(AdditionalProperties)).TeamGuid)\n| join kind=innerunique (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRemoved\"\n    | extend UPN = tostring(parse_json(tostring(AdditionalProperties)).UPN) // Assuming UPN is stored in AdditionalProperties\n    | where UPN contains \"#EXT#\"\n    | project TimeDeleted = TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), TeamGuid = tostring(parse_json(tostring(AdditionalProperties)).TeamGuid)\n) on UPN, TeamGuid\n| where TimeDeleted < (TimeAdded + time_delta)\n| project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName, TeamGuid\n| extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query identifies external user accounts that are added to a Team and then removed within one hour."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1136"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 2",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]",
-                "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject2').huntingQueryVersion2]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
-        "contentKind": "HuntingQuery",
-        "displayName": "External User Added and Removed in a Short Timeframe",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '2.0.1')))]",
-        "version": "2.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ExternalUserFromNewOrgAddedToTeams_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_3",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 7);\n// OfficeActivity Known Organizations\nlet known_orgs_office = (\n    OfficeActivity\n    | where TimeGenerated between(ago(lookback)..starttime)\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\" or Operation =~ \"TeamsSessionStarted\"\n    | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | summarize by Organization\n);\n// OfficeActivity Query for New Organizations\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between(starttime..endtime)\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend UPN = tostring(parse_json(Members)[0].UPN)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | where Organization !in (known_orgs_office)\n    | extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Known Organizations\nlet known_orgs_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(ago(lookback)..starttime)\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation in (\"MemberAdded\", \"TeamsSessionStarted\")\n    | extend Members = parse_json(tostring(AdditionalProperties.Members))\n    | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | summarize by Organization\n);\n// EnrichedMicrosoft365AuditLogs Query for New Organizations\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(starttime..endtime)\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend Members = parse_json(tostring(AdditionalProperties.Members))\n    | extend UPN = tostring(Members[0].UPN)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | where Organization !in (known_orgs_enriched)\n    | extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by Organization, UPN;\n// Final Output\nCombinedEvents\n    | project Organization, UPN, AccountName, AccountUPNSuffix\n    | order by Organization asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1136"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 3",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]",
-                "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject3').huntingQueryVersion3]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Mail_redirect_via_ExO_transport_rule_hunting_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_4",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
-                "category": "Hunting Queries",
-                "query": "// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"Exchange\"\n    | where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n    | mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | extend RuleName = case(\n        Operation == \"Set-TransportRule\", ObjectId,\n        Operation == \"New-TransportRule\", ParsedParameters.Name,\n        \"Unknown\"\n    )\n    | mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)\n    | where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n    | extend RedirectTo = ExpandedParameters.Value\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, AdditionalProperties\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload == \"Exchange\"\n    | where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | extend RuleName = case(\n        Operation == \"Set-TransportRule\", OfficeObjectId,\n        Operation == \"New-TransportRule\", ParsedParameters.Name,\n        \"Unknown\"\n    )\n    | mv-expand ExpandedParameters = todynamic(Parameters)\n    | where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n    | extend RedirectTo = ExpandedParameters.Value\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, Parameters\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = IPAddress;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by RuleName, UserId;\n// Final Output\nCombinedEvents\n    | project TimeGenerated, RuleName, RedirectTo, IPAddress, Port, UserId, AccountName, AccountUPNSuffix\n    | order by TimeGenerated desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies when Exchange Online transport rule is configured to forward emails.\nThis could be an adversary mailbox configured to collect mail from multiple user accounts."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 4",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]",
-                "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject4').huntingQueryVersion4]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MultiTeamBot_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_5",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Bots added to multiple teams",
-                "category": "Hunting Queries",
-                "query": "let threshold = 2;  // Adjust this threshold based on your environment\nlet time_threshold = timespan(5m);  // Adjust the time delta threshold\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"BotAddedToTeam\"\n    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n    | extend CountOfTeams = array_length(Teams)\n    | extend TimeDelta = End - Start\n    | where CountOfTeams > threshold\n    | where TimeDelta >= time_threshold\n    | project Start, End, Teams, CountOfTeams, UserId\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"BotAddedToTeam\"\n    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n    | extend CountOfTeams = array_length(Teams)\n    | extend TimeDelta = End - Start\n    | where CountOfTeams > threshold\n    | where TimeDelta <= time_threshold\n    | project Start, End, Teams, CountOfTeams, UserId\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(Start, *) by UserId;\n// Final Output\nCombinedEvents\n    | project Start, End, Teams, CountOfTeams, UserId, AccountName, AccountUPNSuffix\n    | order by Start desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query helps identify bots added to multiple Teams in a short space of time."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence,Collection"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1176,T1119"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 5",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]",
-                "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject5').huntingQueryVersion5]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Bots added to multiple teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '2.0.1')))]",
-        "version": "2.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MultiTeamOwner_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_6",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - User made Owner of multiple teams",
-                "category": "Hunting Queries",
-                "query": "let max_owner_count = 3;  \n// Adjust this value to change how many teams a user is made owner of before detecting\n// OfficeActivity Query: Identify users who have been made owners of more than 'max_owner_count' teams\nlet high_owner_count_office = (\n    OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRoleChanged\"\n    | extend Member = tostring(parse_json(Members)[0].UPN) \n    | extend NewRole = toint(parse_json(Members)[0].Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | summarize TeamCount = dcount(TeamName) by Member\n    | where TeamCount > max_owner_count\n    | project Member\n);\n// OfficeActivity Query: Fetch details for users with high ownership count\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRoleChanged\"\n    | extend Member = tostring(parse_json(Members)[0].UPN)\n    | extend NewRole = toint(parse_json(Members)[0].Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | where Member in (high_owner_count_office)\n    | extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1]);\n// EnrichedMicrosoft365AuditLogs Query: Identify users who have been made owners of more than 'max_owner_count' teams\nlet high_owner_count_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRoleChanged\"\n    | extend Member = tostring(UserId)\n    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | summarize TeamCount = dcount(ObjectId) by Member\n    | where TeamCount > max_owner_count\n    | project Member\n);\n// EnrichedMicrosoft365AuditLogs Query: Fetch details for users with high ownership count\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRoleChanged\"\n    | extend Member = tostring(UserId)\n    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | where Member in (high_owner_count_enriched)\n    | extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1]);\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize by Member, AccountName, AccountUPNSuffix;\n// Final Output\nCombinedEvents\n| order by Member asc\n| project Member, AccountName, AccountUPNSuffix\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query identifies users who have been made Owner of multiple Teams."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1078"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 6",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]",
-                "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject6').huntingQueryVersion6]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - User made Owner of multiple teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MultipleTeamsDeletes_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_7",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
-                "category": "Hunting Queries",
-                "query": "let max_delete = 3;  // Adjust this value to change how many Teams should be deleted before being included\n// EnrichedMicrosoft365AuditLogs - Users who deleted more than 'max_delete' Teams\nlet deleting_users_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"TeamDeleted\"\n    | summarize count_ = count() by UserId\n    | where count_ > max_delete\n    | project UserId\n);\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"TeamDeleted\"\n    | where UserId in (deleting_users_enriched)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix\n    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;\n// OfficeActivity - Users who deleted more than 'max_delete' Teams\nlet deleting_users_office = (\n    OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize count_ = count() by UserId\n    | where count_ > max_delete\n    | project UserId\n);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | where UserId in (deleting_users_office)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix\n    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by UserId;\n// Final Output\nCombinedEvents\n| project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix\n| order by TimeGenerated desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query identifies where multiple Teams have been deleted by a single user in a short timeframe."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Impact"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1485,T1489"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 7",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]",
-                "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject7').huntingQueryVersion7]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "NewBotAddedToTeams_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_8",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = starttime - 14d;\n  // Historical bots from EnrichedMicrosoft365AuditLogs\n  let historical_bots_enriched = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (lookback .. starttime)\n      | where Workload == \"MicrosoftTeams\"\n      | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n      | where isnotempty(AddonName)\n      | distinct AddonName;\n  // Historical bots from OfficeActivity\n  let historical_bots_office = OfficeActivity\n      | where TimeGenerated between (lookback .. starttime)\n      | where OfficeWorkload == \"MicrosoftTeams\"\n      | where isnotempty(AddonName)\n      | distinct AddonName;\n  // Find new bots in Enriched Logs\n  let new_bots_enriched = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"MicrosoftTeams\"\n      | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n      | where AddonName !in (historical_bots_enriched)\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Find new bots in OfficeActivity\n  let new_bots_office = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"MicrosoftTeams\"\n      | where isnotempty(AddonName)\n      | where AddonName !in (historical_bots_office)\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Combine both new bots from Enriched Logs and OfficeActivity\n  let CombinedNewBots = new_bots_enriched\n      | union new_bots_office\n      | summarize arg_min(TimeGenerated, *) by AddonName, UserId;\n  // Final output\n  CombinedNewBots\n      | project TimeGenerated, AddonName, UserId, AccountName, AccountUPNSuffix\n      | order by TimeGenerated desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query helps identify new, and potentially unapproved applications or bots being added to Teams."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence,Collection"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1176,T1119"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 8",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]",
-                "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject8').huntingQueryVersion8]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "New_WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_9",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = totimespan((endtime - starttime) * 7);\n  \n  // Reserved file names and extensions for Windows\n  let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\n  \n  // EnrichedMicrosoft365AuditLogs Query\n  let EnrichedEvents = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n      | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n      | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n      | where isnotempty(ObjectId)\n      | where ObjectId !~ FileName\n      | where ObjectId in (Reserved) or FileName in (Reserved)\n      | where ClientUserAgent !has \"Mac OS\"\n      | join kind=leftanti (\n          EnrichedMicrosoft365AuditLogs\n          | where TimeGenerated between (ago(lookback) .. starttime)\n          | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n          | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n          | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n          | where isnotempty(ObjectId)\n          | where ObjectId !~ FileName\n          | where ObjectId in (Reserved) or FileName in (Reserved)\n          | where ClientUserAgent !has \"Mac OS\"\n          | summarize PrevSeenCount = count() by ObjectId, UserId, FileName\n      ) on ObjectId\n      | extend SiteUrlUserFolder = tolower(split(SiteUrl, '/')[-2])\n      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n      | extend UserIdDiffThanUserFolder = iff(SiteUrl has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(ClientUserAgent, 100000), Ids = make_list(Id, 100000),\n          SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(FileName, 100000) by Workload, RecordType, UserType, UserKey, UserId, ClientIp, SiteUrl, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIp\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;\n  // OfficeActivity Query\n  let OfficeEvents = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where isnotempty(SourceFileExtension)\n      | where SourceFileName !~ SourceFileExtension\n      | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n      | where UserAgent !has \"Mac OS\"\n      | join kind=leftanti (\n          OfficeActivity\n          | where TimeGenerated between (ago(lookback) .. starttime)\n          | where isnotempty(SourceFileExtension)\n          | where SourceFileName !~ SourceFileExtension\n          | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n          | where UserAgent !has \"Mac OS\"\n          | summarize PrevSeenCount = count() by SourceFileExtension\n      ) on SourceFileExtension\n      | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n      | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000),\n          SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000) by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIP\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;\n  // Combine Office and Enriched Logs\n  let CombinedEvents = OfficeEvents\n      | union EnrichedEvents\n      | summarize arg_min(StartTime, *) by UserId, ClientIP;\n  // Final Output\n  CombinedEvents\n      | project StartTime, EndTime, Operations, UserAgents, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url\n      | order by StartTime desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This identifies new Windows Reserved Filenames on Office services like SharePoint and OneDrive in the past 7 days. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CommandAndControl"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1105"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 9",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]",
-                "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject9').huntingQueryVersion9]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "OfficeMailForwarding_hunting_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_10",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  \n  // Enriched Logs Query for forwarding rule operations\n  let EnrichedForwardRules = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"Exchange\"\n      | where (Operation == \"Set-Mailbox\" and tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardingSmtpAddress') \n          or (Operation in ('New-InboxRule', 'Set-InboxRule') and (tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardTo' or tostring(parse_json(tostring(AdditionalProperties))) contains 'RedirectTo'))\n      | extend parsed = parse_json(tostring(AdditionalProperties))\n      | extend fwdingDestination_initial = iif(Operation == \"Set-Mailbox\", tostring(parsed.ForwardingSmtpAddress), coalesce(tostring(parsed.ForwardTo), tostring(parsed.RedirectTo)))\n      | where isnotempty(fwdingDestination_initial)\n      | extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n      | parse fwdingDestination with * '@' ForwardedtoDomain \n      | parse UserId with * '@' UserDomain\n      | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.'))[0])\n      | where ForwardedtoDomain !contains subDomain\n      | extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n      | extend ClientIPAddress = case(ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))), ClientIp)\n      | extend Port = case(ClientIp has \".\", (split(ClientIp, \":\")[1]), ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]), ClientIp)\n      | extend Host = tostring(parse_json(tostring(AdditionalProperties)).OriginatingServer)\n      | extend HostName = tostring(split(Host, \".\")[0])\n      | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, HostName, DnsDomain\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Office Activity Query for forwarding rule operations\n  let OfficeForwardRules = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"Exchange\"\n      | where (Operation =~ \"Set-Mailbox\" and Parameters contains 'ForwardingSmtpAddress') \n          or (Operation in~ ('New-InboxRule', 'Set-InboxRule') and (Parameters contains 'ForwardTo' or Parameters contains 'RedirectTo'))\n      | extend parsed = parse_json(Parameters)\n      | extend fwdingDestination_initial = (iif(Operation =~ \"Set-Mailbox\", tostring(parsed[1].Value), tostring(parsed[2].Value)))\n      | where isnotempty(fwdingDestination_initial)\n      | extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n      | parse fwdingDestination with * '@' ForwardedtoDomain \n      | parse UserId with * '@' UserDomain\n      | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.') [0]))\n      | where ForwardedtoDomain !contains subDomain\n      | extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n      | extend ClientIPAddress = case(ClientIP has \".\", tostring(split(ClientIP, \":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))), ClientIP)\n      | extend Port = case(ClientIP has \".\", (split(ClientIP, \":\")[1]), ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]), ClientIP)\n      | extend Host = tostring(split(OriginatingServer, \" (\")[0])\n      | extend HostName = tostring(split(Host, \".\")[0])\n      | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, HostName, DnsDomain\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Combine the results from both Enriched and Office Activity logs\n  let CombinedForwardRules = EnrichedForwardRules\n      | union OfficeForwardRules\n      | summarize arg_min(TimeGenerated, *) by UserId, ForwardedtoDomain, Operation\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, Host_0_HostName, Host_0_DnsDomain, IP_0_Address, Account_0_Name, Account_0_UPNSuffix;  \n  // Final output\n  CombinedForwardRules\n      | order by TimeGenerated desc;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Adversaries often abuse email-forwarding rules to monitor victim activities, steal information, and gain intelligence on the victim or their organization. This query highlights cases where user mail is being forwarded, including to external domains."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 10",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]",
-                "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject10').huntingQueryVersion10]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject11').huntingQueryTemplateSpecName11]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "TeamsFilesUploaded_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_11",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
-                "category": "Hunting Queries",
-                "query": "// Define the query for EnrichedMicrosoft365AuditLogs\nlet enrichedLogs = EnrichedMicrosoft365AuditLogs\n  | where RecordType == \"SharePointFileOperation\"\n  | where Operation == \"FileUploaded\"\n  | where UserId != \"app@sharepoint\"\n  | where ObjectId has \"Microsoft Teams Chat Files\"\n  | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n  | join kind=leftouter (\n      EnrichedMicrosoft365AuditLogs\n      | where RecordType == \"SharePointFileOperation\"\n      | where Operation in (\"FileDownloaded\", \"FileAccessed\")\n      | where UserId != \"app@sharepoint\"\n      | where ObjectId has \"Microsoft Teams Chat Files\"\n      | extend UserId1 = UserId, ClientIp1 = ClientIp\n  ) on ObjectId\n  | extend userBag = bag_pack(\"UserId1\", UserId1, \"ClientIp1\", ClientIp1)\n  | summarize AccessedBy = make_bag(userBag), make_set(UserId1, 10000) by bin(TimeGenerated, 1h), UserId, ObjectId, SourceFileName\n  | extend NumberOfUsersAccessed = array_length(bag_keys(AccessedBy))\n  | project timestamp = TimeGenerated, UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Define the query for OfficeActivity\nlet officeLogs = OfficeActivity\n  | where RecordType == \"SharePointFileOperation\"\n  | where Operation == \"FileUploaded\"\n  | where UserId != \"app@sharepoint\"\n  | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n  | join kind=leftouter (\n      OfficeActivity\n      | where RecordType == \"SharePointFileOperation\"\n      | where Operation in (\"FileDownloaded\", \"FileAccessed\")\n      | where UserId != \"app@sharepoint\"\n      | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n  ) on OfficeObjectId\n  | extend userBag = bag_pack(UserId1, ClientIP1)\n  | summarize AccessedBy = make_bag(userBag, 10000), make_set(UserId1, 10000) by TimeGenerated, UserId, OfficeObjectId, SourceFileName\n  | extend NumberUsers = array_length(bag_keys(AccessedBy))\n  | project timestamp = TimeGenerated, UserId, FileLocation = OfficeObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed = NumberUsers\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Union both results\nenrichedLogs\n| union officeLogs\n| order by timestamp desc;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query identifies files uploaded to SharePoint via a Teams chat and\nsummarizes users and IP addresses that have accessed these files. This allows for \nidentification of anomalous file sharing patterns."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1199,T1102,T1078"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 11",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11)]",
-                "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject11').huntingQueryVersion11]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject12').huntingQueryTemplateSpecName12]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "UserAddToTeamsAndUploadsFile_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_12",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
-                "category": "Hunting Queries",
-                "query": "let threshold = 1m;\n  // Define MemberAddedEvents for EnrichedMicrosoft365AuditLogs\n  let MemberAddedEvents_Enriched = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | project TimeGenerated, UploaderID = UserId, TeamName;\n  // Define FileUploadEvents for EnrichedMicrosoft365AuditLogs\n  let FileUploadEvents_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where ObjectId has \"Microsoft Teams Chat Files\"\n    | where Operation == \"FileUploaded\"\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = ObjectId, SourceFileName;\n  // Perform join for EnrichedMicrosoft365AuditLogs\n  let EnrichedResults = MemberAddedEvents_Enriched\n    | join kind=inner (FileUploadEvents_Enriched) on UploaderID\n    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;\n  // Define MemberAddedEvents for OfficeActivity\n  let MemberAddedEvents_Office = OfficeActivity\n    | where OfficeWorkload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend TeamName = iff(isempty(TeamName), Members[0].UPN, TeamName)\n    | project TimeGenerated, UploaderID = UserId, TeamName;\n  // Define FileUploadEvents for OfficeActivity\n  let FileUploadEvents_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n    | where Operation == \"FileUploaded\"\n    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = OfficeObjectId, FileName = SourceFileName;\n  // Perform join for OfficeActivity\n  let OfficeResults = MemberAddedEvents_Office\n    | join kind=inner (FileUploadEvents_Office) on UploaderID\n    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n    | project-away UploaderID1\n    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;\n  // Union both results\n  EnrichedResults\n  | union OfficeResults\n  | order by timestamp desc;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query identifies users who are added to a Teams Channel or Teams chat\nand within 1 minute of being added upload a file via the chat. This might be\nan indicator of suspicious activity."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 12",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12)]",
-                "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject12').huntingQueryVersion12]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject13').huntingQueryTemplateSpecName13]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_13",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
-                "category": "Hunting Queries",
-                "query": "let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\n  // Query for OfficeActivity\n  let OfficeActivityResults = OfficeActivity\n    | where isnotempty(SourceFileExtension)\n    | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n    | where UserAgent !has \"Mac OS\"\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000)\n    by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIP\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix\n    | extend URL_0_Url = Site_Url;\n  // Query for EnrichedMicrosoft365AuditLogs\n  let EnrichedMicrosoft365Results = EnrichedMicrosoft365AuditLogs\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(ObjectId)\n    | where ObjectId in (Reserved) or SourceFileName in (Reserved)\n    | where UserAgent !has \"Mac OS\"\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), ObjectIds = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(SourceFileName, 100000)\n    by Workload, RecordType, UserType, UserKey, UserId, ClientIp, Site_Url, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIp\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix\n    | extend URL_0_Url = Site_Url;\n  // Combine both queries\n  OfficeActivityResults\n  | union EnrichedMicrosoft365Results\n  | order by StartTime desc;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This identifies Windows Reserved Filenames on Office services like SharePoint and OneDrive. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CommandAndControl"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1105"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 13",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13)]",
-                "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject13').huntingQueryVersion13]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject14').huntingQueryTemplateSpecName14]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "double_file_ext_exes_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_14",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Exes with double file extension and access summary",
-                "category": "Hunting Queries",
-                "query": "let known_ext = dynamic([\"lnk\", \"log\", \"option\", \"config\", \"manifest\", \"partial\"]);\nlet excluded_users = dynamic([\"app@sharepoint\"]);\nEnrichedMicrosoft365AuditLogs\n| where RecordType == \"SharePointFileOperation\" and isnotempty(ObjectId)\n| where ObjectId has \".exe.\" \n    and not(ObjectId endswith \".lnk\") \n    and not(ObjectId endswith \".log\") \n    and not(ObjectId endswith \".option\") \n    and not(ObjectId endswith \".config\") \n    and not(ObjectId endswith \".manifest\") \n    and not(ObjectId endswith \".partial\")\n| extend Extension = extract(\"[^.]*\\\\.[^.]*$\", 0, ObjectId)\n| extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n| join kind=leftouter (\n    EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\" and (Operation == \"FileDownloaded\" or Operation == \"FileAccessed\")\n    | where not(ObjectId endswith \".lnk\") \n        and not(ObjectId endswith \".log\") \n        and not(ObjectId endswith \".option\") \n        and not(ObjectId endswith \".config\") \n        and not(ObjectId endswith \".manifest\") \n        and not(ObjectId endswith \".partial\")\n) on ObjectId\n| where UserId1 !in (excluded_users)\n| extend userBag = bag_pack(\"UserId\", UserId1, \"ClientIp\", ClientIp1)\n| summarize make_set(UserId1, 10000), userBag = make_bag(userBag), UploadTime = max(TimeGenerated) by UserId, ObjectId, SourceFileName, Extension\n| extend NumberOfUsers = array_length(bag_keys(userBag))\n| project UploadTime, Uploader = UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy = userBag, Extension, NumberOfUsers\n| extend UploaderName = tostring(split(Uploader, \"@\")[0]), UploaderUPNSuffix = tostring(split(Uploader, \"@\")[1])\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Provides a summary of executable files with double file extensions in SharePoint \n and the users and IP addresses that have accessed them."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1036"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 14",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14)]",
-                "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject14').huntingQueryVersion14]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Exes with double file extension and access summary",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '2.0.1')))]",
-        "version": "2.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject15').huntingQueryTemplateSpecName15]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "new_adminaccountactivity_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_15",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "New Admin Account Activity Seen Which Was Not Seen Historically",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet historicalActivity =\n  EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated between (lookback .. starttime)\n  | where RecordType == \"ExchangeAdmin\" and UserType in (\"Admin\", \"DcAdmin\")\n  | summarize historicalCount = count() by UserId;\nlet recentActivity = EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated between (starttime .. endtime)\n  | where UserType in (\"Admin\", \"DcAdmin\")\n  | summarize recentCount = count() by UserId;\nrecentActivity\n| join kind=leftanti (historicalActivity) on UserId\n| project UserId, recentCount\n| join kind=rightsemi (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"ExchangeAdmin\" \n    | where UserType in (\"Admin\", \"DcAdmin\")\n  ) on UserId\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by RecordType, Operation, UserType, UserId, ResultStatus\n| extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n| extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n| extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n| extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '')\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This will help you discover any new admin account activity which was seen and were not seen historically.\nAny new accounts seen in the results can be validated and investigated for any suspicious activities."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,Collection"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1078,T1114"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 15",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15)]",
-                "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject15').huntingQueryVersion15]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
-        "contentKind": "HuntingQuery",
-        "displayName": "New Admin Account Activity Seen Which Was Not Seen Historically",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '2.0.1')))]",
-        "version": "2.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject16').huntingQueryTemplateSpecName16]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "new_sharepoint_downloads_by_IP_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_16",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet BLOCK_THRESHOLD = 1.0;\n// Identify Autonomous System Numbers (ASNs) with a high block rate in Sign-in Logs\nlet HighBlockRateASNs = SigninLogs\n    | where TimeGenerated > lookback\n    | where isnotempty(AutonomousSystemNumber)\n    | summarize make_set(IPAddress), TotalIps = dcount(IPAddress), BlockedSignins = countif(ResultType == \"50053\"), TotalSignins = count() by AutonomousSystemNumber\n    | extend BlockRatio = 1.00 * BlockedSignins / TotalSignins\n    | where BlockRatio >= BLOCK_THRESHOLD\n    | distinct AutonomousSystemNumber;\n// Retrieve IP addresses from these high block rate ASNs\nlet ASNIPs = SigninLogs\n    | where TimeGenerated > lookback\n    | where AutonomousSystemNumber in (HighBlockRateASNs)\n    | distinct IPAddress, AutonomousSystemNumber;\n// OfficeActivity Query: File activities from identified ASN IPs\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between(starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where ClientIP in (ASNIPs)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIP\n    | extend IP_0_Address = ClientIP;\n// EnrichedMicrosoft365AuditLogs Query: File activities from identified ASN IPs\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where ClientIp in (ASNIPs)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIp\n    | extend IP_0_Address = ClientIp;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, RecentFileActivities, IP_0_Address\n    | order by StartTime desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Shows SharePoint upload/download volume by IPs with high-risk ASNs. New IPs with volume spikes may be unauthorized and exfiltrating documents."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1030"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 16",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16)]",
-                "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject16').huntingQueryVersion16]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject17').huntingQueryTemplateSpecName17]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "new_sharepoint_downloads_by_UserAgent_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_17",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet MINIMUM_BLOCKS = 10;\nlet SUCCESS_THRESHOLD = 0.2;\n// Identify user agents or client apps with a low success-to-block ratio in Sign-in Logs\nlet HistoricalActivity = SigninLogs\n    | where TimeGenerated > lookback\n    | where isnotempty(UserAgent)\n    | summarize SuccessfulSignins = countif(ResultType == \"0\"), BlockedSignins = countif(ResultType == \"50053\") by UserAgent\n    | extend SuccessBlockRatio = 1.00 * SuccessfulSignins / BlockedSignins\n    | where SuccessBlockRatio < SUCCESS_THRESHOLD\n    | where BlockedSignins > MINIMUM_BLOCKS;\n// OfficeActivity Query: File operations by matching user agents\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIP, Site_Url\n    | join kind=innerunique (HistoricalActivity) on UserAgent\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIP, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;\n// EnrichedMicrosoft365AuditLogs Query: File operations by matching client apps (UserAgent)\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)  // Ensure matching with UserAgent column\n    | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIp, SiteUrl\n    | join kind=innerunique (HistoricalActivity) on UserAgent\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIp, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, RecentFileActivities, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url\n    | order by StartTime desc;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Tracking via user agent is one way to differentiate between types of connecting device.\nIn homogeneous enterprise environments the user agent associated with an attacker device may stand out as unusual."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1030"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 17",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17)]",
-                "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject17').huntingQueryVersion17]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject18').huntingQueryTemplateSpecName18]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "nonowner_MailboxLogin_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject18').huntingQueryVersion18]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_18",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Non-owner mailbox login activity",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  // Enriched Logs Query for Mailbox Logins (non-owner)\n  let EnrichedMailboxLogins = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"Exchange\"\n      | where Operation == \"MailboxLogin\"\n      | extend Logon_Type = tostring(parse_json(tostring(AdditionalProperties)).LogonType)\n      | extend MailboxOwnerUPN = tostring(parse_json(tostring(AdditionalProperties)).MailboxOwnerUPN)\n      | where Logon_Type != \"Owner\"\n      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIp\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIp\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Office Activity Query for Mailbox Logins (non-owner)\n  let OfficeMailboxLogins = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"Exchange\"\n      | where Operation == \"MailboxLogin\" and Logon_Type != \"Owner\"\n      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIP\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIP\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Combine both results\n  let CombinedMailboxLogins = EnrichedMailboxLogins\n      | union OfficeMailboxLogins\n      | summarize arg_min(StartTime, *) by UserId, MailboxOwnerUPN, Logon_Type;\n  // Final output\n  CombinedMailboxLogins\n      | project StartTime, EndTime, Operation, UserId, MailboxOwnerUPN, Logon_Type, Account_0_Name, Account_0_UPNSuffix, IP_0_Address\n      | order by StartTime desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Finds non-owner mailbox access by admin/delegate permissions. Whitelist valid users and check others for unauthorized access."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 18",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18)]",
-                "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject18').huntingQueryVersion18]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Non-owner mailbox login activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '2.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '2.0.1')))]",
-        "version": "2.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject19').huntingQueryTemplateSpecName19]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "powershell_or_nonbrowser_MailboxLogin_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject19').huntingQueryVersion19]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_19",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\n    let endtime = todatetime('{{EndTimeISO}}');\n    // EnrichedMicrosoft365AuditLogs query\n    let EnrichedMailboxLogin = EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (starttime .. endtime)\n        | where Workload == \"Exchange\" and Operation == \"MailboxLogin\"\n        | extend ClientApplication = tostring(parse_json(AdditionalProperties).ClientInfoString)\n        | where ClientApplication == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n        | extend TenantName = tostring(parse_json(AdditionalProperties).TenantName)\n        | extend MailboxOwner = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n        | extend LogonType = tostring(parse_json(AdditionalProperties).LogonType)\n        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, TenantName, UserType, UserId, MailboxOwner, LogonType, ClientApplication\n        | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n        | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n        | extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n        | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n    // OfficeActivity query\n    let OfficeMailboxLogin = OfficeActivity\n        | where TimeGenerated between (starttime .. endtime)\n        | where OfficeWorkload == \"Exchange\" and Operation == \"MailboxLogin\"\n        | where ClientInfoString == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n        | extend LogonType = \"Unknown\"  // If LogonType does not exist, create a placeholder\n        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, LogonType, ClientInfoString\n        | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n        | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n        | extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n        | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n    // Combine Enriched and Office queries\n    let CombinedMailboxLogin = EnrichedMailboxLogin\n        | union OfficeMailboxLogin\n        | summarize arg_min(StartTime, *) by UserId, Operation\n        | project StartTime, EndTime, Operation, TenantName, OrganizationName, UserType, UserId, MailboxOwner, LogonType, ClientApplication, ClientInfoString, Count, AccountName, AccountUPNSuffix, AccountNTDomain;\n    // Final output\n    CombinedMailboxLogin\n        | order by StartTime desc;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detects mailbox login from Exchange PowerShell. All accounts can use it by default, but admins can change it. Whitelist benign activities."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,Persistence,Collection"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1059,T1098,T1114"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 19",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19)]",
-                "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject19').huntingQueryVersion19]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject20').huntingQueryTemplateSpecName20]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "sharepoint_downloads_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject20').huntingQueryVersion20]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_20",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
-                "category": "Hunting Queries",
-                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = starttime - 14d;\n  // Historical user agents in EnrichedMicrosoft365AuditLogs\n  let historicalUA_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (lookback .. starttime)\n    | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n    | summarize by ClientIp, ClientApplication;\n  // Recent user agents in EnrichedMicrosoft365AuditLogs\n  let recentUA_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (starttime .. endtime)\n    | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIp, ClientApplication;\n  // Combine historical and recent user agents from EnrichedMicrosoft365AuditLogs\n  let Enriched_UA = recentUA_Enriched\n    | join kind=leftanti (historicalUA_Enriched) on ClientIp, ClientApplication\n    | where not(isempty(ClientIp))\n    | extend IP_0_Address = ClientIp;\n  // Historical user agents in OfficeActivity\n  let historicalUA_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (lookback .. starttime)\n    | summarize by ClientIP, UserAgent;\n  // Recent user agents in OfficeActivity\n  let recentUA_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (starttime .. endtime)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIP, UserAgent;\n  // Combine historical and recent user agents from OfficeActivity\n  let Office_UA = recentUA_Office\n    | join kind=leftanti (historicalUA_Office) on ClientIP, UserAgent\n    | where not(isempty(ClientIP))\n    | extend IP_0_Address = ClientIP;\n  // Final combined result\n  Enriched_UA\n  | union Office_UA\n  | project StartTime, EndTime, ClientIp, ClientApplication, IP_0_Address;\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "New user agents associated with a client IP for SharePoint file uploads/downloads."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1030"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 20",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20)]",
-                "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject20').huntingQueryVersion20]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject21').huntingQueryTemplateSpecName21]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MultipleUsersEmailForwardedToSameDestination_HuntingQueries Hunting Query with template version 3.1.0",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject21').huntingQueryVersion21]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2022-10-01",
-              "name": "Global_Secure_Access_Hunting_Query_21",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
-                "category": "Hunting Queries",
-                "query": "let queryfrequency = 1d;\nlet queryperiod = 7d;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(queryperiod)\n    | where Workload == \"Exchange\"\n    | where AdditionalProperties has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(AdditionalProperties) on (\n        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"\n    ))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | extend ClientIp = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIp\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated > ago(queryperiod)\n    | where OfficeWorkload =~ \"Exchange\"\n    | where Parameters has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"\n    ))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = ClientIP;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by DestinationMailAddress, ClientIp;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DestinationMailAddress, ClientIp, Ports, UserId, AccountName, AccountUPNSuffix\n    | order by StartTime desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21),'/'))))]",
-              "properties": {
-                "description": "Global Secure Access Hunting Query 21",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21)]",
-                "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject21').huntingQueryVersion21]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Global Secure Access",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "tier": "Partner",
-                  "name": "Microsoft Corporation",
-                  "email": "GSASentinelSupport@microsoft.com",
-                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
-        "contentKind": "HuntingQuery",
-        "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.2')))]",
-        "version": "2.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
-      "apiVersion": "2023-04-01-preview",
-      "location": "[parameters('workspace-location')]",
-      "properties": {
-        "version": "3.1.0",
-        "kind": "Solution",
-        "contentSchemaVersion": "3.0.0",
-        "displayName": "Global Secure Access",
-        "publisherDisplayName": "Microsoft Corporation",
-        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Global%20Secure%20Access/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p><a href=\"https://aka.ms/GlobalSecureAccess\">Global Secure Access</a> is a <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog#domain-solutions\">domain solution</a> and does not include any data connectors. The content in this solution requires one of the product solutions below.</p>\n<p><strong>Prerequisite:</strong></p>\n<p>Install one or more of the listed solutions to unlock the value provided by this solution.</p>\n<ol>\n<li>Microsoft Entra ID</li>\n</ol>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution depends on the following technologies, and some of these dependencies may either be in Preview state or might result in additional ingestion or operational costs:</p>\n<ol>\n<li>Product solutions as described above</li>\n</ol>\n<p><strong>Workbooks:</strong> 2, <strong>Analytic Rules:</strong> 19, <strong>Hunting Queries:</strong> 21</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
-        "contentKind": "Solution",
-        "contentProductId": "[variables('_solutioncontentProductId')]",
-        "id": "[variables('_solutioncontentProductId')]",
-        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/gsa.svg\" width=\"75px\" height=\"75px\">",
-        "contentId": "[variables('_solutionId')]",
-        "parentId": "[variables('_solutionId')]",
-        "source": {
-          "kind": "Solution",
-          "name": "Global Secure Access",
-          "sourceId": "[variables('_solutionId')]"
-        },
-        "author": {
-          "name": "Microsoft",
-          "email": "[variables('_email')]"
-        },
-        "support": {
-          "name": "Microsoft Corporation",
-          "email": "GSASentinelSupport@microsoft.com",
-          "tier": "Partner",
-          "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
-        },
-        "dependencies": {
-          "operator": "AND",
-          "criteria": [
-            {
-              "kind": "Workbook",
-              "contentId": "[variables('_workbookContentId1')]",
-              "version": "[variables('workbookVersion1')]"
-            },
-            {
-              "kind": "Workbook",
-              "contentId": "[variables('_workbookContentId2')]",
-              "version": "[variables('workbookVersion2')]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-              "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-              "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-              "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-              "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-              "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-              "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-              "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-              "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-              "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-              "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-              "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-              "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-              "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-              "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-              "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-              "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-              "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-              "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-              "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
-              "version": "[variables('huntingQueryObject1').huntingQueryVersion1]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
-              "version": "[variables('huntingQueryObject2').huntingQueryVersion2]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
-              "version": "[variables('huntingQueryObject3').huntingQueryVersion3]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
-              "version": "[variables('huntingQueryObject4').huntingQueryVersion4]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
-              "version": "[variables('huntingQueryObject5').huntingQueryVersion5]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
-              "version": "[variables('huntingQueryObject6').huntingQueryVersion6]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
-              "version": "[variables('huntingQueryObject7').huntingQueryVersion7]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
-              "version": "[variables('huntingQueryObject8').huntingQueryVersion8]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
-              "version": "[variables('huntingQueryObject9').huntingQueryVersion9]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
-              "version": "[variables('huntingQueryObject10').huntingQueryVersion10]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
-              "version": "[variables('huntingQueryObject11').huntingQueryVersion11]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
-              "version": "[variables('huntingQueryObject12').huntingQueryVersion12]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
-              "version": "[variables('huntingQueryObject13').huntingQueryVersion13]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
-              "version": "[variables('huntingQueryObject14').huntingQueryVersion14]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
-              "version": "[variables('huntingQueryObject15').huntingQueryVersion15]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
-              "version": "[variables('huntingQueryObject16').huntingQueryVersion16]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
-              "version": "[variables('huntingQueryObject17').huntingQueryVersion17]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
-              "version": "[variables('huntingQueryObject18').huntingQueryVersion18]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
-              "version": "[variables('huntingQueryObject19').huntingQueryVersion19]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
-              "version": "[variables('huntingQueryObject20').huntingQueryVersion20]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
-              "version": "[variables('huntingQueryObject21').huntingQueryVersion21]"
-            }
-          ]
-        },
-        "firstPublishDate": "2024-04-08",
-        "providers": [
-          "Microsoft"
-        ],
-        "categories": {
-          "domains": [
-            "Identity"
-          ]
-        }
-      },
-      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
-    }
-  ],
-  "outputs": {}
-}
diff --git a/Solutions/Global Secure Access/Package/testParameters.json b/Solutions/Global Secure Access/Package/testParameters.json
deleted file mode 100644
index 8dd674f595..0000000000
--- a/Solutions/Global Secure Access/Package/testParameters.json	
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "location": {
-    "type": "string",
-    "minLength": 1,
-    "defaultValue": "[resourceGroup().location]",
-    "metadata": {
-      "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
-    }
-  },
-  "workspace-location": {
-    "type": "string",
-    "defaultValue": "",
-    "metadata": {
-      "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
-    }
-  },
-  "workspace": {
-    "defaultValue": "",
-    "type": "string",
-    "metadata": {
-      "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
-    }
-  },
-  "workbook1-name": {
-    "type": "string",
-    "defaultValue": "Microsoft Global Secure Access Enriched M365 Logs",
-    "minLength": 1,
-    "metadata": {
-      "description": "Name for the workbook"
-    }
-  },
-  "workbook2-name": {
-    "type": "string",
-    "defaultValue": "Microsoft Global Secure Access Traffic Logs",
-    "minLength": 1,
-    "metadata": {
-      "description": "Name for the workbook"
-    }
-  }
-}
diff --git a/Solutions/Microsoft 365/Analytic Rules/sharepoint_file_transfer_above_threshold.yaml b/Solutions/Microsoft 365/Analytic Rules/sharepoint_file_transfer_above_threshold.yaml
index c980984145..25267f8d2b 100644
--- a/Solutions/Microsoft 365/Analytic Rules/sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Microsoft 365/Analytic Rules/sharepoint_file_transfer_above_threshold.yaml	
@@ -55,5 +55,5 @@ incidentConfiguration:
     - Account
     groupByAlertDetails: []
     groupByCustomDetails: []
-version: 1.0.5
+version: 1.0.6
 kind: Scheduled

From 1c2fbd680bf112d028aa77cb7344487f30f8f918 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Sun, 6 Oct 2024 15:46:37 +0300
Subject: [PATCH 19/27] package

---
 .../Data/Solution_GlobalSecureAccess.json     |   27 +-
 .../Global Secure Access/Package/3.0.0.zip    |  Bin 0 -> 48410 bytes
 .../Package/createUiDefinition.json           |  729 +++
 .../Package/mainTemplate.json                 | 5024 +++++++++++++++++
 .../Package/testParameters.json               |   40 +
 5 files changed, 5806 insertions(+), 14 deletions(-)
 create mode 100644 Solutions/Global Secure Access/Package/3.0.0.zip
 create mode 100644 Solutions/Global Secure Access/Package/createUiDefinition.json
 create mode 100644 Solutions/Global Secure Access/Package/mainTemplate.json
 create mode 100644 Solutions/Global Secure Access/Package/testParameters.json

diff --git a/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json b/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json
index 990dd54b3c..d1978bff0b 100644
--- a/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	
+++ b/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	
@@ -6,11 +6,11 @@
   "WorkbookBladeDescription": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences.",
   "AnalyticalRuleBladeDescription": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in the Manage solution view.",
   "HuntingQueryBladeDescription": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in the Manage solution view.",
-  "Workbooks": [
+    "Workbooks": [
     "Workbooks/GSAM365EnrichedEvents.json",
     "Workbooks/GSANetworkTraffic.json"
   ],
-  "Analytic Rules": [
+ "Analytic Rules": [
     "Analytic Rules/Identity - AfterHoursActivity.yaml",
     "Analytic Rules/Identity - SharedSessions.yaml",
     "Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml",
@@ -30,33 +30,32 @@
     "Analytic Rules/SWG - Abnormal Deny Rate.yaml",
     "Analytic Rules/SWG - Abnormal Port to Protocol.yaml",
     "Analytic Rules/SWG - Source IP Port Scan.yaml"
-  ],
-  "Playbooks": [],
+  ],  
   "Hunting Queries": [
     "Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml",
+    "Hunting Queries/double_file_ext_exes.yaml",
     "Hunting Queries/ExternalUserAddedRemovedInTeams_HuntVersion.yaml",
     "Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml",
     "Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml",
+    "Hunting Queries/MultipleTeamsDeletes.yaml",
+    "Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml",
     "Hunting Queries/MultiTeamBot.yaml",
     "Hunting Queries/MultiTeamOwner.yaml",
-    "Hunting Queries/MultipleTeamsDeletes.yaml",
     "Hunting Queries/NewBotAddedToTeams.yaml",
-    "Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml",
-    "Hunting Queries/OfficeMailForwarding_hunting.yaml",
-    "Hunting Queries/TeamsFilesUploaded.yaml",
-    "Hunting Queries/UserAddToTeamsAndUploadsFile.yaml",
-    "Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml",
-    "Hunting Queries/double_file_ext_exes.yaml",
     "Hunting Queries/new_adminaccountactivity.yaml",
     "Hunting Queries/new_sharepoint_downloads_by_IP.yaml",
     "Hunting Queries/new_sharepoint_downloads_by_UserAgent.yaml",
+    "Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml",
     "Hunting Queries/nonowner_MailboxLogin.yaml",
+    "Hunting Queries/OfficeMailForwarding_hunting.yaml",
     "Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml",
     "Hunting Queries/sharepoint_downloads.yaml",
-    "Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml"
-  ],
+    "Hunting Queries/TeamsFilesUploaded.yaml",
+    "Hunting Queries/UserAddToTeamsAndUploadsFile.yaml",
+    "Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml"
+  ],  
   "BasePath": "C:\\git\\Azure-Sentinel\\Azure-Sentinel\\Solutions\\Global Secure Access",
-  "Version": "3.1.0",
+  "Version": "3.0.1",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
diff --git a/Solutions/Global Secure Access/Package/3.0.0.zip b/Solutions/Global Secure Access/Package/3.0.0.zip
new file mode 100644
index 0000000000000000000000000000000000000000..cf955a94a0e2dc93e90d48ef06baa7636fbb7f80
GIT binary patch
literal 48410
zcmY)VW0YpG^8OFEZQC~Qwmogzw(ag|+qR}{+qP}Hr_KMI^F6<{p6BgesZXjZ*-6$_
ziGnmJ7#a`|5EM|duej!C=kA0S77!3`JP;7(zputlriL!2s+OXrW|nrAE|&Io3|7we
zcGtSz_M0QAKmLJV2%x*&b!caXozq4Ar6D+FmI1t7^_!o_kicTG#hOWYdI*+c*BEQF
z4TQD=<KHtG`_hTqP3nbBj*JXSQFsXEGoLdVfAPNGYkx?F`g^hcDM)Yk>N(R*HH`=m
z!=5LI9*pd1NU_a9Z_{{FK=mbVa<K{EV<9QO$Wm5+&4kG-pPN3EVU{@+8l_O<BkCO+
zmiom){8+ktwgwaQTAvIHQ7L<^(jJ#>oJj$&9Cw=ubPlaEa9l)Va2cIjQ5l~|G76Bj
zK7XY-%&*>y%2vX*6;JUzMWsQsao!7)dLQT1n<wjgXEH)8yq5oBc{%Y{pI1p=@^{iy
zqI^0DE}t-a<K$o&#$_!;nh!NM`nk?KEQ~be1gmEn+n45BHsfU9>C=&CL>$rqUx(}F
z@5=KTn9WdG)KvTaerD;3zTNh&W_^3z;d8|JH7l7g5g{X1Dh5b0DjZapRpmuD=9(`@
zqXA@KhPs5@;NqXKMU4i%zwiEh6W*teueMR|^rp1fd!@Y1QBzn_di<?wP?<2YI;~-4
z^&z;Z$Nc^}I@5W#h!qg;VT{4<XuXq$P@F3vhQ?VOmN7a@XzimL`l!^HH7<xAzcjwD
z2@qptyV)LIgKuq#=_E<8JOTD*^CpRBDa2BjC#!snQX2>4D|WX!Be_8g#QK}kwItXY
zXSp!j>_@x=#xg}G_AMu23F9CZqCAUgVZS)Dnw-#-sejKiQf|EP!70lBnDNxwxqxH+
z0@K1lzJyc0ALNa1YeNDiKn60W`;sX$6HLZHsIsu2Rv92l`59A<v~!^g$z>8xRDo>I
zONoJ_f*4{>x!LBCCKoV46G>+1sY`D1EhZtk=;#p!F9vI_se|&wv-*j&*Y`G@VeC=^
z&WypF-rr9d1y%e7cTYE?B;UnpYO>q;qKr4jrZcyoZp%<C5XBx|%0$a#wFlujpYBeC
ziVewjO`bbp759=pAuciO0!03iAMJaQyGPs41ca#ocM!xmWtA^sW+}7<PlF33X0-<n
zEG-2DZ=Vzj8SI9`^t=VHpEbpMQl3{$7h?W9Ma6h-68F+tDv8vpYw>(p<C0b+=&+db
zW*fJlRjkzK9)L)$&;K1-^OKG`S9&1elwpLk^_}jyM{c;xK=eM-h@%S&T{nOdeE`y_
zd#`WQoTj9(_3gklDfppFd!6F|cxz+Gv3A1cm=By$*3Z?%y6?H`*%4lH&*1<snXYuo
z!cDcW>3u4N>_!SGb7ddovamxzbTT*-%r=r+J7=MIqwi+#*fZ@cVSYwBcAkVbutK<i
z7f=!Kt4xC9J*g(ge3py*J@f#-QK|}LvH1K_1Or7ZM#;yVW<&$LFC(Lbuer0L%oHAy
zj!aICQ&fo<(c%^!<46@n{}x(+3H#2w?AgHLCyB%7{|p@jPCB$rH+_kZ?%yF08Cxma
z`&-=iC9Xheu8Vmzt;qdY<)UZ;1Dc~ewdD7cL9%#}C|^jjtm~T3ugg2(c{&6Q5Lp$;
z3fPDa7+#{XG-xU31`;i!*%me=88E}TxcB(tm>%NgYPN!%U3txfUpxiTW$RUoL`G#i
z`PgpW65EI|43fzrFx8;rGD#OMcc1HGs2K`<4cNWNw~)Ntt|voLDswzlj)SKxbMAVD
z?{ZJxPEIaPO9Ea?0^IyV0jt$^w=JsK{wE;(%Zk5sPuP~nsZ}DyFXskpB&Ju3h@l-#
zOGTy<aB}{>3nI4dFH2KF-HimO<hBp=NM(_^71lvS;E+ra{{G!hP<}8~WsZmaDdWws
z&F4YrDK!exV7y-Byk-(GcoWcimg{icaWLLmCA)`SnslCa#_al1_pqHyRZ~5zj|tDM
zfJbrznc0<qA67W1&qzPbh)AGMfcH#fWillHG_-##bo&q>(eQm^A9mIeXcK082I#Md
z{-a!lBK0JWU_l6T4opw+rn_ISmdp{@<b}KSccIyW0kevLE+y!X8{T)aEuNAbG(5)@
zE+lkQ*okx5+~ftXivI`aBZy}K3q>D1DcFoflFqtXntL2N%OmR>wf6dooyj0<(|4}Q
zV2T9WWGcGo=FJ&CxPEm7ZOM(|*@s)%!9Bbv*S;_$IHbIA9X=AV4`WYg2e@%R%`#R|
z(61QXGV>R{qU=b?%l)KRQ(HR{rQ=z!fE1A|Y12Ywrh7cELSqv^IhgLV@X9P^kf$=8
z%ZyrNnnBZRk-{J8?wy9@dhff;@dX0|{pkC_4el*jg35@Xj&Q>GKEKi$a#7gg`XB<>
z&Z>Ij)!$bvTKwkYhVr_$-s5lh)^<x7)eAytohNRd6&JCHRM}?ZqS`Do4cVzXupbEE
zzE!Fl=6qJ|AG-kYnZwyKG8v_lmt)9ZK`IuS=4S&<By%8SwLM-A`hxp9%M$j9pw?y$
zegNy^{yea;+dval09uz`9k=E+u!|wO(TYuTpffEEGPdMk3Hc4QW_;M%TIOONi;+FL
z2)}6R-+n8W&`MZswp$t+mGyyoB3|(zO+*;nZk*`MK57t`0#p%cA=^f5sRZ;`o#2WT
zSi*1KDY=c{b+HRsiaN<wkh-L85StztrYi^qOIU}5I5KB2pr#4FK+%YBQ*r#qIiwjH
zmY!tgMEW3&@5A%8J%BBb19V79QsKbD2$9Oy>z${TyCrOmx<8Elkl9jRGvf#4a^4f^
zXVHZ`SHtr%VPoMXTaNbdoG8pKn2s)T6_(Rf<UCkrzijML?y_z82{2f;M2BKg*@AFA
zL5dX?*eARNCc0R!$2ABp3YpC=v*YfpY-!Q$jxHR@PZ3ORcKys6qxpM+>Ui7}*2GD3
zLeOW{lDM2_?m_vJa-;cQ*<9>}K5ILWds4E)ljjI0lFn_)Jx8emjK0Ox1U)+#`|hW>
zr0rVYs|;bDAWn5JL1KUfk*oTB^cgD>Bg;_2!0)%Z2Bma;$^wp@4MJEf5Ux!!Ib_YX
z)&$JW9%dkidA1ctLS}|8cpgA6$TL7k_6T<9n%xU_{f=e$&aj${Tjd+1tCm=2jb|km
zpj>q`eq#83AQK$~L;z2kE8H8rn``+2;q84!4vl<_$Fa&C|D#!#dxfo$lN;3Bii&ZE
zhfHJa7`Yb4s1GKSm6v~)3oP67tLu*a!xHE~LonjGwo37ul^V3L#=QLUtisyGwH7%e
zQjLC@p7gvDp5*-P?N3AfPCN|N`p{XFc^)0{5LFllW@J65YA9gc;85e;%3Q-s5!gbG
zi6~G_ZmTFFNqj2E3L<Y(qfmBlEMRXi8jpsoEE|gi94w#My&lrT3;Ub}8`ofU?rf~4
z5mp$)vP+WJq2`1WzxYqI?4`nc2RfA|DXjW_{J)K3N?KP1{b-&#0p=1|2!34_<9r18
z`N=LswfV{l+CD(q_yn&>q7Jr)2VS5r<dGx@<_q(K`8pEsog5@FFW~H4K@t(e1j2Nk
zLxK-y{_Xj74B`ZO`x!^8j3r30F&Fd~Qo2xBQ5ARz=*|Z5+8A_rDnKJzl12P7K(1gv
zf~j39xz@#QqPo-cbH`o^t%JO9JGezB(lI#K9v@n$$C+XmJRDHKmLEg<`rSj6j>ci#
zTW^=zP?_2{H^f}`2YJRll60>F#2RwU13UakhvK-#l#I^;T&i|&1=I#)$UnbVmlko&
zOJt{PEq*tLl>`u*1L@t^EgX>Cd6|WUL0|RdbYt@gY7H<)cqT0Z$63c)cLI^}qhTBC
zGUNr(F?1NLk%k|AUsMv{?}8U~?yx>YLna3!L9K*dOEr9{BVP-Vlj{wSVABp<AI#~$
zg5MIAL&qfOjF#kgJfJ+K7rXNjpWsB)P4)anw+)){Elwv}F%(6RodZ^<->G_a3N!`Q
zPW<sE$E;%yLWv<GlCr^u;<zDIL1vSf_1tg-MvAoth28>8bsH;0iTv)-Xs>F<4!@=D
zoj$q8MwDYdpCb6cI+k1qZe*6kw!)gzo}eZx_|!o2%YF0V2f`H0FeQ}dW`jKhPlybA
z9hc_!@o1Ke?IJEl@$-|JLl?b&EK)X@9<{iykDT)TefG^ciWPeOFj3^@QGx`kcHZD%
zkONZ*RLB`v@A&N5^uoiN6eLri<YXp8(&|WRb4(ADx>pB8in)$<hbMa>>UP6UmEd8+
zuCvtu^<Ao~k$@1<MsX`5ur@t?qi~9anT?(-U=|FPCBDYtT?Cm7bm0J?IKsa4)uqKi
zjH1sT;<Bq%htk>L0wY~tCSQgqEFjUSEQx>f-7OtZv}k^wB2>pt6?>~$3Og)P>$~*J
z*2KI3e<ncyx7z{rYeGa)g^C#Pnu)Yb{or|Xw9#@s$GM1@AI8>jC!ywFJnR+!-GYq_
z;y!<lZCeJFUwXhMlTDauz-?t!ZBx4`>OAwTwsvLjfbY4g)&J|XVD0;TWm~f&!74JK
zoGp+YIq!GF0o>N(K9jJLJ5|_%<(UXvY$5~*=JPq|y&as0b>kD?RBQ_PLT*n{-A2;E
zx!(deBVOwOY%Ma|zvB>cXf$c8$zc13Kp*a3WfUtq%v|aL;w<yT!|sH`hC<NJ!m}qe
zvr}+<AOi`4a4Dyu!Jo82eQ>e2>@5v*97`~O4f5n78ka%ejr0U>bB9Feqq4e$(U~vW
zL&oFKBW4N_5MDnlPbkZjJtZQT6Dm~`=m`xi&H#9>CO~u;%|22(FAKjWiYXYjx+pOl
zz5bZR%0pw4g7Fbgom$0nM5hAZWq2xU#d(>lC14B6MlYMs{G-GqBFAekR$gmAv-JvO
zfF=)Jk-O?L&VlZEm&RGOsXCGfFw0K)(Z_C=Yg*NGLO4hiKu993H3yTCYYOt`mV71G
z<w+!o*Te^7#b&e4k`hW46`4$zHlS|nxPjsh!QvU!jqmPnR3kl+Ipct`sS!Fx-Vls*
zO?|d!KG1L?ksd2xCO#(Q8t2BxqL<7mzDmrqr4L24A_`^j$|%Bem|!W$Q^tRZ6<BjO
zrhavKFduIrYzHnPPBu>jso1@aG|mVDW8k>XtBTUO3S<Li&gu)c<WD1)(aH{7U2-gW
zzOZDQq$h)d1#g97<;m}t>@9oTYyH+}HxO^sOHslNUaoo8@_;<;J#A8x3C>+kP@isn
zIH0d=x?aw>k#sgLil)53aJ0?AiHG<V)Hjj_EofH?2^Gv6kQ<R*nzw2}+`K4jv}kTH
z2EveSw-b7>U>tV2TR+~dwoN<sh}BZ$SzM7q;M1fuKcZ)I^HzU7x_Sk)xe^Lnq%`T*
zkU_!?e|eM~whbVDOfn&R7&?1ojk{k5)y~oBdh)5v7Vg0?hLCbOjZ>1XbhABSTzQrL
zvQDBz6DcSL<1C0$fvBM1NZDLaV_(cN{@_fLcPdv;R7POxo&eB9QMcn$Uz##P#F}d_
z<y!EH6S!ENg@#Ys(a{EnLQ9D?hji9GK1YzN`YL%dTdo~B?<;~Yd#Gj~sjR5Mmqvrv
z17ELkw~DhVahQo>rm3aA9c{JXBj2x0uLI)vUk5xN`+qPATor`W5ci<$cYjAwj{8bx
zPUIQx9e70dzP`Yo?1p8@pW?+BSFA%Lg9Uut(<29yeYIEDfX7(%1OGYBI$aO*E;vP3
z=_79l!AF-N@ntdAsV2@K$NQ*KE}nQZ`I>V(>>vEK{*%p_vab(ApwfXu7%ZHtoMn8q
zYzzc0u<0Rue3;OzWBe9T5nWxlLu)((K#%h6k(Z}ZjDJ4RA}WmBA*sT#YKV>07;z;S
z!K#nKcXkN6(^F+VbGaD4z~uR4UV{q8mFD*dTj?L6p&Vn%P&PyyZQeACmB=!WW#!Cc
zCt)!yWeqHxK~f2>1K&KI=f4x3wsWW4*U*~dVv)W1!wQD^iUIIY<U8!D=mY15+{!Md
zU(07YwTJZO0ut?`vJlc-jJ3V0+z!|r+2+U^%}MG(VmKv&$U9XDbuuilhj;fzuA-;u
zw0tj3_rnGY!CVZC9$MPym>|r?(t<3Tc+z!)*WP)SSjR|dx)RcPaQt;8+>z=bd%b-*
zR4BVCgn4LImFiJKUF5D1&)Im2r^tX9-ql0ncurRwoK*>GZ~Z1=4VFc^*()r>!M_jj
z+6f+n<iwEQ_((<^!N5$Uqq><|37%&0QIZPRVQE*eQ!Cyl##69^+=*xF5Ic;W<Et17
zdg)1noAeVSbz=kTF>W4*WWUBM#`9Hrr!NgDC#PX+V{3I%=Ows|hS+gkFjE}$uIZs8
z$9;e*EXU=lRW?Zp6De08N-kR$E_R)WZ0_<$eqtC6t@fs+C}SzjIVn($jEIwzYt9qf
zj}dgw=8AJFlQ%NnpaK2&4MXV#!m=^?u-x1V5!(Z@9Vv2f{Rw(UblNYIGxZ{{cvl#(
z786wq5%cve=qo#xjSuW)ww;v=OPr()+Ywt-=4QB*81;oM@ZT+{1->g9II)Qyc;u}s
zVf8B#?Sk3DJ?K|AZH4!4Q!7?jwkX|C{^$+po+>vgMws0s`70!Kc>cq>X#t2tJJ4Xe
zKMyo>IE$N*VGt7H9GXFZ9h>`g-M+VA#)jxJ=0QGHx+<*L%w)ru6#^Rv(3mQ5GuWX<
zVbV@i1>e__GzfNzP7aWFSO&xnSe-?=oRb&s%JYor#G&fD(O6ivtaQgyE6owj@Ov*K
z4QPGT-DjlRlY0Vv0M=&tjfuLrsH>L!N%#(Gh_>Jnhj)d!2Cf7DBKz?H!~v7=Ef|tE
z&9Y8)L_mJAXIvuKy;^5MOv`Qlnj!V+ZIrZ!P3lb9@sPbq#Xz;p%~+%w-h#osm9tG|
zZcJz3maO>ZA0H>tFnNVYpi>PNPpZ}P?78<?`9`m>=)=`Mdi{6g@(diZLe&ifHFuu}
z3Ud||(YIn>lfrkGB_d4XB>RNf3o4bdi+CCDn^nAIBLF4m?0C<ik3$Db<$MecNz@HY
znA5&FDc`yu%!HYRAazfR1Uk=bS7faeZterP9KVEmWthLC=r_aN;P^~spxUJ>K=W-S
z`)bAmlsVtC=$A*k&NU7-4%6*kZQqq`mAyE533W<x?2JBWEScRzRt=wn_i;}m#2=BX
zQ|x5przjEclzC{dv=T9YnDspH7iXHeDC|w|xKFhT{+BAa8mWNoYcy&fG%!9Ak!o)E
z{NmSfJd4ub7Gk51jdH<go%K^Eq8Qp~h~1r>3mNg#$wNJNAUq+lY}`p?Q}<OesC7uo
zk2;kqqb*G};X7@sHA{2LiCMO*QwG_NvJ&FT@CiJpZ;WarWX-5`WN$AB)M;c=yCldA
z<WH$<k#n}M@gP~ux48#o5eLPg*L8ETB55(KMfT)!Vkr-2kw`qFvZrdv>+8AWLn7R8
zlPl8R1=I+ZwDNfd;tiV_Z(F34E4dt9C!gUw1wqZIbiUPx{K@do*BY2izJcrvmfiRe
z>$=5{kb9BB50i~<<tAuY2hO0>N}?-3s$+eVwzE3Ki}XpK^MU|ED^C@ljt*ID7t0X%
zl1U1qUFfYA)K3=yy=4$7(ZwFB#9@E8U6x%KKX=S;ymn4rXm=O6!c_i9JJJ_lOq{~E
zv@+k0StY@8kouxb^3A~=sw~2V28JSP${Il_;Q=l-Vy80g_S=rV-%jNV;zB{7t<K{8
z;?UQW$v(5mj+#5DoarhUF73$5$Hjc0<LE-k>i|I9N$i~*&-@xIH_~-Bf@snB1BZkX
z6%_p~a3}1@Mh9ghn|7>yY6L5K41^Jwa0&yt6Cv_oc{Bjl9Zo#163z3pj$Vh6rt%is
z7<&+@$GN9i!rLKsVNoGLD$K?laI7W*1yFX6GJCo)sx%>5?t-wM3B8xTaA1F45CV~l
zV9Zf+2Wz?htqNV)EaFR57EHQ9pTdE6YaQU)Ae@Fn7g5w*A|I+Vk}5aXI!#z<PerE;
zY5h%9x4h4IXe8Qfj5rxdeJR=Z=XFuXCEmkJ;xReN4WyecDea+(O9NGG>?Q<=wD!+m
zra2><GN3byTV<pb6`8f!lKHT5+})M-Xs%GRD9YFno^|j)H4=XGQc?D|NVSftd<6RM
zS_n_iA9<7QsBrUg%_sD^U4KnEC~1XGH(i`_uQ*F}4nwBfIe#9^{RpC}cu@Mj@B8Vm
zfQ3n<a@jHd=DR#SM~MVma_!2iST)EUk>kV2Of<1RM?c7(I?yzxk-qzJ3b?G{-!V(`
z?QggaC)r!Rao>E9|3{iKX>b1kMR##*3hIQQ5194x$i3h_cYy?pw`-;R2@H>+&drbN
zK6pBIK<s=a)Pq%KI7nL{3^qd8z6pbwfsDyO7vPSeFzwwko8IK-#2#TA7I^*n0ap0`
zD@VAFS_};o0Ri14K>#8DD@WKGTH2|Y+B(?$D@y#g5OLN0<#x!K$oTrhciICwy6sJ;
zF5U9SUbVS#Gh?Re!Od(v$xUw8d%=?r4SM}5S+bdG{k&q_Go0_^Cwtp`4YD(?4*8Wx
z2n9{Z_f@2{tZab-7zs)gEFhea#P8?!XPU|F8*7cj#OC_b;%aNkENO2v81&i1-^O!=
z9UIlY#r_MBm*~4m_}9H(sL1Zw`bn+Yj)2pI<>9t|3mjWsd?otohxD#n;7a8j(q=cS
zztf*|vG0lRGqzoS^ylz))WnQy1<w19hd)4K#mDVXzWxkyHTOMGARC*VG+mzJ+vRz+
z-Xj#>C}wUpx*isIh5JR~FSgHA`aJ@+h`-e*?*rt@7$+qFZiKVJ76pt)<AdjNY$#J}
z4*RTZDJ8*PdrjpLieTo3608?>s<g(Pz9YccvHNAHGk3dBo7L+ozJQ%@`g<B@+Om6A
z8RhkFxvXFA`(G(jdwrkds4cZfhOX+q+z!;8vK;-d3}(b|Wp;?a8T-fwNTca*BSSDC
zgPF0`jqB<}B228`Uwl83*PkPKaoIR3)!h`$`c>t|9}3sIFYt%ALk`^r;&hPO>}DK8
zuP;3Q@9gOsfbs~t?@mYe!wrs5Tr7l)e+7#1{UyT1gWI_1I*<~EZy)nsCgDM%1=)*v
z4ymz$qj$J1D8i~MKeE+iA)ny-T4bnPWM@<?_C2m3oj|zXhp0IrqohWM_MOY&)-;_5
zUpG5DX`l6@p<M<h>szJlN4-(E*aR-gzXrU2HaH)u=D((zLDQu{9+0FqxWW@I6OiTX
z1<n4B4-~-p{8VZVmZoJ5oORN?vF&&%@39%wAx_KT@(>(FWtAR5SrM&9CLAF&*S8nw
z$yD#pH4_@fC!%yUm)5XjA!|Yg4Y*6V{Dx(}Q`NX}Ui)R5#=iyb2^9q`HP~ZlS)wPG
zlDZOS*5oA!t++ST@9t6p!wK2wT1oL;6;ar1{XQPxH$U-8WGzqd>rtE_E}!N$pIVKR
zRrLT~8(JPu>*Vw=>5*msp1u9~MM~8mY#8lGgz`H4o5jx%?AB$LrUOwVWT&dgh2#6A
z3Ol&~$;$O#=z2#r8BNs*7=|U?PVeRI;6H>eH(TqzYkAvNde<A<`7PQx-ZuiLzoq2F
zE?!d_PMvnq$rJyUSdsF3Y-Gg|TPi2VVtu&?8{h}LHH+^PiA+bT%wqki81<2G0X*fj
z<GW>}+L-y0GyfXXQMX-9aOqs$?(Apy8a6=VHAg$LHBl>5{h8_P#~CB#{)h~!2--#c
zo9MAUhZF{Z8KyrDx9iCF2PtHPTdbgf943a63MNKJ(V%+<yBoqBkV|I{c;I4{qKLZn
z;GdB=a=AlX>&vKj)$z+yIoWp#UP^>@igYBlTmLfLzDUxlJa)0ZTg?ZYAzU^aj$Xuf
zEaE<grY<FJ%^8X19aIz{XUx>)8fcij=;qu?qvo9r6w!gMu#JCY7R8qWjFr@s>Q-DV
z0SK)tYnUsMJLzkX?$m?zz!Yu;mKb(N^$sF=A(r!Qt2l7pIcC#MvS+rVH%ngELPaY!
z9Gy=>t2TXyG8lGMGXvbatLFP7r1f<>R4{c8hxeKq)-uv{4y<t@^?h=nT35#nO!OCP
z)h+9`t=4?jb5+e3*M7Ehm95sr%Xa;=qb^$2|2Q@O<DC3I&fouXvO}l`EgKwY<3hBf
zL#DsX7+@C*>C2#{g?%+H;X351O)~~F#i|Tr*t}=z7OxUxP0bq|tl@E?V{R`S9WLtu
zC|X5SeFN2$bqRCW%3}k44w-aYGsgQZ2K#FNL6t7!X2$rnu2^VQYgudDu2zZrDqOD8
zuU)N8%S}%0z_zNJ8|M56^^u^VVUGr`(f0L9SH(^d5u*JMG;X{f%m0ruR3GLRyksrg
z2#s&sa-~(fW4rurw%xQj-Lc5>kwLemnG@pLQ#(75BVlCNt%zo@KXcevx00S}uy02I
z>pra4mNYrg^k=!X6TkDcPpA=LQY>$+`5R~@I*^sD_z*60?pg-p=Km$==Km$=<-ZA9
z&}%CiAL!=AxH)h9mu5I_*99CGE4A9?(Bs1SN=-9FuT7HRKvOOUr0E^lmlcQX#n&Ew
z*cXCJ&NB8$5V|dIkWsE2X8QhtuYU+w47=0+43^7g@#@)=b*v@g9M~ENbMT<K@tT#U
zZ{wzgtM|Wn^g&^*ef0A}KH`Q4{+r(~%Dw?^<3x?N>hS?HzSUO6)z!f&8(#|qT+l{s
z+~*v*>SMO5OjSYzE45V;v$AbUS(dS9yCrpV;~WGu2m2+$h`6Uv#i3qBe;@G`oF$Zw
zwJG-n#TSH@^=WgHlljZ%D>>u23NBlaOL1Q)2q7bQtL*|?o+qzOvTbm?4))h`7jA`s
z1j0$hGLC4H=ua?SSFPYgtoF*uvGy8nE#b5T%XPIzOO6ftwH`z-2e@mv&Sw7Yu|Wbq
zPK#jY`c6U8+J5b_#XykgPmLSyZbLM~Bg(znMVuv;=<Lh7B662jj3%2_aGp0a*sVyn
zUVUrV{%X#%ji=0Qt9Y|Ufu_xFIlw=J`Tr1dJpV&9{|BKRrPGQ}4;;NUXK1383Wwil
z-5S>1vJRXr;TtZYv{1Y3ZC1Nm;qGnA>H2Rg#o=}5#;58Vi#z`JGm9gO`+@ZER11at
zvo=4{ImM?JG8BBnfK_YJw0GOA+bwtXYJqP_@x#?Q_J#efa@UgUT(oRyl*OouSjN&U
z0|m!=tH<;38l)N+lkW>IW2b_KDYk7MbKRdu$uuBRTfyPX@oPO?@*1qsw0_z!tKMxi
z6ggV*&Jo|X$^5eU%WQ2Vh8Zpn3B&YY+<yNUs`xu0FMv?qT0t5pXi7(dfW9D#zSLC8
zc@7wix=<oZt$LXvpcfbDVbCQrxL}#owX=S&t`$N*SMI+AuD|~yaQuf5z&fqt{*N#@
z)<l=h>n%5GwVGKh@cXL^eltIJu_hyUBp>nXdSKE<TrXHc{{KSJ@%mpVWo7JtOtH9D
z%O#}GSXk&ct=B{<S<hBC1{t#DAiIH~bU}eUb580E5jxaXnH#Y^;r;mjO*Dg}QKzeO
z_#!A$0pQu(m3$}cH?vrG_1Yg-xzd*kY3T>=w*?eCH5``qqo8|f>6jWRukKt;>lN*A
zQ!9X#nm1H0J5CNpP<E!nQMgtju2(Xy2*-~MbNmbv+xX@fsl7!phx52}R1kgJcJOhl
zSql)+N>Hz0f#$SU=Qdu;rQEKKMN;d%<k2#A5QS%!=aKD2QW^&Pbk8DXscvJRK(ODa
zneCj#vvmurMZ%2%l(v_4QrENuN$r366QuUi`do8`IR&yCZ3%clJIH`ETcAy#hpv@Y
z?QJtunOZgJG;i%VQN0{ui^SF(iJcaHPs@3~T6;Gy`bsmD4qJOype_~rmCS0hUR%I*
z;C8ijV(Zucyy5XYx<32o&2`iJm)9hijO;d;K7(Tb^ca#tC;ggaiwwvKt?tb=FUE@%
zoKRBNHt&Pm)A(fHuvw?ARxvn|(wts(plzT+^FG|gQjXlL3j};$<at8t$N%u&|M2IG
zwoMj!a0bt~)i^@w3<iT2>_BG&G&;8~8)mq3?Axgnp5AdKcx<8hQagSGo*(a9(orp&
z-39Az*;<RDo4b8%h9Lnp0NKtR=1a9AITu&^pM<eWR<LbjF}@caMMj6Zd{f9lyRfFq
zZmr(=!4!9>71d3EwQZ+jYZgL1&hN8ax{Ekbqa5b5M9!Zxvx`b7wU$kbAQ9vh9n=<<
zy$EKhX{Ra#m)Rljpi*ccWnC13m2+8hxDK)zz8*0mT6l(kGkwvruZyRSx>aGUiopZc
z>q)D7z5L}JzK^G+vxCg93N?EM%S9^N`*+ly01jEHX;_R|SrpBb&7fSFX|Q|OD(RqB
z(WX^PU!CpBhwOhkpqBf;4o092A~7P?g%F-2TNWMi1pomSp{@b!K?TJt)=QgDe&!00
zcrgqSgx6$c%n-ULrv%68dAiD&iw&-o95xxQ8Zq9WYZbvO6;GG3s@5QxO|UE0bIu*O
zkzs+fRFYM!|1~)!G4Fx+XCen%+O`Y)fr<^VzJqLQe@_MdklM5hq)da`0R4|o5&!dP
zfqA!>BI4h|xoZW_V_OLTo5cu7_Nv1{1O{l?vxg#_bL5m(cUyW_Dd+rO)K$iMtg<MJ
z4aMgD+~9@F7flxiH8sKKae{=nbxxd5J@6|wwhVq%N&jo!Wc-cypXOiOZH-=Py$}kg
z2yMvI{8!Z8Us|(xj{(5k)1@W<;V=Hjpc|*Xj7Lj2X{gF(@to7ObEhH@9eq9;@Y-V2
zhaaGcet5=~c^zAHx#sbI?f;EJ$G?SJN@g-hwqm|9hanVO@W^>_sFP}2YmfjgoE@vF
z@2*1nV3d3NJX%QVU~V?^@rGf46JA{U!%d9o%|&5CMUxB5l*NG=QJgwN3js7{(1X8`
zxh(jXzXnzyfXvT<DdWAh26UHu?+7Lkq~XQ?;Fn`EuInA!Jl1#fc=A@qksQs$pbl+O
zcqy9+o-xs|%kEp%Q3}(QcUPeZ#gKE5GGif>?{|hzFtTB5kw!N<yMqyP3dYbmIO8YC
z3MQS!x_-6wh8zZ|WWsK*C~5F|VC=LGS4|6zUMmY#6Y)VIj{D6O#V;#|$<l@J;la}C
zSo&4eB($GBP!k_0fuRTr$F0*4$KT{?2BJ~qCa(nk*sv<O9%b=#_o$>|p~WR4(4#!5
zw1g7@i%Q$3;AA#?m6wY2SX&y(2UIY{VB1xJ(2Wc^CZu|b5Q(!!b5XeJ2NE?dAcHJ;
z79;q`qk?=!uOie1K;k!qZ>tb~C00nt^LZ?+#|ie0?d&W%_Gj{=bo~QUVNM*W=Adbv
zfjkZpL@^2=xwD`w>~!8II~`Q=p~qY!LlRz{b5Jqo|ITe3%0|;cUkW(G^4aPbzsyC!
zIDi1Xn8=sP&KTrE3Nx5ZKsli|?Y+pS>GNKvFO&ETeQ7)bdPXFOLDP6Z7-vppUhRiL
z*^qY^tZ1SHA^Nf&Qz0<lL8nx%P0xhiM5ezaQS>tFCa{$sz0=b4s?~yj27VaqB-v;q
zH+)i!QBB}K-{=&vsF@$=DgWRE+HZY054JGnK^#NHfxnc>2%geqQx7C>B}b1{A5S~n
z9A0ZBN!9tc|HT)NBP#_JFJ-n82PKpMyP$+7Q+~Do!OMy8<N-biO&+laxBt8!ddV-;
zFrvCH0H4~qJB(YgaB2Sw4kMvFdphE3aXCnw-&q9!LieU$J9*R!&~6Ir#<6kSs0Mf-
zhf#cFs-+D$_Po@Bx6#3I$V*380b@sy7y=MU^}>@%;Cp{L$yo0fS6bsx=H9z!?j8?t
z?Dz#+1~o%O9rmD@{B|_IOZarY33?7(F<aycG_R}A+*uqE0r&Cb0*ClO%ryq<G{z&q
zNlQ!PQMB+C&}!IzOpGxVqwNcCTLi=(iJijt`pTKL35=lhO5}6}aNKSo%K&@VY_kF!
zOeXh6dU?#&`S;F|l%@9$Gk7Rm=wC<H=QA3g`3;T<@UrhuJBhZ%$c~+Msl<xpBGgxv
zt(}~a6f>cN_QV_cY+AAjY?}LZVA35p*|~oMxd7RGZTD=0CSRj$c>sgHTX?QYVGNy$
zKL$1G(gw>fDEB{{@6r59DuJ4hOsE`>Nb%X3^{{(p(F>R)EfTLxxi4L|G3kn+U|!a0
zO;`>V@621)E8Cf<Fa`9D<SZLaPT8=0YJKs*fJpxKe=#GN`m7)7f3NxlF0Cm39z7M&
z4NN7th_|#M3)jABv1IKFnU5h`N7lL#>;*a21V-r>1kN6xQJv6lV;nE_lKqfYRc_E+
za(%S`z+-V5Wmp7y6q3n`NMYAWF;L{r<hg-keS+FXn;JD<gZ>te=HSO0j1gJe=<7}4
zGj^~yu$RYET*@2Zf+uWD{F71H6>bRbrnIS;5b&%KQE^W&jPM-_3dq$PKGfAf*w+!>
z9O|uec3@y%TQf8jVEbb<p`O!QiIH=wX_c%L>w7dX8u5oTiA#{6f>Ug>%;kJsVMgXV
zPMnlm?bjorg+Q88)stv~yRtuCLy~aZ_(W@u#@k6XRH6@Am{bU3`gWW~7OFd&5&BBe
z2l;w<3soPA8BdQGi*lBv=G{)`&T4v}7(T?)6!;8Ic9=Zm%@aEcdK&1TtTnU*y-Bd6
z<NOuN0?%p7K9;41tBpPuo`B9P&aaN~*Mu==#486w_yKXos&n>?;V_Jz;swFooB=_H
z%JFwTLdoTW+JPD4uh$MsV59;?$b5-TejrW_%$4atP!IAxug9$5*a(K5X4h9dd3$sI
zY%2sgKBwr2M}ynpwqMNQuwI4Z_(8@T9oq!wK~jxz$iol;79s&z+pK{bcXn$xHMUUp
zz3UFYIw?lVAsN{^exCiaPh#^I&(lk#3{bR0hJrQdfvyJpHrT3Lwj2AcmI<nC!7zt#
zAm6@9hnM(%P*C}4z=_<qf3LA)MC5RO&ilj{T<IR_7hn+OD>{ZHyK>r`WcwN!={h(X
zZ@Tx0w&yCo<<#`<z8KK6y7{lg@I|S=^9Z0VkhEoB(gpX1nU)96GW$_{L*ua+mUmEm
zqvvweGTk4f@U#b^gFosjaG8tuj^{c$7~p}|T@5IKJ%{aY6=7o+P;&$vlAZKr$BC~Y
z@wHL(41Et3ap^LZz1&S_%-XJW;Tn7w)*2wkMCQ%TJ(g18?L}$Kb9i*9vct|AgYOO|
zvSbZHYb$yT?GDqv?zp<a-#an3Cxzo6WkIw{nK?uPFxGt6B<FtS6{7?=hw~+v!0SeY
zJ?kc;EP*m5JXtJf7eG~G$)!5bmW{zR2%FsWtC)90t4L5S{*0*mo#Ch1<|f@g`ATB7
zJoBy87@fo8rqA}ZoqUgs2JALdG)cX3)F=J5H6hXpPl_m!GPO$T_62RZVYZfxPs{;d
zpK8z*eTA$ZJx#-<9q8peFX6wV7*v;7T~&6%fBN*{k44Bm_bQ}4!Xf(v1>R{yjcHKV
zoGw%f*?(K))a2bIe!S;Ni_R8}0`!bo#ao|D=HO}wfvvyYny*0h4795KrOuYr*~;<{
z8$@mT6=&}6p0f^5KPQ*%M`hnnq8!J_GV28$F8a#KZ%!7f-!l}F(PI)7;OImF6Ruh?
zu|pU<jlAP*jzm@Z_XB8z;aB78zV<zfBe%30=&a@NG6dEd-r?gXmsK1|wgo>MWoT?q
ze5Ih3wFH6<q$oVm(_F|hB)?HONZF$G<lzRBSDqHNBa49$p?rY$-Ai6XSl%G-W-@*J
zY)q1Izk(5$DIKem;Tno_1LRn?VOjG^bscJC98GV@tDu#jbki{AH26uBPJJIXvs~B+
zZry7q;MEfA`mKE1Lu6T~?pk=k14r12xw#7nmFv*<sm%j#n!@~htoe5LZBf~R<NG<7
zy(5^EmNhkMqU6d(&8^KQU;TvsWWg+=;od^Xd}7<L-jcs(4UbFix=4WJG2lBe8d7jg
zfsH@0-d|df8_WwtdSHI3`}wX`NfOZ8=X1yBesXBID0qPDk_!h=?2qB`q^6a*ycauG
zcT(>pBJg<V&%NF44s||UeKAPn%6t8eU$0I~Ow#YtF#*sDL~nQ~97yPsE|`rdLba^B
z-CGL4-*dHw9$5eyuW*Y6Hsgogjl`srvzo)W&WM&{!mofgi?(}{kIP86h>6$-fIsbt
z{o=+I&Z33bbQc^!1C%{(VKlOEyS^wj80Ty0Jk^YQiqrpwc*)G+%x`uP;Zpy_kN}LY
z&>P>UK7d}GLVmZpe?xIzN6U;dT;bf`F_3xg_axOcT{LEoq_QcYmjj-o!Be3jRH63z
z*WQ1DkRU-VnIOX})AMHpp~CMNEWsWS^+P8Wy@B2RD<{wd)Oe{d(@>!|K1qsM6iMS1
z|H><l7dzRe$4@K~X>gHDMHpWoep|pxwEWWdBF*dMc-WsI#=|Y;k02u}+;WD_K#i9;
zr$ad)K4*PDyJ8y>PyJ|g@>jc=o%mV@y`FuQwvQE0TO{_Dz1@FgO)yck&*e?M5>gwX
z6A}IKv_o}Hqch&mOj%Q2nEV<+?QbvPE^2Y(Xu-UOK(8&UK}}mNXv6$<JB~i^zC`GP
zm|6cdq!-Qu8$p}Kv1e1lixhK1OwMA-ju>a)iNIn84mrr_NRnZUn6a$w6&*u>st|i+
zcrND0^an*rZ$O_{e|8m=kf>R{?Sz#}J?IXbaC`6aOB;C*QdeSzFM6z**5#Ubw;0_O
zuWg<XRKaGS@L40#Cg1*1!a!QDK7uFt8*1t-ZZi;!?@i*$y&Tj%P-XYt_MB%|Jn(VV
zgeB?QNxbL`arc|T)s>{Xo&vR9Wd649JnGwluN;wsH7fFAM_%Xq%s)-BnHY-AI;>&I
zEMoUhp)&NGg3)hQ`e)*ObaJGK03E}nL>MXuhJWhaV@kJgOK-p0fH+Fd<R_dPeZK`_
z$!+8NBT&FCNS+=rOwE1D+C@UQ=o~hSg|gwYfp<$38-FYs-biU{3BLwwR{39tsrhoo
zszFk-y56G82bYqF8F$bQ7oV`|V`aWAzQ=XD?a`*H7)q9F38URjQqQOe`M570MDKW?
zZ_7fjcZi5I9}Ay5eD|}|kEJj{%kJE`9v1u|kgJq;^QgyJP{CfcO+B&95JKN_7{jt9
z_ZzhQSymuhN7=s{CA8N`U3mb9?#QMLCi~~yaWQsg)T=jIjRq&QP-IIuZbeQ{M#m2n
zCo4`H&zFTwkn8%~PH~Sje2qEwRnh<(7vJcfr7E6Ju&`QuEO2;@d-ql6PaY5Zow3@t
zR1hB6(hg+6+&45RgQ)zcp#~k$@nIW)6+~j5X`F-2U?NEE^$u&1VWd)Iu;ZEbzTS4t
zrbp6x1fVx7Bt=o`YajKjWW=Hu%Z)~=MtIU9gx{icAM@M1;78^vF3TAul{so6U2Jlc
z&d9M~aI9@Wn8t_}`)5Fn%TreyFqZJS3z8t6TTZY$5+Gr`%5#eF`rffm*Cvx<kveQ`
zf+q0rk<<pzawwre;4J{o8T@LXN@<QzyUFJW)ZJGdh89VV`BoFsRx$Q;tj|uy-75Eg
zAt-t|_^#F)t+71RB~afJ_HoCt?<TOo<_j_|4H7YSHp)Plq{^AZ7`8(DB-ph5y@1YV
z%z{>%6>r$iL~$p0%6m7pN^8wlaiv;PlQS8sQ{qD5K7u?%SwWR+nlcPOg~wwU98r)+
z&~TAR-$*!=YoZS4D2^;lHCA5Oq()YMQOLsXF%^Jcn4`Vr7*_>O1tbF+Bnb6NSzTIk
z{$RdB<qFE-#VC$Xdw@V2b%t&ofI?L3<|05b;zSJpa4}krZvA_Krq)k#j<4K|rp8MK
z%J8SFlXmA5l;751AzNe>bVZ^u*@8S1sD*G;dYXM|1%$ISin_t9iJO}ag^RZww+?4W
z*7z=jTB+^9`_Gp@SmTt-bGMabT>kKD@MZb2S3VWWpkenuO`+MgCL94#wQ&`i1r{T1
zPuCEyr_f1AVnl_?VV7zOXGv!Edj(sJs(4F$x!3_ND8G+IU!wEybAC#jMsiSH2a(F4
zs-RlC;n0yeHT-;fYHE}TYNeE9(;R<()!s9lUqe}ZEftI{(R-ZlD88l*WvsS>M;$Is
zxVvFg_vGTtJj2aGOfQ?#hOySKAwTnB%YHCy{@aGT3nl0bmOOXTjWJUtw2v-nONuAS
zQsS#_%NBMIp92T|9e;yTiTseEO{00$y9AkR1yrX6GDND`Y+-iR<oHKNYAyx})MTdA
z8CM`2N|;&cRk2w~D2X4*(6bFMzP#x(h#X4mes%j^L!U%g!aov+&y(0?xh0oCN37?J
z7K_f(4Mez+dWsd&iKZX#c2KHCDB6~8B1~Ck_ha>~4Y*><K2*UWT9CoG=G5D_Ow4+N
z5)^;WO_JZRrSPlvwd*I1DrWCR483TU^`(xs^P?K9Cu0mEk^*Q$R!JSULq{Nzi}9ks
zK79{CI%Tf2KHB=)V@=AAyEqD>srcd?Pi%hu&h5L6w?~}><)cD3e}?sox>3Bw&k1vD
zF*VQp{A*x^*JUK#|MOk@bNRzuV{mKWKkOR@j+<_c!;BOUoezkPkY>tUOg?b|1BvtD
z%!|1fpwqT+7-r<-g>hV_CgZT|l07CU5J%sHjDWK#1XM6N4^rM%Le7}6@h^ZjZGp)@
z(zG_M$qmw84QHLm8_z|Jk@Vvzz5bK(DisNpcwpKyH%>O9ZHYDB`V3msw_FUlj|#J(
zh23GzsaFc*1E}*_I$^jaL(KL=@+nK=a<d0X$t{+U<BzR0WPvmnPa8gcG|T8H1ctvT
zknN~1r77hKRqr(dYqUi3&RSM(g#&tSuN#l@tRPWu4}=ku9*kAV*()moD}DLS85ui9
zKR@|6+fSnff*4;TYre|)vZdU0us^6R-G6%nZwy>|uM8iBIN5M&fmq0|+g%Lgby2oH
z_KhfUU_4RH#}B&bT&h`3P#9l|R4A^ghg>Ty@WpChJmIZ~Y2f(-*Fg8_f^=4j6iE~m
z@Ex9s9GQfp`$)^WQ_!w5&+uCe3dOiu7+npX-(f|&hK;~~-XP*%_MotCk+UhO9L`n{
z4^kGP)G8TIE69`$8p2175m&Q5E|NG<r6+`Y5Z~n_%1?_9)6#O)j4sj8Hp+YPTiH2r
z<;;Ri%_A%UE59dmEh%&=MPjAw#65AtN5lTy@JT>E9}*5sK|<HmMp34|U7Il)F2`mZ
zlpotE-hj;`gL)aw8T6%oWitYbTbG;>eGs4358&v|UJe^ka=Gfu>S$si=9rn=P{R;!
zPZI>{JSs2;<V9>8(h>g#MN<X{3|8Z@H)a!tP=S;3XOSLJUu_VAdhoPZyk)K1pnQ5b
z0JSw`y%`XOx*)A^b7soy@ybi7qiQNzOB%9KgF%9xt@W=3x%zwcWfm`nGQMQQ?D71e
zvoHJiP7havQ(Qop-_4KBO^_~G3=F$&>QtME4Tm~t!fp%)xy0?Ihbk+eC&}91D^3>7
z195<~D95Dz_8xK<75*!iPTrJ28xFde@WRd7CGlhr^p0*TNH`Y)vQHZ0eR-jKyPkq!
z7ht#<<5i?snf2N`js|Erl2Zitj8KB)#A<XAAI~MHxxP_#FXGz9#10<tyHWGJ)@5#F
zcd(8&(4qyF`Kd}I;!6cug|T&WNAyE0-p%;^@><|e4I>P!Ggr#cjCla{{oZNuZh!QR
zl#Uhm9u${BdO&GnKxmJdPe-5!x#H*G{gp)A?Bd~g2;tH^m<lKN3>2+6H3CKwm@Jy4
z@{8?HXQLGoF^@YDQoeP04QP3(r?F#i^a^^Dfv15~=;E;LAEtaT-n>J#ei(IooHpK$
zVAN2iJjHz9x*yapx{IN`bQuG8QQoNomoc}+k226lN#E~*$iS1QJ$e63<y6+G@wE<$
zK%(?QytIB1q(0xjl)*J1VaSFmUJ?uRk{mjv`6TK>gwP;{_Tw4sor<%>s<3N96o~Vq
zJ-3r^1t_LweX7>M@#L&cK-%exuC=1a9EGB0xM%vq7eVb0$(a>VI$f;2{Y@EK2E`27
zgY^tiGKoqGvijmFbh6&)ck;~eSv6TpDNXFw{GIn@8G}e)u&4Y*%5~XoMJjP;iy%4B
zC#X$7rq2++(K;hXyRmH&oh)#mM{)gOu9aNlSN-FEJNG<iH|~70Z+!FxWhoMNlWOQz
z&5;_(c7JJ1gB~oO0Drmznh|QweLw|4Pdm-#-}vv|c8c8Gji;^b6qHjIN=isAb7X=V
zrtxxqa*FihSRo(_5hjzZh013uKq5`m>1QN*`#I0X!|*zlEAVfZccaJW>Z|0?56jpT
z_`VDCRd+&#zm+Q(7qOPIzR;JRb}`1<s7S9-k_RSsDVw7I#8?ZNsrqCnGOF{8xxS+1
zEXo!v?NU^+)lcuxbZ9PpZGtR!9k$g))ZYv$QnpHJ^j8)5m^b<T=TboTpWyMJa=#AR
zCHlJJaINfJFz=9{riq@Ee=jfr#UW(f_O>e*^v6By8?`jzB$@nqNVw*e$VFg!eTEZi
z>=8|!?22T13DnhlOHq}XIkQVRA=|OB$moueA^PsF<zQLI(Y_oSer}jHUBg?fZv$=(
zzoj#`80W_tp4Y~^*{cM46S1FRXZ{WrSWEDjbc~~Ka?}&DEhxcAXHZg5mA?%;D(O|O
zC4D)jJ6Y@s^U1E#Ju`4xEKTztCWEFICHTi34@sPf-y=GTF_1m%Hi?qV2<Rk5SPn1`
zrM2bMkq`6qV+eV*FL2?Hq=ypZVCEd7iNL5Dcq!0AOIT^bAt@f5;mPfrYy_7pqru0u
zX+a8j8FfnMt?`Q3=-xF!lp-6CWMEEXB|G*H`NXv-#WB01!yp*S1G~u?iWy0;c)5dG
zc>{OV2rqtP(Fv3Np+GP{kVyp~(K+`lYq;Z7xKi2>g9UK6Y4(e=)ZrKC)+4zcBKkA6
zsR^<YmQ?L6N(!jVq$5aV8U07q&6ONANCy&i<5Y8Cy_=tbQ;wJ?!uxl{iIm-yZtmxt
zh~b^fZE5ZRi}epf6M~Y+R-6C`EOU`28)~)+Lt{34ShvuiRjajG?Q(6iS2cl6+&?Y0
z9^zW9Q|Mh}YFA<TN{Lf0#WqnNN34vR(I}inybFmER=A3+-|$3@sJnw=MCa=R9<LKP
z0tQQ2!(Fi5_}(8psc3BL9D;CM;Iz)v4F&1fhR2`#gIKJq*nm9iO?&it&i~U{bJ`jx
zGLkh3oSt=d8>Z&W@YKDgn63(fS?q4ric_qcK4Lmp>a*L|_UQF=<*Uc1g+#3>V1fvz
zpX=70yqXCtIh#|ruU5Sfh?{{e;XeK;sh1kv<gd(jC2{HTJJHd44kOm44!^uu`WO&c
zqhMEi_lKbOBay5Ae}q&v9!++w>S&H?GtxuZWPGOo6H*;+7Hhem)YRx36>rU5yXRS0
zvywUC#ehu)dc8$-Pf-vrPX*C>BCc{Lqt|c)AlRmbs<-jjtgFR~^e%Zyb*<fSr`5a_
zZh=x#4MZ>SQa%4^sMf|vzh1H%(yA&9o{IiYLlv%~au@3lPUk+P#b*t=KbE6S1aW(S
zdq!)4RnWWuorsN9mQ7RJ#xFSN?;fikP(9@PMcM^&hJbT~PVQzn{yP{X?BP}kluqLS
zUYtO~6A`|mOU*g6q$CR^%@^!To9;0HJ@gvgRszT%1jHQYz=Ew1E&uO>Ncan5l@B$k
zK&F6_q=Hj=!&VcnuJxJ|PP17zBreRP)$;pbKTr$C(9L7#OunLfYJ662Qa|p=3W~I6
z@z8!wf(JG9YAATbAWtY(OT0S>F#$13jAv4;6p)YDI4&-<gR`sqt@GC;L7~!2J>7O5
zs9*LCi)CY|!<i+teHA4vILFQ@xG*klI?CFRc5_{gHXETTOi6Q1Jln%ZkRsuc9e;L{
zAMzWM#Xp61$eyC={%^gAyvws7oD_*lcm{XXc;r5xUTQqL@RI$Ss~9E?N?GPez9G*^
zKwsjv#j2LsV9k?OwVJI)ZR@pK>ndRrcJT%Ui?m=;KGlGDiTD2pu|Q709N`ecmsAK6
zNC)iSd>~bezY4pK_2b)K+isFhci5;68}(tW)oRw+w%4h5yUjtr?)3T5XdN8}F%YL;
zMW5kq?B#-9w=L3c4cZnQ8M~n22VMBhBxcPd?QW~nXxo<6TwAX{eS8nP#Q(~1obgV>
zOZnY`K6iR{yVHRaZol0nus$`1wceo9sdbz6p$)syW_vhTTc3sXGc+<Nx-QD7dmaZ<
zQdS2c>OPaua|pszEuK8|!=iPS9lgWb+)^+wx<I;t2g4dqX7}ma-O=(0RK6Np-;!{#
zALv3U-2o<^g@(pdl!|lr+H*Zz!FZ3O2l0NMoE<q1=*wVHN5euzdm2`Zx+?Bz<3c-~
zQV0TC&0`~o_db1bdPIhRm7KZq72&MelCKOeJvH=h_8;-H`w_vwu=2+#3derfBDTVc
ziQ!76#3NM@P>FI9%><<sCkw!O9Y;3HD!(AWuIm9fL);cv3_(RY*I*e8A*gEXTCu&t
zbG-Ab6HQ5(Fu6FkRno_rfW%18>ZPg8v?0?wfAnrV?$B{r0^@LmwF2+Y=ss{oHlxiB
zN?P|+cIJoAy}O(#JIgvv?4I51**!Q+c3QPo9~>|}$98H~r|&d-{dT+GA1q^p`S@Nw
zC7Q|;h8vs%_Qbw<?SCt7Zc6O2tpWITHnGQkB=(B!==-{Y^9Lh&QdjcqdeW!h@+}Uf
z3$`1HyB*Rw{oOwuk3u2A3yfDlKp6r#zSCt659`eK9x%^b=m4UZewjbdp}Ha39>xs@
z5gFdQaKwkxbdI5bN7=%_H<7J?TLutwNxgoSF@n~_r^dH6b`2?{1cvdBe;C_(%L-xN
zu{vuC!>PkC5CsZ)J$ZvyHg!zh@fD41Lt~w@j<TmvGWINt@ycrhj+S=d0ty=d^>WaU
zNxL!yWr}|YZ%Wq3-Qlppr}9GOrop?jVaT!w$o3(89(ILMl|<GS1iY$i!B-9Wqu>El
zeKftx`{cR6q0tP$05HDLRX}DDO@5+1VL5W>jdFUMd`_!M6E5%cWJb@t0Sa3m=*E45
zc-C}k-CvD}cRjnQB>T5#yfW(2yd~eG;fj&=SJ*woZdIm3``P};gpVe=AzkhaJZl2m
z9ux*_iWdxLC?aWQfSWWO*p4+t3;cl%0cg)9C}J+6h?zkV){!(-B+8^ZB+*7epRl-s
zLj0pC^IzD6GMG(kOD?<2U?V0r+{vu3blc9MCG1J^!l<ATTb}S3vamQ#9@}2fKvnN3
zP=FN${-k^1F1+>SC?V0#z#%qpIa`$B{O6A6<9Abb`RLfacF|(+V}soqP35bNCJuHO
z^BG>sRA1Zb>aWmZS>(X?FmQ=-rCv|eU&%<IZ5Pm6r+->up=SS;`n4!VCDQ`bw}%le
znKeFj+>|e}vl=4ULs&<;w+=svAedm8qiIq^XgmY}N7+E=+vI(DTJJT$puT3-qi^+8
zw=_&SfMr52u~PK39fLt|ZJi=1(~QYQGMh9ieH!Z^uUgIM7=IlbvTolB&BKC@M(w0}
zNnaVsRtk2p*pz2?k(SKpVw!Q(%S^ezWG*nNcm#zOoLJRHevmM}Mr?Gcir!J{BPeb#
z)`hQ|87tX$t?R~%)~(lYYPiFI3ZQoYeVeghttV>B7A#m)g7JP19z5sc3jX@~eg^y7
z<l^y>*u=f17z->Y{!|x^W+Bn6@h2l*GxL-Z_UyxJ8US<-N64tR2Vl}_wD#-aFIA(F
z+2v#l;ZU?%3CEIbCK{x&o$OUq8d`Rj7jz>*GY94s&n#iQ&sa!U`ZjF{kj_d}t%SkO
z@z6uh>QXPIAmQ;&CSJt)7~g;h2!ZqwnGC7Xrv{zPDbk{p2$e1mPg=2*gEA;zRp^JP
zfhDJrOd^B~UZAlA;pEmLF3V_6ifa_@vhamWe!iCDv6jumpN;x{9S*SYU*J~yY){EQ
zthc;Kxxg=Zf-D#Kg$w)=2U8l52QWvtL}JJs^+La%kcRoodK&wv8x|<FEr^+WS(VtM
zM01IE%j`B5tW=qKBc&58-uYJnIup^_va{f%!n%c>mP$)c7gsq0SE-^BK3-Jq-M=3H
zs;Gu!ld6gHlWL`z`EXPtQ+~$U6AGTfl_RbGzyIsM{@>_SCm){|v@sAzEYZgQ{r^SB
zuDmvArc^LZPswaPg}KKKB-^ed2hp-P8Z>5uC&BSa;O)-99t~P7J^<vqSZ~y84JGZF
zKXUDR8ZcW>l|53i1~2?^K9ZyPv8VVDoc4(t;TlVKk)lRyYnkFdT;F5G!(C}cU_ln)
zFf#>HWSL0>9AXl)C}`EQGOemrcJqPU^;xb*;jfqBU@ueEmukCI+mE8QB`^NHV(E<g
ztrK-=a5Y3VfgjMH`LJ^qErf5x3q@7B1Ee}IswBLyPjRUzzTg#JSmM#6<z4a%Pe7rS
z+HbRKm<*-fU=(TC=*4|5o_aM~X(`*pI<|ZY>9?#Ju|Vm;M6-|%P*q&`r-932t7L@s
z<;h^>OFI1X`_x?m5DcD1SXBgMaR#0|nr&Fw1U!e=A|I}*h)A4^#YApgWjXPZkt*pS
zqf>Lpy<;M4vP@K^*G6RW<gPi1LMkU;Xvv_L*%_k&bt$=%?lc*Yk%=WvfQXmkMAiTw
zB-PF*-p^>Ho%xPG2XNv7yEB+-D`=}VexN2>{tpBHfSv?_n}OEFnt=YfcCRh^N2Z$%
zU(!#bwL9!es*`H}8U0L!7N=98bi=W89dL#G!M)hb?5Spled7d_$<zaX1qUHN^du$d
zC5KjxZmnriD;AY?0liY+(Ipj(@D^o0q!bi76|3;M=n_JGK}7?;7qzs3_!72OBUlX@
z48uaG9ipW(^oiL@b%8Z`$<smKqb?8UH<p|H?KfZ-_>1M33v!d4r}CGp8c=5}7fm2E
z8%+5AG=Y8+yRsWV7mBR#Ktq3;)sW{quz`dE?_4r+GJC_@JCi63?Gf)I-f5>)#w}<f
zctYq}9)Pcyx}<s84e!e|ViP}y+f~odW)WYsms+wj*6I&@p-%d|qh<3$Vx3+POuQ-|
zEK^4^bsfaI#OkSTR41y*$Jba-^AZhGkb{AIOq*mr!h+|$Ckx*k;I)e={m-N7g79`y
z$^e<X$6RWOb!&+Y9SY+TnH0%qeomCNw-|tQK~pP&1a_H^ETn>rG0HYSMTg66(M4j9
zv~cssY4nj?(`wc5t&~bp(2<2MVG}EMj{FZ=k545hXZV+DTN$OlT)3IU+vw?fqASU*
zX8L8a;pnp&n@q))F{-n0v#H#kDz=ufteu&9`$c+%c*wdOpESK>mHBN@7`wX>5|JKy
zX;rYM^MI5Ovrl~DQFUhi1h%AMSe?90+XWOq;$&3CEZPEfsg=1gC9DY;P${f&zg=-*
zrB&0yx+PMTaCt#-iis(uY7@>S<)vw3E9Htp<(N1vmM3<y@O-aE!<-mtJedaX7eb<?
zOD7hPJU6_Cn?Gge$PmAJrua!;f9c-m+_a?X-1V(|!}Wk#E_9Q{2S7EJwG=~IfQbK%
z+(&6q!P0U?J95S1bYW@g^T53evwN)EfbJ%s{jzuLk^S=(99|acF@By;;Cj>-eG-aC
z#*Ah_UJ}=V3@uoV;%ZQ`qU7|<tOd5;=+jaI1=XcmlWC<BmG|hSI(q<hhUwY>oK77-
zigtlLkUN%XIc6kKwM{v4nU*IkHlMOl<lm>G*3DJby1A-aH=l`GPr(n_PEczrHv^9V
z>@F&)HujdZ6oh>^22bnM9nhROFWgA*P{8vHhmdglwAP-uHY*_s?N^z#Huh6ytz9B(
zZDYe(YvXygv@_N|t^7yNE+?%F_0G;l8=o7Vi8h!I*e5oXlvbUwt61X0#seg!&HP50
zlvbujnUuCnN~`)QlhVG>q_mAqC8cewHz{png`~8px&@Y$=b4n&;wLz~iN^LO=I-9U
z{4|-a)-03Nt|eLR3G5(YM~27TqajGdFR;T6Xnt>acqLBO)(Gby2y-6>>>}YdrL)av
zL6Q6Usie70B{)7B!HmnoqMP?tJ@za4aj2q`!_O4|hEn`fdud!A9Qc5<i9EYS5190H
z$jm;V@-TiOx>sy==Au`JW;fQ%@NJ;H;q#mea9*ToS;^4#Fko7wPK_IsrhVgNX55g`
zggR=*zURX6O@x~sj;!lz_Q$<3_vUD^qOmei{@B;X);<5C1M>|<(fvD^2k<pGjL}b2
zY0PY-1iX$;n1M(FgJ*YwkvPB@IbojITi0i)JA!@XIV7=W9s}h8v-(CNg~&M}tse$e
zAIkQKhs=gkPE%c}icrGi$1uzt4eO0IM+VggZpJ?<yTAVq@KEr_!XGE+r{BNt?)}6v
zrodrXS^TZ%qzg-v!~%$4AswM^?<Wc|!ACf;smU}dJ>%%ZUb+?dylBH@jlhR9n&=p3
z*o4xw9GQh>bg(givV?e*h%Ed2V#s?E!UiYcba)Ibb7%-ET!H9-;RZhrHk(+xd(roz
znt#qB4{%RZ>eZog{0r_JD6*hLnCE!3om3nh9tTI{Nx`Hl>U-}Ji-M&yBFxDdOW^sI
zEq78dAT(>BX*}^hor+Rzlb~GtZc5-^&!+5qc47XKUGxlWMm|-2XBUl@x?n(HF@<hm
zsb4_3s|$hYAED?l(qo<qV&T`N@^ABn5sd%W*JR4b>rZK7dm0#idU0c^DZ#5;fL#lK
z6C-TCuIvclyXUBpcaCl?7f`|@qHJ%<Q<EOY>|W``lKm*uJ8dO2u4PrErQUh~Lxz>;
zgA_^sXb#qXG;*aflqa`aiN^SX;ZNCt;RrV`bWcT&VLbTaUfE>A#+>yHa4kS%cIJR~
zPGE@v{m&H3j&7si8lm^9v)jEe>)oDes^~kj+0^|O+jD-fCg9J!E<B^GHqI%fE|Xq$
zx1cmE;Ug#SQwu&v8)3dyu^1{8M%L$P?Qkza#fY|&Ra(IU`13`{F4g6!c5?QR1dA)*
z0<_|pwAMo|1#>1Jm0lk1<q1!ExcSd^_2i$L;KZ;_7m(5+kvNu`g?tBELn!D|SoJ_9
zosVJ@QN-b}^nsQ)TRI|SYLt$M$8<#GscHF7NvD5Tn6QPR_?+9VU#@X|c_o!Jx@YRB
zby*Q|?eO|z37atU?DMO)xdzR=E%y9Ijy=Co+Vj_K&p!vG8*$Fri9dMRw)`af376SR
zu;n*0wR&>+FTj@1!CPP&XJQd$IT40MYL-`+D#6C@88ATmYrtZ0ff?)?s-Bz~JSGIi
zkwIG^JR^2|7M}rJ6`-$*7}}v#k*4|${Sa&WRBBsD_R8jVuvIg)F}x4y!VKIYl@1NO
z4xu(!$D^%<)_Ke@nG9F6S4FG1c$-W*jzKNBQ8t#JG77Z;DCWrit1>6E{-WWR_6noD
zVhpvgPgY=q2LPk^;6yGtkC$FVB`J8^8On!059BeR%!K_1H;uWctP&B0R^WeT77tmK
zmyc+YQ6UXc=QR~H6itXbN8(e5>CY=AMJ}nZp+`-_)LuC*Vkp6IPGl;jC`oS~IrpIN
zT)Xm_T?1w_=rZRUXiq%dGlV6tjWY`02n_ZS`O`_dzmixa#vBWHK#l;om?;+wtQvhd
z6pg4De-N9}lpiC!L(Q^>2H@R`5wng{%F?BZcJ<m&bXIDsbefb-lhSEYI!#Ka3EfPU
zPLoWxl+O7_+hzf$1`9p9ItLeeYFT)22@g=*?V&uE&^s&(j%vHrm7ONZ<0%}?9@=Tr
zSkY;s7{ba<lVT^=%{WaoEeE{W(rF@7qjZ{-PLr*7n&>L2Rh=eFT7;Hxon(zDx}Z?p
zbyBp=HR$JUah)`CTqn)ab+Q)M$tjvMi2=YraGsEF%r1CkAqa5fUxQFmi|Whvqa=Be
zSCm<BYyBwAOhum@{#N->P9o<C7*AO?__tg-3@ROXMV{VaxUs;W0w{Gu2ul^J0IZf?
zVc<6uppFNIb`%T?Tr(J_W;~f;9DQ<Y0S>^Ss~yS=M!&nCSg_vt@XaY+upnr8*K(s^
zcne{kGGdY)_FcexG1LijmaM^%!agM~P#OP9<H%573VZYR786&1$u(Xup7w^l!>f!V
z-vZP7e;Szjf_3|H$4KYMp+Wy$?>~*oB|s*@?Lu?3?i}0v4{Fk<p#@L95fB}pB7Hgj
zhW%|@;l#z~HPJb-MzVgLlUa>^MUWG~9Ygo}awm~m=ggXdqb-aYL!Be|=nB<RC3?P>
zs26LS<JLuL_t0#eZ2WWc%RbLA9_#yp#&9g}aE7CvE1X)NX7*yg7B8T1ZH078hVfya
z!yj-}g{7D)f#qkw-_W_h(w>~0RgI4%n2%-{D1DA@g>c~2>>(!U$}r5_8H8!t*;k^B
z&AWdE3q~SBtLO>5<9>js_sJh+o0ssjpjrBQ@3V<5vxj?o>W+Up`}KSda`J82-qUaF
z?q)Rq>&3B;OLSK2dgG|`Z!n+ZLUXySDn!9hSuCs>XYnkpv9!|IsNBPeh6hwS3zwz+
zQW+Fc2C=J5S$aWMmU%QUb;uLeA#eQg!1cryfm#5<Z4Or#EVi&Sht_bv#Z(Hf7pW9^
zJ0iNz^7F;DPkJ%5rq@@v0?LbG)%amg!Lc%*vi_fOkNG<nft~>VoXlsJUc7hWlVJkQ
z*oUHpwz|R9GIVe=AAWMtsV3)G|8k&ttaUdqqnLa%@B?w&`MA6r_%iMWR@XnU#9^f(
zb_;te4vMu4RNCk*$76OLe0yurL-snaIkr2E7jl)6Da!&k^4`ry6xWn}C9k?RtN{IU
zT^B3Y*R60BDA2d4PG$!)WbS$2{1l6DdFOMB;R{KtFjzz%8otn65x$@p!piW4Vg}>Q
zz!x+P_Pp5=z93VhgfEovg{_A#=qjnD;R~yJVwM0fWQ{3oqFEfkP_)f8Xy|PLFtl<2
z46PEtuzmmorX-%CjSWwDc(VzUi223^vBuOw=#Ix=K7v^Qe;}9&!DA2@Lw7`8HohUr
zs=T7ip<9b@Xl1Sh$>DF`J<$kt;3nV>;1nl9l;$W(P&$+*i^&ss((&H_?-H^*XaU~6
zhJsY2I0ynO(z6SO^ScKhF-CmEgfK?sm091T^$=Xao<Zp;8T**;iYFfkZtyzegqnzH
z&`Gd@?;EuHV`K(^USMxI&H^v54Z&(3OkA7Zh7&<0SA<Wn;}<-|kp*m^bUdgN{3&8O
zV)R-WRDs?L{1(4;DuT;loW(lxDQpaL5y~B%-J}mS;Sl{m#se}1=NjgWN;rh1cd{o=
za)h!H0lItk!B&*;y~_1N|Iy{nAKw0ti$6pklfy2GZzV!7N)8jLP3ANC`;9MZ2^R{E
zTU^`3FZ{y?K13-#biv>|1<!Hl{a4X;Ir`?(_#=~xc=;76U6k5siXRi;xFu*F)l*Y_
z4=<<7%oXDd`OB}OnP0<%eFXhKbtp&x)0ghha1v+G-VD=;go9Ge8uLesgdm@$BZ>@@
z=9{Zaz%ipI5cEjS+~fDL+$XwG(VBWjOu5(sS}dZ+iZsa?kx-{uRaPTq(sdhsQISiG
z5rFLlWXj3iNjC6GrJAFvly_C_W-)b2g;iw^U!b&-;uJ~IqhW6zaP?S-?bzGf=Q{6c
zE-p)sNmLI<vp~Kz=CJ5IZg`biYDSCB>O(AI>zUo8zDRFPR$UGYvd9Xn<2u&0s$yYS
zj?k%g_SQXj>s!up*Ko~ATyY|oUefu5KCh`;-}DvRjqv?KQqtG5BgtqxU(0N4fAWNI
zebU$%sBh^(6#@IDm0cX6o<K>)`gFPTSAZ)sq-44Q87Z#O3Sc@DeUgW~uv2l`$h}fD
zv7lSZb~5|LiLcYMaGn%>i#L<syJTBZ|27~cs)@~dE}=9trf%_sWRN6QF@stg$Ptm1
z%|QZ!zW49cWy%Z@@=u8Z)k1;NCH#3nKsT4@qTT7d5Co{CKc5;5RIT!#5+ZcL;`1!Q
zp^t<>7Ax^nW5A5<!&BnGMH`ut1q;!T@9CZ>6Q(z#Pmm2Ww#Cnq5lf(af=Xp_q*a0P
zNq7-JYaSXX-&zqUuNcD0K>1?Gqs;*2HIZMu*%Bxp)0+VH8>N8E^r@VaT+$?2)(Sv4
zsaYM*ZG43|v!*k!{j1lM5bGA1q~G{c1STbu{iym6u%~le1Uxc2XTAArEX7eq{ZR>&
z-+rLHu9DgSP<|E6-4gKmtdWLIw2H&$i?+E2y}d2)`F0L`zForSHwT}`a}7OPb2!I|
zN6n)z8zrCQNM2E9#H~fiw=<W4<nXr{B|jWl0GmU!x^J`GD==9IIFDoHEoKM6k_e24
zLrD@k&q42A6724SFC5d!uN>@8z6HZDH26s_%?5nwoWknSKRHA)t_817bp(73%ptrx
zheqXe@+0%3?){FA(lp+*C{$XBK{=hsuQ*JM!Za!&`ip1y8Q<2(w+WJi7h{iwclqpB
z+4swfglMxck{A?Iwk|t?)j%?+8b#}g9K9lBz@_&cU<3(rhSQuTXfF6iAKs@y*~Q_s
z1jt;I@bRE%dQI;=h1psaW~2;bmY(=fh*E-8NkC^6!zqMTMTDIg=mN}YEUZ=7Q(4@z
zdl~{m6@AsmUkVKt?{78^Q{7|epd?WWIeTjK)$HvPqp{Rm#tf`i440Lhhzttr;j1-B
zC^{2zW~wt1MKj5lO|C^C9;r)W*q5FH)+xF{5qW<c5!lqlnCQ^>;}o}c`|;`aa&f?g
zz)4pT11tquidHfezD=~Qi*pm@Gx2VT2K8`nsa7eD>nUR2o-*#OM17Iz#f_z=0}%20
z8sBp?F6@%)N&_$r&`51&w_uRPEw{2g#L>B60Xw#4W$eEfi24F_WZ(v%3T(1g%$M1G
zftW9$|DPJ_Vevxwl%Nk9EAX?#Ka^Oo5)1ZXS+K-{t&4<Pp$khaScwH&bI{bJ6Ac_l
z4~+$DuZRUx3}Iy~STX<FX0TwI{!QL&i3N-4%@PatRrc7Ah&A>0V<@r%;??E>{C76B
z4tNT#fXZo&1qeHUGsG0V!?io`o7UW*rYfbv)#a&a`A=z){H{P;3H;JIhgqpmSuYg}
zrmLhj5;S!ckM<I1u&l9$O|*-n!HTxI2F<-KXs}KW8mv>I!Pbuk`vB(XE3i1z3@ul;
zu66bH+vydkZ!bWQ@YNJ1;$=g^l5EK<%G|iMkg!hXYLFcMRwstFyeOjgsW-xCCZU8F
zC?Ocr)TUVifj=n-Z0Jw#tf^zrO=GYRPGN+ZfxTelWaNv*f&>3sq8+e50M%#otudVX
zV`DrY&D;rmGloN35lx0_02W%N1`JRGFyK?;A{=Dq$zyFvWc}D1`a&7kGz&_0n92#6
zhC1<-kiWwAGaMR@jHQRfypM^;5vmC+aie?V_#WiOwG-I~9rjdC^@`5@FoIJQh(?hz
za%_DiR|5+{M)ubTUX=RMK1UU$U$AtrBAi$ZJB6d*?qk~uNZ2Dq#>*5z;=v888C8|E
zOb(OwJ#67}=acu<^Y6mQQz`7&Tl!CeP)a(>^PH|lzbj__HOQ^=#-H3@_-wufyMKTa
z2P`o7n1w2K1J9?qo9`=%Hlysj5t(^Q7d}Q+%%~EpA@CFQ4UP_;Pr*5OWsOFazwTaM
ze*R14#~+9A^W)xMDt|fq^T`=(h+(A&UR5qHoj+Y(?x+9R`;X86>+<r;mp|>nfB#bX
zT>J40Ry~86c}3sv{RONzf{LFncfv*)L9pQE4gv^7_YhAI>-Rg<K!@oG#^(#+b`goH
zM)+A7i4dm<!!clo7L<{4=~ijaV#poA`*K>u*jRGm6(@06h2UTMqX(*xT7b?LjMqtc
zL3}Rs;SxyDO)ADPleLV6)JTL|Os^)I-`_Gl`vf)Y0*aR!cas`-vV_K!uwzHp&`5Sh
zWI#=eLVM3ZTQ3?&EUR-ks;8jeMZCj-52s?>`+~l^^cV)!4TkgIe!D-MP3J_l<E^HZ
zKB5EFkqo8zV$lpE8b<S%#D(TfGMmPN6P1%v82jK)!JdSjjCI1mgV#@w12Qag3_lFc
z@R3sSR<|`<@|vKAZ<t{rJ9NO?Z$ozkhZ0(3tzbk`8L5N5t2gQ|1gKc1Coa<yZ<4>l
z6}<o|Nz_;iCP^X2CDdl!P@AN40u1vH4Yld42(?iRVP&XIF~7xTpf;L*Bi?KYwUMb&
zLTyT@&DKM0bd}Twpf*L_eM^9AvPKs+(J2nDDca^5boI7?Yq~k$nr;cM*#x*|#8Q-A
zop|8dze2*lY%ood4S7YG`?eNL)6LZP$>DDmnC5f{gQO{a1H*#fr!=^d%kmolzGVyz
zj@^LJ$JPw&R$tNfZ%+vdfQy1dF*X6hVH|q%hNEg&>?NK8&ak0V`0rP84?}T6%ne3&
z!k9~eZ&<XAkvn#0hBa{Ebajsp0I1_h9dUS`V%j=%>VEeYtoek*%Iq7j$;iK>sgI4o
z0^T6h*niKfq1B&t7z0beLl-;rkqp7{>e=K+L&)Xb-Q7M|V!?_?MR9r%+y|BeHhx$h
z#wdTmLHFzZq;4I+S`B|*O`xe8uoGMXtq`OTT#fIqz^#Xl251>L%(+5v^}(u$Ag;R%
zs=L;M07AF+-}wB1M@4ds-H_1)80RbVi&-dj?AIvIGy8i8eq8q3SoDznDd@thO{_8d
z&G8L@a~L)h{u+A%Z0xZIH|{@>>m2siJ1_>1&?~oc4(3H+uOgSckr9_kIDaYqnd6tj
zQz{=x02r`y8dHE3y8wR@y!EF>`rY{)j_pJaal^hO`Po>iGZ9tf1lTHIt)<HRpL6f4
z@fM{oqX27!Luv%vfIH+uN-co$P~d<lN!P+3=oqL5eZ#Xo0wo>nq3W@*`+fI^MQy!?
zk0%>SJ<Dx{fBJN)YA*Yw)Gp6Ery2r~62usMB|=uhq;){@beju{FX)T9UJ9cWxqoBW
zhA_MpoA`Yco`j236hW!_G3jPa)c+i-5C0us1v6_p12oj<&tG;Iw*7^-y_arXh1TH1
zg#o$4VMRiFsU`#5%c{rKWZe{bp<?P;b-{Eb!k(eP9}{>zN`XpZz`Q60D%kx}R7!yO
zu*}})8oJ_hTf2lGjRtA4M4MUolgN+F(;)&qaE{R@{Ap$*N+;>th9Yl0M=D@_OBA3f
z6{TQq+;N@Y-fB!URs|1$YkTTmyB<{buFuI7_S-4sqcjyO;R}|+6vV!m>Z|(OiXq`D
z!@2>B+NRS+tD_O-VbC_c-YpZ&Pez)l7fDIeuIB@>6?W~dYc0=9eIeGAa#fS~lznPH
zL*K@LIO%08-HuB4#u{0$2xj(5rJ|Qux#c<3S%QrRT)QXvYxiW)+C5oq?Vc=NyC>VY
zcI&O$i`HxHm3oWT=qIrhi<MIV{FcjFoSm~+h4Yh1FJON8gcLo^%T63Y1LNO`X0y7=
zv_+GZ0}w2L05p%a0Du|AO8g(ALm6lA`2rg^5Nc43#ybXMr5AwevVwI(0PFo;HUzNS
zD<Oc77@qKn#v&|(Z51Y2Vx2C5fYj>_$5jgzypGF_`r8(|+(OqMhw>>sYP)*?%G)du
zFzHwYr{Y5c0lO;#0Tn}783<U+=eijnpr+58H(LS$Wonc_z!C_!^*}&fCAASC;9@WT
z62QN#(S%KOiv$0Pwz&q~ye+`LUJmfDR|5Yw0Q}=IdPK4p*bu((#EMBa<P~M^+gjjX
zFH^rKhyNlID^g4!7~Z4ERx=bEkuT9Q9P3_y`S9SzFn2Hl3>qabXW>m|3>6t=$rgF9
zR}GORdPjwtBN1t?VgLX__jyFFl`(Q)w?79*0ul-wDeibaHoQ6JVF+o3k-=ymFwPiI
z)rc^1h84ok&>H~_T(K%w)Tjggh~`h5cK;ViN0<o&z%ty|9+iyzBcZ=yu|G=bjH(*E
zVK$LGG)zEdIq3<d)P82YUZ=ho<`RjI#F|d6`>PT0u4gwD`BQtwtJI8$st@eQS`F7&
zJfY{)n&&8w*)~jMhCfnhFB<MgXf!6HT8_#^uF4!|rSMd;9{;4}i&T0e!wHVhW#o#?
zi97P}Ud8wRox03?0?T)RtNQVr2US=YsU#}@Hh=NpdB~V-`P3l)GsVxBsmnGOh+_j0
zMxJr%vXe1vA!lp#61IBEG!Fb-zw{Cca+F@er{^V92tr;8gKF_(>kIdKC9Mi@qJC(v
zS8qkHmtqJjd%cPo95&<i(lq$+W=pS^OpVg(ReHU)-s`2Sq&DI8DsIYK!V#7=z_5v4
zaYtCuHrJr8x5W|G&vAtHOGnuH9bxQ`D~vbuj%CEao9i#y6PDydUQuSht@VWUGj)D)
z_*<P%CUkUF#y;Lm1lYLYdt{FVp4b(sU@%|?yjCZcfnU)@6rh0_J_jBy+Tnd8mTG3e
zlFaa^8Z{*M6a&9Ha-HI-XOh7()|Q4wd;smc0lNliaK*tob&lgbj{3eXcN>e{5itWZ
zlGCR{VJZeAxrx^7@D0Y?@bNBMmm9es#H$vMp#93QuKkMC9e(*==Mt`AK%YN(JkSW<
zIJBI9%me0p9K!Vbcj%X;36BOAPBt(LSo!8~D5fDxVe;`Fsc1@-SOW7(VBUidjK^4r
zjl?xykz_)8lo-Wg&s^f3E4vtZxx*PJneRpX9W6-b<JlyP%O8GOGdqQL*W$@49yVPC
zzure3RJZT~7glKfYVOhYlO3oU3`rh<OMM9Lq}k!_6jnpfj8|-J+1*R{yCjjsnU+%q
z02h&IC3X$ckaO&?PhGh~^34rqL3-j~PGE#O#j2VgNU}oK7Zl}mKas&*(bwc_vX?sn
z6#5Zg7jG%*5PJ}p9I2D)Ig<IEX9r=HH+6CR>`#)EJkRtRik`2Y-eT?UYhVD^vuC&%
zzTxl<huz9${?9O>hV0xHuF*!j&U+p6eY5lq>?K`&M9ciTFP?%Ub))8(=n80@*U}w+
zWtiLn%?2v1R^hU$U_d@9+~dHi<_{~ZKYPy{Em3UcUK};*d9B~^I8hI~Kxd_kDp%lg
z1uj?M$4V(!uE6CAyd^L<{q54apm6Gqc@z>awGoRDb96%}Z~Yz`MAt1tbHJpbfl5iP
zGBk(r(nE8UskzG3T#Wh3xEuu#ch%+dznz>tWNI$4PL}~Wwiue2bn}9X^P!=M{S~2!
ziXp5FO)TaC-V8KR(*w_&Euo1rHA-k=2~FI3Xriu?+9Wh_DFnn4D8;O?hE4Q~qZEs_
zxdzR>Eht5^o&!@f>m^Qc{WwLR;S?u67!~hl))*afFCD0uVntpv#(`T4RivX=F9In7
zY%5sN9fDaM?At;f!dzOg3=!ac1pXmL%^3ODU^%`xgT-k`z}@_{N`E^-+~Ex}CcK44
z&oD((75&u5qlv+U4FQWs;FWezd@R7=jjemc6w;JgMtDz@e)86Gh!jx-{oS{|3tny7
z71myjIl3Jdyf&6}D~PggIldk2k3&X6!I~gUDYzk{(ZLv&sS!CK+-i6LowK06Q=8r3
zt!kK2pZDQlO2+;zsaY^Ont%#3mHh>$`%u)bO;$xk@;}b#_>2oN8|#2RQXB(fO7j4S
z=u08I$m!%g_!sg(i$>amA_p(eiV7jY13psPGDjkKG;m-kU_n$djE8@@6Y`prLW3q$
zP?nB!s&<w4z~+HgX<&A(a+GwcC>SAlM+(N?uGd*adU<9j-3x(9KZ05V1O}*9<M2=d
zm>gjWx@7DQ+>_FxuJ@lfLA(&1ADjP?IX|>coQ1MLWTzg0I(X&;iEhhgt;lX-&50|L
zsVe|=381|A7&(kA0f$^>XmU1(oRKMduV@0{gDJSE0?f8_8VD(yKoWHp^&*|&09h`b
zeE=%U{K7n&$y@{pNRTE{_mN;`)Hxh!<Rp>|1)c3vLj|1hbCnwR!89(L2(E7zVg6(V
z`=84ySZ)0(^T%@9RV$z0Lgl)0M!&_n^=wJqT4Z2K)v6wsA{*gLQ>~AwE(Izm2K}L6
zAiir3l_T5xFsP3k4ClZ7c7HgV!pTD3JXIyZzVvdYNPeW6q38j;z3^w&C^bjWekJ};
z%$M$5<xNg5yyrhaJA#=DKNuS$9t+FFJY^KE=O0Dud7*!vY+{~vr%{I7667dDZauw_
zTO|NUlTZqck$hCfCR-H%lyaY-<KUqoKxWJlwFCx8If|80Kt-J^o52BTJGgkmB@#%c
zMu`L}kw9CI1kzVj8^8i-`2Cgu{A3O(Y$G``9mr4dR@b7Yw+8lO=D~i<685vP@MNC=
zKLgML=j!b@*i6mnEWL2-kC`EJG8=9$_Q%ZD`bh$8b)Yg5%7Za<F)<I?-e^#=ITsnk
z<#3S#!}Klu8-P*UzA?a6a()9P&wLjw-P9oOk>e>C1Obvm-Ipv0&<vbWu4j+t&=ve%
z75*AljqBfB@Kf7kuyhZs8T&f*FCdW-)f4$}(Lv!RI&K-)@FkB0Cj%T2>n=i=04fCF
zB5aT5&#^oP9>RjVP+1UGBpgCC5(}aR^Mx0VDewqzQ3m+3u4!})J_FQeJGMrE)FtR}
zWbML(L}s29!9c%~J0nt4#;t3K_wQg#LX$<lgUtp=LqJq;<Bu=`O@oI<W3)b<z@uHc
zPrE!uS~!as_zqYDgA{>uK|`1YYTtmFJz&ru7UT|QVTAkw9Ch!{fz5FGW*qnelz;{?
zFph{punW)Nn7#{ag#RET;lIF2_zy7CF7+N^ZR(Dku>d?h5!nq~So{$U_O`L;FNZYz
z3;$ZCR~LN7f}Zgr=TvzjeM5pq*eOnyqz72`MT2|L0vWJL6kIHNjc(nYPu^G0zw@G}
z;CiEBV%~ZIS{$U-Xhts9O7a4GY}8dwAar2G!`oD)=BnAAufLIdl?x1?99>hK;ki45
z1${cIateJUuoi$WkRBn?P|!qI{{bq>Kz)2TBEuO%`Q#umswvH$)&ZH_5l}o8oZOJV
z_Kf}g*mQ?s*|g?-$$4khBo}6qAaYzN1+_3a5?~${1(^zqoWVkO4g*(2lTr~q6}t!{
z7O^-*WaQsbw5JCO71SEO3Dt~TJB%$9`}8YSVT={TLrW>fDd&EQ$%~3$p|qr4%7h9_
z@jzX&+`wLfIe2D#J;jA1{i!Gp7V8-eUKFRLlE>qjti(t_D&Q@?dk2((g(-^6$84FA
z+@Oi_bFC4@GvjTrhNC9l`O`7z@2DXWB5+Es$+wV2cK`Yxm+-TX+V=`}@5)w>-Qn;8
zoOH1c!n3ej6nn9I05Sr*TWfT%OX-sy*1sHP^b-T_&4FTc!Bapm;$qBM9oL;W&_ZJQ
z)q=Z)Dl3S6OwwfGhlI|Imy9%N)T1Of#A_@PalumY8VP0>g?I)$Or3^&{RS-JQUf5n
z@=}06hBc~sNxvs2znVGqSxokr$d$*46|1@DI85z1VhS<7_=KSzF^nb1c?Baz?H_#k
z)7~EuC}m1mDcC&*<O<KHi=(FQ?d>NRjw?|1p~Pt*e_w=A>@v1Qp?*1BuA7VpQ>`vq
zI0{oiUSl#RB+0bP)B5Rc8c~4OpgrI~8LHPMNfp-L+rUm!L#{Wx@k|Q-a}oaH3gAJ-
z^+|5T*QqSZ?R>eNFSqlW+xg^1zQ`7S;py{XHuLLQh__}NF97HT!%(V&O)Ajos(6(}
zVp4`v87?0(@m1S6dAk-d0uD^tyrI>WRSkQUhLH;l`C6i0KEdOoBx&-2J_mBYeo%d{
z%u8Ly(|kxoedO7D9+-O2HsDZqjy&fL%Yc*ta(|C0)2-15@I9ebdaclUv!0#Jy4|gp
z(0W0R5?WtE>z{3G%@yt-eERtQA)}Croluec8c_PNsf0VOha^+D!z(~1T6ZmkDsO5$
zK&aLf*bQM`4}Md_T=k}gY80#A)F=pr+t5u7T{t3dxV)($Q=`18QQp+p{+k-wifRKl
zHC6#-E^~#$%)M-3E^&pUaI0(4-&=Eqqmg%oqfuVrSpOA{kFY^v4??bZ>32688Nw#>
z-}c_!Xk@PgNdj!^-3=}vekc$T(jF!Q#bR`COz}_j>e!ZNaFq$aPpp9pCnjuW9+2UD
zL~lv(1oEp!GW{sNdFJDkxU?g`01wnYy1`dbHWK7@TwYiUc0Unj4MWE{j>w4$o|v&4
zP&5jSg(<yaexhUnWj@spq1O25kH`@ezxG%_QoW3;;?c#_@`8!a<SC37heY>$;mC{-
z<Ga6J7)PHjemVVka`8VAr+fZC&oAD7Fe;I>itsrgw)BF}FW@uWLo{!Jsx)}r(Zt>V
zmCWAwQ?juBUGr{23pgNvqoEtz&^)jF_Kn5dX}fY@Gj_kI$Q;F{U@s?BUg#xVe^Tqr
z?3u}&nJWjSl&FP2Pae8jid-pjk0x@HrzUbwCi`gun#<582^5A5xj+@V3<M;3Z!G<V
zg&>P~2iA_b$S4*NI84Ci0n5Di@6=`H6WCeOrRaFh%>mfth51Wf`M3EyAK<3zYcgfz
z@~JnXjA8ifV;F8p;6f>}=|crAG|g6ttPtcVkrgGfVr66nuBVTMt|;B%58)0^+7Hok
z_TcXD#;Wdc)hJeXhZnRiZpa<3YvJV$m+o+x8l^kDbcb)hJ6u~)ZNMGAikW{IcX%V$
zaot$L9bUNAwdn7yafdha+~LjA9lm~dcyu%4>e#>Y5O@+?4er5xbaM8>-Qvv*p_BP=
zd)?yA?DZf?fNgb)Tb_^M_^4+aBlpqZfCF-4-MT)#xEPQbhM+SnDXtv`XF^vjGy#tC
znZX>I0frQykqB78gad~Qn+WrVUl~sQvEczU?BvX_*fE#{`^L%4AOQl!z_E$FGB9H)
zjeX@0g?~QmR@DG0!BY=>afYsVFhpYb3K31PO4r%p$O6Y3x=XpgpM0|kq45qaOoeLA
zM{=w__)ep}qAOnt?uZyS$z6x&H;h7nQ4e9=|KtT2m*V7Xb#Hzu;$T|@^7}374)#V0
zX@S08^}EZRuy(W+ks}FSQt-b}qr_pJV;RwhJ|jgeL9?|enBXxPQcq57-aWi(I!dr)
zRu(`k^_o}alTsw~AP*Iih!nEFuZR<(&SIBI?u8y)naqji-2ku&pyOuu(T#aUj4nk?
z3*iis{6o<d-+0D2xuv7qYtfi>dtKp~w{+VRGx;;j1(!!UaY86FCyo`SL*&nwn7&sF
zf;c^md0Iz0I~WNxzF@|q>)s3JN`y~i%b+UoWH^%L1XLq&vMjHmHeDf(*NOssxC~=t
z@P!oiV?A+|HXEPoA=J%e&FW^NrEWCXFs*&o!Hl}<sN}k5r#vU{I#inr6s7>DFy+V<
z9Sa$f+OERp)}GS?X1HBtdsrtzwJ>(Y&%EZEmY!6>y9}dAZ+_Cz)m(6YPmM~}a!W(0
z7TP&5j7&wT$hAH!N^5_5lGKF9f?TLX20=xh<65X;_Kbt@_Xu_~f-_d?BoiGME<F{k
z<DwjWJ{4hC5w`_cQ)biZV#ZU2XGyNt+3UB0F{@E`p>-|>62Vd-YgidPI!ak^E&MB5
z1L>a}KMTJ<QqZAw1DRU+NTv^PlAMoAFw+}>s>uYStcLknxCCzxnCbb2k9qqIOg#WY
zT|aWES;l<{$x)({N_0}<r;PiuU2$JZ{MJL@w~~%7bn!emeyh1EeoHlq)$v;e-C!HS
zZ|S-sdBY`sOQuGN-zxE2+mGMUR#Y3nZ>{LtT?WF{%mrIDmw<2;Zgnjxd}|<Ftvm=<
ztAubpB!nxpZ@zFOS1UvIWOm$MBv&hYWk?cW`;lDkkR}N9=Hmfa^1)B<`1Tw*PUL)r
zwGI3p0-gnbQB)TCK5SA6_P~-K_%^r-;0=`;3!E9@`Zj0l8}qhO_cjAoA!;iEB2@&!
z3j9;;J?_jB-V*s`qy2yEtqpb+$2sA`%mx*(aV#3e`jJ@A5{Q*BOV<o^?HS@aI@ZDm
zg#Nue%*uG`IIB!@aEB7}#2PHO0i%m}^XVw0OOjM+$M(BVM;RVz?z2<ob%+ljY~$5o
z+6xIn1n^C8L#7<msiDyk2~V!%ZiXlCWl&xIsEUC^)&mX692RqN^7)D(&)AzSM4hoB
z5&noamgLV3!7SpQX)%osV}<z3RB4(5T}tGYDjp6=k<BX#ECP(OARP)9taxS=IXZ`t
zcBdzqY;mxkg-UacShuCMXbC%7r1SG8S7!;3W;s3ePih&+8*R?2P;j7+xiaL9RCl2$
z0fG+#OXaObYWXk)CS7VNlvlzKfwrNwFk=;z*1xQkZ)0m72uT`RmIN&dc^4VZkaB|k
zVWAA+iV~tM5riunt{CpK(woan(4uOmmWLY5feI?fx&SelH5f@3sI;QyfOLV7YaLSI
zJbfA1)9g8p14S2+FM-O$j<7s)JUrS*5`eh?`m?An+1Skbext1b=bt!>k%_y1-Bkyz
z<2mv2QHrz$z$hj#p|vStD9gpzP)Taz)4C{$Ukb*l;0lK6jFe&m#ThlmFr6j55>udI
zn!}w1;pHyGo(pV2b*0C8X3gek*V{R|wcIj0U-(nPD^ouuymEC=7gJ~jAYJd~qtW6t
zRn>L%ivG2(<XLO$Rk)%R!NG-f)`EsBgtU%lLCa2Xw}~8RWm3HoTv-^Y0Pa8wuLtOO
zB&j=cp+_?GjdFP8qk$`vzGw8hJ~+6twJNw$HHy{2l?6T18v<AAq62utCAd<iMhUJg
z!Ij$&uGCgk8wFRc3&F7r-m;a8jBG7|w=CT1TD1Ds;4RyEc*}N)w_HEoGC+ZxP`o8Z
z^tzg10;M6DUReYG7XB2rt``ovY-b3d%#+&-x@>2!7)b(bE9f%3Yc1aopfT`-!~iT3
zMFzl;HhcrvT*3&#AC_UZYv5d*gLqId-h{>>*uV77Mg&nL=-Xte>X@|ye1z1DK|@zq
z)2Ve2fX@Jnf%9^LInFROOyHv%1i!^Rr0^XK?}vF<t<jv&FMF(d)wn}B9gU0$*uU7P
zSRslEMI<RL2fl!)73S^0*n1Nns-bXWLEc4p%=?n+G?>ysPT6V>ojAw$9vST$kym&G
zUE&Z{_F?G$7~DTD?UfVt*YzfIa9&8A0d8R_fS_@{W3bTu1nyo;?{<T9p#uchk`3R#
zW(^_nd>bTX9YEAcbVuZZ^MG+gSs?NdtQ~4vuh)NixHMz}7$s8XRb&_|1EQXK<ap}d
zM#=Wl5Vxpu7LxV+-m|0UXr7I~6G+$in+X4!mBLN|C5RmVV$!mm_9)-MD8pl4HB6X{
zdfYXicGnHkX`{^cI6<p;S5&wjJ}^oU3lutfGu`2^LIvk)M7-<SO(pE_9zws&YUHg9
z-%vMa!pjL|&@O~|0SSH}K#;;aw4`1kvBO4Cup)Fv^fCNdF(6E$M@xo>Sy#eKTIifE
z$4JOH(<it*1|WPka*{6vNkpbv7822kN{M)S5>X8MvFT)aNd@`Ss=4vf8aF33UZg^+
zapsqJJcX@@!*X$(sE?MoFxwxr!ck=wEaOozIv`oyDRGX$vr@*RO0h{9k7~7eRE;to
zRY;C99#t8S>Lo%ZaCh*K=#pqRvNn{^iZQ8_e(-rP^T)>kYH&vxwlh?r@@@+I8GoS8
zQW_pOu|l{3Q;beEt2?e|Q_{e0VCY^)8HLpyyq@}VoI9=3biV=iLhsGU4~TQZzqG(?
zld$g0rt{2FBj5iz0FPii336MR1esP4cB~I%cEh%d=LFNqstl#_XkP>79QfPK2~x?o
z$vZ1c*^WI$5UoTlB!gl$laCS)lCA65z+XB#C+Va>^ZbLObK0w-b5x^P9i3Cqg|Q)Y
zj;<StH(a7~WNMV?oD!Y0{pcKRMYSn(PC>WUGWeTzE>fnw1pcOQt83BQTZ6yp<l%2R
zCI03C@i#+|Gnn8KhqI7Lg&@kjxxF}?PWIZ6B*06?;cz%e7z%@l61z&j97x9~F*+qi
z=Sg97mPhD38t!0mzC2a1kk6MpVOb1v$6ARz%~YbVgq&Xq9D)kVlW?c&L3>iQfJ#?#
z?~!WBP$UW`w**642nZ5WlQpg+Fle)|p!ETR)&qig6i|>hBxqGY&?Aav5rIm;g7m~n
zi4t0uaFr7E2okj>P*FCdXlX!EHO@zR_@YojCDCvh0>SER0+EyufM_6#!Ad1mNfD@p
zsZyW1On;_ssWP^U_$gE8J?qqYB~&RQM+sFbp-PFL5~@@}l}e~m2~`s7c?nf|Vo;@|
z9|t`c4-Qr8tO`|9jbe4EQb8}zhM-Eio;Kca300D*Q9_kUsM7XBm9!PrGlnX4azRC%
zC7?=$TV0FZ-WsS<HxH`REul(lfhwK<{b!6UKkzU{`^Y#Z-o5b=2>rsN0d+HEOlG_7
zMIm*w)qauy+loT6gharjdjtJGG)hkZ`UeWw2AezsJpVHvZ;ONXi1~Ek$-oLQEh7!t
zWAJ7y5E0;L>PHJ^@Ly{xr%@acYYP4<!+}Zlt`WS%FEGI~fl#`@KsdJLMWJyfKF*2@
z%@fHEU4;Sww7`$jQ&AN&M80WMx%(M|1<k;&{S}r{aHGIjVFctG$dQXE7h(kHX}q0}
z(A_m~;iPwuV;Ng`I|)-#vT^y-Ys+(gW8ELjX#&Ur!Ojn0Qodqpt9$TZP05`#8W~g6
zAzC4Mj$w|$<CfM)l>Xd54?RAP(R?jocz&IaPlx9-CkXcz;G%2t42$n^hG2N?Ha~)Z
zMDE4cpy7D##T)+U13Z%PLi_dTg=pyY9H>NnrXsr}>~L@cM4>~6#;;_Ce9lg`{FMwN
zKnw%s3pq4)fkrNIcICHHCLM`VCli*xQ+mrN3NI4lJfGSp6C^&R{h{1B`8x};nI$Op
zC&P61jQxF@Xb*l>LlamcDbXpV=bzJiuPXBZ3;!cGCq9p5V}m)mz2-TmnC}-F$}9`q
z0A+(2NUFMYG>gjaD|*Q2rfTDrf<5@GQ0<=T-BQzH-q2a_{JTne4%FXKr25JjB6L^X
z1p82wJZD6PGao>hQzPV)Sb3U1XCWQAKR+a-ByVHu+m%18EaZScsl@$<g`7~0$#o3V
zvxsi5(tV7h3o?dTUDT??g<<dEr%23_U-UwjG}L!iw<%<a`CM|msMZ7&{j6KPSr><G
z(NA_lKEf?F#l(?g7z)0)->BRCgl$mRI5Mt{$6V{`A^`J&gMxG9IY9W?)F0`(;8{d~
zynFsnF;|7q70)p6!l#e#ACgirU0Q%#pQb7{T2JJK<fHOR{K|f&<VhXRs1NRE>aOZ%
zQjKDDKU2YT{D%BYy0#SFaOr1~sZsiwN<Y)~`<b*A)zW^Z)y+!F_?Ei4UZCz0zNNyg
zu0>aGjc=)!=UeKPzNJn0md-GUJct;u>CA_{`U`h4^)f_F=DzK9G4--Fev$y&>SD6N
zLUkQER3=<3Fb$FucQ(oXB}~NtE*)T2=q}Bb0Ci!a@TdW97HAw?5&V9<@G1>>4*11B
zq_6{HH-J8%*GPDw*r$1ii@0%wtQ&9mU~ydX8jDIHSc~^2<)G;b2hGQM=%5jgXtwTD
z4W-wD*B1Vfx1JNVhZPd<!}>6=3qKtHAx%7<=hMkB+pBsDCj6)?d-<*(>`%(vFI&46
zMt=GAaWJC_{7{}gd=mGENCT#T9b{MWtg5zjzx$`-CEXnBq@FZm3BN~SdWHQ{5G#DQ
zfKt);mL^jMi8TBx@e0(z@<%MTpYHjg@kg+d-^}(^9Doi)R#Eg*st`VkN+rf16;8ZK
zOv-#Tin(y4o=??0_b-QO3ddb7$)PHyM9t3&CMD*MIyrkoBdOAuocA!jQ8g@^c$sQx
z-QJttap}8xBEFl20Y9Fb1Lv3wi5HN!w-()!l^z^@zeHR^lzyB%dL`9n>B`yG=*Gzt
zF`fk<+?CT?)s>?f#p<q{g6HK8xpH)E7QErol_OK5bmf$;ob7kzXe+8!T{*=~OUrn0
zdbz%q-Vz?1!mX}FMQ@D<r=RD+>6adyHF|Kkcl6|pxp2<Ge*D6HH~kDDllg9YeK-AV
z6`v%)w)$=?=>kvy@_^<-mTi4wbT3WtW^CKIv6CCy$&GE>wr%^ywr$(CZCf|{d;hy%
zcF)dy=+jeEea`gsJYD_tRMk2TiL;?B@kyB=N#(=Zee7<uLc4LF#>GYrKVm`2H?bWe
z-1Gu?P6bou&SUVpfD}k>LQi!^xv-My;VOjtz9AebkR9SH`*1Bhy2GOg&VlyRTM!Wh
zE%BxE<KA3NJiXe|qKi4p<w4@m+H=j>SnZL1H+jr*<qLipFJ$cydP<qU^ZJQ7%fs!N
z4emO#0OTJ?xgz}x2|uBm?bNrkB7~t0zhWHfRGD4M_)C?;!=+ZX%u&selW4<ZQDCvK
zg|)7#`gM3~!WX31%b2>=i{w>sO1g<lkgX~0jMUcUrmU^HL)GVgnaOVznaK);DqBtZ
zw(Q+_3ys%5!?^S^lYq^yMMn$G9pA-<mIBS?Chaed&S;DFTr02}1_MocfKjXb^vFWD
zOQgNhS+XwlhGh``u$XMp&O%!|T<3lCZsZ3>PM`7ZZ=2?SRH|Q-agekJn%4sHueDOI
zpk1I5_b2JtZJnCLiH`=x!i$>RH029oh0b9Hm=9VR<|!7*6yLmU@2t;tMa|mGXINdd
zZWx_xD&?JW#K6%&$LNy(Y)ztZ5U+q#of3NMDzZeI@EGV8SUO0j4nj#mejc?QX6+hh
z-uDh!gR5@0y=4i=;dm>W>v4Zg{4Q?d=C)U9h*J|*Zbq)xZx?;fRiKSJ3Ur7|$NlJ2
z53<f9uehExe!Egx1h@I@(Q5=zOjvo)U=+TM-(VIIp&&kPN%MMo6f_S-eMA_>0j0nK
zRm)HV*vO{YZ^0sBHF;BuZZug{pFps-`};fm_x*;#McLpF3%#4XRE|Fg++TJ5fl~MP
zI8uL~NzNGKfr_lzd`gD}QM0_*+p(qr*4uOZr~AeAS}&*yj9c}c%sM&bjjVxox;?(a
z0o{YRNI0A#sL`I@S&a}sdu$;z(h*6p{O}JEiv$`<S*!Dre(n(qVwura)(7~bAtnI}
z@FN(tL}lVwR!nW`W9I|1*V(FdnTEFH${Ck1^q14+aqKw6fgz^6sEgwnvng^2^iuuI
zY9NojQ>Wv{p8>yK?{@>l-Hczric2Fo2MK4QM>NnWu&~Q$uK@z6+L?QsMPXn&5XR(+
zrxR3TZzMThRWq;;OkTo2Stx&M61+=mJWI+PQz<7XzE9gP$BK(bFJJ<t&{BRu9H19U
zt4q?i8MezI#;EHGM5s#G=2@~eCN4b(!z5mGOI}#c71!@{NtW-4Q1GF^zTw`^s{@zQ
zTH=uXDz%w1c)>}Pl_b{;kO(Te-t|R&(4Dr5VIz7zn~flt*Y>LNamD@vuoiX|-+w2<
ziKz5FN$L$=H@Ht{dp1+um%ec(_|Q@l5Jo2sAMjLT#QwD=Gp#V!9WDMnTi)xT(tD7b
z!j+(*{7=6D5qEa|qiEGbwxa0<`czcYQF&bR^(Dz_zoZoj2h0zHJ2EEW-#$C-2QNk^
z#_&#PF9^t4OG7~Q?6~ne-RwB&)<s|KMeTSdf=>k*4Fzu8Ei25UoV6%JtMPGa)mCDP
zR)hF%Vl~zJU4ir9MeyLh0t?N0ovy3Fd*u6|^{kU3LX>PhYS4vs!eNbFS%BtnP%#X5
z%@xpC$FjFo%t_Oo*V?Z}So|fZiEDd@=;{TrNO5^lgL)nR>5^j!R?*?_?B$^B$N(4?
ztsA1<H<G&<6XRH&k4xkyx>iuk5{s6X%jeJ+mHVT@-@a7h<PyFWpJ0p<Z5py!6Sly&
z&@73U1RaTl;xl*MF(jD>z8uVit4~lOlu*&sOK*ni$y0Em@(NO)Kpu@`<dOgiD1w?v
zK`S&uQ&*e}SwVx^a?#g{RW`D=fcY*!xglJ`Cg{-^b7f^a({I4fJ|TNC24NFV%^f#=
z*+Ru*tt!E!eA2US(|_D*PqR|Q(q_A@C?qO%4QES@1oCy6(m~IvAK)p3SF&e$HsIGM
z3-luwm<IPC`G8+b*@&xWugf)7dH*D+Yc~%h_?}YV9$-B)Wsqz!Up0&=Wg5|;$6s_=
zdAjRCsp$^=OmKF&fo^Xd-Bmk<%llBf&cK%<@xl%JIN=K!U>`>Mx4zfE%$@Ab@l*;5
z_|r7*WN)v-5F&X^t!n(JR`732n%czuzGx2%ZnO%P7^2;JAO-v;=b$U&r`=ds8uvJu
zt8{#s63x@`z4%BBx`5JWp2<u8FXl)CmomH+VfjpZ;A<tWYl{>SA<GoB<P~b#5}`_a
z7B$V`!SSM^1JjLGVlM*8ncCSOtDi~4v-geC-fv_;HZ*u>8uq@v2M!4dd;g;(m|UuC
zC9ltWG4sa>^%Co3@UOe!wTfRJ0rf1YoDcyx?-<YL1s)0tqz}jxJO`fMs?n=3k6H#f
zT7kDP_XN+}QHlvmzX#hbzF?=k$ZAZDeFq_H>6|MNsxE1GB7l1xOIhuy?7&mf?q&~+
z?mHziBk_QVZ>X!p?^XA<V|s)q`$nn1kh{LXI)Nw0hw8?2z?kHb1yvb6SW$Q_oO=~%
zFV5o&_L9bE@$S?d34`(TgP`#d4RS?(1Pl=defQjUAD5AQC=6Oj=Ve~x8DFg6R44hV
zpF44GYgpj!zu~%&{BXtLB1)r(gvTS7grAFau+6S`goQ)vL<s{%>VB<1rjxNjN43B&
zSs|Cxp>ZU$L|^r1ldxRX88CH`ojeX>5wh1w!QM}*dwx;M#){;vjXF9nWmZi7D^5C$
z;O4|h4~-lV29$9pN9rQMDcN|iIDV8AVJFys0sfnufF-DG?812cvn+xResfil5o_o4
zqoW0FUa|29dv3Or(YXVeHqOaP8%qW!eT?b(f_jt`sNA5^Uk}fuZQ!I~@!u~7UTz>a
zP*zh@Yu=`M4W%UGu>hB&5btG=^PJcdr#olH95c0R%GE`c#74ehjlgM;+va>;%kXcV
z+FDS7b_(IcAG=%4v`w+p#~<Zm{5rmr#AIQevd*p+x8~GVRTpb1lks&W6PtP><U}kb
zAkg^Klq~CGjR$j&MCVs+;3<D1-~=G(<r-pO=AiVP9N3=P&QmHZ&NzDiU;5tuwkilf
zgiw)0Sb>5v;=~%HKtu=Jkg}^jAWcW~{-r;BkwmCsx@7VG(cY-X^@}%9X4sKzM9xlx
zJX}9a7u(*~{QEUPGL|HxuSmwwj1?6$#mJ5pV~I<b@e=)t+&Z=V&hz8neEcd8+)tbb
z`f&cK5f&YSy(B?WsANw_m4!2g<zT92&muTs8%b`+e{MJeeUM%8F~DP@Lj}j0`jQod
zy@@$zNEq{p<sQ@A{CdA&D>M376uka=cE@_TH7j2NaiaN3_3lFcYWC+<pau_zPQbsD
z_+lNrCYO`g`V^yJ_vC8|w}~ssV;?CG%vmWz@E$7Z0yC>c^Hi~k>|Z#Wa5(6f&k*2M
z{-CCTVj@+xabPB>RBt*+5gr0veDAenmW;-Vm(cVy9jud(lz^ttP0;4+SAPpe=+{iW
z0R2R3&Ac_&7wp5&f-AyF2saNgo=i}ufXaZJimyefGi)Q(06zb8obTHvicaZ!)gQ(V
zaRR=bRaioPdX8b|#|(jJuO)HpHTovlO=orNWoAF(lY$CK_>3Mf3)wpTDmffx8|$Wz
zfoQjj{|phod7M#LBzYaS5BD^9#a^glb>(;I#K7p>#ShxPWn1$(U;C~#xVxM8;(@(2
zCuoO5^X@H*_fdrP5Yu^ob8Nhd|F(T5_UfeA?Zi@cfE@(FklFP*f(#RdV@~!5hmRVL
z74`C8UqIIT3GG3jNq5b{L6jcIq8HFspwLhBp{v`9FzP=+Ko$q5`Ffp|xZCAVauyh<
z!_QU1#>A2!xhsdQqGSqPnmEAGggG;MB@qCFrocGa7-wYeh+gC{fTO!&Y(nz;h8@K@
zoL<opZ8C%xtm`w^k^^R}Qh;AuitCrqZ)YqQp11FN@pqYBd~eV9+wrn0_&iy&>Qec@
z9k(N5MWaKG&OvON!DlE}F<hG9QA(mP_2cA3k1<PktI3Eh9=MU7CQbFALMMx}u;l5}
zCkJjMPWG~)I&H%fRA?;eS`aRd%>{*3$~{@Hb)K$27j34HW743Vc;ak@a)Q>(5KUhc
zmE*ZOGB{BbmBvA)U-`B@79K#}&X8#oi-<!*#!T~)tQOJVjnX?Xj{yP=Zc`C54^#jf
z;X#Ig4K1Z*AP8KGuZhSdC)X~PSk<A4@8GstaB;IOvPwmQNvgpPnT>Rwj+nSN#9dHH
z6BF)WE4my=s_{52doUV67frkr9W@<mUzy)8v0WVy3){pM9=&08wx)8Xg%G{<PjF`d
z%XjN}-kRyWHOn?Q`<Mr^=HS{dyM><CHZ^1`kK-w<3H6rHbTxFXof)D<fMhf=9PAI+
z2ZFsyccKanO5&OBK&!1t&x%DKwcYhGBTzgn1M16JHMy+6k49>{3mxD5ND#i!2ilu~
zj#6}^@65a(;c?AIUQw|a#~0>KmCW~!Cx7UuS2Ss&gpncJpHT*9Yg_&E(cepaLN<3q
zN*W1&q)&;TQEHh2)DCYrAE=<wh#it;O}?x{b9gaqmfL4E9}>!(yE9KlT=k`cq!#0B
zpiEXn+52Q5^~r|CqXQu=Iz;pV#0)0A<?cm?Ej}ktdKqpEdDlP>y5u2MB0}I$2gw_y
zT+|)Ad0YDr!0bOCmoBF<*zKPlZ^%{hXZI$Kn)PUOcU=5?zOW?m(fEWUkbNE{^wSCQ
z^V9rp`1gP~6=}BEn}2G>-)|}dJ4*>`BGey@Rj9x{1|#p4l#~*xSGm%P=i*!jaXFef
zVGiW2B!<)X4K9K4xQSA+Gx3C#c?=xl>g6Ai{zDp~7ZYJme9DvP>|)kqnwWV^>ZZFc
zA$#7>Q_^CludCo5FETDS(GZzcbpb`5HBPl&gfR{h^D)FCc0Oc$WwT{o03q&~O}&7D
z!Fop1v%+b{ceUbQoRZ7>mJ)|X2P*}e>k5Vuct2i<>xv(ER~SQ+3uO?mNN6J_-~psI
z)MDr_<NG915RB`(gTZUESHwd|ds4)GI@qUq+q3)fL4=TaxwU1x*;zgLvht#e%GT&R
z)9R%P=4Q9TbGNhQzDG-pb`ro0lZ%d+g$i~w%*Ink9}@~`>%JFq8UO&9<Hx=vkk#h{
zALb)Xs~xusS326;PX5r>Z9Df}M|Zt{_+k*mv@c7F+&kpYv1UulF$}DeGq*RZ8N29r
zpsgIIg4;mb4){F1S)i!Lid|6UyluPOS2jSU*I#GyZ9T@)(sU5yp<Thm_d_%|+ptTb
zs_UTcBSEmLg{O^$UXE|*)u<mK;qpY2o_&dwhNqDgr!Zcu!eHkZ7eLtGn2%O8d!oS>
z?s+^ZiUBcj#G(@*ej3X&V3BDPi{0~{WYDyc*6%*e6D4O+uwwj&5$3c~3^jC6Z@dtA
zvUxpUDkB3iMMhL4W+-OQ1N5U#xb(9^tEr1$4nc-Em?y{BD9Z<N4~=3be}JUQ8L*S_
zxl>|bBxdSlAhXR}W9U6wd{ClZz%x+=u#AUp+T%G(5$h)LW@0+mdAC4sOkeNH_H8dl
zx39Dm{(fsXv41)p+BO8s|Lq*7^j6)HnL+f{wI19)TQG0S4DHl#zahWHdxqPZKFU+>
zKFfrgU&-i6@6dsj+Qo~`w?n}BC{g|hMJjhQ*L|g7UKymUz$7|DWeAid`c^m9r1(Ey
zJi4Z<=BYlhIezHef<GWXpnxX$XmBBX<O4Rr$06I(-o-A@{<~qg^f(1kn67{DxS(5T
zvJhU0XOMV(wdL}7^sT8=43h^0uqv8Me2r$eXa8}IGZ?Dh<0#Q)RM@_NCqnW*KSwqw
z{MRnkW&}h&ah6>DRf1eGMdh5(<=K1?VK;cvx$mv%n<rVY1QLWwm<$z-gn+t|9?R=|
zHt9!yA!ZFZj|+<&_e+KB?aJp)RH#BnS{`Vgk4Iv&V-L~#Z3{cr!m&??Xv)%N9ycKu
z+KN58zzY;g_t0okT9Fr_L@S9Glz@{Q_E$1ijfre5!w(a_Sz~By%zXx8Wao2{2MBgO
zj<{<gga2=ja7&!mT_rg=0eF95!h?r<3<tkIt0q-gair9LL6{swat!TT?iYhB@z3MZ
zYoWdVIJHu06mBjh8?9iG&9>DP(|nCsIB|utDra6E7Z}S6>`<!{J2;_i)iiueh5S$_
zaA#R>Gc(1sEX!#LoA#WbyP(^sc9<4hsdk(`*~(PSPfN1DOS<)d(QMQ5_=RwsTDK9i
zn+}){wydM$W{+q4H>=rao5%RT?$*j&!dA6pvOa;Pni5n_c+=f=vtrD9h`v1tIr6Zr
zUZF-0p6xjOT3W41d=52wKp_ak9#vz|7Js4_soku}F>~BC=tIiCCG@PDxA+Q2&E9@P
zUfsYr?vtd#p8}Nnwk?zzLX_4~i3)F3)(VadC|zqK7@}!nMo|lE1+-msk~^Fi*ft6!
zh6@)asfonLnwiDY+chDqQk-~3sg7%Zi<8Y#168ei!3Is(xFs%dXUi(F_3QybUXSW#
zOeyk?H-Obqa<KSj9l8g-&YnMk^ix)6TsMN$d3zw3{pnFe<nl;jPyH@K0^+!41o)hn
z&d)-|2R&X1R#1+GjIhR*2|F&}(I4)E=;vk-*gZH=l+E^ifa#m=hNsZfjGXQvKp{7^
z?u_hH(bo8Xg_*S$0I|bum&)!w-iE#^hyMoM!@gUlAk}BNJ`dDYNI9I2P5BVJh2c%1
zzL>rg;l~wJN(8dArg=dCj;4p=(nVyj&HN23x=(G+NzL&%G}YV;pRjGpTkmXiq{1w=
zU}W4QGJllQtu$?^G|$WW{LuaS5%lNngO79dgclZ<C4-ycx-n}nH8sH_cVb<!Uh@<)
z=UKlu<Vf=HKucKjcn&54Zze;PGYhvmkt}$iNm6XTu>kP%s>`Dxt|p+*g)3Q_CI%L%
z|C{D5Qo8;qbVDV>d02`Fce;X2EL}??QC^1-%g2r&QHsL{DAETwzCdwI{#K%th&jY|
z5j~8WY*3;UcPWuaiUS6!2SnJh<N-mLoi5Zz8}tvw%;)1Fpb?a5|J9(_3`Ai7JoiiW
zQ(!4))Z{v_3%K^~wn}?kDs1zZkEv5DlBQg!rd*K(MUrQ(Nc9I@l{j>AJLuO1q8YB;
zL(r@Jbx1D2#XQxxBt++kgI>x2xNdzADm@6k?_ecM<Ror~Bvq!}>)%`|`XVV_m$9t=
zO!!_wZ%cnXN3exH(wolSEQmQURepr%zzGEpC|OP{6mg{hh()T0`k8dKUSeDESk6A^
z>%#jo?#@=B>Ar)sc?2CABqqp}M-9VkH}E4<7B9Y91H_aLu)3|TSu}<vwmzyyLfrxR
z@i<C*QLizAq7|FcbXTB|T%preC3~-L49Th~>v=dcYp%h<c<~>l89}FC%9t{&BXZ(O
z!%y^XLK&Pvl;Q(enhbh*`Vt=wOr3u|$RMZHLFz~9{i~%!Ji}y-?D>xLp*GWc+)lfr
zY_;FcvM89_T<q6^zpDu;+>J%wV@;=_38rIEr%;3pWEl(ZG#mms4M+hH4t=p;&e0!=
zs_ibzc#EgPN5O&oq`_dwC|uV3Qk4OK@Jo&59h^b9mR20gIy6fp#-KKzH^to5zYE+s
z0Ox-1Vhz{8x^5M-&^tV{5`DDie(J3_q-cKwAj%jg9{*ZlRpDrfNogzk+%V=Mtb!vL
z(fhYN$}c0A<KBN#Vjx`I9G|y8x`J?14vesQwj*#nA_~7f_@R1q2TPz9D$}aDuXUON
zDWdP#8AA~Sgzo4h#J12-&1hpM@;nn7gE(D^_#hFiqAJ|4;R)-xRZW)J*_5|AfjF_F
zD?wAY={GrL&#!+ymQoiCTd<N{Jop<`K&0cxmn=%7q_I>*_|Qo7Nj%VNO@W&LQ(CUx
zcZ-ul`xl@hF`$Byx?{vBk${m7Kx(?6%cgvR4qi<cDonB;mQ|h*uv)cTEf`W~S3>3r
z7CJruiC)ZB^Mk?xw{))kAY(gUR3`}>-ck$P($^9v)ldXgY)){Xi?~sVb0Qe0B%{%;
zW_b?uVBTwrN~+5AOgPRPQSNW|ZZp)?j<Pp38pwq0s1$`^1S$^GvL$ShAlb#=TP0#y
zQ1K$&dl7^wgSeV9w}{~pM=8C(%lJn__;N{qMYHXli+mSh_c5WD)#vdfXg*@Pq1AZe
zB(0~-{L8uFSpM(AIIXX0k?c*JpRT>|C1BPz&kkMDaMz^x;ZfnMS3;_<z+6tEI@3(z
z1=nn8bC&bM+g`Li%TYWd_(F2)yvx3BK-5a}+hkxpUu?PhbS^%;oLflZyS_-`^Z)MS
zg5si|!xiu7(%x%$|KzQznYpz+@(u=1wxxpW`C&23F#DBgMmvmZ2494yOA^b9@jEwz
z9|@b^L*H|!J6M#`_l4wnW*Ii{FOq8^8dSP&_g)-Q2T%LH-`#I?)iO<EjxTAD;I)^z
z&VX`(=1%*<YN*CBb{Q{qy2cF@J4nsgA1@$=zPP<rpIg_nK*@{n#y=7io)P*MFyQFw
zr7s8W>BQG?U12+Dvg}Dlj~>rtIb5|xsJ|&Mo%yRXmAkbj)Pjj8u1exxDHuSsXx(q^
zMRbA1AoAS2CV{<qI*p;MERU+b;68<5#}H>Zn255a6Ui=>`;~`5gMfPX*YlH<KVW=+
z!<3A6Sy!_xO3}-KY-yu;&8J$6Jm0^M>h{Xj@q}uLjyyrczap7R3!MU+jy}iO9qdh<
zwu)<R5Exh#B8p_`5jvCsc?{o_VHf-~IUEy49jFWP;3h{iX$mW@jI}%X@Hj$VtPT#B
zNe#bz*<n?E$J*u%Vyw{Ohz9Mz`xZq~_kXCPi^o!ncx`fV6q(y~#+Zr2xBItzPj>S<
z(dY5<(-SEn47dAN9hi-PAAOS_fwOD-0}N$Y^EUtCQxL~lrA0?zG7xN5;h#nktxGI>
zz%Zy&*xT4Vocp<k_-26rj=M34;^;F+&9=QeD}**)YWKa!%3)xItg~6aJ+ByD%`H9!
zYN?zBUbA?DUHWla`q2X>l26d-dDiw9CmZH7MEgAVXtMY2W4N8&`B&}qzFF#q*_++X
zAK-i)Lx(Xe0^!U>01wLVE<k#EKow|k>y4*CNo)4}c3{*rQUaPbe9|78^L;@?A2~NK
zdOM>RRtYolfJ^!TzUUoD`WIg}qTKTz$K6|uwG2;+Z7iMD1ogy)1xJiX4uzv<jciyi
zTxcCy;B_TjND+Ur<X{-nGWw!?;?6bopaZ&mcWZNVE2up)17ku!z|cu#q^Dz-Qg}IL
zo$b2gKUR&X={4>H$N7d{kL)Y+1m$);EUO`w{UpdtqT5VJ5+EB-1tNl0R7h*a2Swhv
z?}-jv-yj2}wz%nLk~;okd8_i4aa(H>wnY>aL{kX(e&gxXdTXGRp0{x3!J&Y==&3Q5
zp>PwF#?fj+G-z_Z{U|=MYM~miTOWdO?uge1r|VfN{!6t@PJX3F$~iW7NYz7i2_7~_
z5jqqja93I_{GG{o!J-V(t2NSZZPGP$kL0yzFJJkH9KxfEcR}=6oB=kN+LSgiS?@h0
zn#ia*+G<s4v=h+KGEmFCR7VFwo&j6oi&o}e+goUQR5R>vZ=oduo%S9H`M|4#x=$&o
zx$x2cr34R80unyp-JbTj@xwUpH|Fk$NaKEvza~F@H!l$#>iRHhaJK|7&f?qSRd0<|
zP9zkrtyzzh;m6Buxa*pDog6K_e2<h%@FJ6xG=^uRvnF6w?*efhB>^UdEbGzIL6TDY
zY54=b3JkF|D@jGekhUFr%DGlcn=Li>VR%J$Xql&L0ZcVl+-=@$T1M?gy*024{E^hc
z!lMc|>q%t;#v;A65hLzz6}j3f=R_n*sy=MkQ3D^2Z}*S=$1ns1Jj}5a>w5~!+}$1@
zHwWayR()j2JFN`sxsaF8c&=!xf#P!^bOPYR!rIMegF5<jggjMRQniiA5}s5kSx<7L
z)a3`)B|<r68)OMqrdl#@g)$gu#?;=OA?;$TmUMTwuKx1^-Qv&1KKJsHE(!Ay^;Aem
zCPZUU8*lqC_E!!BmT$_i<8sP1er`&=inxbR<TrQNk@2}pZ-mbR%?af4(?O{<TTBoB
zO1~rtW-}CZ8bT_v$<Wd+z7h_lJ7qtQ20o$=xmzZgwbJnrXdA_W$%2OuJgiK+)QGQx
zZc0EP(Iq}IzDUKFnK&exl!6j6vF<~N2pE3OYN6W(-<%Q<9=GC=cmJ42aDtN{KzJp`
zWVNs@Y1xCuUz|z5*kDwW_OKM6Mk5;w(ul2L9cKFAdpA<{p!0#x`bp|C27#t@ZS4$B
z2IYP3>S;>UgH_J1c;7mn*4y*HG7SzV_@A@A7$XA)c$yvpyL35#sF#EEdY=dSC<v1A
zfSXr46wtQzq&mEFuefiJpk`|01JPwfXr`|7()*#9{R?6W5;pB9myZxf2cL5J6I)R%
z65;NehzB#*{5Z>o@VUV{n4KhD%zTqA0fR@W;=jS8I2~1bABZdYAMI4mmV9xbQ~?+~
z3slPwf_oYBRT>4g?9*I6lNf2H+xX&*H*73cR4g=qCtZERBw*m|fZtz**3b^Xf_}%&
zc(Z}-$H2M=Crv3b*L0@h7t}<14{LgkxU`N$(_kk&D(r_F2##^e>LDBAy4iy&XP$x-
z+SL6%6)rjn6M+YnhV9<3t%+1zX+HB6xWKQAe&c_SZ~#s~`y2dMgEyKUj}Tcj?BD^-
zF1cNodz)fxsZ-;-;o;?qgx>8m_ssF@{nq{c?VVS5C&$P9@sh3g=I)Zd_vZeRub1HN
zlDL;(|M~l!ECp1J8nQ+iLAxBUO_9^S*l|ztxG!ZQ;BtO~kO}&TNLQq>)IcFJ$72xK
zim6s^k^-rY2u1>PR(`LbNunV6$!daBG@6Gy^O7o5mnX)3@9VBKxtJAxK~`uupaUx9
z$w)5oJxS<mpI~mW5|eNX_w-7LKWPl@Q-NnVSKBg0xOuBnK<r(cnGlr?lq@s9fVZ&W
zSf#B?QZ4jACf{4a7pic<=m=Z*PEmnI6pVaRpeg5%Del$Z_tm_(EBF_%wPSbU(sOs1
zziGfx-wi!<<{e;3UK=VVUpT=6gO+3gF$RP$1le<)k3Cj`3_k&aB<%Jxw|#7ziZ{@A
z^l7g(gq0*>WoR8iLfY$K)j%l@pP4jGY$doagH}?aS~HAzz@sjgFC;!2D)>l*9kuD1
zUW8anM-rOXbYH+9jaZ<x{MdzSlTCG{52A|c2NI|mB_<r#BT9yH;b9#h4G{-PVFCEP
z`IM+G36T_1skyB6!3Q<c;g&QAp;p5K9V15V|E9er@>&J|G(eR1*lKuflqgbdXA<x8
z<~+14-)LajZ`h|-wGScCgr%!;hCx{>wQ08OM9A1tdw5$6zHh}(=17oB%-%&LGP7fm
zS<_9S&^a+M0d|j5?;FQFerd?nC7Lz`rOrv~WSFyFE4y(PkLPK~Enb#ekeLj!wC6;2
zDpgmMj~b<|zQsq-HQY0+Q|MT-M$M;6ykq*U^XASsOkPVFiH~mB%pRN$nyTlTZ05??
z1(ak%d!=%rvb{&ra<eo~F1Oa3s241=3qTGRr_DS3g2BrTNTT*v)-ROpeO+E8@t(sT
z>~TXG2>w+tgScgWhR31vO0{7xODw|=^2z2OX(y1TZvh^}EN0noM`WB2A!Y@|KX412
zjNO+VzfdKB08HQNZtu+^7bJNYU}0Xl5;t1uml2hMV@_FzyKU6_iJ>0Bcs2_Nob6>*
z8}UzJ@Qkq2701Kvq{OoGky&LjS=d3T8DN%}R-~qd1I&^V%MKPCrREW3n|qmMfL(Gd
z{zDnVTbmxCnL2i9Q@{rJv{yxJ?6M*@bd3sBWl7`v5D9>#Z@dASr7rilf#7-l%CF~M
zXgB$F4&NM`o?Oknnp=cnzg!l4{HgxD_RGU2>j|N|FtaXN7eg@|4WdsEzU_@{VhtNC
zW6J1BWyqc{_C?c{sp|%)jLMNOmp2wYa*{1wR#Kdl(QP4qAw1gWPD};E^nF<z{q6mL
zJBD&UN@n<zoR}E30s`11@f3u9PURc)s7yDjBB$P3uq<o)AUj$*d}`;Cv`kbOdmta(
zd#t~5$S9keBdPP4nefEeY4^S5KWA8RSuDSOM{!h=z_`HC_jM4lN%Ux-NBQ_BMKzhb
zE<Y=aMu=us7L3eq=;FatNKp!MR8T$7dw4df7FZELc`xryp3Ji{N60RQ+kEZ`E5+s}
znhVnvDY?XTAKIA{{+)^MCtZcYY!B(v@qU4{IwZYym~dSF#F-#*@b^%a3}m7en5@m(
z&W7FK`0@|!^?HA9cRH$+*CR>l?_>Ea^$BWUKvWxD;{ePpBq_iPGAt)f#mH5k;FaSA
zt!DwoQ)RxPl&W~<yK(<WrMqz${XA?d{0`-&4&heRd(yxBJPXx{Z<8M>E{T7k!{ybv
ze;a6gLR;|7rXu|Zi2y7f1ME(;q;n=cT~@^8yijdv$q^~aBfB7>O_@uiLbgtNtTs+U
z<TdCLd+YGW3r5xq9yAca;36^$y%-%6aS(X)OLgVXzyTy_#WE;wu4><e+4oYIX5NuK
z`e<Z1u9b50vg3s-c9lLl493g&<%`hYuRNBZALNvXo5puoIRLDL8}i)Wff=Hxl%5Ln
z0kP_GckkGks<og@U)o}EhyDe}bbcPuYBp|zBT{%sx8#8$8%&ws2*#^EuF-U*Vq|ZF
z(hRyjZcAb1L_uWWyq|M?P>$ZPEW@Nb`MIe2>iTseP|FP`3!>eXZR`qBaOrV}AeEIU
z$kK5#+~un35hQTegf5pvMN1W(0)L|;-fNj{A_aq@Z?PKQCGn!yp}_yAIgM3%IUE1E
zk9%4k?C}pKdV)1hro5d{9C^0^(TV04`gg66G20uBMxM*RtcU$0?~6xeoty~_84-g0
zn3;Inqv{Ffh;(wBp-_0#oQL6)4Pj%oUx#VxVsEec!bvX|vov}=U-gL^XM|nySI7?h
z+y0M4c&5u6s+%us8#tE9GwC&RcJY3ap#F_@kh$y5eDov0ht~EL&dkr@a++1k(A&ov
za$kQCh*Q!=<VWF!UoBGpU5ogvjSayJ1G-~_&a9hGOg!Va)Q|uYT6)cfWBAZm(^9zn
zQKj>bp>UaKclGC2X-Qscvb+>)+Xh~ZHR%eTqPb4h#z5}552c^o^q9H9mu}o>ebnt!
zg<)gfEzCa_+q;?LSJ8f(&D{1^8;#ndP9~$o@mKYVzvC}Tl@ahNlFsG4NR&S#y~H%>
zI|M%K7;zcX3Nh^B2-TC5J=|P`z1&>vH?cEO*ReBnorRCuorUVvHqAD1)z$f8=UInt
z;#Gf_Mj$5#AA_g3(@jyqGV@Gxm113RJqMf)*-qKu2>!Nb4t0(>@YR!nu+f@8nFX{y
zZJIK3I7K$0Ya9CEw+1s`<u9k}r0i5!;qCxvoJdL}e#x-~(+@L@HkS4%yFZuq_VW&y
zRv;Tf;z<2)=WVO{yr=QmL!O4KvI)2ZAZt7QC~wt})ZawzI$S{1IG#k!Iet=1T4kB`
zP+R+&TS4fJySLjOe9;i{`gmMjP$KZR-MUb{l!Ke_VIUevn%7&PRBIH5@u`L3b~u!M
zV5(@d8XYfn8C@e~8N5Fwh<S`#!J3CxwRCGS(|SgaqZ)e~8(-I(5})7cn_t(nvnLFI
zC8N#1hREFXX+2%)znEKVU*`+v*8gxadxu-!Cwb*k>>k-;zJ;c(e;SIkZrhL-Tdf@q
z#qgpVzq!q=e<bU_arId?&Io$oxCPhlL4Ua52=*&$B1jCBMC%_HS>tO(r0l@l<;_U?
zobX^UIna=h1m*tlVN~F#85%nE;ho;e`zY^|$L)2!_zjyM+_U+^ZBL_${St-2M+Cys
z=Q68*VZ`ycdz6<2)-%Ed5w?M6=!>l1tX=M)*{FA*H`^n`f5#FI^7-h4WoA2Cc-(G6
z9$LdFv##&J6*7=kuA=)8{T(bW28QU=f8K^~5=zLJJyHPVL{{kl4ApkqM&K>52o%J4
zz()Hg$8km-8~V%I)J5a(8~Thy12?$?ZnSQRC%i%+4UN?zD@ftGS(iV-qnmlLN%xgv
z;xV{x+c0ji>F|&Nc7z2Z{$rmdj?zk1nhgQ-`c~<zwB>_mNrVL9sTu>{rydg{_7YaH
zw`V2q4Fnb*w?F!o7b5)fUrzr+F6Z9^KD2FLR}kM%_2P#4;zh}s{d(X13~R=ycG1kh
zRU(%3jNrueL$dQ)hOjw?D|hwtN{V3jV8HTEE;foTv%2RC7qeknRbh)5>D9)Fl|2$D
z{U?-+9cZ-oY8A3zxp!;d_i^yQEs>NOULqRy@dn)@CyPRhXz>kho<i5|YTPbSV*Ge<
z8tUk1!5NC#mq1&zy?k$FeV6?!X320SJ8uPS6JWB9{D2bRSzM%s&C|8iQ>(j4;3gfN
z*9ws60D-P>P?{lKgP-+JM6Ub4!Z)Nj(I_k%BXhA8GBIlo!P!Ns0VG73P58zzg{2c<
zvPW$eWjx71ZqZPzVK?CZ&y26*#S>p6U<<aP3bqLz9e}@6Z<EFJXXV<oDGzGG(`57R
z7`O*FKYw2z<a%t}2nctVjfL>@yKKjEca)t??>VIEch@%{Bx2?l+QXlx4a=6}bUSes
z+QCSQV$LV-_FV5++_{Fy{ksdq3N2uN2Q2CO&Pa`n6SzI3-hrWK&(P?{cQZyXHv9||
zDwr)hDeN{zFo>WOPgV-Qa6iUmI<X8Z?LBbHRy&Cgw7+v2&^E|)z$6`omcEa6od{*%
zaZ*mJYS0EWRQ?89z8bCznx4NSyJ$pgqLaKcu{Ufwry)vNoW)D04#7GXZU(go(<iXY
zLrsL@!bd2)tO!HAVZl|s!?APz_bIw%$O~nxb6Iyt=wR$G&NyFV);6Q>isWNuxkY3x
zqA7h#YGb0s2gmA+>P!yX)UPB<1#t%xS=iz@y`(Y<yw(#weK*v><n1ZmKN^lc;TOyJ
z+$^(B2-8Er`|Me^hrTUu(wQ!IvmEVIcBb_S*h<n{Hcb~*_yhpH(;ru~UnWlZ?@NA-
z6A60>R;$3~&_YD)m-CIxI~_a4OEm~2k@Yo;IN?%)4tLX_K^U{yD#Gb#jmbnlM`x<a
z*VI~bmp&{*o58BH1<RG@U=1B#XR22Yb*_#VL2#XEmsaZ6<#eaaZo}~LcI?Q#tvLLx
zD$K3xc{?KV3?N(wV`_#AcY`&Ui_0PG;zFaXxQprbpJPtxenVCS2T~-kk=amVO6~D~
z@&5eT?ybK@aHE7mfF`iivzV-Cp*dMj@<d96_~^pUM~G#4iC<Oo9-X)Q_sm3(C}55R
zSKar-jy;5#;~!skOgc0F7$55IfcpRl3AoZe2f?bt5G38dVB|r_l+;9BTL-=cg+$~-
zsTAUA*pzwslkdlbUfae#eGL!3`nMLskWfF+z^*N*;%cagG`i@QQX*)64!1<#&0eeh
z-Mmfdn9(uEy@r)0`+!~NelOYmLm|dq9%Qh8%a;P<m0!I6af{Vss5`&qoxNavp>TU;
zAsMZArA~!;rS-La3}rqzJlkFd8nvd-A~pnc)Yl$*PIuvN)#{t|x=YPfRMG-gU}VI;
z2sr}6fRCDkg@#^xPm?GT@f$oh_QF?_zvSLvwN5HVaF`pBj@n~GTS)Ox#TVK7$=_kK
z6hJ#hPZwGG6{?|=U9Kq**|@vyc24VZy~wAt&KgMaS4~VaRXMC{ejy)a*B?p$axaE9
zBVz(Lk&{j3B+^~RV@8F4S)US*s6bCoA&OJ|7R@T;Lv6<5AJ*O7(|Hf{RZc?NNz(PN
z2)ft<|HGvA9)_Nq46NeMZ+DOS$kvR#O2jbKrp@PVXa6>U@ja0iM7Mxo0tq)|@<kn*
zJlymu;BxoPg8}CqHo7x1*w^vRw^qIg;&2>=<B)=2n?JYLe+`;3qArsaPzMa^7OtRo
zDr}k4poFw0Up|I?D}E-uwzDCYHV`y8l3o|;e42nC!jr+d?ZLv|!3>z)&SwBC4>7kB
z(RTNK`0aA3!hCMr4yXI`nXO0Vcjr^*IqT`ODcbjy%$ckn6IdxTTf3Ni=GImmu0}Mj
zq^Z!(?MeS0%(!p*!L9Ipz^^OJ#Q{8K()VvDO;<xFFRIxQG7T@lXu;K4X^zKNygcqY
zO?wc7M7G&7d1CEP<OLUlUh?44PLO+QpMvV!PV)bP!s-a%6ly<ja3AThW_^F_1u3sk
z;SU}3Lz+OKq-=i&k*TW4Q<)qozUBjoQZ-1KL2UM`TkE0a<d`dGjb$OV{K6+saru23
z?Q>6lOy!hB&rFp1++)OWO2Fm8wJ>o%tVjCsz6E<PO*?XTbfcXRo*fx_<?mx&-0kkk
zCpNFsYzd`6UEy$#umJWzzK;`<l>G9ha&WJ=+?9AX23HYibZZAlZ13(4`M8FJjjhtI
zos_ixNJZD6ZEIfgRyxZBZa^flPf1pqic#wVHZ=wz`j)j`WrSfU8IiM?Vy78vKX6{$
zRG*tB*C-32LGPtuw0qKPhWnlYx+^`xn|9andB$g9XPw5+@K>G71b4{f?+bb~ulk>n
zSO?p<S74;coDJI!OQ?Vvc}7anEuHtZ<+p5bm}N0H)jAP@)R^qLF&G0aCCYFp_M?Au
z(V&e^BR9bO@I<hw5G~+3#+Q4n^3p7k5Z$;<K4}gmCvtPsF-e=7yLRqvANTf8`L?06
zEv=^0gXulNW<!G}llhE@X&PTu?rmFna13qx`vCCb(H<P6<3UXG1Atc;O(5w?RLo?u
zWA%C)2%VNTTMch)j1{}JHkI|(EhA=t2bnj57xC3Mm_Bm$yLCZ7F6JGSug-;jE>#Q~
zuAmO``#{svm3HUM6@Vy;#X<?b*l$8N;3?;BBNik*xnu|xe`m?A8n7z;1XDTNuJYCJ
z@OnW`3x1Sy=KS~N*5&>6MZjP;%h&YolBwtR=8~rO`sR|Whxqm!uNQas@$V~fB7o-q
z%N{+OAIGr<%-2I3;_Xn~P;W8A8r+EbG8*r-4`}WZSA`G$M&6%}56sdH_6Np-PqJ3J
z@&KVmPngXj<lwvB;V{Fr_*cO$f`ps&BN-Nn90GoFr8`CpBRwBLO2q6B-&1ABJQ|v;
zluLb}))xo-r3xOxxZi(v9=wzNs>3aKOXz;K1o0vUi2-d?P9Y$u4T6AGNwk1cpb6Gn
zYdz2wM74BnS2K6>d%KEISL<TkF?4^-inG<0|2Oz-6zKRCDkLJLWc#;`LtK_2Mcw$e
zESgukt4NA>!qt(xqKB5$#M4t#CS~&OGEMFg`vIq7TyvG93EPppEjJG*DhmMv=3#>-
z4nq=;?WNsL(gUud;J@TRoDq4NY8bl8Uu(+r`RU9~1UQ5-bK1<6N%KRtV&hEj=e(x=
z3a^@xyu3lOB7~O_OHCP*T>21bU2K^3>&_hui~TOm=V_Bp6`IW3x{Wp5fp1!kf5lj6
zq#Fm4n+NQ(BTKW4Z4_u-`pHZ-hK=(W$TOCwKx&DCV5*6Jr7|)dZ_F2rbhpl=nN^WN
zzjW!A>Y}Jr-ydV|`dkDt9PE1j4@;w?f4-%<%MERCWy4WwUq}c}1nJs9P7B9}bb?l+
zwpX7~N^}2ESJn3*XrW3J_C{?hXd2HCH%HN5>~$yJ3&X;7hSv96r*7XD)?O0p>GX7`
zqj^>SoV93S)Ag#8*NM8Dm!Fy!0Ep#J{{dq0si?e1KYU6J01y{&seSItpZ)_xWlyR)
zziEzVT8Gt4rQ9Bq$GxT5b)c+7#oSblMyH|OhLOfKZ0$SQ3`fmB2-1W9X!#^!YJhY6
z8H$qJ#g1|A*q|VR5gSpxk~X0Kv3Z{vm8b==*Y1Jx-`(zbgR$HmSIYcLbJ}^;exrr$
z)_TJb?sa9f>49eiL$*b$<@MK3zyTq-_a(gDbIPxgpW2&FK@9oX{rO^$CS8-O2b-Z;
zZ4WEZ)01%hL{NX6XH8fi{bSYWx5{wWh&I*89+rP<12PQH+d)N2VDsDJd-4S%3G-`!
zv<3POafJ{U-G;}xR<~>44X@+ba?uC1@`#K$_07iP8r$;J7yJPKrJ;+h0DoSM-~Gu;
z0Zh;A4(4Oh!0!MTZ;4v}U4oBN=xq+e#f~$mDVT5}a65jvX(bXmK*FDu@WOC`qykke
z@plsvHR=a0qT`vNxck2k$_-K)&~@kc$quvuu4t-O!maOO+&q~ePoQP}R^w46c%)xv
z5Oq0yX?#sjCHxnj_K)M|LYxTEc!Z`kL`7|CIfLRTfn%fs<-+-|goOm&VSSz=CGTbW
zpe;LNBFIo^%BrZpR&O8Y3cnQORz1_NlE-t=@wotrwZ729;Rk+|?EvYpKNuLkOU9jR
zZS6B_rFm05X+~v$`FyqRdKHFVa|<A7pFSNelW&EFWzxn}Jem=nO#DN&OuB&ty8~j(
zbK6?Zw=$nLk+#*x0>Q!#;Jg>)U5d0+U;v~aHfJ}do;-VJf1}2uCWzJ$=?W()(f`Ld
zBWN#7&H}KNdMN+)rCfo0fhY06YGZH(Xp-hN78*SLrXuNynlnbQrp=tLnWs7BdOOi5
z4rRP{LGq4i8n@{@4j&!8+n^Be$dV&b7j9;`CP|?*sLM-RBH-t<0E#dGH9Fu$U@cLS
zf1a1WlwsPQ=XeiGs{KQiYHM#qtt*>mxiYySWLj-@|D9z~nJC?6xWg!uf{rp*u<X_5
zRB$JTDs{$ZTZay2Agmkj!?b@1HRmnZ<bm0aJKx$_iK*YdjK3pX4(Szidw1F$hC}<~
zn`FnHdtZ$tEdOA_<o9KE!>fo4c9jYJ9$4?9=;4g^7{ZOS18Gp<dGM`RkIFFpjZEmJ
z!GhD*W6JT*rUgI#pXnPA%7uOZ#5ZTl8`(qu2~y_!0baaMUBMrokdTi`+X^#1>HU=a
zP7m?#1_FiNszw39OvZ@*u;kaaf9|&kt6uXRR4FoSA6r={NSOxZxw?3MJQA8fATThC
z8JQFqp>y0!<v2hRpMCB}={pld+@_%Hu!-aiQBd{{G7^%;7|*-(ia*!Co-r#`gDY1^
zW9&V|rbdH^_Av{5wT1;U@*GYapF0aSsprpZtO{FUSv@zm&aNd{JV!UqvV~%HnAkl_
zQDSzQ**sh23*Dw;cB(}RU#ntvXqL`+oeEz8YCcwluK=~(t+Q`QmXE%Tvml`uK1TMB
zJd_x|Cbo|{`9j3$7``fz!nmp!KI)}25~spAfZ9u{k6VL^wO515dakuf;Xd|eL*VD{
z&5<e`?#31$s}=ed_QFIN_}Y=1Dx2M$=BVr0GGnE|%6eg|%~tbkLoXKU^`$$@tA&jh
z8_mu&z8Fb1)-D|G<`$nyfU4U6R<*6R*{uPnuKsUTBO}Ps3|w97SuwIq9NiclTv#R>
zTlab&+!Sj|_ke7zmV`|a!S(BeW(xD>cI`z6Bo*_=mhF`S`OH?jmq0)zws|_~N@MC6
zXQN9ggzZ*ylV{v@Si2^Fx)UJG`A?|)KSDKtPzxX={~zHeKp60!Q0_mWw|ofOCSr50
zv6UhH>fFg7b<?`<!!T(lic@<io0^fFAtECS@?T@B^(MOY3Xx7`HY0F1qn2xRvKJ#b
z$=|J=Yq8OiY|Wi0UcW<0(>Haj)c_B(p%dYQ4VpN0P2a){c=GF-p`GacKPRr3o7oEE
zC9Z0Qek1y%PMuNLbAXQMq^TD-qD*Yx9(J`*ZYbYQSu15i8sEAx<YonQ>5b&oGC6N}
zW7Z<;>F$jLC}A4vbQ{QZ&YV;;-s+-A=QICL9Txu1%YeE2%$I_!I-2m)+&URz_F&t2
zrTw#nCblJ8!9`2tZg`?m!l86%%v5I|68Zix)i5&_-*858tMFF^PLYtKqg)kL_m~Uf
z>0k8frq{x>Mz$Ux(CdElF$Aj5Q@_BUe}wW<z#wQqXh1+fP(aB(Vj5qayAzsNKtMe4
zKtPy)tN-_5<Y;2xY@%WzVq$7xYvF8RXG?GCWM}*THsUgBJ~U7W1ay-G0fhX2wGanr
h+Qz`bR@ubH-Wt%<|4|2r`0p+dz!?lE{k#6F{V#9og~k8?

literal 0
HcmV?d00001

diff --git a/Solutions/Global Secure Access/Package/createUiDefinition.json b/Solutions/Global Secure Access/Package/createUiDefinition.json
new file mode 100644
index 0000000000..ab866d954b
--- /dev/null
+++ b/Solutions/Global Secure Access/Package/createUiDefinition.json	
@@ -0,0 +1,729 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+  "handler": "Microsoft.Azure.CreateUIDef",
+  "version": "0.1.2-preview",
+  "parameters": {
+    "config": {
+      "isWizard": false,
+      "basics": {
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/gsa.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Global%20Secure%20Access/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Global Secure Access](https://aka.ms/GlobalSecureAccess) is a [domain solution](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution requires one of the product solutions below.\n\n**Prerequisite:**\n\nInstall one or more of the listed solutions to unlock the value provided by this solution.\n1. Microsoft Entra ID \n\n**Underlying Microsoft Technologies used:**\n\nThis solution depends on the following technologies, and some of these dependencies may either be in Preview state or might result in additional ingestion or operational costs:\n1. Product solutions as described above\n\n\n**Workbooks:** 2, **Analytic Rules:** 19, **Hunting Queries:** 21\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "subscription": {
+          "resourceProviders": [
+            "Microsoft.OperationsManagement/solutions",
+            "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+            "Microsoft.Insights/workbooks",
+            "Microsoft.Logic/workflows"
+          ]
+        },
+        "location": {
+          "metadata": {
+            "hidden": "Hiding location, we get it from the log analytics workspace"
+          },
+          "visible": false
+        },
+        "resourceGroup": {
+          "allowExisting": true
+        }
+      }
+    },
+    "basics": [
+      {
+        "name": "getLAWorkspace",
+        "type": "Microsoft.Solutions.ArmApiControl",
+        "toolTip": "This filters by workspaces that exist in the Resource Group selected",
+        "condition": "[greater(length(resourceGroup().name),0)]",
+        "request": {
+          "method": "GET",
+          "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+        }
+      },
+      {
+        "name": "workspace",
+        "type": "Microsoft.Common.DropDown",
+        "label": "Workspace",
+        "placeholder": "Select a workspace",
+        "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
+        "constraints": {
+          "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+          "required": true
+        },
+        "visible": true
+      }
+    ],
+    "steps": [
+      {
+        "name": "workbooks",
+        "label": "Workbooks",
+        "subLabel": {
+          "preValidation": "Configure the workbooks",
+          "postValidation": "Done"
+        },
+        "bladeTitle": "Workbooks",
+        "elements": [
+          {
+            "name": "workbooks-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences."
+            }
+          },
+          {
+            "name": "workbooks-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
+              }
+            }
+          },
+          {
+            "name": "workbook1",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Global Secure Access Enriched M365 Logs",
+            "elements": [
+              {
+                "name": "workbook1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats."
+                }
+              }
+            ]
+          },
+          {
+            "name": "workbook2",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Global Secure Access Traffic Logs",
+            "elements": [
+              {
+                "name": "workbook2-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats."
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "name": "analytics",
+        "label": "Analytics",
+        "subLabel": {
+          "preValidation": "Configure the analytics",
+          "postValidation": "Done"
+        },
+        "bladeTitle": "Analytics",
+        "elements": [
+          {
+            "name": "analytics-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in the Manage solution view."
+            }
+          },
+          {
+            "name": "analytics-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
+              }
+            }
+          },
+          {
+            "name": "analytic1",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Connections Outside Operational Hours",
+            "elements": [
+              {
+                "name": "analytic1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query identifies connections that occur outside of the defined operational hours. It helps in monitoring and flagging any unusual activity that may occur during non-business hours, indicating potential security concerns or policy violations."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic2",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect IP Address Changes and Overlapping Sessions",
+            "elements": [
+              {
+                "name": "analytic2-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query identifies network sessions based on DeviceId and UserPrincipalName, then checks for changed IP addresses and overlapping session times."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic3",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
+            "elements": [
+              {
+                "name": "analytic3-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic4",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
+            "elements": [
+              {
+                "name": "analytic4-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic5",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
+            "elements": [
+              {
+                "name": "analytic5-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic6",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+            "elements": [
+              {
+                "name": "analytic6-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies when an Exchange Online transport rule is configured to forward emails.\nThis could indicate an adversary mailbox configured to collect mail from multiple user accounts."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic7",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Malicious Inbox Rule",
+            "elements": [
+              {
+                "name": "analytic7-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\nThis is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic8",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+            "elements": [
+              {
+                "name": "analytic8-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This detection flags the occurrences of deleting multiple teams within a day.\nThis data is a part of Office 365 Connector in Microsoft Sentinel."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic9",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+            "elements": [
+              {
+                "name": "analytic9-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic10",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Office Policy Tampering",
+            "elements": [
+              {
+                "name": "analytic10-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies if any tampering is done to either audit log, ATP Safelink, SafeAttachment, AntiPhish, or Dlp policy. \nAn adversary may use this technique to evade detection or avoid other policy-based defenses.\nReferences: https://docs.microsoft.com/powershell/module/exchange/advanced-threat-protection/remove-antiphishrule?view=exchange-ps."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic11",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
+            "elements": [
+              {
+                "name": "analytic11-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive.\nList currently includes exe, inf, gzip, cmd, bat file extensions.\nAdditionally, identifies when a given user is uploading these files to another user's workspace.\nThis may be an indication of a staging location for malware or other malicious activity."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic12",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
+            "elements": [
+              {
+                "name": "analytic12-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies Office operations that are typically rare and can provide capabilities useful to attackers."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic13",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
+            "elements": [
+              {
+                "name": "analytic13-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic14",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
+            "elements": [
+              {
+                "name": "analytic14-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%)."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic15",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
+            "elements": [
+              {
+                "name": "analytic15-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies Office365 SharePoint file transfers above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic16",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
+            "elements": [
+              {
+                "name": "analytic16-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies Office365 SharePoint file transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic17",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Abnormal Deny Rate for Source to Destination IP",
+            "elements": [
+              {
+                "name": "analytic17-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, initial access, or C2, where an attacker tries to exploit the same vulnerability on machines in the organization but is being blocked by firewall rules."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic18",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Protocol Changes for Destination Ports",
+            "elements": [
+              {
+                "name": "analytic18-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic19",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Source IP Scanning Multiple Open Ports",
+            "elements": [
+              {
+                "name": "analytic19-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial access."
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "name": "huntingqueries",
+        "label": "Hunting Queries",
+        "bladeTitle": "Hunting Queries",
+        "elements": [
+          {
+            "name": "huntingqueries-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in the Manage solution view."
+            }
+          },
+          {
+            "name": "huntingqueries-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+              }
+            }
+          },
+          {
+            "name": "huntingquery1",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
+            "elements": [
+              {
+                "name": "huntingquery1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery2",
+            "type": "Microsoft.Common.Section",
+            "label": "Exes with double file extension and access summary",
+            "elements": [
+              {
+                "name": "huntingquery2-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Provides a summary of executable files with double file extensions in SharePoint \n and the users and IP addresses that have accessed them. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery3",
+            "type": "Microsoft.Common.Section",
+            "label": "External User Added and Removed in a Short Timeframe",
+            "elements": [
+              {
+                "name": "huntingquery3-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query identifies external user accounts that are added to a Team and then removed within one hour. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery4",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
+            "elements": [
+              {
+                "name": "huntingquery4-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery5",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+            "elements": [
+              {
+                "name": "huntingquery5-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies when Exchange Online transport rule is configured to forward emails.\nThis could be an adversary mailbox configured to collect mail from multiple user accounts. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery6",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+            "elements": [
+              {
+                "name": "huntingquery6-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query identifies where multiple Teams have been deleted by a single user in a short timeframe. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery7",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+            "elements": [
+              {
+                "name": "huntingquery7-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery8",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Bots added to multiple teams",
+            "elements": [
+              {
+                "name": "huntingquery8-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query helps identify bots added to multiple Teams in a short space of time. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery9",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - User made Owner of multiple teams",
+            "elements": [
+              {
+                "name": "huntingquery9-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query identifies users who have been made Owner of multiple Teams. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery10",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
+            "elements": [
+              {
+                "name": "huntingquery10-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query helps identify new, and potentially unapproved applications or bots being added to Teams. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery11",
+            "type": "Microsoft.Common.Section",
+            "label": "New Admin Account Activity Seen Which Was Not Seen Historically",
+            "elements": [
+              {
+                "name": "huntingquery11-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This will help you discover any new admin account activity which was seen and were not seen historically.\nAny new accounts seen in the results can be validated and investigated for any suspicious activities. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery12",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
+            "elements": [
+              {
+                "name": "huntingquery12-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Shows SharePoint upload/download volume by IPs with high-risk ASNs. New IPs with volume spikes may be unauthorized and exfiltrating documents. This hunting query depends on AzureActiveDirectory AzureActiveDirectory data connector (SigninLogs EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery13",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
+            "elements": [
+              {
+                "name": "huntingquery13-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Tracking via user agent is one way to differentiate between types of connecting device.\nIn homogeneous enterprise environments the user agent associated with an attacker device may stand out as unusual. This hunting query depends on AzureActiveDirectory AzureActiveDirectory data connector (SigninLogs EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery14",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
+            "elements": [
+              {
+                "name": "huntingquery14-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This identifies new Windows Reserved Filenames on Office services like SharePoint and OneDrive in the past 7 days. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery15",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Non-owner mailbox login activity",
+            "elements": [
+              {
+                "name": "huntingquery15-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Finds non-owner mailbox access by admin/delegate permissions. Whitelist valid users and check others for unauthorized access. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery16",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
+            "elements": [
+              {
+                "name": "huntingquery16-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Adversaries often abuse email-forwarding rules to monitor victim activities, steal information, and gain intelligence on the victim or their organization. This query highlights cases where user mail is being forwarded, including to external domains. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery17",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
+            "elements": [
+              {
+                "name": "huntingquery17-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects mailbox login from Exchange PowerShell. All accounts can use it by default, but admins can change it. Whitelist benign activities. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery18",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
+            "elements": [
+              {
+                "name": "huntingquery18-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "New user agents associated with a client IP for SharePoint file uploads/downloads. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery19",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
+            "elements": [
+              {
+                "name": "huntingquery19-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query identifies files uploaded to SharePoint via a Teams chat and\nsummarizes users and IP addresses that have accessed these files. This allows for \nidentification of anomalous file sharing patterns. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery20",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
+            "elements": [
+              {
+                "name": "huntingquery20-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query identifies users who are added to a Teams Channel or Teams chat\nand within 1 minute of being added upload a file via the chat. This might be\nan indicator of suspicious activity. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery21",
+            "type": "Microsoft.Common.Section",
+            "label": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
+            "elements": [
+              {
+                "name": "huntingquery21-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This identifies Windows Reserved Filenames on Office services like SharePoint and OneDrive. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity. This hunting query depends on AzureActiveDirectory data connector (EnrichedMicrosoft365AuditLogs Parser or Table)"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "outputs": {
+      "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+      "location": "[location()]",
+      "workspace": "[basics('workspace')]"
+    }
+  }
+}
diff --git a/Solutions/Global Secure Access/Package/mainTemplate.json b/Solutions/Global Secure Access/Package/mainTemplate.json
new file mode 100644
index 0000000000..d962276efd
--- /dev/null
+++ b/Solutions/Global Secure Access/Package/mainTemplate.json	
@@ -0,0 +1,5024 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "author": "Microsoft - support@microsoft.com",
+    "comments": "Solution template for Global Secure Access"
+  },
+  "parameters": {
+    "location": {
+      "type": "string",
+      "minLength": 1,
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
+      }
+    },
+    "workspace-location": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+      }
+    },
+    "workspace": {
+      "defaultValue": "",
+      "type": "string",
+      "metadata": {
+        "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+      }
+    },
+    "workbook1-name": {
+      "type": "string",
+      "defaultValue": "Microsoft Global Secure Access Enriched M365 Logs",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name for the workbook"
+      }
+    },
+    "workbook2-name": {
+      "type": "string",
+      "defaultValue": "Microsoft Global Secure Access Traffic Logs",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name for the workbook"
+      }
+    }
+  },
+  "variables": {
+    "email": "support@microsoft.com",
+    "_email": "[variables('email')]",
+    "_solutionName": "Global Secure Access",
+    "_solutionVersion": "3.0.0",
+    "solutionId": "azuresentinel.azure-sentinel-solution-globalsecureaccess",
+    "_solutionId": "[variables('solutionId')]",
+    "workbookVersion1": "1.0.1",
+    "workbookContentId1": "GSAM365EnrichedEvents",
+    "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
+    "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
+    "_workbookContentId1": "[variables('workbookContentId1')]",
+    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+    "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
+    "workbookVersion2": "1.0.1",
+    "workbookContentId2": "GSANetworkTraffic",
+    "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]",
+    "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]",
+    "_workbookContentId2": "[variables('workbookContentId2')]",
+    "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]",
+    "analyticRuleObject1": {
+      "analyticRuleVersion1": "1.0.0",
+      "_analyticRulecontentId1": "4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa",
+      "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa')]",
+      "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa')))]",
+      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4c9f0a9e-44d7-4c9b-b7f0-f6a6e0d8f8fa','-', '1.0.0')))]"
+    },
+    "analyticRuleObject2": {
+      "analyticRuleVersion2": "1.0.0",
+      "_analyticRulecontentId2": "57abf863-1c1e-46c6-85b2-35370b712c1e",
+      "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '57abf863-1c1e-46c6-85b2-35370b712c1e')]",
+      "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('57abf863-1c1e-46c6-85b2-35370b712c1e')))]",
+      "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','57abf863-1c1e-46c6-85b2-35370b712c1e','-', '1.0.0')))]"
+    },
+    "analyticRuleObject3": {
+      "analyticRuleVersion3": "2.0.8",
+      "_analyticRulecontentId3": "dc451755-8ab3-4059-b805-e454c45d1d44",
+      "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'dc451755-8ab3-4059-b805-e454c45d1d44')]",
+      "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('dc451755-8ab3-4059-b805-e454c45d1d44')))]",
+      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','dc451755-8ab3-4059-b805-e454c45d1d44','-', '2.0.8')))]"
+    },
+    "analyticRuleObject4": {
+      "analyticRuleVersion4": "2.1.3",
+      "_analyticRulecontentId4": "4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac",
+      "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac')]",
+      "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac')))]",
+      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d38f80f-6b7d-4a1f-aeaf-e38df637e6ac','-', '2.1.3')))]"
+    },
+    "analyticRuleObject5": {
+      "analyticRuleVersion5": "2.1.4",
+      "_analyticRulecontentId5": "1a8f1297-23a4-4f09-a20b-90af8fc3641a",
+      "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1a8f1297-23a4-4f09-a20b-90af8fc3641a')]",
+      "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1a8f1297-23a4-4f09-a20b-90af8fc3641a')))]",
+      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1a8f1297-23a4-4f09-a20b-90af8fc3641a','-', '2.1.4')))]"
+    },
+    "analyticRuleObject6": {
+      "analyticRuleVersion6": "2.1.4",
+      "_analyticRulecontentId6": "edcfc2e0-3134-434c-8074-9101c530d419",
+      "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'edcfc2e0-3134-434c-8074-9101c530d419')]",
+      "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('edcfc2e0-3134-434c-8074-9101c530d419')))]",
+      "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','edcfc2e0-3134-434c-8074-9101c530d419','-', '2.1.4')))]"
+    },
+    "analyticRuleObject7": {
+      "analyticRuleVersion7": "2.0.6",
+      "_analyticRulecontentId7": "a9c76c8d-f60d-49ec-9b1f-bdfee6db3807",
+      "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a9c76c8d-f60d-49ec-9b1f-bdfee6db3807')]",
+      "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a9c76c8d-f60d-49ec-9b1f-bdfee6db3807')))]",
+      "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a9c76c8d-f60d-49ec-9b1f-bdfee6db3807','-', '2.0.6')))]"
+    },
+    "analyticRuleObject8": {
+      "analyticRuleVersion8": "2.0.6",
+      "_analyticRulecontentId8": "db60e4b6-a845-4f28-a18c-94ebbaad6c6c",
+      "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'db60e4b6-a845-4f28-a18c-94ebbaad6c6c')]",
+      "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('db60e4b6-a845-4f28-a18c-94ebbaad6c6c')))]",
+      "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','db60e4b6-a845-4f28-a18c-94ebbaad6c6c','-', '2.0.6')))]"
+    },
+    "analyticRuleObject9": {
+      "analyticRuleVersion9": "2.0.5",
+      "_analyticRulecontentId9": "d75e8289-d1cb-44d4-bd59-2f44a9172478",
+      "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd75e8289-d1cb-44d4-bd59-2f44a9172478')]",
+      "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d75e8289-d1cb-44d4-bd59-2f44a9172478')))]",
+      "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d75e8289-d1cb-44d4-bd59-2f44a9172478','-', '2.0.5')))]"
+    },
+    "analyticRuleObject10": {
+      "analyticRuleVersion10": "2.0.6",
+      "_analyticRulecontentId10": "0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb",
+      "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb')]",
+      "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb')))]",
+      "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0f1f2b17-f9d6-4d2a-a0fb-a7ae1659e3eb','-', '2.0.6')))]"
+    },
+    "analyticRuleObject11": {
+      "analyticRuleVersion11": "2.0.7",
+      "_analyticRulecontentId11": "178c62b4-d5e5-40f5-8eab-7fccd0051e7a",
+      "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '178c62b4-d5e5-40f5-8eab-7fccd0051e7a')]",
+      "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('178c62b4-d5e5-40f5-8eab-7fccd0051e7a')))]",
+      "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','178c62b4-d5e5-40f5-8eab-7fccd0051e7a','-', '2.0.7')))]"
+    },
+    "analyticRuleObject12": {
+      "analyticRuleVersion12": "2.0.7",
+      "_analyticRulecontentId12": "433c254d-4b84-46f7-99ec-9dfefb5f6a7b",
+      "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '433c254d-4b84-46f7-99ec-9dfefb5f6a7b')]",
+      "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('433c254d-4b84-46f7-99ec-9dfefb5f6a7b')))]",
+      "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','433c254d-4b84-46f7-99ec-9dfefb5f6a7b','-', '2.0.7')))]"
+    },
+    "analyticRuleObject13": {
+      "analyticRuleVersion13": "2.0.6",
+      "_analyticRulecontentId13": "7460e34e-4c99-47b2-b7c0-c42e339fc586",
+      "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7460e34e-4c99-47b2-b7c0-c42e339fc586')]",
+      "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7460e34e-4c99-47b2-b7c0-c42e339fc586')))]",
+      "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7460e34e-4c99-47b2-b7c0-c42e339fc586','-', '2.0.6')))]"
+    },
+    "analyticRuleObject14": {
+      "analyticRuleVersion14": "2.2.6",
+      "_analyticRulecontentId14": "efd17c5f-5167-40f8-a1e9-0818940785d9",
+      "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'efd17c5f-5167-40f8-a1e9-0818940785d9')]",
+      "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('efd17c5f-5167-40f8-a1e9-0818940785d9')))]",
+      "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','efd17c5f-5167-40f8-a1e9-0818940785d9','-', '2.2.6')))]"
+    },
+    "analyticRuleObject15": {
+      "analyticRuleVersion15": "1.0.5",
+      "_analyticRulecontentId15": "30375d00-68cc-4f95-b89a-68064d566358",
+      "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '30375d00-68cc-4f95-b89a-68064d566358')]",
+      "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('30375d00-68cc-4f95-b89a-68064d566358')))]",
+      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','30375d00-68cc-4f95-b89a-68064d566358','-', '1.0.5')))]"
+    },
+    "analyticRuleObject16": {
+      "analyticRuleVersion16": "2.0.8",
+      "_analyticRulecontentId16": "abd6976d-8f71-4851-98c4-4d086201319c",
+      "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'abd6976d-8f71-4851-98c4-4d086201319c')]",
+      "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('abd6976d-8f71-4851-98c4-4d086201319c')))]",
+      "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','abd6976d-8f71-4851-98c4-4d086201319c','-', '2.0.8')))]"
+    },
+    "analyticRuleObject17": {
+      "analyticRuleVersion17": "1.0.0",
+      "_analyticRulecontentId17": "e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b",
+      "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b')]",
+      "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b')))]",
+      "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b','-', '1.0.0')))]"
+    },
+    "analyticRuleObject18": {
+      "analyticRuleVersion18": "1.0.0",
+      "_analyticRulecontentId18": "f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a",
+      "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a')]",
+      "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a')))]",
+      "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a','-', '1.0.0')))]"
+    },
+    "analyticRuleObject19": {
+      "analyticRuleVersion19": "1.0.0",
+      "_analyticRulecontentId19": "82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1",
+      "analyticRuleId19": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1')]",
+      "analyticRuleTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1')))]",
+      "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1','-', '1.0.0')))]"
+    },
+    "huntingQueryObject1": {
+      "huntingQueryVersion1": "2.0.2",
+      "_huntingQuerycontentId1": "271e8881-3044-4332-a5f4-42264c2e0315",
+      "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('271e8881-3044-4332-a5f4-42264c2e0315')))]"
+    },
+    "huntingQueryObject2": {
+      "huntingQueryVersion2": "2.0.1",
+      "_huntingQuerycontentId2": "d12580c2-1474-4125-a8a3-553f50d91215",
+      "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d12580c2-1474-4125-a8a3-553f50d91215')))]"
+    },
+    "huntingQueryObject3": {
+      "huntingQueryVersion3": "2.0.1",
+      "_huntingQuerycontentId3": "119d9e1c-afcc-4d23-b239-cdb4e7bf851c",
+      "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('119d9e1c-afcc-4d23-b239-cdb4e7bf851c')))]"
+    },
+    "huntingQueryObject4": {
+      "huntingQueryVersion4": "2.0.2",
+      "_huntingQuerycontentId4": "6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45",
+      "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45')))]"
+    },
+    "huntingQueryObject5": {
+      "huntingQueryVersion5": "2.0.2",
+      "_huntingQuerycontentId5": "9891684a-1e3a-4546-9403-3439513cbc70",
+      "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9891684a-1e3a-4546-9403-3439513cbc70')))]"
+    },
+    "huntingQueryObject6": {
+      "huntingQueryVersion6": "2.0.2",
+      "_huntingQuerycontentId6": "64990414-b015-4edf-bef0-343b741e68c5",
+      "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('64990414-b015-4edf-bef0-343b741e68c5')))]"
+    },
+    "huntingQueryObject7": {
+      "huntingQueryVersion7": "2.0.2",
+      "_huntingQuerycontentId7": "a1551ae4-f61c-4bca-9c57-4d0d681db2e9",
+      "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a1551ae4-f61c-4bca-9c57-4d0d681db2e9')))]"
+    },
+    "huntingQueryObject8": {
+      "huntingQueryVersion8": "2.0.1",
+      "_huntingQuerycontentId8": "9eb64924-ec8d-44d0-b1f2-10665150fb74",
+      "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9eb64924-ec8d-44d0-b1f2-10665150fb74')))]"
+    },
+    "huntingQueryObject9": {
+      "huntingQueryVersion9": "2.0.2",
+      "_huntingQuerycontentId9": "558f15dd-3171-4b11-bf24-31c0610a20e0",
+      "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('558f15dd-3171-4b11-bf24-31c0610a20e0')))]"
+    },
+    "huntingQueryObject10": {
+      "huntingQueryVersion10": "2.0.2",
+      "_huntingQuerycontentId10": "bf76e508-9282-4cf1-9cc1-5c20c3dea2ee",
+      "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bf76e508-9282-4cf1-9cc1-5c20c3dea2ee')))]"
+    },
+    "huntingQueryObject11": {
+      "huntingQueryVersion11": "2.0.1",
+      "_huntingQuerycontentId11": "723c5f46-133f-4f1e-ada6-5c138f811d75",
+      "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('723c5f46-133f-4f1e-ada6-5c138f811d75')))]"
+    },
+    "huntingQueryObject12": {
+      "huntingQueryVersion12": "2.0.2",
+      "_huntingQuerycontentId12": "e3d24cfd-b2a1-4ba7-8f80-0360892f9d57",
+      "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3d24cfd-b2a1-4ba7-8f80-0360892f9d57')))]"
+    },
+    "huntingQueryObject13": {
+      "huntingQueryVersion13": "2.0.2",
+      "_huntingQuerycontentId13": "f2367171-1514-4c67-88ef-27434b6a1093",
+      "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f2367171-1514-4c67-88ef-27434b6a1093')))]"
+    },
+    "huntingQueryObject14": {
+      "huntingQueryVersion14": "2.0.2",
+      "_huntingQuerycontentId14": "641ecd2d-27c9-4f05-8433-8205096b09fc",
+      "huntingQueryTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('641ecd2d-27c9-4f05-8433-8205096b09fc')))]"
+    },
+    "huntingQueryObject15": {
+      "huntingQueryVersion15": "2.0.1",
+      "_huntingQuerycontentId15": "0a8f410d-38b5-4d75-90da-32b472b97230",
+      "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a8f410d-38b5-4d75-90da-32b472b97230')))]"
+    },
+    "huntingQueryObject16": {
+      "huntingQueryVersion16": "2.0.2",
+      "_huntingQuerycontentId16": "d49fc965-aef3-49f6-89ad-10cc4697eb5b",
+      "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d49fc965-aef3-49f6-89ad-10cc4697eb5b')))]"
+    },
+    "huntingQueryObject17": {
+      "huntingQueryVersion17": "2.0.2",
+      "_huntingQuerycontentId17": "49a4f65a-fe18-408e-afec-042fde93d3ce",
+      "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('49a4f65a-fe18-408e-afec-042fde93d3ce')))]"
+    },
+    "huntingQueryObject18": {
+      "huntingQueryVersion18": "2.0.2",
+      "_huntingQuerycontentId18": "e8ae1375-4640-430c-ae8e-2514d09c71eb",
+      "huntingQueryTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e8ae1375-4640-430c-ae8e-2514d09c71eb')))]"
+    },
+    "huntingQueryObject19": {
+      "huntingQueryVersion19": "2.0.2",
+      "_huntingQuerycontentId19": "90e198a9-efb6-4719-ad89-81b8e93633a7",
+      "huntingQueryTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('90e198a9-efb6-4719-ad89-81b8e93633a7')))]"
+    },
+    "huntingQueryObject20": {
+      "huntingQueryVersion20": "2.0.2",
+      "_huntingQuerycontentId20": "3d6d0c04-7337-40cf-ace6-c471d442356d",
+      "huntingQueryTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3d6d0c04-7337-40cf-ace6-c471d442356d')))]"
+    },
+    "huntingQueryObject21": {
+      "huntingQueryVersion21": "2.0.2",
+      "_huntingQuerycontentId21": "61c28cd7-3139-4731-8ea7-2cbbeabb4684",
+      "huntingQueryTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('61c28cd7-3139-4731-8ea7-2cbbeabb4684')))]"
+    },
+    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('workbookTemplateSpecName1')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "GSAM365EnrichedEvents Workbook with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('workbookVersion1')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.Insights/workbooks",
+              "name": "[variables('workbookContentId1')]",
+              "location": "[parameters('workspace-location')]",
+              "kind": "shared",
+              "apiVersion": "2021-08-01",
+              "metadata": {
+                "description": "This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats."
+              },
+              "properties": {
+                "displayName": "[parameters('workbook1-name')]",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Enriched Microsoft 365 logs Workbook (Preview)\\n---\\n\\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::all\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The Log Analytic Workspace In Which To Execute The Queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| summarize Count = count() by UserId\\r\\n| order by Count desc, UserId asc\\r\\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"e841bafb-6437-4d29-84ac-ba16c5a6d901\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"ac5f2082-50bc-4739-bdf2-20c93b613671\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"SharePoint/OneDrive Insights\",\"subTarget\":\"Threat\",\"style\":\"link\"},{\"id\":\"dc2778e7-739b-44ba-9ae4-c81901277f57\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Exchange Online Insights\",\"subTarget\":\"ThreatEXO\",\"style\":\"link\"},{\"id\":\"666111e2-54ff-4fa4-a648-11a5c8c0235b\",\"cellValue\":\"selTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Teams Insights\",\"subTarget\":\"ThreatTeams\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Exchange\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Exchange\\\")\\r\\n| summarize [\\\"Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Count\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Set-AdminAuditLogConfig\\\", \\\"Set-OrganizationConfig\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Audit Of Critical Configuration Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Set-TransportRule\\\", \\\"Set-AtpPolicyForO365\\\", \\\"Set-MalwareFilterRule\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Changes In Email Security Policies\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"Add-RoleGroupMember\\\", \\\"Remove-ManagementRoleAssignment\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Monitoring Role Group Membership Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"New-TenantAllowBlockListSpoofitems\\\", \\\"Remove-TenantAllowBlockListSpoofitems\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Spoofing Settings Management Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Operation in (\\\"New-SafeAttachmentPolicy\\\", \\\"Set-SafeAttachmentPolicy\\\", \\\"Set-SafeAttachmentRule\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Safe Attachments Policy Changes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatEXO\"},\"name\":\"group - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs | where Workload == \\\"Exchange\\\" | where Operation in (\\\"Add-MailboxFolderPermission\\\", \\\"Add-RoleGroupMember\\\", \\\"New-TransportRule\\\", \\\"Remove-ManagementRoleAssignment\\\", \\\"Set-TransportRule\\\") | summarize Count = count(), Users = makeset(UserId) by Operation | order by Count desc\",\"size\":0,\"title\":\"Permission changes and security policy updates\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"seltab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatEXO\"},\"name\":\"query - 13\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Teams\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"Teams\\\")\\r\\n| summarize [\\\"Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Count\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatTeams\"},\"name\":\"group - 10\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\",\\\"SPO/OneDrive\\\")\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n| summarize Count = count() by City, State, Country\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"numberOfMetrics\":19,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| summarize [\\\"Event Count\\\"] = count() by [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem\\r\\n| order by [\\\"Event Count\\\"] desc\\r\\n\",\"size\":2,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 20\"}]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"group - 20\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| where Operation in (\\\"MemberAdded\\\", \\\"MemberRemoved\\\", \\\"TeamDeleted\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Changes In Team Memberships\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"ThreatTeams\"},\"customWidth\":\"50\",\"name\":\"query - 11\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RiskyExtensions = dynamic([\\\"exe\\\", \\\"msi\\\", \\\"bat\\\", \\\"cmd\\\", \\\"com\\\", \\\"scr\\\", \\\"pif\\\", \\\"ps1\\\", \\\"vbs\\\", \\\"js\\\", \\\"jse\\\", \\\"wsf\\\", \\\"docm\\\", \\\"xlsm\\\", \\\"pptm\\\", \\\"dll\\\", \\\"ocx\\\", \\\"cpl\\\", \\\"app\\\", \\\"vb\\\", \\\"reg\\\", \\\"inf\\\", \\\"hta\\\"]);\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"SPO/OneDrive\\\")\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend [\\\"File Extension\\\"] = tostring(parse_json(AdditionalProperties).SourceFileExtension)\\r\\n| where [\\\"File Extension\\\"] in (RiskyExtensions)\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, [\\\"File Extension\\\"], Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], [\\\"File Extension\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], [\\\"File Extension\\\"], Operation, Count\\r\\n\",\"size\":0,\"title\":\"Risky File Operations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| where Operation in (\\\"FileRecycled\\\", \\\"FileDownloaded\\\", \\\"FileUploaded\\\", \\\"FileCreated\\\", \\\"File Modified\\\")\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Bulk File Events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where Workload in (\\\"SPO/OneDrive\\\")\\r\\n| where Operation == \\\"FileDeletedFirstStageRecycleBin\\\"\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by bin(Timestamp, 1h), [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n| where Count > 1\\r\\n\",\"size\":0,\"title\":\" Bulk File Deletion Operations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileDeletions\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let baselinePeriod = 30d;\\r\\nlet detectionWindow = 1h;\\r\\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs\\r\\n| where TimeGenerated >= ago(baselinePeriod)\\r\\n| where Workload in (\\\"OneDrive\\\", \\\"SharePoint\\\", \\\"SPO/OneDrive\\\")\\r\\n| where Operation == \\\"FileDownloaded\\\"\\r\\n| project Timestamp = TimeGenerated, [\\\"User ID\\\"] = UserId, [\\\"Client IP\\\"] = ClientIp, Operation\\r\\n| summarize Count = count() by bin(Timestamp, detectionWindow), [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation\\r\\n| project Timestamp, [\\\"User ID\\\"], [\\\"Client IP\\\"], Operation, Count\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Bulk File Download\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DownloadCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Threat\"},\"name\":\"query - 4\"}]},\"name\":\"group - 9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\\r\\n| extend \\r\\n    Country = tostring(GeoInfo.country), \\r\\n    State = tostring(GeoInfo.state), \\r\\n    City = tostring(GeoInfo.city), \\r\\n    Latitude = tostring(GeoInfo.latitude), \\r\\n    Longitude = tostring(GeoInfo.longitude)\\r\\n| project \\r\\n    UserId, \\r\\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\\r\\n    Latitude, \\r\\n    Longitude, \\r\\n    City, \\r\\n    State, \\r\\n    Country\\r\\n      | where tostring(Country) != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Access By Location\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"minSize\":20,\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"numberOfMetrics\":8,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| summarize [\\\"Event Count\\\"] = count() by [\\\"Time Generated\\\"] = TimeGenerated, [\\\"User\\\"] = UserId, [\\\"Source IP\\\"] = SourceIp, [\\\"Device Operating System\\\"] = DeviceOperatingSystem, [\\\"Workload\\\"] = Workload\\r\\n| order by [\\\"Time Generated\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Access By Location And OS\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 1\"}]},\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| project \\r\\n    Operation, \\r\\n    UserId, \\r\\n    Workload, \\r\\n    SourceIp, \\r\\n    DeviceId, \\r\\n    TimeGenerated, \\r\\n    Details = pack_all(),\\r\\n    OS = tostring(DeviceOperatingSystem)\\r\\n| extend Workload = tostring(Workload)\\r\\n| extend WorkloadStatus = case(\\r\\n    Workload == \\\"Exchange\\\", \\\"Exchange\\\",\\r\\n    Workload == \\\"Teams\\\", \\\"Teams\\\",\\r\\n    Workload == \\\"SharePoint\\\", \\\"SharePoint\\\",\\r\\n    \\\"Other\\\"\\r\\n);\\r\\n\\r\\nlet appData = data\\r\\n| summarize \\r\\n    TotalCount = count(), \\r\\n    ExchangeCount = countif(Workload == \\\"Exchange\\\"), \\r\\n    TeamsCount = countif(Workload == \\\"Teams\\\"), \\r\\n    SharePointCount = countif(Workload == \\\"SharePoint\\\"), \\r\\n    OtherCount = countif(Workload == \\\"Other\\\") \\r\\n    by UserId\\r\\n| where UserId != ''\\r\\n| join kind=inner (\\r\\n    data\\r\\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId\\r\\n    | project-away TimeGenerated\\r\\n  ) on UserId\\r\\n| order by TotalCount desc, UserId asc\\r\\n| project UserId, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\\r\\n| serialize Id = row_number();\\r\\n\\r\\ndata\\r\\n| summarize \\r\\n    TotalCount = count(), \\r\\n    ExchangeCount = countif(Workload == \\\"Exchange\\\"), \\r\\n    TeamsCount = countif(Workload == \\\"Teams\\\"), \\r\\n    SharePointCount = countif(Workload == \\\"SharePoint\\\"), \\r\\n    OtherCount = countif(Workload == \\\"Other\\\") \\r\\n    by UserId, SourceIp = tostring(SourceIp)\\r\\n| join kind=inner (\\r\\n    data\\r\\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId, SourceIp\\r\\n    | project-away TimeGenerated\\r\\n  ) on UserId, SourceIp\\r\\n| order by TotalCount desc, UserId asc\\r\\n| project UserId, SourceIp, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\\r\\n| serialize Id = row_number(1000000)\\r\\n| join kind=inner (appData) on UserId\\r\\n| project Id, Name = SourceIp, Type = 'Client IP', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = Id1\\r\\n| union (\\r\\n    appData \\r\\n    | project Id, Name = UserId, Type = 'Operating System', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = -1\\r\\n  )\\r\\n| order by ['Events Count'] desc, Name asc\\r\\n\",\"size\":2,\"title\":\"Activity Log\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5},{\"columnMatch\":\"Type\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Other Count\",\"formatter\":5},{\"columnMatch\":\"ParentId\",\"formatter\":5},{\"columnMatch\":\"Operation Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Exchange Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},{\"columnMatch\":\"Teams Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"purple\"}},{\"columnMatch\":\"SharePoint Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\"}},{\"columnMatch\":\"Details\",\"formatter\":5,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\"}}},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<br />\\r\\n💡 _Click on a segment of the pie chart to explore more details_\"},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| extend \\r\\n    OS = coalesce(DeviceOperatingSystem, \\\"Unknown OS\\\"),\\r\\n    OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \\\"Unknown Version\\\")\\r\\n| summarize DeviceCount = count() by OS, OSVersion\\r\\n| order by DeviceCount desc\\r\\n\",\"size\":3,\"title\":\"Devices Accessing M365\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"Parampie\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend \\r\\n    [\\\"Operating System\\\"] = coalesce(DeviceOperatingSystem, \\\"Unknown OS\\\"),\\r\\n    [\\\"OS Version\\\"] = coalesce(tostring(DeviceOperatingSystemVersion), \\\"Unknown Version\\\"),\\r\\n    [\\\"Device ID\\\"] = coalesce(tostring(DeviceId), \\\"Unknown DeviceId\\\")\\r\\n| where [\\\"Operating System\\\"] == dynamic({Parampie}).label\\r\\n| summarize [\\\"Device Count\\\"] = count() by [\\\"Operating System\\\"], [\\\"OS Version\\\"], [\\\"Device ID\\\"]\\r\\n| order by [\\\"Device Count\\\"] desc\\r\\n\",\"size\":2,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":1}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"OperatingSystem\",\"OSVersion\"],\"expandTopLevel\":false}}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},{\"parameterName\":\"Parampie\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 1\"}]},\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let BusinessHoursStart = 8; // 8 AM\\r\\nlet BusinessHoursEnd = 18; // 6 PM\\r\\n\\r\\nEnrichedMicrosoft365AuditLogs \\r\\n| where UserId in ({Users}) or '*' in ({Users})\\r\\n| extend HourOfDay = hourofday(TimeGenerated)\\r\\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\\r\\n| summarize [\\\"Off-Hour Activities\\\"] = count() by [\\\"User ID\\\"] = UserId, [\\\"Date\\\"] = bin(TimeGenerated, 1d), [\\\"Operation\\\"]\\r\\n| order by [\\\"Off-Hour Activities\\\"] desc\\r\\n\",\"size\":0,\"title\":\"Activity Outside Standard Working Hours (8:00 - 18:00)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EnrichedMicrosoft365AuditLogs\\n| summarize Count = count() by bin(TimeGenerated, 1h)\\n| order by TimeGenerated asc\\n\",\"size\":0,\"title\":\"Microsoft 365 Transactions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"unstackedbar\"},\"conditionalVisibility\":{\"parameterName\":\"selTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"}],\"fallbackResourceIds\":[\"Global Secure Access\"],\"fromTemplateId\":\"GSA Enriched Microsoft 365 logs\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "version": "1.0",
+                "sourceId": "[variables('workspaceResourceId')]",
+                "category": "sentinel"
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
+              "properties": {
+                "description": "@{workbookKey=GSAM365EnrichedEvents; logoFileName=gsa.svg; description=This Workbook provides a detailed view of Microsoft 365 log data, enriched with contextual information to enhance visibility into user activities and potential security threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Global Secure Access Enriched M365 Logs; templateRelativePath=GSAM365EnrichedEvents.json; provider=Microsoft}.description",
+                "parentId": "[variables('workbookId1')]",
+                "contentId": "[variables('_workbookContentId1')]",
+                "kind": "Workbook",
+                "version": "[variables('workbookVersion1')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                },
+                "dependencies": {
+                  "operator": "AND",
+                  "criteria": [
+                    {
+                      "contentId": "AzureActiveDirectory",
+                      "kind": "DataConnector"
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_workbookContentId1')]",
+        "contentKind": "Workbook",
+        "displayName": "[parameters('workbook1-name')]",
+        "contentProductId": "[variables('_workbookcontentProductId1')]",
+        "id": "[variables('_workbookcontentProductId1')]",
+        "version": "[variables('workbookVersion1')]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('workbookTemplateSpecName2')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "GSANetworkTraffic Workbook with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('workbookVersion2')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.Insights/workbooks",
+              "name": "[variables('workbookContentId2')]",
+              "location": "[parameters('workspace-location')]",
+              "kind": "shared",
+              "apiVersion": "2021-08-01",
+              "metadata": {
+                "description": "This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats."
+              },
+              "properties": {
+                "displayName": "[parameters('workbook2-name')]",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Network Traffic Insights Workbook (Preview)\\n---\\nInformation in the dashboard is based on log data\\n\\n\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::all\"],\"parameters\":[{\"id\":\"ff8b2a55-1849-4848-acf8-eab5452e9f10\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticWorkspace\",\"label\":\"Log Analytic Workspace\",\"type\":5,\"description\":\"The Log Analytic Workspace In Which To Execute The Queries\",\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| project id\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":2592000000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"f15f34d8-8e2d-4c39-8dee-be2f979c86a8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}},{\"id\":\"8bab511b-53b3-4220-9d1c-372345b06728\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Users\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"NetworkAccessTraffic\\r\\n| summarize Count = count() by UserPrincipalName\\r\\n| order by Count desc, UserPrincipalName asc\\r\\n| project Value = UserPrincipalName, Label = strcat(UserPrincipalName, ' - ', Count, ' Logs'), Selected = false\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"limitSelectTo\":20,\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"527af4d2-3089-4aa4-9fbb-48ec697db20d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WebCategories\",\"label\":\"Web Categories\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"NetworkAccessTraffic\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| order by Count desc, firstCategory asc\\r\\n| project Value = firstCategory, Label = strcat(firstCategory, ' - ', Count, ' Logs')\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 15\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"2b2cd1be-9d25-412c-8444-f005c4789b55\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"cc3e67f2-f20f-4430-8dee-d0773b90d9ce\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"All Traffic\",\"subTarget\":\"AllTraffic\",\"style\":\"link\"},{\"id\":\"5ae54b5a-ac7b-4b7a-a1e1-1e574625caa3\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"URL Lookup\",\"subTarget\":\"URLLookup\",\"style\":\"link\"},{\"id\":\"68c566f8-957e-4a3f-8b66-730fc24135fb\",\"cellValue\":\"tabSel\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Insights\",\"subTarget\":\"Security\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkAccessTrafficData = NetworkAccessTraffic\\r\\n| where SourceIp != \\\"\\\" and isnotempty(SourceIp)\\r\\n| summarize arg_max(TimeGenerated, *) by SourceIp, TenantId;\\r\\n\\r\\nlet SigninLogsData = SigninLogs\\r\\n| where IPAddress != \\\"\\\" and isnotempty(IPAddress)\\r\\n| summarize arg_max(TimeGenerated, *) by IPAddress, TenantId, UserId, CorrelationId;\\r\\n\\r\\nSigninLogsData\\r\\n| join kind=leftanti (\\r\\n    NetworkAccessTrafficData\\r\\n    | where SourceIp != \\\"\\\" and isnotempty(SourceIp)\\r\\n) on $left.IPAddress == $right.SourceIp and $left.TenantId == $right.TenantId\\r\\n| project TimeGenerated, IPAddress, UserId, UserPrincipalName, AppDisplayName, DeviceDetail.deviceId\\r\\n\",\"size\":0,\"title\":\"Sign-ins Outside Global Secure Access\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Security\"},\"name\":\"group - 10\"},{\"type\":1,\"content\":{\"json\":\"💡 Type the URL for detailed analysis\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"text - 10\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ec8c38c8-3064-4921-8dcd-a69d3895599b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"URL\",\"type\":1,\"typeSettings\":{\"isSearchBox\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"parameters - 9\"},{\"type\":1,\"content\":{\"json\":\"# Web Categories\"},\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let CategoryData = NetworkAccessTraffic \\r\\n| where DestinationFqdn contains \\\"{URL}\\\"  // Filters logs based on the provided URL parameter\\r\\n| extend CategoriesList = split(DestinationWebCategories, \\\",\\\")  // Split categories into a list\\r\\n| mv-expand Category = CategoriesList  // Expand the list into individual rows\\r\\n| extend Category = trim_start(\\\" \\\", trim_end(\\\" \\\", tostring(Category)))  // Trim leading and trailing spaces\\r\\n| extend Category = iff(TrafficType == \\\"microsoft365\\\", \\\"Microsoft M365\\\", Category)  // Set category to \\\"Microsoft M365\\\" if TrafficType is \\\"microsoft365\\\"\\r\\n| summarize UniqueCategories = make_set(Category);  // Create a set of unique categories\\r\\n\\r\\nCategoryData\\r\\n| extend \\r\\n    PrimaryCategory = iff(array_length(UniqueCategories) > 0, tostring(UniqueCategories[0]), \\\"None\\\")\\r\\n| project \\r\\n    col1 = PrimaryCategory,\\r\\n    snapshot = \\\"Primary Category\\\"\\r\\n\\r\\n| union (\\r\\n    CategoryData\\r\\n    | extend \\r\\n        SecondaryCategory = iff(array_length(UniqueCategories) > 1, tostring(UniqueCategories[1]), \\\"None\\\")\\r\\n    | project \\r\\n        col1 = SecondaryCategory,\\r\\n        snapshot = \\\"Secondary Category\\\"\\r\\n)\\r\\n\\r\\n| order by snapshot asc\\r\\n\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\"},\"leftContent\":{\"columnMatch\":\"col1\",\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"# Traffic Access Details\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkData = NetworkAccessTraffic\\r\\n| where DestinationFqdn contains \\\"{URL}\\\";  // Filters logs based on the provided URL parameter\\r\\n\\r\\nNetworkData\\r\\n| summarize \\r\\n    UniqueUsers = dcount(UserPrincipalName),\\r\\n    UniqueDevices = dcount(DeviceId),    \\r\\n    TotalAllow = countif(Action == \\\"Allow\\\"),\\r\\n    TotalBlock = countif(Action == \\\"Block\\\")\\r\\n| project \\r\\n    col1 = UniqueUsers, \\r\\n    snapshot = \\\"Unique Users\\\"\\r\\n| union (NetworkData\\r\\n    | summarize UniqueDevices = dcount(DeviceId)\\r\\n    | project col1 = UniqueDevices, snapshot = \\\"Unique Devices\\\")\\r\\n| union (NetworkData\\r\\n    | summarize TotalAllow = countif(Action == \\\"Allow\\\")\\r\\n    | project col1 = TotalAllow, snapshot = \\\"Total Allow\\\")\\r\\n| union (NetworkData\\r\\n    | summarize TotalBlock = countif(Action == \\\"Block\\\")\\r\\n    | project col1 = TotalBlock, snapshot = \\\"Total Block\\\")\\r\\n| order by snapshot asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"name\":\"query - 14\"},{\"type\":1,\"content\":{\"json\":\"# Bandwidth Usage\"},\"name\":\"text - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let NetworkData = NetworkAccessTraffic\\r\\n| where DestinationFqdn contains \\\"{URL}\\\";  // Filters logs based on the provided URL parameter\\r\\n\\r\\nNetworkData\\r\\n| summarize \\r\\n    TotalSent = sum(SentBytes),\\r\\n    TotalReceived = sum(ReceivedBytes),\\r\\n    TotalBandwidth = sum(SentBytes + ReceivedBytes)\\r\\n| extend \\r\\n    TotalSentMB = round(TotalSent / 1024.0 / 1024.0, 2),\\r\\n    TotalReceivedMB = round(TotalReceived / 1024.0 / 1024.0, 2),\\r\\n    TotalBandwidthMB = round(TotalBandwidth / 1024.0 / 1024.0, 2)\\r\\n| project \\r\\n    TotalSentMB,\\r\\n    TotalReceivedMB,\\r\\n    TotalBandwidthMB\\r\\n| extend dummy = 1\\r\\n| project-away dummy\\r\\n| mv-expand \\r\\n    Column = pack_array(\\\"TotalSentMB\\\", \\\"TotalReceivedMB\\\", \\\"TotalBandwidthMB\\\"),\\r\\n    Value = pack_array(TotalSentMB, TotalReceivedMB, TotalBandwidthMB)\\r\\n| extend \\r\\n    snapshot = case(\\r\\n        Column == \\\"TotalSentMB\\\", \\\"Total Sent (MB)\\\",\\r\\n        Column == \\\"TotalReceivedMB\\\", \\\"Total Received (MB)\\\",\\r\\n        Column == \\\"TotalBandwidthMB\\\", \\\"Total Bandwidth (MB)\\\",\\r\\n        \\\"Unknown\\\"\\r\\n    ),\\r\\n    col1 = iff(Value < 0.01, 0.00, Value)\\r\\n| project-away Column, Value\\r\\n| order by snapshot asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"# Traffic Logs (filtered)\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where DestinationFqdn contains \\\"{URL}\\\"\\r\\n| project \\r\\n    Timestamp = TimeGenerated,\\r\\n    User = UserPrincipalName,\\r\\n    [\\\"Source IP\\\"] = SourceIp,\\r\\n    [\\\"Destination IP\\\"] = DestinationIp,\\r\\n    [\\\"Destination Port\\\"] = DestinationPort,\\r\\n    [\\\"Destination FQDN\\\"] = DestinationFqdn,\\r\\n    Action = case(\\r\\n        tolower(Action) == \\\"allow\\\", \\\"🟢 Allow\\\", \\r\\n        tolower(Action) == \\\"block\\\", \\\"🔴 Block\\\", \\r\\n        tolower(Action) // This returns the action in lowercase if it doesn't match \\\"allow\\\" or \\\"block\\\"\\r\\n    ),\\r\\n    [\\\"Policy Name\\\"] = PolicyName,\\r\\n    [\\\"Policy Rule ID\\\"] = PolicyRuleId,\\r\\n    [\\\"Received Bytes\\\"] = ReceivedBytes,\\r\\n    [\\\"Sent Bytes\\\"] = SentBytes,\\r\\n    [\\\"Device OS\\\"] = DeviceOperatingSystem    \\r\\n| order by Timestamp desc\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"]},\"name\":\"query - 13\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"URLLookup\"},\"name\":\"group - URL Lookup\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| project \\r\\n    Timestamp = TimeGenerated,\\r\\n    User = UserPrincipalName,\\r\\n    [\\\"Source IP\\\"] = SourceIp,\\r\\n    [\\\"Destination IP\\\"] = DestinationIp,\\r\\n    [\\\"Destination Port\\\"] = DestinationPort,\\r\\n    [\\\"Destination FQDN\\\"] = DestinationFqdn,\\r\\n    Action = case(\\r\\n        tolower(Action) == \\\"allow\\\", \\\"🟢 Allow\\\", \\r\\n        tolower(Action) == \\\"block\\\", \\\"🔴 Block\\\", \\r\\n        tolower(Action) // This returns the action in lowercase if it doesn't match \\\"allow\\\" or \\\"block\\\"\\r\\n    ),\\r\\n    [\\\"Policy Name\\\"] = PolicyName,\\r\\n    [\\\"Web Category\\\"] = DestinationWebCategories,\\r\\n    [\\\"Transport Protocol\\\"] = TransportProtocol,\\r\\n    [\\\"Traffic Type\\\"] = TrafficType,\\r\\n    [\\\"Received Bytes\\\"] = ReceivedBytes,\\r\\n    [\\\"Sent Bytes\\\"] = SentBytes,\\r\\n    [\\\"Device OS\\\"] = DeviceOperatingSystem,\\r\\n    [\\\"Policy Rule ID\\\"] = PolicyRuleId\\r\\n| order by Timestamp desc\\r\\n\",\"size\":3,\"title\":\"Traffic Logs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"rowLimit\":1000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"AllTraffic\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Unique Users\\nNetworkAccessTraffic\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\\n| project SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\n| summarize UniqueUsers=dcount(Country)\\n| extend snapshot = \\\"Total Locations\\\"\\n| project col1 = UniqueUsers, snapshot\\n\\n// Union with Unique Devices\\n| union (\\n    NetworkAccessTraffic\\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\\n    | extend BytesInGB = todouble(SentBytes + ReceivedBytes) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\\n    | summarize TotalBytesGB = sum(BytesInGB)\\n    | extend snapshot = \\\"Total Bytes (GB)\\\"\\n    | project col1 =   tolong(TotalBytesGB), snapshot\\n)\\n\\n// Union with Total Internet Access\\n| union (\\n    NetworkAccessTraffic\\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\\n    | summarize TotalTransactions = count()\\n    | extend snapshot = \\\"Total Transactions\\\"\\n    | project col1 = TotalTransactions, snapshot\\n)\\n\\n// Union with Total Private Access\\n// Order by Snapshot for consistent tile ordering on dashboard\\n| order by snapshot\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"snapshot\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"col1\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"ExistingClients\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"ExistingClients\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"ExistingClients\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend BytesIn = todouble(SentBytes + ReceivedBytes) / (1024 * 1024)  // Convert bytes to Mbytes\\r\\n| summarize TotalBytesMB = sum(BytesIn) by bin(TimeGenerated, 1h), TrafficType\\r\\n| order by bin(TimeGenerated, 1h) asc, TrafficType asc\\r\\n| project TimeGenerated, TrafficType, TotalBytesMB\\r\\n\",\"size\":2,\"title\":\"Usage Over Time (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"query - 0\"}]},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\\r\\n| project  TimeGenerated, SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| where Country != \\\"\\\"\\r\\n| summarize Count = count() by City, State, Country\\r\\n\\r\\n\",\"size\":3,\"title\":\"Locations\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Country\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"Country\",\"legendMetric\":\"Country\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"turquoise\"}}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"allow\\\" and DestinationWebCategories != '' // Filter for allowed traffic\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Top Allowed Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"block\\\" and DestinationWebCategories != '' // Filter for blocked traffic\\r\\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\\r\\n| summarize Count = count() by firstCategory\\r\\n| top 10 by Count\\r\\n\",\"size\":3,\"title\":\"Top Blocked Web Categories\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic  \\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where tolower(Action) == \\\"block\\\" and DestinationFqdn != ''  // Filter for blocked traffic with non-empty Destination FQDN\\r\\n| summarize Count = count() by [\\\"Destination FQDN\\\"] = DestinationFqdn, [\\\"Destination Web Categories\\\"] = DestinationWebCategories, [\\\"Policy Name\\\"] = PolicyName\\r\\n| order by Count\\r\\n\",\"size\":0,\"title\":\"Top Blocked Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":1000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_3\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_3\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\\r\\n| where SentBytes > 0\\r\\n| where tolower(Action) != \\\"block\\\"\\r\\n| summarize \\r\\n    Count = count(), \\r\\n    [\\\"Sent Bytes\\\"] = sum(SentBytes), \\r\\n    [\\\"Received Bytes\\\"] = sum(ReceivedBytes), \\r\\n    [\\\"Total Bytes\\\"] = sum(ReceivedBytes + SentBytes) \\r\\n    by [\\\"Destination FQDN\\\"] = DestinationFqdn\\r\\n| order by Count desc\\r\\n\",\"size\":0,\"title\":\"Top Allowed Destinations\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"magenta\"}},{\"columnMatch\":\"Recived\",\"formatter\":4,\"formatOptions\":{\"palette\":\"turquoise\"}},{\"columnMatch\":\"Total\",\"formatter\":4,\"formatOptions\":{\"palette\":\"pink\"}},{\"columnMatch\":\"Sent\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":1000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Count_1\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"NetworkAccessTraffic\\r\\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\\r\\n| where TransportProtocol != ''\\r\\n| summarize Count = count() by toupper(TransportProtocol)\\r\\n| top 10 by Count\\r\\n\",\"size\":2,\"title\":\"Protocol Distribution\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticWorkspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabSel\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"group - 4\"}],\"fallbackResourceIds\":[\"Global Secure Access\"],\"fromTemplateId\":\"GSA Network Traffic Insights\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "version": "1.0",
+                "sourceId": "[variables('workspaceResourceId')]",
+                "category": "sentinel"
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]",
+              "properties": {
+                "description": "@{workbookKey=GSANetworkTraffic; logoFileName=gsa.svg; description=This workbook provides an overview of all traffic logs within your network, offering insights into data transfer, anomalies, and potential threats.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Global Secure Access Traffic Logs; templateRelativePath=GSANetworkTraffic.json; subtitle=; provider=Microsoft}.description",
+                "parentId": "[variables('workbookId2')]",
+                "contentId": "[variables('_workbookContentId2')]",
+                "kind": "Workbook",
+                "version": "[variables('workbookVersion2')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                },
+                "dependencies": {
+                  "operator": "AND",
+                  "criteria": [
+                    {
+                      "contentId": "AzureActiveDirectory",
+                      "kind": "DataConnector"
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_workbookContentId2')]",
+        "contentKind": "Workbook",
+        "displayName": "[parameters('workbook2-name')]",
+        "contentProductId": "[variables('_workbookcontentProductId2')]",
+        "id": "[variables('_workbookcontentProductId2')]",
+        "version": "[variables('workbookVersion2')]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Identity - AfterHoursActivity_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query identifies connections that occur outside of the defined operational hours. It helps in monitoring and flagging any unusual activity that may occur during non-business hours, indicating potential security concerns or policy violations.",
+                "displayName": "Detect Connections Outside Operational Hours",
+                "enabled": false,
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet operational_start_hour = 8; // Start of operational hours (8 AM)\nlet operational_end_hour = 18; // End of operational hours (6 PM)\nNetworkAccessTraffic\n| where TimeGenerated between(starttime .. endtime)\n| extend HourOfDay = datetime_part('hour', TimeGenerated)\n| where HourOfDay < operational_start_hour or HourOfDay >= operational_end_hour\n| project TimeGenerated, UserPrincipalName, SourceIp, DestinationIp, DestinationPort, Action, DeviceId, DeviceOperatingSystem, ConnectionId\n| extend IPCustomEntity = SourceIp, AccountCustomEntity = UserPrincipalName\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT24H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "InitialAccess"
+                ],
+                "techniques": [
+                  "T1078",
+                  "T1133"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "AccountCustomEntity",
+                        "identifier": "Name"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "IPCustomEntity",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 1",
+                "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
+                "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect Connections Outside Operational Hours",
+        "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+        "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+        "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Identity - SharedSessions_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query identifies network sessions based on DeviceId and UserPrincipalName, then checks for changed IP addresses and overlapping session times.",
+                "displayName": "Detect IP Address Changes and Overlapping Sessions",
+                "enabled": false,
+                "query": "// Identify sessions\nlet sessions = \n  NetworkAccessTraffic\n  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SourceIps = make_set(SourceIp) by DeviceId, UserPrincipalName, SessionId\n  | sort by StartTime asc;\n// Check for changed IP addresses and overlapping session times\nsessions\n  | extend PreviousSourceIps = prev(SourceIps, 1)\n  | extend PreviousEndTime = prev(EndTime, 1)\n  | extend PreviousDeviceId = prev(DeviceId, 1)\n  | extend PreviousUserPrincipalName = prev(UserPrincipalName, 1)\n  | where DeviceId == PreviousDeviceId and UserPrincipalName == PreviousUserPrincipalName\n  | where set_difference(SourceIps, PreviousSourceIps) != dynamic([]) // Check if the current and previous IP sets differ\n  | where PreviousEndTime > StartTime // Check for overlapping session times\n  | project DeviceId, UserPrincipalName, SourceIps, PreviousSourceIps, StartTime, EndTime, PreviousEndTime\n  | extend IPCustomEntity = tostring(array_slice(SourceIps, 0, 1)[0]), PreviousIPCustomEntity = tostring(array_slice(PreviousSourceIps, 0, 1)[0]), AccountCustomEntity = UserPrincipalName\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT24H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "InitialAccess"
+                ],
+                "techniques": [
+                  "T1078",
+                  "T1133"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "AccountCustomEntity",
+                        "identifier": "Name"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "IPCustomEntity",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 2",
+                "parentId": "[variables('analyticRuleObject2').analyticRuleId2]",
+                "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject2').analyticRuleVersion2]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect IP Address Changes and Overlapping Sessions",
+        "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
+        "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
+        "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - exchange_auditlogdisabled_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies when the Exchange audit logging has been disabled, which may indicate an adversary attempt to evade detection or bypass other defenses.",
+                "displayName": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
+                "enabled": false,
+                "query": "// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"Exchange\" \n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    // Only admin or global-admin can disable audit logging\n    | where Operation =~ \"Set-AdminAuditLogConfig\"\n    | extend ParsedParameters = parse_json(Parameters)\n    | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)\n    | where AdminAuditLogEnabledValue =~ \"False\"\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue\n    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), \n                        iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), UserId))\n    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n    | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"Exchange\"\n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    | where Operation =~ \"Set-AdminAuditLogConfig\"\n    | extend ParsedParameters = parse_json(AdditionalProperties.Parameters)\n    | extend AdminAuditLogEnabledValue = tostring(ParsedParameters[3].Value)\n    | where AdminAuditLogEnabledValue =~ \"False\"\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = SourceIp, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters), AdminAuditLogEnabledValue\n    | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), \n                        iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), UserId))\n    | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n    | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n// Combine Office and Enriched Events and Deduplicate\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIP;\n// Project Final Output\nCombinedEvents\n    | project StartTimeUtc, EndTimeUtc, Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue, AccountName, AccountUPNSuffix, AccountNTDomain\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1562"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 3",
+                "parentId": "[variables('analyticRuleObject3').analyticRuleId3]",
+                "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject3').analyticRuleVersion3]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Exchange AuditLog Disabled",
+        "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
+        "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
+        "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - External User added to Team and immediately uploads file_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity.",
+                "displayName": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
+                "enabled": false,
+                "query": "let fileAccessThreshold = 10;\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend MemberAdded = tostring(parse_json(Members)[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName\n    | join kind=inner (\n        OfficeActivity\n        | where OfficeWorkload =~ \"MicrosoftTeams\"\n        | where Operation =~ \"MemberRemoved\"\n        | extend MemberAdded = tostring(parse_json(Members)[0].UPN)\n        | where MemberAdded contains \"#EXT#\"\n        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName\n    ) on MemberAdded\n    | where TimeDeleted > TimeAdded\n    | join kind=inner (\n        OfficeActivity\n        | where RecordType == \"SharePointFileOperation\"\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | where Operation == \"FileUploaded\"\n        | extend MemberAdded = UserId\n        | join kind=inner (\n            OfficeActivity\n            | where RecordType == \"SharePointFileOperation\"\n            | where Operation == \"FileAccessed\"\n            | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n            | summarize FileAccessCount = count() by OfficeObjectId\n            | where FileAccessCount > fileAccessThreshold\n        ) on OfficeObjectId\n    ) on MemberAdded\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n    | where MemberAdded contains \"#EXT#\"\n    | project TimeAdded = TimeGenerated, Operation, MemberAdded, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where Workload =~ \"MicrosoftTeams\"\n        | where Operation =~ \"MemberRemoved\"\n        | extend MemberAdded = tostring(parse_json(tostring(AdditionalProperties)).Members[0].UPN)\n        | where MemberAdded contains \"#EXT#\"\n        | project TimeDeleted = TimeGenerated, Operation, MemberAdded, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    ) on MemberAdded, TeamName\n    | where TimeDeleted > TimeAdded\n    | join kind=inner (\n        EnrichedMicrosoft365AuditLogs\n        | where RecordType == \"SharePointFileOperation\"\n        | where Operation == \"FileUploaded\"\n        | extend MemberAdded = UserId, SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n        | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n        | join kind=inner (\n            EnrichedMicrosoft365AuditLogs\n            | where RecordType == \"SharePointFileOperation\"\n            | where Operation == \"FileAccessed\"\n            | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl), TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n            | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n            | summarize FileAccessCount = count() by ObjectId, TeamName\n            | where FileAccessCount > fileAccessThreshold\n        ) on ObjectId, TeamName\n    ) on MemberAdded, TeamName\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// Combine Office and Enriched Events and Deduplicate\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeAdded, *) by MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName;\n// Project Final Output\nCombinedEvents\n    | extend MemberAddedAccountName = tostring(split(MemberAdded, \"@\")[0]), MemberAddedAccountUPNSuffix = tostring(split(MemberAdded, \"@\")[1])\n    | extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n    | extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n    | project TimeAdded, TimeDeleted, MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, MemberAddedAccountName, MemberAddedAccountUPNSuffix, UserWhoAddedAccountName, UserWhoAddedAccountUPNSuffix, UserWhoDeletedAccountName, UserWhoDeletedAccountUPNSuffix\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Low",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Teams)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "InitialAccess"
+                ],
+                "techniques": [
+                  "T1566"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "MemberAdded",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "MemberAddedAccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "MemberAddedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserWhoAdded",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "UserWhoAddedAccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "UserWhoAddedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserWhoDeleted",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "UserWhoDeletedAccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "UserWhoDeletedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 4",
+                "parentId": "[variables('analyticRuleObject4').analyticRuleId4]",
+                "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject4').analyticRuleVersion4]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Accessed files shared by temporary external user",
+        "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
+        "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
+        "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - ExternalUserAddedRemovedInTeams_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour.",
+                "displayName": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
+                "enabled": false,
+                "query": "let TeamsAddDelOffice = (Op:string){\n  OfficeActivity\n  | where OfficeWorkload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where Members has (\"#EXT#\")\n  | mv-expand Members\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName, ClientIP\n};\nlet TeamsAddDelEnriched = (Op:string){\n  EnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"MicrosoftTeams\"\n  | where Operation == Op\n  | where tostring(AdditionalProperties.Members) has (\"#EXT#\")\n  | mv-expand Members = parse_json(tostring(AdditionalProperties.Members))\n  | extend UPN = tostring(Members.UPN)\n  | where UPN has (\"#EXT#\")\n  | project TimeGenerated, Operation, UPN, UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), ClientIP = SourceIp\n};\nlet TeamsAddOffice = TeamsAddDelOffice(\"MemberAdded\")\n  | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDelOffice = TeamsAddDelOffice(\"MemberRemoved\")\n  | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nlet TeamsAddEnriched = TeamsAddDelEnriched(\"MemberAdded\")\n  | project TimeAdded = TimeGenerated, Operation, MemberAdded = UPN, UserWhoAdded = UserId, TeamName, ClientIP;\nlet TeamsDelEnriched = TeamsAddDelEnriched(\"MemberRemoved\")\n  | project TimeDeleted = TimeGenerated, Operation, MemberRemoved = UPN, UserWhoDeleted = UserId, TeamName, ClientIP;\nlet TeamsAdd = TeamsAddOffice\n  | union TeamsAddEnriched\n  | project TimeAdded, Operation, MemberAdded, UserWhoAdded, TeamName, ClientIP;\nlet TeamsDel = TeamsDelOffice\n  | union TeamsDelEnriched\n  | project TimeDeleted, Operation, MemberRemoved, UserWhoDeleted, TeamName, ClientIP;\nTeamsAdd\n| join kind=inner (TeamsDel) on $left.MemberAdded == $right.MemberRemoved\n| where TimeDeleted > TimeAdded\n| project TimeAdded, TimeDeleted, MemberAdded_Removed = MemberAdded, UserWhoAdded, UserWhoDeleted, TeamName, ClientIP\n| extend MemberAdded_RemovedAccountName = tostring(split(MemberAdded_Removed, \"@\")[0]), MemberAdded_RemovedAccountUPNSuffix = tostring(split(MemberAdded_Removed, \"@\")[1])\n| extend UserWhoAddedAccountName = tostring(split(UserWhoAdded, \"@\")[0]), UserWhoAddedAccountUPNSuffix = tostring(split(UserWhoAdded, \"@\")[1])\n| extend UserWhoDeletedAccountName = tostring(split(UserWhoDeleted, \"@\")[0]), UserWhoDeletedAccountUPNSuffix = tostring(split(UserWhoDeleted, \"@\")[1])\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Low",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Teams)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1136"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "MemberAdded_Removed",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "MemberAdded_RemovedAccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "MemberAdded_RemovedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserWhoAdded",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "UserWhoAddedAccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "UserWhoAddedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserWhoDeleted",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "UserWhoDeletedAccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "UserWhoDeletedAccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 5",
+                "parentId": "[variables('analyticRuleObject5').analyticRuleId5]",
+                "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject5').analyticRuleVersion5]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - External User Added and Removed in Short Timeframe",
+        "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
+        "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
+        "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - Mail_redirect_via_ExO_transport_rule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies when an Exchange Online transport rule is configured to forward emails.\nThis could indicate an adversary mailbox configured to collect mail from multiple user accounts.",
+                "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+                "enabled": false,
+                "query": "// OfficeActivity Query\nlet officeActivityQuery = OfficeActivity\n  | where OfficeWorkload == \"Exchange\"\n  | where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n  | mv-apply DynamicParameters = todynamic(Parameters) on (\n      summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | extend RuleName = case(\n      Operation =~ \"Set-TransportRule\", OfficeObjectId,\n      Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n      \"Unknown\"\n    )\n  | mv-expand ExpandedParameters = todynamic(Parameters)\n  | where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n  | extend RedirectTo = ExpandedParameters.Value\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n  | extend From = ParsedParameters.From\n  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters\n  | extend AccountName = tostring(split(UserId, \"@\")[0]),\n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// EnrichedMicrosoft365AuditLogs Query\nlet enrichedLogsQuery = EnrichedMicrosoft365AuditLogs\n  | where Workload == \"Exchange\"\n  | where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\n  | extend AdditionalProps = parse_json(AdditionalProperties)\n  | mv-apply DynamicParameters = todynamic(AdditionalProps.Parameters) on (\n      summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n  | extend RuleName = case(\n      Operation =~ \"Set-TransportRule\", ObjectId,\n      Operation =~ \"New-TransportRule\", ParsedParameters.Name,\n      \"Unknown\"\n    )\n  | mv-expand ExpandedParameters = todynamic(AdditionalProps.Parameters)\n  | where ExpandedParameters.Name in~ (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n  | extend RedirectTo = ExpandedParameters.Value\n  | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n  | extend From = ParsedParameters.From\n  | extend UserAgent = tostring(AdditionalProps.UserAgent)\n  | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, From, Operation, RuleName, Parameters = tostring(AdditionalProps.Parameters), UserAgent\n  | extend AccountName = tostring(split(UserId, \"@\")[0]),\n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine both queries\nunion isfuzzy=true officeActivityQuery, enrichedLogsQuery\n| summarize arg_min(TimeGenerated, *) by RuleName, RedirectTo\n| project TimeGenerated, RedirectTo, IPAddress, Port, UserId, From, Operation, RuleName, Parameters, AccountName, AccountUPNSuffix\n| order by TimeGenerated desc;\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
+                  },
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "Collection",
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1114",
+                  "T1020"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "IPAddress",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 6",
+                "parentId": "[variables('analyticRuleObject6').analyticRuleId6]",
+                "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject6').analyticRuleVersion6]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+        "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
+        "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
+        "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - Malicious_Inbox_Rule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.\nThis is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.\nReference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/",
+                "displayName": "GSA Enriched Office 365 - Malicious Inbox Rule",
+                "enabled": false,
+                "query": "let Keywords = dynamic([\"helpdesk\", \"alert\", \"suspicious\", \"fake\", \"malicious\", \"phishing\", \"spam\", \"do not click\", \"do not open\", \"hijacked\", \"Fatal\"]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n  | where OfficeWorkload =~ \"Exchange\" \n  | where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n  | where Parameters has \"Deleted Items\" or Parameters has \"Junk Email\" or Parameters has \"DeleteMessage\"\n  | extend Events = todynamic(Parameters)\n  | parse Events with * \"SubjectContainsWords\" SubjectContainsWords '}'*\n  | parse Events with * \"BodyContainsWords\" BodyContainsWords '}'*\n  | parse Events with * \"SubjectOrBodyContainsWords\" SubjectOrBodyContainsWords '}'*\n  | where SubjectContainsWords has_any (Keywords)\n      or BodyContainsWords has_any (Keywords)\n      or SubjectOrBodyContainsWords has_any (Keywords)\n  | extend ClientIPAddress = case(\n      ClientIP has \".\", tostring(split(ClientIP, \":\")[0]),\n      ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))),\n      ClientIP\n    )\n  | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))\n  | extend RuleDetail = case(\n      OfficeObjectId contains '/', tostring(split(OfficeObjectId, '/')[-1]),\n      OfficeObjectId contains '\\\\', tostring(split(OfficeObjectId, '\\\\')[-1]),\n      \"Unknown\"\n    )\n  | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, OriginatingServer, OfficeObjectId, RuleDetail\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend OriginatingServerName = tostring(split(OriginatingServer, \" \")[0]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload =~ \"Exchange\"\n  | where Operation =~ \"New-InboxRule\" and (ResultStatus =~ \"True\" or ResultStatus =~ \"Succeeded\")\n  | where tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Deleted Items\" \n      or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"Junk Email\" \n      or tostring(parse_json(tostring(AdditionalProperties)).Parameters) has \"DeleteMessage\"\n  | extend Events = parse_json(tostring(AdditionalProperties)).Parameters\n  | extend SubjectContainsWords = tostring(Events.SubjectContainsWords), \n           BodyContainsWords = tostring(Events.BodyContainsWords), \n           SubjectOrBodyContainsWords = tostring(Events.SubjectOrBodyContainsWords)\n  | where SubjectContainsWords has_any (Keywords) \n      or BodyContainsWords has_any (Keywords) \n      or SubjectOrBodyContainsWords has_any (Keywords)\n  | extend ClientIPAddress = case(\n      ClientIp has \".\", tostring(split(ClientIp, \":\")[0]),\n      ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n      ClientIp\n    )\n  | extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, iff(isnotempty(BodyContainsWords), BodyContainsWords, SubjectOrBodyContainsWords))\n  | extend RuleDetail = case(\n      ObjectId contains '/', tostring(split(ObjectId, '/')[-1]),\n      ObjectId contains '\\\\', tostring(split(ObjectId, '\\\\')[-1]),\n      \"Unknown\"\n    )\n  | summarize count(), StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by Operation, UserId, ClientIPAddress, ResultStatus, Keyword, ObjectId, RuleDetail\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine and Deduplicate\nlet CombinedEvents = OfficeEvents\n  | union EnrichedEvents\n  | summarize arg_min(StartTimeUtc, *) by Operation, UserId, ClientIPAddress;\n\n// Final Output\nCombinedEvents\n  | project StartTimeUtc, EndTimeUtc, Operation, UserId, ClientIPAddress, ResultStatus, Keyword, RuleDetail, AccountName, AccountUPNSuffix;\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Persistence",
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1098",
+                  "T1078"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIPAddress",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 7",
+                "parentId": "[variables('analyticRuleObject7').analyticRuleId7]",
+                "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject7').analyticRuleVersion7]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Malicious Inbox Rule",
+        "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
+        "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
+        "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - MultipleTeamsDeletes_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This detection flags the occurrences of deleting multiple teams within a day.\nThis data is a part of Office 365 Connector in Microsoft Sentinel.",
+                "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+                "enabled": false,
+                "query": "// Set the maximum number of deleted teams to flag suspicious activity\nlet max_delete_count = 3;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(tostring(AdditionalProperties.TeamName), 1000) by UserId\n    | where array_length(DeletedTeams) > max_delete_count\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId\n    | where array_length(DeletedTeams) > max_delete_count\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DeletedTeams, UserId, AccountName, AccountUPNSuffix\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Low",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Teams)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Impact"
+                ],
+                "techniques": [
+                  "T1485",
+                  "T1489"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 8",
+                "parentId": "[variables('analyticRuleObject8').analyticRuleId8]",
+                "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject8').analyticRuleVersion8]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+        "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
+        "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
+        "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - Office_MailForwarding_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.",
+                "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+                "enabled": false,
+                "query": "// Set query parameters\nlet queryfrequency = 1d;\nlet queryperiod = 7d;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(queryperiod)\n    | where Workload =~ \"Exchange\"\n    // Uncomment or adjust the following line based on actual field usage\n    // | where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")\n    | where tostring(AdditionalProperties.Parameters) has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(tostring(AdditionalProperties.Parameters)) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n      )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated > ago(queryperiod)\n    | where OfficeWorkload =~ \"Exchange\"\n    // Uncomment or adjust the following line based on actual field usage\n    // | where Operation in (\"Set-Mailbox\", \"New-InboxRule\", \"Set-InboxRule\")\n    | where Parameters has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n      )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by tostring(DestinationMailAddress), ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DestinationMailAddress, ClientIP, DistinctUserCount, UserId, Ports, EventCount, AccountName, AccountUPNSuffix\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P7D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Collection",
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1114",
+                  "T1020"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 9",
+                "parentId": "[variables('analyticRuleObject9').analyticRuleId9]",
+                "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject9').analyticRuleVersion9]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+        "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
+        "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
+        "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - office_policytampering_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies if any tampering is done to either audit log, ATP Safelink, SafeAttachment, AntiPhish, or Dlp policy. \nAn adversary may use this technique to evade detection or avoid other policy-based defenses.\nReferences: https://docs.microsoft.com/powershell/module/exchange/advanced-threat-protection/remove-antiphishrule?view=exchange-ps.",
+                "displayName": "GSA Enriched Office 365 - Office Policy Tampering",
+                "enabled": false,
+                "query": "// Query for EnrichedMicrosoft365AuditLogs\nlet enrichedOpList = EnrichedMicrosoft365AuditLogs \n    | summarize by Operation\n    | where Operation has_any (\"Remove\", \"Disable\")\n    | where Operation contains \"AntiPhish\" \n        or Operation contains \"SafeAttachment\" \n        or Operation contains \"SafeLinks\" \n        or Operation contains \"Dlp\" \n        or Operation contains \"Audit\"\n    | summarize make_set(Operation, 500);\n\nlet enrichedLogs = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"ExchangeAdmin\"\n    | where UserType in~ (\"Admin\", \"DcAdmin\")\n    | where Operation in~ (enrichedOpList)\n    | extend ClientIPOnly = case( \n        ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), \n        ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))),\n        ClientIp\n      )  \n    | extend Port = case(\n        ClientIp has \".\", tostring(split(ClientIp, \":\")[1]),\n        ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]),\n        \"\"\n      )\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters = tostring(AdditionalProperties.Parameters)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Query for OfficeActivity\nlet officeOpList = OfficeActivity \n    | summarize by Operation\n    | where Operation has_any (\"Remove\", \"Disable\")\n    | where Operation contains \"AntiPhish\" \n        or Operation contains \"SafeAttachment\" \n        or Operation contains \"SafeLinks\" \n        or Operation contains \"Dlp\" \n        or Operation contains \"Audit\"\n    | summarize make_set(Operation, 500);\n\nlet officeLogs = OfficeActivity\n    | where RecordType =~ \"ExchangeAdmin\"\n    | where UserType in~ (\"Admin\",\"DcAdmin\")\n    | where Operation in~ (officeOpList)\n    | extend ClientIPOnly = case( \n        ClientIP has \".\", tostring(split(ClientIP,\":\")[0]), \n        ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP,\"]\")[0]))),\n        ClientIP\n      )  \n    | extend Port = case(\n        ClientIP has \".\", tostring(split(ClientIP,\":\")[1]),\n        ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]),\n        \"\"\n      )\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \n        by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Enriched Logs and Office Activity Logs\nunion isfuzzy=true enrichedLogs, officeLogs\n| summarize StartTimeUtc = min(StartTimeUtc), EndTimeUtc = max(EndTimeUtc), TotalOperationCount = sum(OperationCount) \n    by Operation, UserType, UserId, ClientIP, Port, ResultStatus, Parameters, AccountName, AccountUPNSuffix\n| order by StartTimeUtc desc;\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (Exchange)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Persistence",
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1098",
+                  "T1562"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 10",
+                "parentId": "[variables('analyticRuleObject10').analyticRuleId10]",
+                "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject10').analyticRuleVersion10]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Office Policy Tampering",
+        "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
+        "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
+        "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - Office_Uploaded_Executables_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive.\nList currently includes exe, inf, gzip, cmd, bat file extensions.\nAdditionally, identifies when a given user is uploading these files to another user's workspace.\nThis may be an indication of a staging location for malware or other malicious activity.",
+                "displayName": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
+                "enabled": false,
+                "query": "// Set query parameters\nlet threshold = 2;\nlet uploadOp = 'FileUploaded';\n// Extensions that are interesting. Add/Remove to this list as you see fit\nlet execExt = dynamic(['exe', 'inf', 'gzip', 'cmd', 'bat']);\nlet starttime = 8d;\nlet endtime = 1d;\n\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated >= ago(endtime)\n    | where Operation =~ uploadOp\n    | where SourceFileExtension has_any (execExt)\n    | extend RecordType = coalesce(tostring(RecordType), \"UnknownRecordType\")  // Ensure RecordType is a string\n    | project TimeGenerated, OfficeId, OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName\n    | join kind=leftanti (\n        OfficeActivity\n        | where TimeGenerated between (ago(starttime) .. ago(endtime))\n        | where Operation =~ uploadOp\n        | where SourceFileExtension has_any (execExt)\n        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName\n        // Uncomment the line below to enforce the threshold\n        //| where PrevSeenCount > threshold\n        | mvexpand SourceRelativeUrl, UserId\n        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId\n    ) on SourceFileName, SourceRelativeUrl, UserId\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string\n    by OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated >= ago(endtime)\n    | where Operation == uploadOp\n    | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n    | where SourceFileExtension in (execExt)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend RecordType = coalesce(tostring(RecordType), \"UnknownRecordType\")  // Ensure RecordType is a string\n    | project TimeGenerated, Id, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent), Site_Url, SourceRelativeUrl, SourceFileName\n    | join kind=leftanti (\n        EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (ago(starttime) .. ago(endtime))\n        | where Operation == uploadOp\n        | extend SourceFileExtension = extract(@\"\\.([^\\./]+)$\", 1, tostring(parse_json(tostring(AdditionalProperties)).SourceFileName))  // Extract file extension\n        | where SourceFileExtension in (execExt)\n        | extend SourceRelativeUrl = tostring(parse_json(tostring(AdditionalProperties)).SourceRelativeUrl)\n        | summarize SourceRelativeUrl = make_set(SourceRelativeUrl, 100000), UserId = make_set(UserId, 100000), PrevSeenCount = count() by SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n        // Uncomment the line below to enforce the threshold\n        //| where PrevSeenCount > threshold\n        | mvexpand SourceRelativeUrl, UserId\n        | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId)  // Ensure consistent types for SourceRelativeUrl and UserId\n    ) on SourceFileName, SourceRelativeUrl, UserId\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserAgents = make_list(UserAgent, 100000), Ids = make_list(Id, 100000), SourceRelativeUrls = make_list(tostring(SourceRelativeUrl), 100000), FileNames = make_list(tostring(SourceFileName), 100000)  // Cast FileNames to string\n    by Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIp, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine Office and Enriched Logs\nlet CombinedEvents = EnrichedEvents\n    | union isfuzzy=true OfficeEvents\n    | summarize arg_min(StartTime, *) by tostring(FileNames), UserId, Site_Url, tostring(RecordType)  // Ensure FileNames and RecordType are strings\n    | order by StartTime desc;\n\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, Workload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, Site_Url, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder, FileNames, UserAgents, AccountName, AccountUPNSuffix;\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P8D",
+                "severity": "Low",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "CommandAndControl",
+                  "LateralMovement"
+                ],
+                "techniques": [
+                  "T1105",
+                  "T1570"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "URL",
+                    "fieldMappings": [
+                      {
+                        "columnName": "Site_Url",
+                        "identifier": "Url"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "File",
+                    "fieldMappings": [
+                      {
+                        "columnName": "FileNames",
+                        "identifier": "Name"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 11",
+                "parentId": "[variables('analyticRuleObject11').analyticRuleId11]",
+                "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject11').analyticRuleVersion11]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - New Executable via Office FileUploaded Operation",
+        "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
+        "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
+        "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - RareOfficeOperations_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies Office operations that are typically rare and can provide capabilities useful to attackers.",
+                "displayName": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
+                "enabled": false,
+                "query": "// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\n    and not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') \n         and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n    | extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIP)[0])\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Operation in~ ( \"Add-MailboxPermission\", \"Add-MailboxFolderPermission\", \"Set-Mailbox\", \"New-ManagementRoleAssignment\", \"New-InboxRule\", \"Set-InboxRule\", \"Set-TransportRule\")\n    and not(UserId has_any ('NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)', 'NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)', 'NT AUTHORITY\\\\SYSTEM (w3wp)', 'devilfish-applicationaccount') \n         and Operation in~ ( \"Add-MailboxPermission\", \"Set-Mailbox\"))\n    | extend ClientIPOnly = tostring(extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?', dynamic([\"IPAddress\"]), ClientIp)[0])\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), \n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n\n// Combine and Deduplicate Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by Operation, UserId, ClientIPOnly;\n\n// Final Output\nCombinedEvents\n    | project TimeGenerated, Operation, UserId, AccountName, AccountUPNSuffix, ClientIPOnly\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Low",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Persistence",
+                  "Collection"
+                ],
+                "techniques": [
+                  "T1098",
+                  "T1114"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIPOnly",
+                        "identifier": "Address"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 12",
+                "parentId": "[variables('analyticRuleObject12').analyticRuleId12]",
+                "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject12').analyticRuleVersion12]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Rare and Potentially High-Risk Office Operations",
+        "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
+        "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
+        "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - SharePoint_Downloads_byNewIP_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25.",
+                "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
+                "enabled": false,
+                "query": "let threshold = 25;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n\n// Define a baseline of normal user behavior for OfficeActivity\nlet userBaselineOffice = OfficeActivity\n    | where TimeGenerated between(ago(starttime)..ago(endtime))\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | summarize Count = count() by UserId, Operation, Site_Url, ClientIP\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIP;\n\n// Get recent user activity for OfficeActivity\nlet recentUserActivityOffice = OfficeActivity\n    | where TimeGenerated > ago(endtime)\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIP, OfficeObjectId, OfficeWorkload, UserAgent;\n\n// Define a baseline of normal user behavior for EnrichedMicrosoft365AuditLogs\nlet userBaselineEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(ago(starttime)..ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | summarize Count = count() by UserId, Operation, Site_Url, ClientIp\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url, ClientIp;\n\n// Get recent user activity for EnrichedMicrosoft365AuditLogs\nlet recentUserActivityEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by UserId, UserType, Operation, Site_Url, ClientIp, ObjectId, Workload, UserAgent;\n\n// Combine user baselines and recent activity, calculate deviation, and deduplicate\nlet UserBehaviorAnalysis = userBaselineOffice\n    | join kind=inner (recentUserActivityOffice) on UserId, Operation, Site_Url, ClientIP\n    | union (userBaselineEnriched | join kind=inner (recentUserActivityEnriched) on UserId, Operation, Site_Url, ClientIp)\n    | extend Deviation = abs(RecentCount - AvgCount) / AvgCount;\n\n// Filter for significant deviations\nUserBehaviorAnalysis\n    | where Deviation > threshold\n    | project StartTimeUtc, EndTimeUtc, UserId, UserType, Operation, ClientIP, Site_Url, ObjectId, OfficeObjectId, OfficeWorkload, Workload, UserAgent, Deviation, Count = RecentCount\n    | order by Count desc, ClientIP asc, Operation asc, UserId asc\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P14D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1030"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "URL",
+                    "fieldMappings": [
+                      {
+                        "columnName": "Site_Url",
+                        "identifier": "Url"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 13",
+                "parentId": "[variables('analyticRuleObject13').analyticRuleId13]",
+                "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject13').analyticRuleVersion13]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Previously Unseen IPs",
+        "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
+        "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
+        "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - SharePoint_Downloads_byNewUserAgent_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25%).",
+                "displayName": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
+                "enabled": false,
+                "query": "let threshold = 5;\nlet szSharePointFileOperation = \"SharePointFileOperation\";\nlet szOperations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet starttime = 14d;\nlet endtime = 1d;\n\n// OfficeActivity - Base Events\nlet BaseeventsOffice = OfficeActivity\n    | where TimeGenerated between (ago(starttime)..ago(endtime))\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent);\n\n// OfficeActivity - Frequent User Agents\nlet FrequentUAOffice = BaseeventsOffice\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n\n// OfficeActivity - User Baseline\nlet UserBaseLineOffice = BaseeventsOffice\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n\n// OfficeActivity - Recent User Activity\nlet RecentActivityOffice = OfficeActivity\n    | where TimeGenerated > ago(endtime)\n    | where RecordType =~ szSharePointFileOperation\n    | where Operation in~ (szOperations)\n    | where isnotempty(UserAgent)\n    | where UserAgent in~ (FrequentUAOffice)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OfficeObjectIdCount = dcount(OfficeObjectId), OfficeObjectIdList = make_set(OfficeObjectId), UserAgentSeenCount = count()\n        by RecordType, Operation, UserAgent, UserType, UserId, ClientIP , OfficeWorkload, Site_Url;\n\n// EnrichedMicrosoft365AuditLogs - Base Events\nlet BaseeventsEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(starttime)..ago(endtime))\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(UserAgent);\n\n// EnrichedMicrosoft365AuditLogs - Frequent User Agents\nlet FrequentUAEnriched = BaseeventsEnriched\n    | summarize FUACount = count() by UserAgent, RecordType, Operation\n    | where FUACount >= threshold\n    | distinct UserAgent;\n\n// EnrichedMicrosoft365AuditLogs - User Baseline\nlet UserBaseLineEnriched = BaseeventsEnriched\n    | summarize Count = count() by UserId, Operation, Site_Url\n    | summarize AvgCount = avg(Count) by UserId, Operation, Site_Url;\n\n// EnrichedMicrosoft365AuditLogs - Recent User Activity\nlet RecentActivityEnriched = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(endtime)\n    | where RecordType == szSharePointFileOperation\n    | where Operation in (szOperations)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | extend  ClientIP = ClientIp\n    | where isnotempty(UserAgent)\n    | where UserAgent in (FrequentUAEnriched)\n    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ObjectIdCount = dcount(ObjectId), ObjectIdList = make_set(ObjectId), UserAgentSeenCount = count()\n        by RecordType, Operation, UserAgent, UserId,ClientIP, Site_Url;\n\n// Combine Baseline and Recent Activity, Calculate Deviation, and Deduplicate\nlet UserBehaviorAnalysisOffice = UserBaseLineOffice\n    | join kind=inner (RecentActivityOffice) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n\nlet UserBehaviorAnalysisEnriched = UserBaseLineEnriched\n    | join kind=inner (RecentActivityEnriched) on UserId, Operation, Site_Url\n    | extend Deviation = abs(UserAgentSeenCount - AvgCount) / AvgCount;\n\n// Combine Office and Enriched Logs\nlet CombinedUserBehaviorAnalysis = UserBehaviorAnalysisOffice\n    | union UserBehaviorAnalysisEnriched;\n\n// Filter and Format Final Results\nCombinedUserBehaviorAnalysis\n    | where Deviation > 0.25\n    | extend UserIdName = tostring(split(UserId, '@')[0]), \n             UserIdUPNSuffix = tostring(split(UserId, '@')[1])\n    | project-reorder StartTimeUtc, EndTimeUtc, UserAgent, UserAgentSeenCount, UserId, ClientIP, Site_Url\n    | order by UserAgentSeenCount desc, UserAgent asc, UserId asc, Site_Url asc\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P14D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1030"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "UserIdName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "UserIdUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "URL",
+                    "fieldMappings": [
+                      {
+                        "columnName": "Site_Url",
+                        "identifier": "Url"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 14",
+                "parentId": "[variables('analyticRuleObject14').analyticRuleId14]",
+                "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject14').analyticRuleVersion14]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - SharePointFileOperation via devices with previously unseen user agents",
+        "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
+        "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
+        "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - sharepoint_file_transfer_above_threshold_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies Office365 SharePoint file transfers above a certain threshold in a 15-minute time period.\nPlease note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
+                "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
+                "enabled": false,
+                "query": "let threshold = 5000;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload has_any(\"SharePoint\", \"OneDrive\")\n    | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n    | extend ClientIP = ClientIp\n    | summarize TransferCount = dcount(ObjectId), fileslist = make_set(ObjectId, 10000)\n        by UserId, ClientIP, bin(TimeGenerated, 15m)\n    | where TransferCount >= threshold\n    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),\n             strcat(\"SeeFilesListField_\", tostring(hash(tostring(fileslist)))))\n    | extend AccountName = tostring(split(UserId, \"@\")[0]),\n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where EventSource == \"SharePoint\"\n    | where OfficeWorkload has_any(\"SharePoint\", \"OneDrive\")\n    | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n    | summarize TransferCount = dcount(OfficeObjectId), fileslist = make_set(OfficeObjectId, 10000)\n        by UserId, ClientIP, bin(TimeGenerated, 15m)\n    | where TransferCount >= threshold\n    | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),\n             strcat(\"SeeFilesListField_\", tostring(hash(tostring(fileslist)))))\n    | extend AccountName = tostring(split(UserId, \"@\")[0]),\n             AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, TransferCount, fileslist\n    | order by TimeGenerated desc\n",
+                "queryFrequency": "PT15M",
+                "queryPeriod": "PT15M",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1020"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "File",
+                    "fieldMappings": [
+                      {
+                        "columnName": "FileSample",
+                        "identifier": "Name"
+                      }
+                    ]
+                  }
+                ],
+                "customDetails": {
+                  "TransferCount": "TransferCount",
+                  "FilesList": "fileslist"
+                },
+                "incidentConfiguration": {
+                  "groupingConfiguration": {
+                    "reopenClosedIncident": false,
+                    "enabled": true,
+                    "lookbackDuration": "PT5H",
+                    "matchingMethod": "Selected",
+                    "groupByEntities": [
+                      "Account"
+                    ]
+                  },
+                  "createIncident": true
+                }
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 15",
+                "parentId": "[variables('analyticRuleObject15').analyticRuleId15]",
+                "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject15').analyticRuleVersion15]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
+        "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
+        "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
+        "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Office 365 - sharepoint_file_transfer_folders_above_threshold_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies Office365 SharePoint file transfers with a distinct folder count above a certain threshold in a 15-minute time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.",
+                "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
+                "enabled": false,
+                "query": "let threshold = 5000;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n  | where Workload has_any(\"SharePoint\", \"OneDrive\")\n  | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n  | extend UserAgent = tostring(AdditionalProperties[\"UserAgent\"])\n  | summarize count_distinct_ObjectId = dcount(ObjectId),\n              fileslist = make_set(ObjectId, 10000),\n              any_UserAgent = any(UserAgent)\n    by UserId, ClientIP = ClientIp, bin(TimeGenerated, 15m)\n  | where count_distinct_ObjectId >= threshold\n  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),\n               strcat(\"SeeFilesListField_\", tostring(hash(tostring(fileslist)))))\n  | extend AccountName = tostring(split(UserId, \"@\")[0]),\n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n  | where EventSource == \"SharePoint\"\n  | where OfficeWorkload has_any(\"SharePoint\", \"OneDrive\")\n  | where Operation has_any(\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncUploadedFull\", \"FileUploaded\")\n  | summarize count_distinct_ObjectId = dcount(OfficeObjectId),\n              fileslist = make_set(OfficeObjectId, 10000),\n              any_UserAgent = any(UserAgent)\n    by UserId, ClientIP, bin(TimeGenerated, 15m)\n  | where count_distinct_ObjectId >= threshold\n  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]),\n               strcat(\"SeeFilesListField_\", tostring(hash(tostring(fileslist)))))\n  | extend AccountName = tostring(split(UserId, \"@\")[0]),\n           AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n  | union EnrichedEvents\n  | summarize arg_min(TimeGenerated, *) by UserId, ClientIP, any_UserAgent;\n// Final Output\nCombinedEvents\n  | extend TransferCount = count_distinct_ObjectId\n  | project TimeGenerated, UserId, ClientIP, AccountName, AccountUPNSuffix, FileSample, UserAgent = any_UserAgent, TransferCount, fileslist\n  | order by TimeGenerated desc\n",
+                "queryFrequency": "PT15M",
+                "queryPeriod": "PT15M",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  },
+                  {
+                    "dataTypes": [
+                      "OfficeActivity (SharePoint)"
+                    ],
+                    "connectorId": "Office365"
+                  }
+                ],
+                "tactics": [
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1020"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "Account",
+                    "fieldMappings": [
+                      {
+                        "columnName": "UserId",
+                        "identifier": "FullName"
+                      },
+                      {
+                        "columnName": "AccountName",
+                        "identifier": "Name"
+                      },
+                      {
+                        "columnName": "AccountUPNSuffix",
+                        "identifier": "UPNSuffix"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "ClientIP",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "File",
+                    "fieldMappings": [
+                      {
+                        "columnName": "FileSample",
+                        "identifier": "Name"
+                      }
+                    ]
+                  }
+                ],
+                "customDetails": {
+                  "TransferCount": "TransferCount",
+                  "FilesList": "fileslist"
+                },
+                "incidentConfiguration": {
+                  "groupingConfiguration": {
+                    "reopenClosedIncident": false,
+                    "enabled": true,
+                    "lookbackDuration": "PT5H",
+                    "matchingMethod": "Selected",
+                    "groupByEntities": [
+                      "Account"
+                    ]
+                  },
+                  "createIncident": true
+                }
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 16",
+                "parentId": "[variables('analyticRuleObject16').analyticRuleId16]",
+                "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject16').analyticRuleVersion16]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "GSA Enriched Office 365 - Sharepoint File Transfer Above Threshold",
+        "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
+        "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
+        "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SWG - Abnormal Deny Rate_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, initial access, or C2, where an attacker tries to exploit the same vulnerability on machines in the organization but is being blocked by firewall rules.",
+                "displayName": "Detect Abnormal Deny Rate for Source to Destination IP",
+                "enabled": false,
+                "query": "let NumOfStdsThreshold = 3;\nlet LearningPeriod = 5d;\nlet BinTime = 1h;\nlet MinThreshold = 5.0;\nlet MinLearningBuckets = 5;\nlet TrafficLogs = NetworkAccessTraffic\n  | where Action == 'Denied'\n  | where isnotempty(DestinationIp) and isnotempty(SourceIp);\nlet LearningSrcIpDenyRate = TrafficLogs\n  | where TimeGenerated between (ago(LearningPeriod + 1d) .. ago(1d))\n  | summarize count() by SourceIp, bin(TimeGenerated, BinTime), DestinationIp\n  | summarize LearningTimeSrcIpDenyRateAvg = avg(count_), LearningTimeSrcIpDenyRateStd = stdev(count_), LearningTimeBuckets = count() by SourceIp, DestinationIp\n  | where LearningTimeBuckets > MinLearningBuckets;\nlet AlertTimeSrcIpDenyRate = TrafficLogs\n  | where TimeGenerated between (ago(1h) .. now())\n  | summarize AlertTimeSrcIpDenyRateCount = count() by SourceIp, DestinationIp;\nAlertTimeSrcIpDenyRate\n  | join kind=leftouter (LearningSrcIpDenyRate) on SourceIp, DestinationIp\n  | extend LearningThreshold = max_of(LearningTimeSrcIpDenyRateAvg + NumOfStdsThreshold * LearningTimeSrcIpDenyRateStd, MinThreshold)\n  | where AlertTimeSrcIpDenyRateCount > LearningThreshold\n  | project SourceIp, DestinationIp, AlertTimeSrcIpDenyRateCount, LearningThreshold    \n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT25H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 1,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "NetworkAccessTrafficLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "InitialAccess",
+                  "Exfiltration",
+                  "CommandAndControl"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "SourceIp",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "URL",
+                    "fieldMappings": [
+                      {
+                        "columnName": "DestinationIp",
+                        "identifier": "Url"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 17",
+                "parentId": "[variables('analyticRuleObject17').analyticRuleId17]",
+                "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject17').analyticRuleVersion17]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect Abnormal Deny Rate for Source to Destination IP",
+        "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
+        "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
+        "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SWG - Abnormal Port to Protocol_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes.",
+                "displayName": "Detect Protocol Changes for Destination Ports",
+                "enabled": false,
+                "query": "let LearningPeriod = 7d;\nlet RunTime = 1d;\nlet StartLearningPeriod = ago(LearningPeriod + RunTime);\nlet EndRunTime = ago(RunTime);\nlet LearningPortToProtocol = \n  NetworkAccessTraffic\n  | where TimeGenerated between (StartLearningPeriod .. EndRunTime)\n  | where isnotempty(DestinationPort)\n  | summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;\nlet AlertTimePortToProtocol = \n  NetworkAccessTraffic\n  | where TimeGenerated between (EndRunTime .. now())\n  | where isnotempty(DestinationPort)\n  | summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;\nAlertTimePortToProtocol\n  | join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort and $left.SourceIp == $right.SourceIp and $left.DestinationFqdn == $right.DestinationFqdn\n  | where isnull(LearningTimeProtocol) or LearningTimeProtocol != AlertTimeProtocol\n  | project AlertTimeDstPort, AlertTimeProtocol, LearningTimeProtocol, SourceIp, DestinationFqdn\n  | extend IPCustomEntity = SourceIp, FqdnCustomEntity = DestinationFqdn\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "P8D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 1,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion",
+                  "Exfiltration",
+                  "CommandAndControl"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "IPCustomEntity",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "URL",
+                    "fieldMappings": [
+                      {
+                        "columnName": "FqdnCustomEntity",
+                        "identifier": "Url"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 18",
+                "parentId": "[variables('analyticRuleObject18').analyticRuleId18]",
+                "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject18').analyticRuleVersion18]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect Protocol Changes for Destination Ports",
+        "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
+        "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
+        "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject19').analyticRuleTemplateSpecName19]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SWG - Source IP Port Scan_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial access.",
+                "displayName": "Detect Source IP Scanning Multiple Open Ports",
+                "enabled": false,
+                "query": "let port_scan_time = 30s;\nlet min_ports_threshold = 100;\nNetworkAccessTraffic\n| where TimeGenerated > ago(1d)\n| where Action == 'Allowed'\n| summarize PortsScanned = dcount(DestinationPort) by SourceIp, bin(TimeGenerated, port_scan_time)\n| where PortsScanned > min_ports_threshold\n| project SourceIp, PortsScanned, TimeGenerated\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 1,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "EnrichedMicrosoft365AuditLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "Discovery"
+                ],
+                "techniques": [
+                  "T1046"
+                ],
+                "entityMappings": [
+                  {
+                    "entityType": "IP",
+                    "fieldMappings": [
+                      {
+                        "columnName": "SourceIp",
+                        "identifier": "Address"
+                      }
+                    ]
+                  },
+                  {
+                    "entityType": "URL",
+                    "fieldMappings": [
+                      {
+                        "columnName": "Fqdn",
+                        "identifier": "Url"
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject19').analyticRuleId19,'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Analytics Rule 19",
+                "parentId": "[variables('analyticRuleObject19').analyticRuleId19]",
+                "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject19').analyticRuleVersion19]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect Source IP Scanning Multiple Open Ports",
+        "contentProductId": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
+        "id": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
+        "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AnomolousUserAccessingOtherUsersMailbox_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_1",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 2);\nlet user_threshold = 1;    // Threshold for number of mailboxes accessed\nlet folder_threshold = 5;  // Threshold for number of mailbox folders accessed\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between (ago(lookback)..starttime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    | join kind=rightanti (\n        OfficeActivity\n        | where TimeGenerated between (starttime..endtime)\n        | where Operation =~ \"MailItemsAccessed\"\n        | where ResultStatus =~ \"Succeeded\"\n        | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    ) on MailboxOwnerUPN, UserId\n    | where isnotempty(Folders)\n    | mv-expand parse_json(Folders)\n    | extend folders = tostring(Folders.Path)\n    | extend ClientIP = iif(Client_IPAddress startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, Client_IPAddress), Client_IPAddress)\n    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n    | extend folder_count = array_length(set_folders)\n    | extend user_count = array_length(set_MailboxGuid)\n    | where user_count > user_threshold or folder_count > folder_threshold\n    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n    | sort by user_count desc\n    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (ago(lookback)..starttime)\n    | where Operation =~ \"MailItemsAccessed\"\n    | where ResultStatus =~ \"Succeeded\"\n    | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n    | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    | join kind=rightanti (\n        EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (starttime..endtime)\n        | where Operation =~ \"MailItemsAccessed\"\n        | where ResultStatus =~ \"Succeeded\"\n        | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n        | where tolower(MailboxOwnerUPN) != tolower(UserId)\n    ) on MailboxOwnerUPN, UserId\n    | where isnotempty(tostring(parse_json(AdditionalProperties).Folders))\n    | mv-expand Folders = parse_json(AdditionalProperties).Folders\n    | extend folders = tostring(Folders.Path)\n    | extend ClientIP = iif(ClientIp startswith \"[\", extract(\"\\\\[([^\\\\]]*)\", 1, ClientIp), ClientIp)\n    | extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)\n    | extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)\n    | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId\n    | extend folder_count = array_length(set_folders)\n    | extend user_count = array_length(set_MailboxGuid)\n    | where user_count > user_threshold or folder_count > folder_threshold\n    | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, \"Both User and Folder Threshold Exceeded\", folder_count > folder_threshold and user_count < user_threshold, \"Folder Count Threshold Exceeded\", \"User Threshold Exceeded\")\n    | sort by user_count desc\n    | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders, AccountName, AccountUPNSuffix\n    | order by user_count desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114.002"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 1",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]",
+                "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject1').huntingQueryVersion1]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Anomalous access to other users' mailboxes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "double_file_ext_exes_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_2",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Exes with double file extension and access summary",
+                "category": "Hunting Queries",
+                "query": "let known_ext = dynamic([\"lnk\", \"log\", \"option\", \"config\", \"manifest\", \"partial\"]);\nlet excluded_users = dynamic([\"app@sharepoint\"]);\nEnrichedMicrosoft365AuditLogs\n| where RecordType == \"SharePointFileOperation\" and isnotempty(ObjectId)\n| where ObjectId has \".exe.\" \n    and not(ObjectId endswith \".lnk\") \n    and not(ObjectId endswith \".log\") \n    and not(ObjectId endswith \".option\") \n    and not(ObjectId endswith \".config\") \n    and not(ObjectId endswith \".manifest\") \n    and not(ObjectId endswith \".partial\")\n| extend Extension = extract(\"[^.]*\\\\.[^.]*$\", 0, ObjectId)\n| extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n| join kind=leftouter (\n    EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\" and (Operation == \"FileDownloaded\" or Operation == \"FileAccessed\")\n    | where not(ObjectId endswith \".lnk\") \n        and not(ObjectId endswith \".log\") \n        and not(ObjectId endswith \".option\") \n        and not(ObjectId endswith \".config\") \n        and not(ObjectId endswith \".manifest\") \n        and not(ObjectId endswith \".partial\")\n) on ObjectId\n| where UserId1 !in (excluded_users)\n| extend userBag = bag_pack(\"UserId\", UserId1, \"ClientIp\", ClientIp1)\n| summarize make_set(UserId1, 10000), userBag = make_bag(userBag), UploadTime = max(TimeGenerated) by UserId, ObjectId, SourceFileName, Extension\n| extend NumberOfUsers = array_length(bag_keys(userBag))\n| project UploadTime, Uploader = UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy = userBag, Extension, NumberOfUsers\n| extend UploaderName = tostring(split(Uploader, \"@\")[0]), UploaderUPNSuffix = tostring(split(Uploader, \"@\")[1])\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Provides a summary of executable files with double file extensions in SharePoint \n and the users and IP addresses that have accessed them."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1036"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 2",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]",
+                "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject2').huntingQueryVersion2]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Exes with double file extension and access summary",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '2.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '2.0.1')))]",
+        "version": "2.0.1"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ExternalUserAddedRemovedInTeams_HuntVersion_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_3",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "External User Added and Removed in a Short Timeframe",
+                "category": "Hunting Queries",
+                "query": "// If you want to look at user added further than 7 days ago adjust this value\n// If you want to change the timeframe of how quickly accounts need to be added and removed change this value\nlet time_delta = 1h;\nEnrichedMicrosoft365AuditLogs\n| where Workload == \"MicrosoftTeams\"\n| where Operation == \"MemberAdded\"\n| extend UPN = tostring(parse_json(tostring(AdditionalProperties)).UPN) // Assuming UPN is stored in AdditionalProperties\n| where UPN contains \"#EXT#\"\n| project TimeAdded = TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), TeamGuid = tostring(parse_json(tostring(AdditionalProperties)).TeamGuid)\n| join kind=innerunique (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRemoved\"\n    | extend UPN = tostring(parse_json(tostring(AdditionalProperties)).UPN) // Assuming UPN is stored in AdditionalProperties\n    | where UPN contains \"#EXT#\"\n    | project TimeDeleted = TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), TeamGuid = tostring(parse_json(tostring(AdditionalProperties)).TeamGuid)\n) on UPN, TeamGuid\n| where TimeDeleted < (TimeAdded + time_delta)\n| project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName, TeamGuid\n| extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query identifies external user accounts that are added to a Team and then removed within one hour."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1136"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 3",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]",
+                "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject3').huntingQueryVersion3]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+        "contentKind": "HuntingQuery",
+        "displayName": "External User Added and Removed in a Short Timeframe",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '2.0.1')))]",
+        "version": "2.0.1"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ExternalUserFromNewOrgAddedToTeams_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_4",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime - starttime) * 7);\n// OfficeActivity Known Organizations\nlet known_orgs_office = (\n    OfficeActivity\n    | where TimeGenerated between(ago(lookback)..starttime)\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\" or Operation =~ \"TeamsSessionStarted\"\n    | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | summarize by Organization\n);\n// OfficeActivity Query for New Organizations\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between(starttime..endtime)\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberAdded\"\n    | extend UPN = tostring(parse_json(Members)[0].UPN)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | where Organization !in (known_orgs_office)\n    | extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Known Organizations\nlet known_orgs_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(ago(lookback)..starttime)\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation in (\"MemberAdded\", \"TeamsSessionStarted\")\n    | extend Members = parse_json(tostring(AdditionalProperties.Members))\n    | extend UPN = iif(Operation == \"MemberAdded\", tostring(Members[0].UPN), UserId)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | summarize by Organization\n);\n// EnrichedMicrosoft365AuditLogs Query for New Organizations\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between(starttime..endtime)\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend Members = parse_json(tostring(AdditionalProperties.Members))\n    | extend UPN = tostring(Members[0].UPN)\n    | extend Organization = tostring(split(split(UPN, \"_\")[1], \"#\")[0])\n    | where isnotempty(Organization)\n    | where Organization !in (known_orgs_enriched)\n    | extend AccountName = tostring(split(UPN, \"@\")[0]), AccountUPNSuffix = tostring(split(UPN, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by Organization, UPN;\n// Final Output\nCombinedEvents\n    | project Organization, UPN, AccountName, AccountUPNSuffix\n    | order by Organization asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1136"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 4",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]",
+                "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject4').huntingQueryVersion4]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - External user from a new organisation added to Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Mail_redirect_via_ExO_transport_rule_hunting_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_5",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+                "category": "Hunting Queries",
+                "query": "// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"Exchange\"\n    | where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n    | mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | extend RuleName = case(\n        Operation == \"Set-TransportRule\", ObjectId,\n        Operation == \"New-TransportRule\", ParsedParameters.Name,\n        \"Unknown\"\n    )\n    | mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)\n    | where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n    | extend RedirectTo = ExpandedParameters.Value\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, AdditionalProperties\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload == \"Exchange\"\n    | where Operation in (\"New-TransportRule\", \"Set-TransportRule\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | extend RuleName = case(\n        Operation == \"Set-TransportRule\", OfficeObjectId,\n        Operation == \"New-TransportRule\", ParsedParameters.Name,\n        \"Unknown\"\n    )\n    | mv-expand ExpandedParameters = todynamic(Parameters)\n    | where ExpandedParameters.Name in (\"BlindCopyTo\", \"RedirectMessageTo\") and isnotempty(ExpandedParameters.Value)\n    | extend RedirectTo = ExpandedParameters.Value\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | project TimeGenerated, RedirectTo, IPAddress = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1]), UserId, Operation, RuleName, Parameters\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = IPAddress;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by RuleName, UserId;\n// Final Output\nCombinedEvents\n    | project TimeGenerated, RuleName, RedirectTo, IPAddress, Port, UserId, AccountName, AccountUPNSuffix\n    | order by TimeGenerated desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies when Exchange Online transport rule is configured to forward emails.\nThis could be an adversary mailbox configured to collect mail from multiple user accounts."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 5",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]",
+                "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject5').huntingQueryVersion5]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Mail Redirect via ExO Transport Rule",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MultipleTeamsDeletes_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_6",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+                "category": "Hunting Queries",
+                "query": "let max_delete = 3;  // Adjust this value to change how many Teams should be deleted before being included\n// EnrichedMicrosoft365AuditLogs - Users who deleted more than 'max_delete' Teams\nlet deleting_users_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"TeamDeleted\"\n    | summarize count_ = count() by UserId\n    | where count_ > max_delete\n    | project UserId\n);\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"TeamDeleted\"\n    | where UserId in (deleting_users_enriched)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix\n    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;\n// OfficeActivity - Users who deleted more than 'max_delete' Teams\nlet deleting_users_office = (\n    OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | summarize count_ = count() by UserId\n    | where count_ > max_delete\n    | project UserId\n);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"TeamDeleted\"\n    | where UserId in (deleting_users_office)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix\n    | project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(TimeGenerated, *) by UserId;\n// Final Output\nCombinedEvents\n| project TimeGenerated, UserId, Account_0_Name, Account_0_UPNSuffix\n| order by TimeGenerated desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query identifies where multiple Teams have been deleted by a single user in a short timeframe."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Impact"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1485,T1489"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 6",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]",
+                "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject6').huntingQueryVersion6]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Multiple Teams deleted by a single user",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MultipleUsersEmailForwardedToSameDestination_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_7",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+                "category": "Hunting Queries",
+                "query": "let queryfrequency = 1d;\nlet queryperiod = 7d;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated > ago(queryperiod)\n    | where Workload == \"Exchange\"\n    | where AdditionalProperties has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(AdditionalProperties) on (\n        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"\n    ))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIp)[0]\n    | extend ClientIp = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIp\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated > ago(queryperiod)\n    | where OfficeWorkload =~ \"Exchange\"\n    | where Parameters has_any (\"ForwardTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n    | mv-apply DynamicParameters = todynamic(Parameters) on (\n        summarize ParsedParameters = make_bag(bag_pack(tostring(DynamicParameters.Name), DynamicParameters.Value))\n    )\n    | evaluate bag_unpack(ParsedParameters, columnsConflict='replace_source')\n    | extend DestinationMailAddress = tolower(case(\n        isnotempty(column_ifexists(\"ForwardTo\", \"\")), column_ifexists(\"ForwardTo\", \"\"),\n        isnotempty(column_ifexists(\"RedirectTo\", \"\")), column_ifexists(\"RedirectTo\", \"\"),\n        isnotempty(column_ifexists(\"ForwardingSmtpAddress\", \"\")), trim_start(@\"smtp:\", column_ifexists(\"ForwardingSmtpAddress\", \"\")),\n        \"\"\n    ))\n    | where isnotempty(DestinationMailAddress)\n    | mv-expand split(DestinationMailAddress, \";\")\n    | extend ClientIPValues = extract_all(@'\\[?(::ffff:)?(?P<IPAddress>(\\d+\\.\\d+\\.\\d+\\.\\d+)|[^\\]]+)\\]?([-:](?P<Port>\\d+))?', dynamic([\"IPAddress\", \"Port\"]), ClientIP)[0]\n    | extend ClientIP = tostring(ClientIPValues[0]), Port = tostring(ClientIPValues[1])\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DistinctUserCount = dcount(UserId), UserId = make_set(UserId, 250), Ports = make_set(Port, 250), EventCount = count() by tostring(DestinationMailAddress), ClientIP\n    | where DistinctUserCount > 1 and EndTime > ago(queryfrequency)\n    | mv-expand UserId to typeof(string)\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, IP_0_Address = ClientIP;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by DestinationMailAddress, ClientIp;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, DestinationMailAddress, ClientIp, Ports, UserId, AccountName, AccountUPNSuffix\n    | order by StartTime desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies when multiple (more than one) users' mailboxes are configured to forward to the same destination. \nThis could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 7",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]",
+                "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject7').huntingQueryVersion7]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Multiple Users Email Forwarded to Same Destination",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MultiTeamBot_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_8",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Bots added to multiple teams",
+                "category": "Hunting Queries",
+                "query": "let threshold = 2;  // Adjust this threshold based on your environment\nlet time_threshold = timespan(5m);  // Adjust the time delta threshold\n// OfficeActivity Query\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"BotAddedToTeam\"\n    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n    | extend CountOfTeams = array_length(Teams)\n    | extend TimeDelta = End - Start\n    | where CountOfTeams > threshold\n    | where TimeDelta >= time_threshold\n    | project Start, End, Teams, CountOfTeams, UserId\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// EnrichedMicrosoft365AuditLogs Query\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"BotAddedToTeam\"\n    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | summarize Start = max(TimeGenerated), End = min(TimeGenerated), Teams = make_set(TeamName, 10000) by UserId\n    | extend CountOfTeams = array_length(Teams)\n    | extend TimeDelta = End - Start\n    | where CountOfTeams > threshold\n    | where TimeDelta <= time_threshold\n    | project Start, End, Teams, CountOfTeams, UserId\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(Start, *) by UserId;\n// Final Output\nCombinedEvents\n    | project Start, End, Teams, CountOfTeams, UserId, AccountName, AccountUPNSuffix\n    | order by Start desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query helps identify bots added to multiple Teams in a short space of time."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence,Collection"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1176,T1119"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 8",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]",
+                "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject8').huntingQueryVersion8]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Bots added to multiple teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '2.0.1')))]",
+        "version": "2.0.1"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MultiTeamOwner_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_9",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - User made Owner of multiple teams",
+                "category": "Hunting Queries",
+                "query": "let max_owner_count = 3;  \n// Adjust this value to change how many teams a user is made owner of before detecting\n// OfficeActivity Query: Identify users who have been made owners of more than 'max_owner_count' teams\nlet high_owner_count_office = (\n    OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRoleChanged\"\n    | extend Member = tostring(parse_json(Members)[0].UPN) \n    | extend NewRole = toint(parse_json(Members)[0].Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | summarize TeamCount = dcount(TeamName) by Member\n    | where TeamCount > max_owner_count\n    | project Member\n);\n// OfficeActivity Query: Fetch details for users with high ownership count\nlet OfficeEvents = OfficeActivity\n    | where OfficeWorkload =~ \"MicrosoftTeams\"\n    | where Operation =~ \"MemberRoleChanged\"\n    | extend Member = tostring(parse_json(Members)[0].UPN)\n    | extend NewRole = toint(parse_json(Members)[0].Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | where Member in (high_owner_count_office)\n    | extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1]);\n// EnrichedMicrosoft365AuditLogs Query: Identify users who have been made owners of more than 'max_owner_count' teams\nlet high_owner_count_enriched = (\n    EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRoleChanged\"\n    | extend Member = tostring(UserId)\n    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | summarize TeamCount = dcount(ObjectId) by Member\n    | where TeamCount > max_owner_count\n    | project Member\n);\n// EnrichedMicrosoft365AuditLogs Query: Fetch details for users with high ownership count\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberRoleChanged\"\n    | extend Member = tostring(UserId)\n    | extend NewRole = toint(parse_json(tostring(AdditionalProperties)).Role)\n    | where NewRole == 2  // Role 2 corresponds to \"Owner\"\n    | where Member in (high_owner_count_enriched)\n    | extend AccountName = tostring(split(Member, \"@\")[0]), AccountUPNSuffix = tostring(split(Member, \"@\")[1]);\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize by Member, AccountName, AccountUPNSuffix;\n// Final Output\nCombinedEvents\n| order by Member asc\n| project Member, AccountName, AccountUPNSuffix\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query identifies users who have been made Owner of multiple Teams."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1078"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 9",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]",
+                "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject9').huntingQueryVersion9]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - User made Owner of multiple teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "NewBotAddedToTeams_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_10",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = starttime - 14d;\n  // Historical bots from EnrichedMicrosoft365AuditLogs\n  let historical_bots_enriched = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (lookback .. starttime)\n      | where Workload == \"MicrosoftTeams\"\n      | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n      | where isnotempty(AddonName)\n      | distinct AddonName;\n  // Historical bots from OfficeActivity\n  let historical_bots_office = OfficeActivity\n      | where TimeGenerated between (lookback .. starttime)\n      | where OfficeWorkload == \"MicrosoftTeams\"\n      | where isnotempty(AddonName)\n      | distinct AddonName;\n  // Find new bots in Enriched Logs\n  let new_bots_enriched = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"MicrosoftTeams\"\n      | extend AddonName = tostring(parse_json(tostring(AdditionalProperties)).AddonName)\n      | where AddonName !in (historical_bots_enriched)\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Find new bots in OfficeActivity\n  let new_bots_office = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"MicrosoftTeams\"\n      | where isnotempty(AddonName)\n      | where AddonName !in (historical_bots_office)\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1]);\n  // Combine both new bots from Enriched Logs and OfficeActivity\n  let CombinedNewBots = new_bots_enriched\n      | union new_bots_office\n      | summarize arg_min(TimeGenerated, *) by AddonName, UserId;\n  // Final output\n  CombinedNewBots\n      | project TimeGenerated, AddonName, UserId, AccountName, AccountUPNSuffix\n      | order by TimeGenerated desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query helps identify new, and potentially unapproved applications or bots being added to Teams."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence,Collection"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1176,T1119"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 10",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]",
+                "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject10').huntingQueryVersion10]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Previously Unseen Bot or Application Added to Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject11').huntingQueryTemplateSpecName11]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "new_adminaccountactivity_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_11",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "New Admin Account Activity Seen Which Was Not Seen Historically",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet historicalActivity =\n  EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated between (lookback .. starttime)\n  | where RecordType == \"ExchangeAdmin\" and UserType in (\"Admin\", \"DcAdmin\")\n  | summarize historicalCount = count() by UserId;\nlet recentActivity = EnrichedMicrosoft365AuditLogs\n  | where TimeGenerated between (starttime .. endtime)\n  | where UserType in (\"Admin\", \"DcAdmin\")\n  | summarize recentCount = count() by UserId;\nrecentActivity\n| join kind=leftanti (historicalActivity) on UserId\n| project UserId, recentCount\n| join kind=rightsemi (\n    EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"ExchangeAdmin\" \n    | where UserType in (\"Admin\", \"DcAdmin\")\n  ) on UserId\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by RecordType, Operation, UserType, UserId, ResultStatus\n| extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n| extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n| extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n| extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '')\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This will help you discover any new admin account activity which was seen and were not seen historically.\nAny new accounts seen in the results can be validated and investigated for any suspicious activities."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,Collection"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1078,T1114"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 11",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11)]",
+                "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject11').huntingQueryVersion11]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+        "contentKind": "HuntingQuery",
+        "displayName": "New Admin Account Activity Seen Which Was Not Seen Historically",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '2.0.1')))]",
+        "version": "2.0.1"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject12').huntingQueryTemplateSpecName12]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "new_sharepoint_downloads_by_IP_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_12",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet BLOCK_THRESHOLD = 1.0;\n// Identify Autonomous System Numbers (ASNs) with a high block rate in Sign-in Logs\nlet HighBlockRateASNs = SigninLogs\n    | where TimeGenerated > lookback\n    | where isnotempty(AutonomousSystemNumber)\n    | summarize make_set(IPAddress), TotalIps = dcount(IPAddress), BlockedSignins = countif(ResultType == \"50053\"), TotalSignins = count() by AutonomousSystemNumber\n    | extend BlockRatio = 1.00 * BlockedSignins / TotalSignins\n    | where BlockRatio >= BLOCK_THRESHOLD\n    | distinct AutonomousSystemNumber;\n// Retrieve IP addresses from these high block rate ASNs\nlet ASNIPs = SigninLogs\n    | where TimeGenerated > lookback\n    | where AutonomousSystemNumber in (HighBlockRateASNs)\n    | distinct IPAddress, AutonomousSystemNumber;\n// OfficeActivity Query: File activities from identified ASN IPs\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between(starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where ClientIP in (ASNIPs)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIP\n    | extend IP_0_Address = ClientIP;\n// EnrichedMicrosoft365AuditLogs Query: File activities from identified ASN IPs\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where ClientIp in (ASNIPs)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by ClientIp\n    | extend IP_0_Address = ClientIp;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, RecentFileActivities, IP_0_Address\n    | order by StartTime desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Shows SharePoint upload/download volume by IPs with high-risk ASNs. New IPs with volume spikes may be unauthorized and exfiltrating documents."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1030"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 12",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12)]",
+                "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject12').huntingQueryVersion12]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - SharePointFileOperation via previously unseen IPs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject13').huntingQueryTemplateSpecName13]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "new_sharepoint_downloads_by_UserAgent_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_13",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = starttime - 14d;\nlet MINIMUM_BLOCKS = 10;\nlet SUCCESS_THRESHOLD = 0.2;\n// Identify user agents or client apps with a low success-to-block ratio in Sign-in Logs\nlet HistoricalActivity = SigninLogs\n    | where TimeGenerated > lookback\n    | where isnotempty(UserAgent)\n    | summarize SuccessfulSignins = countif(ResultType == \"0\"), BlockedSignins = countif(ResultType == \"50053\") by UserAgent\n    | extend SuccessBlockRatio = 1.00 * SuccessfulSignins / BlockedSignins\n    | where SuccessBlockRatio < SUCCESS_THRESHOLD\n    | where BlockedSignins > MINIMUM_BLOCKS;\n// OfficeActivity Query: File operations by matching user agents\nlet OfficeEvents = OfficeActivity\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIP, Site_Url\n    | join kind=innerunique (HistoricalActivity) on UserAgent\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIP, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;\n// EnrichedMicrosoft365AuditLogs Query: File operations by matching client apps (UserAgent)\nlet EnrichedEvents = EnrichedMicrosoft365AuditLogs\n    | where TimeGenerated between (starttime .. endtime)\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)  // Ensure matching with UserAgent column\n    | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RecentFileActivities = count() by UserAgent, UserId, ClientIp, SiteUrl\n    | join kind=innerunique (HistoricalActivity) on UserAgent\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIp, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;\n// Combine Office and Enriched Logs\nlet CombinedEvents = OfficeEvents\n    | union EnrichedEvents\n    | summarize arg_min(StartTime, *) by UserId, ClientIP;\n// Final Output\nCombinedEvents\n    | project StartTime, EndTime, RecentFileActivities, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url\n    | order by StartTime desc;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Tracking via user agent is one way to differentiate between types of connecting device.\nIn homogeneous enterprise environments the user agent associated with an attacker device may stand out as unusual."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1030"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 13",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13)]",
+                "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject13').huntingQueryVersion13]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 -SharePointFileOperation via devices with previously unseen user agents",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject14').huntingQueryTemplateSpecName14]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "New_WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_14",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = totimespan((endtime - starttime) * 7);\n  \n  // Reserved file names and extensions for Windows\n  let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\n  \n  // EnrichedMicrosoft365AuditLogs Query\n  let EnrichedEvents = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n      | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n      | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n      | where isnotempty(ObjectId)\n      | where ObjectId !~ FileName\n      | where ObjectId in (Reserved) or FileName in (Reserved)\n      | where ClientUserAgent !has \"Mac OS\"\n      | join kind=leftanti (\n          EnrichedMicrosoft365AuditLogs\n          | where TimeGenerated between (ago(lookback) .. starttime)\n          | extend FileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n          | extend ClientUserAgent = tostring(parse_json(tostring(AdditionalProperties)).ClientUserAgent)\n          | extend SiteUrl = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n          | where isnotempty(ObjectId)\n          | where ObjectId !~ FileName\n          | where ObjectId in (Reserved) or FileName in (Reserved)\n          | where ClientUserAgent !has \"Mac OS\"\n          | summarize PrevSeenCount = count() by ObjectId, UserId, FileName\n      ) on ObjectId\n      | extend SiteUrlUserFolder = tolower(split(SiteUrl, '/')[-2])\n      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n      | extend UserIdDiffThanUserFolder = iff(SiteUrl has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(ClientUserAgent, 100000), Ids = make_list(Id, 100000),\n          SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(FileName, 100000) by Workload, RecordType, UserType, UserKey, UserId, ClientIp, SiteUrl, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIp\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = SiteUrl;\n  // OfficeActivity Query\n  let OfficeEvents = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where isnotempty(SourceFileExtension)\n      | where SourceFileName !~ SourceFileExtension\n      | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n      | where UserAgent !has \"Mac OS\"\n      | join kind=leftanti (\n          OfficeActivity\n          | where TimeGenerated between (ago(lookback) .. starttime)\n          | where isnotempty(SourceFileExtension)\n          | where SourceFileName !~ SourceFileExtension\n          | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n          | where UserAgent !has \"Mac OS\"\n          | summarize PrevSeenCount = count() by SourceFileExtension\n      ) on SourceFileExtension\n      | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n      | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n      | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n      | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000),\n          SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000) by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIP\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix, URL_0_Url = Site_Url;\n  // Combine Office and Enriched Logs\n  let CombinedEvents = OfficeEvents\n      | union EnrichedEvents\n      | summarize arg_min(StartTime, *) by UserId, ClientIP;\n  // Final Output\n  CombinedEvents\n      | project StartTime, EndTime, Operations, UserAgents, IP_0_Address, Account_0_Name, Account_0_UPNSuffix, URL_0_Url\n      | order by StartTime desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This identifies new Windows Reserved Filenames on Office services like SharePoint and OneDrive in the past 7 days. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CommandAndControl"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1105"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 14",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14)]",
+                "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject14').huntingQueryVersion14]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - New Windows Reserved Filenames staged on Office file services",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject15').huntingQueryTemplateSpecName15]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "nonowner_MailboxLogin_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_15",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Non-owner mailbox login activity",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  // Enriched Logs Query for Mailbox Logins (non-owner)\n  let EnrichedMailboxLogins = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"Exchange\"\n      | where Operation == \"MailboxLogin\"\n      | extend Logon_Type = tostring(parse_json(tostring(AdditionalProperties)).LogonType)\n      | extend MailboxOwnerUPN = tostring(parse_json(tostring(AdditionalProperties)).MailboxOwnerUPN)\n      | where Logon_Type != \"Owner\"\n      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIp\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIp\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Office Activity Query for Mailbox Logins (non-owner)\n  let OfficeMailboxLogins = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"Exchange\"\n      | where Operation == \"MailboxLogin\" and Logon_Type != \"Owner\"\n      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, Logon_Type, ClientIP\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIP\n      | extend Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Combine both results\n  let CombinedMailboxLogins = EnrichedMailboxLogins\n      | union OfficeMailboxLogins\n      | summarize arg_min(StartTime, *) by UserId, MailboxOwnerUPN, Logon_Type;\n  // Final output\n  CombinedMailboxLogins\n      | project StartTime, EndTime, Operation, UserId, MailboxOwnerUPN, Logon_Type, Account_0_Name, Account_0_UPNSuffix, IP_0_Address\n      | order by StartTime desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Finds non-owner mailbox access by admin/delegate permissions. Whitelist valid users and check others for unauthorized access."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 15",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15)]",
+                "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject15').huntingQueryVersion15]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Non-owner mailbox login activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '2.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '2.0.1')))]",
+        "version": "2.0.1"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject16').huntingQueryTemplateSpecName16]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "OfficeMailForwarding_hunting_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_16",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  \n  // Enriched Logs Query for forwarding rule operations\n  let EnrichedForwardRules = EnrichedMicrosoft365AuditLogs\n      | where TimeGenerated between (starttime .. endtime)\n      | where Workload == \"Exchange\"\n      | where (Operation == \"Set-Mailbox\" and tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardingSmtpAddress') \n          or (Operation in ('New-InboxRule', 'Set-InboxRule') and (tostring(parse_json(tostring(AdditionalProperties))) contains 'ForwardTo' or tostring(parse_json(tostring(AdditionalProperties))) contains 'RedirectTo'))\n      | extend parsed = parse_json(tostring(AdditionalProperties))\n      | extend fwdingDestination_initial = iif(Operation == \"Set-Mailbox\", tostring(parsed.ForwardingSmtpAddress), coalesce(tostring(parsed.ForwardTo), tostring(parsed.RedirectTo)))\n      | where isnotempty(fwdingDestination_initial)\n      | extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n      | parse fwdingDestination with * '@' ForwardedtoDomain \n      | parse UserId with * '@' UserDomain\n      | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.'))[0])\n      | where ForwardedtoDomain !contains subDomain\n      | extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n      | extend ClientIPAddress = case(ClientIp has \".\", tostring(split(ClientIp, \":\")[0]), ClientIp has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIp, \"]\")[0]))), ClientIp)\n      | extend Port = case(ClientIp has \".\", (split(ClientIp, \":\")[1]), ClientIp has \"[\", tostring(split(ClientIp, \"]:\")[1]), ClientIp)\n      | extend Host = tostring(parse_json(tostring(AdditionalProperties)).OriginatingServer)\n      | extend HostName = tostring(split(Host, \".\")[0])\n      | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, HostName, DnsDomain\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Office Activity Query for forwarding rule operations\n  let OfficeForwardRules = OfficeActivity\n      | where TimeGenerated between (starttime .. endtime)\n      | where OfficeWorkload == \"Exchange\"\n      | where (Operation =~ \"Set-Mailbox\" and Parameters contains 'ForwardingSmtpAddress') \n          or (Operation in~ ('New-InboxRule', 'Set-InboxRule') and (Parameters contains 'ForwardTo' or Parameters contains 'RedirectTo'))\n      | extend parsed = parse_json(Parameters)\n      | extend fwdingDestination_initial = (iif(Operation =~ \"Set-Mailbox\", tostring(parsed[1].Value), tostring(parsed[2].Value)))\n      | where isnotempty(fwdingDestination_initial)\n      | extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\n      | parse fwdingDestination with * '@' ForwardedtoDomain \n      | parse UserId with * '@' UserDomain\n      | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.') [0]))\n      | where ForwardedtoDomain !contains subDomain\n      | extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\n      | extend ClientIPAddress = case(ClientIP has \".\", tostring(split(ClientIP, \":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))), ClientIP)\n      | extend Port = case(ClientIP has \".\", (split(ClientIP, \":\")[1]), ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]), ClientIP)\n      | extend Host = tostring(split(OriginatingServer, \" (\")[0])\n      | extend HostName = tostring(split(Host, \".\")[0])\n      | extend DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, HostName, DnsDomain\n      | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n      | extend IP_0_Address = ClientIPAddress, Host_0_HostName = HostName, Host_0_DnsDomain = DnsDomain, Account_0_Name = AccountName, Account_0_UPNSuffix = AccountUPNSuffix;\n  // Combine the results from both Enriched and Office Activity logs\n  let CombinedForwardRules = EnrichedForwardRules\n      | union OfficeForwardRules\n      | summarize arg_min(TimeGenerated, *) by UserId, ForwardedtoDomain, Operation\n      | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, ObjectId, fwdingDestination, Host_0_HostName, Host_0_DnsDomain, IP_0_Address, Account_0_Name, Account_0_UPNSuffix;  \n  // Final output\n  CombinedForwardRules\n      | order by TimeGenerated desc;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Adversaries often abuse email-forwarding rules to monitor victim activities, steal information, and gain intelligence on the victim or their organization. This query highlights cases where user mail is being forwarded, including to external domains."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 16",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16)]",
+                "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject16').huntingQueryVersion16]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Office Mail Forwarding - Hunting Version",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject17').huntingQueryTemplateSpecName17]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "powershell_or_nonbrowser_MailboxLogin_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_17",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n    let endtime = todatetime('{{EndTimeISO}}');\n    // EnrichedMicrosoft365AuditLogs query\n    let EnrichedMailboxLogin = EnrichedMicrosoft365AuditLogs\n        | where TimeGenerated between (starttime .. endtime)\n        | where Workload == \"Exchange\" and Operation == \"MailboxLogin\"\n        | extend ClientApplication = tostring(parse_json(AdditionalProperties).ClientInfoString)\n        | where ClientApplication == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n        | extend TenantName = tostring(parse_json(AdditionalProperties).TenantName)\n        | extend MailboxOwner = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)\n        | extend LogonType = tostring(parse_json(AdditionalProperties).LogonType)\n        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, TenantName, UserType, UserId, MailboxOwner, LogonType, ClientApplication\n        | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n        | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n        | extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n        | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n    // OfficeActivity query\n    let OfficeMailboxLogin = OfficeActivity\n        | where TimeGenerated between (starttime .. endtime)\n        | where OfficeWorkload == \"Exchange\" and Operation == \"MailboxLogin\"\n        | where ClientInfoString == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\n        | extend LogonType = \"Unknown\"  // If LogonType does not exist, create a placeholder\n        | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Operation, OrganizationName, UserType, UserId, MailboxOwnerUPN, LogonType, ClientInfoString\n        | extend AccountName = iff(UserId contains '@', tostring(split(UserId, '@')[0]), UserId)\n        | extend AccountUPNSuffix = iff(UserId contains '@', tostring(split(UserId, '@')[1]), '')\n        | extend AccountName = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[1]), AccountName)\n        | extend AccountNTDomain = iff(UserId contains '\\\\', tostring(split(UserId, '\\\\')[0]), '');\n    // Combine Enriched and Office queries\n    let CombinedMailboxLogin = EnrichedMailboxLogin\n        | union OfficeMailboxLogin\n        | summarize arg_min(StartTime, *) by UserId, Operation\n        | project StartTime, EndTime, Operation, TenantName, OrganizationName, UserType, UserId, MailboxOwner, LogonType, ClientApplication, ClientInfoString, Count, AccountName, AccountUPNSuffix, AccountNTDomain;\n    // Final output\n    CombinedMailboxLogin\n        | order by StartTime desc;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detects mailbox login from Exchange PowerShell. All accounts can use it by default, but admins can change it. Whitelist benign activities."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,Persistence,Collection"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1059,T1098,T1114"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 17",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17)]",
+                "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject17').huntingQueryVersion17]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - PowerShell or non-browser mailbox login activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject18').huntingQueryTemplateSpecName18]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "sharepoint_downloads_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject18').huntingQueryVersion18]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_18",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
+                "category": "Hunting Queries",
+                "query": "let starttime = todatetime('{{StartTimeISO}}');\n  let endtime = todatetime('{{EndTimeISO}}');\n  let lookback = starttime - 14d;\n  // Historical user agents in EnrichedMicrosoft365AuditLogs\n  let historicalUA_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (lookback .. starttime)\n    | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n    | summarize by ClientIp, ClientApplication;\n  // Recent user agents in EnrichedMicrosoft365AuditLogs\n  let recentUA_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (starttime .. endtime)\n    | extend ClientApplication = tostring(parse_json(AdditionalProperties).UserAgent)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIp, ClientApplication;\n  // Combine historical and recent user agents from EnrichedMicrosoft365AuditLogs\n  let Enriched_UA = recentUA_Enriched\n    | join kind=leftanti (historicalUA_Enriched) on ClientIp, ClientApplication\n    | where not(isempty(ClientIp))\n    | extend IP_0_Address = ClientIp;\n  // Historical user agents in OfficeActivity\n  let historicalUA_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (lookback .. starttime)\n    | summarize by ClientIP, UserAgent;\n  // Recent user agents in OfficeActivity\n  let recentUA_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where Operation in (\"FileDownloaded\", \"FileUploaded\")\n    | where TimeGenerated between (starttime .. endtime)\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by ClientIP, UserAgent;\n  // Combine historical and recent user agents from OfficeActivity\n  let Office_UA = recentUA_Office\n    | join kind=leftanti (historicalUA_Office) on ClientIP, UserAgent\n    | where not(isempty(ClientIP))\n    | extend IP_0_Address = ClientIP;\n  // Final combined result\n  Enriched_UA\n  | union Office_UA\n  | project StartTime, EndTime, ClientIp, ClientApplication, IP_0_Address;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "New user agents associated with a client IP for SharePoint file uploads/downloads."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1030"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 18",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18)]",
+                "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject18').huntingQueryVersion18]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - SharePoint File Operation via Client IP with Previously Unseen User Agents",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject19').huntingQueryTemplateSpecName19]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "TeamsFilesUploaded_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject19').huntingQueryVersion19]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_19",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
+                "category": "Hunting Queries",
+                "query": "// Define the query for EnrichedMicrosoft365AuditLogs\nlet enrichedLogs = EnrichedMicrosoft365AuditLogs\n  | where RecordType == \"SharePointFileOperation\"\n  | where Operation == \"FileUploaded\"\n  | where UserId != \"app@sharepoint\"\n  | where ObjectId has \"Microsoft Teams Chat Files\"\n  | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n  | join kind=leftouter (\n      EnrichedMicrosoft365AuditLogs\n      | where RecordType == \"SharePointFileOperation\"\n      | where Operation in (\"FileDownloaded\", \"FileAccessed\")\n      | where UserId != \"app@sharepoint\"\n      | where ObjectId has \"Microsoft Teams Chat Files\"\n      | extend UserId1 = UserId, ClientIp1 = ClientIp\n  ) on ObjectId\n  | extend userBag = bag_pack(\"UserId1\", UserId1, \"ClientIp1\", ClientIp1)\n  | summarize AccessedBy = make_bag(userBag), make_set(UserId1, 10000) by bin(TimeGenerated, 1h), UserId, ObjectId, SourceFileName\n  | extend NumberOfUsersAccessed = array_length(bag_keys(AccessedBy))\n  | project timestamp = TimeGenerated, UserId, FileLocation = ObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Define the query for OfficeActivity\nlet officeLogs = OfficeActivity\n  | where RecordType == \"SharePointFileOperation\"\n  | where Operation == \"FileUploaded\"\n  | where UserId != \"app@sharepoint\"\n  | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n  | join kind=leftouter (\n      OfficeActivity\n      | where RecordType == \"SharePointFileOperation\"\n      | where Operation in (\"FileDownloaded\", \"FileAccessed\")\n      | where UserId != \"app@sharepoint\"\n      | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n  ) on OfficeObjectId\n  | extend userBag = bag_pack(UserId1, ClientIP1)\n  | summarize AccessedBy = make_bag(userBag, 10000), make_set(UserId1, 10000) by TimeGenerated, UserId, OfficeObjectId, SourceFileName\n  | extend NumberUsers = array_length(bag_keys(AccessedBy))\n  | project timestamp = TimeGenerated, UserId, FileLocation = OfficeObjectId, FileName = SourceFileName, AccessedBy, NumberOfUsersAccessed = NumberUsers\n  | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n  | extend Account_0_Name = AccountName\n  | extend Account_0_UPNSuffix = AccountUPNSuffix;\n// Union both results\nenrichedLogs\n| union officeLogs\n| order by timestamp desc;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query identifies files uploaded to SharePoint via a Teams chat and\nsummarizes users and IP addresses that have accessed these files. This allows for \nidentification of anomalous file sharing patterns."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1199,T1102,T1078"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 19",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19)]",
+                "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject19').huntingQueryVersion19]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Files uploaded to teams and access summary",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject20').huntingQueryTemplateSpecName20]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "UserAddToTeamsAndUploadsFile_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject20').huntingQueryVersion20]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_20",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
+                "category": "Hunting Queries",
+                "query": "let threshold = 1m;\n  // Define MemberAddedEvents for EnrichedMicrosoft365AuditLogs\n  let MemberAddedEvents_Enriched = EnrichedMicrosoft365AuditLogs\n    | where Workload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName)\n    | project TimeGenerated, UploaderID = UserId, TeamName;\n  // Define FileUploadEvents for EnrichedMicrosoft365AuditLogs\n  let FileUploadEvents_Enriched = EnrichedMicrosoft365AuditLogs\n    | where RecordType == \"SharePointFileOperation\"\n    | where ObjectId has \"Microsoft Teams Chat Files\"\n    | where Operation == \"FileUploaded\"\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = ObjectId, SourceFileName;\n  // Perform join for EnrichedMicrosoft365AuditLogs\n  let EnrichedResults = MemberAddedEvents_Enriched\n    | join kind=inner (FileUploadEvents_Enriched) on UploaderID\n    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;\n  // Define MemberAddedEvents for OfficeActivity\n  let MemberAddedEvents_Office = OfficeActivity\n    | where OfficeWorkload == \"MicrosoftTeams\"\n    | where Operation == \"MemberAdded\"\n    | extend TeamName = iff(isempty(TeamName), Members[0].UPN, TeamName)\n    | project TimeGenerated, UploaderID = UserId, TeamName;\n  // Define FileUploadEvents for OfficeActivity\n  let FileUploadEvents_Office = OfficeActivity\n    | where RecordType == \"SharePointFileOperation\"\n    | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\n    | where Operation == \"FileUploaded\"\n    | project UploadTime = TimeGenerated, UploaderID = UserId, FileLocation = OfficeObjectId, FileName = SourceFileName;\n  // Perform join for OfficeActivity\n  let OfficeResults = MemberAddedEvents_Office\n    | join kind=inner (FileUploadEvents_Office) on UploaderID\n    | where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\n    | project-away UploaderID1\n    | extend timestamp = TimeGenerated, AccountCustomEntity = UploaderID;\n  // Union both results\n  EnrichedResults\n  | union OfficeResults\n  | order by timestamp desc;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query identifies users who are added to a Teams Channel or Teams chat\nand within 1 minute of being added upload a file via the chat. This might be\nan indicator of suspicious activity."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 20",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20)]",
+                "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject20').huntingQueryVersion20]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - User added to Teams and immediately uploads file",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject21').huntingQueryTemplateSpecName21]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "WindowsReservedFileNamesOnOfficeFileServices_HuntingQueries Hunting Query with template version 3.0.0",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject21').huntingQueryVersion21]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2022-10-01",
+              "name": "Global_Secure_Access_Hunting_Query_21",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
+                "category": "Hunting Queries",
+                "query": "let Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\n  // Query for OfficeActivity\n  let OfficeActivityResults = OfficeActivity\n    | where isnotempty(SourceFileExtension)\n    | where SourceFileExtension in (Reserved) or SourceFileName in (Reserved)\n    | where UserAgent !has \"Mac OS\"\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), OfficeIds = make_list(OfficeId, 100000), SourceRelativeUrls = make_list(SourceRelativeUrl, 100000), FileNames = make_list(SourceFileName, 100000)\n    by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIP\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix\n    | extend URL_0_Url = Site_Url;\n  // Query for EnrichedMicrosoft365AuditLogs\n  let EnrichedMicrosoft365Results = EnrichedMicrosoft365AuditLogs\n    | extend SourceFileName = tostring(parse_json(tostring(AdditionalProperties)).SourceFileName)\n    | extend UserAgent = tostring(parse_json(tostring(AdditionalProperties)).UserAgent)\n    | extend Site_Url = tostring(parse_json(tostring(AdditionalProperties)).SiteUrl)\n    | where isnotempty(ObjectId)\n    | where ObjectId in (Reserved) or SourceFileName in (Reserved)\n    | where UserAgent !has \"Mac OS\"\n    | extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\n    | extend UserIdUserFolderFormat = tolower(replace_regex(UserId, '@|\\\\.', '_'))\n    | extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false)\n    | summarize TimeGenerated = make_list(TimeGenerated, 100000), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation, 100000), UserAgents = make_list(UserAgent, 100000), ObjectIds = make_list(Id, 100000), SourceRelativeUrls = make_list(ObjectId, 100000), FileNames = make_list(SourceFileName, 100000)\n    by Workload, RecordType, UserType, UserKey, UserId, ClientIp, Site_Url, ObjectId, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\n    | extend AccountName = tostring(split(UserId, \"@\")[0]), AccountUPNSuffix = tostring(split(UserId, \"@\")[1])\n    | extend IP_0_Address = ClientIp\n    | extend Account_0_Name = AccountName\n    | extend Account_0_UPNSuffix = AccountUPNSuffix\n    | extend URL_0_Url = Site_Url;\n  // Combine both queries\n  OfficeActivityResults\n  | union EnrichedMicrosoft365Results\n  | order by StartTime desc;\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This identifies Windows Reserved Filenames on Office services like SharePoint and OneDrive. It also detects when a user uploads these files to another user's workspace, which may indicate malicious activity."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CommandAndControl"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1105"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21),'/'))))]",
+              "properties": {
+                "description": "Global Secure Access Hunting Query 21",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21)]",
+                "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject21').huntingQueryVersion21]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Global Secure Access",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Microsoft Corporation",
+                  "email": "GSASentinelSupport@microsoft.com",
+                  "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+        "contentKind": "HuntingQuery",
+        "displayName": "GSA Enriched Office 365 - Windows Reserved Filenames Staged on Office File Services",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '2.0.2')))]",
+        "version": "2.0.2"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+      "apiVersion": "2023-04-01-preview",
+      "location": "[parameters('workspace-location')]",
+      "properties": {
+        "version": "3.0.0",
+        "kind": "Solution",
+        "contentSchemaVersion": "3.0.0",
+        "displayName": "Global Secure Access",
+        "publisherDisplayName": "Microsoft Corporation",
+        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Global%20Secure%20Access/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p><a href=\"https://aka.ms/GlobalSecureAccess\">Global Secure Access</a> is a <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog#domain-solutions\">domain solution</a> and does not include any data connectors. The content in this solution requires one of the product solutions below.</p>\n<p><strong>Prerequisite:</strong></p>\n<p>Install one or more of the listed solutions to unlock the value provided by this solution.</p>\n<ol>\n<li>Microsoft Entra ID</li>\n</ol>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution depends on the following technologies, and some of these dependencies may either be in Preview state or might result in additional ingestion or operational costs:</p>\n<ol>\n<li>Product solutions as described above</li>\n</ol>\n<p><strong>Workbooks:</strong> 2, <strong>Analytic Rules:</strong> 19, <strong>Hunting Queries:</strong> 21</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
+        "contentKind": "Solution",
+        "contentProductId": "[variables('_solutioncontentProductId')]",
+        "id": "[variables('_solutioncontentProductId')]",
+        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/gsa.svg\" width=\"75px\" height=\"75px\">",
+        "contentId": "[variables('_solutionId')]",
+        "parentId": "[variables('_solutionId')]",
+        "source": {
+          "kind": "Solution",
+          "name": "Global Secure Access",
+          "sourceId": "[variables('_solutionId')]"
+        },
+        "author": {
+          "name": "Microsoft",
+          "email": "[variables('_email')]"
+        },
+        "support": {
+          "name": "Microsoft Corporation",
+          "email": "GSASentinelSupport@microsoft.com",
+          "tier": "Partner",
+          "link": "https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access"
+        },
+        "dependencies": {
+          "operator": "AND",
+          "criteria": [
+            {
+              "kind": "Workbook",
+              "contentId": "[variables('_workbookContentId1')]",
+              "version": "[variables('workbookVersion1')]"
+            },
+            {
+              "kind": "Workbook",
+              "contentId": "[variables('_workbookContentId2')]",
+              "version": "[variables('workbookVersion2')]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+              "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+              "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+              "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+              "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+              "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+              "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+              "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+              "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+              "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+              "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+              "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+              "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+              "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+              "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+              "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+              "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+              "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+              "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+              "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+              "version": "[variables('huntingQueryObject1').huntingQueryVersion1]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+              "version": "[variables('huntingQueryObject2').huntingQueryVersion2]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+              "version": "[variables('huntingQueryObject3').huntingQueryVersion3]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+              "version": "[variables('huntingQueryObject4').huntingQueryVersion4]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+              "version": "[variables('huntingQueryObject5').huntingQueryVersion5]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+              "version": "[variables('huntingQueryObject6').huntingQueryVersion6]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+              "version": "[variables('huntingQueryObject7').huntingQueryVersion7]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+              "version": "[variables('huntingQueryObject8').huntingQueryVersion8]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+              "version": "[variables('huntingQueryObject9').huntingQueryVersion9]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+              "version": "[variables('huntingQueryObject10').huntingQueryVersion10]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+              "version": "[variables('huntingQueryObject11').huntingQueryVersion11]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+              "version": "[variables('huntingQueryObject12').huntingQueryVersion12]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+              "version": "[variables('huntingQueryObject13').huntingQueryVersion13]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+              "version": "[variables('huntingQueryObject14').huntingQueryVersion14]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+              "version": "[variables('huntingQueryObject15').huntingQueryVersion15]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+              "version": "[variables('huntingQueryObject16').huntingQueryVersion16]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+              "version": "[variables('huntingQueryObject17').huntingQueryVersion17]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+              "version": "[variables('huntingQueryObject18').huntingQueryVersion18]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+              "version": "[variables('huntingQueryObject19').huntingQueryVersion19]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+              "version": "[variables('huntingQueryObject20').huntingQueryVersion20]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+              "version": "[variables('huntingQueryObject21').huntingQueryVersion21]"
+            }
+          ]
+        },
+        "firstPublishDate": "2024-04-08",
+        "providers": [
+          "Microsoft"
+        ],
+        "categories": {
+          "domains": [
+            "Identity"
+          ]
+        }
+      },
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+    }
+  ],
+  "outputs": {}
+}
diff --git a/Solutions/Global Secure Access/Package/testParameters.json b/Solutions/Global Secure Access/Package/testParameters.json
new file mode 100644
index 0000000000..8dd674f595
--- /dev/null
+++ b/Solutions/Global Secure Access/Package/testParameters.json	
@@ -0,0 +1,40 @@
+{
+  "location": {
+    "type": "string",
+    "minLength": 1,
+    "defaultValue": "[resourceGroup().location]",
+    "metadata": {
+      "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
+    }
+  },
+  "workspace-location": {
+    "type": "string",
+    "defaultValue": "",
+    "metadata": {
+      "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+    }
+  },
+  "workspace": {
+    "defaultValue": "",
+    "type": "string",
+    "metadata": {
+      "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+    }
+  },
+  "workbook1-name": {
+    "type": "string",
+    "defaultValue": "Microsoft Global Secure Access Enriched M365 Logs",
+    "minLength": 1,
+    "metadata": {
+      "description": "Name for the workbook"
+    }
+  },
+  "workbook2-name": {
+    "type": "string",
+    "defaultValue": "Microsoft Global Secure Access Traffic Logs",
+    "minLength": 1,
+    "metadata": {
+      "description": "Name for the workbook"
+    }
+  }
+}

From 85e11558d15084e0613a3a632bdc487fc96ff8c7 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Mon, 7 Oct 2024 08:57:04 +0300
Subject: [PATCH 20/27] workbooks version

---
 Workbooks/WorkbooksMetadata.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index d00f2276a3..e20201e86f 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -8017,8 +8017,8 @@
 			"GSATrafficLogsWhite.png",
 			"GSATrafficLogsBlack.png"
 		],
-		"version": "1.0.1",
-		"title": "Microsoft Global Secure Access Traffic Logs",
+		"version": "1.0.2",
+		"title": "Network Traffic Insights",
 		"templateRelativePath": "GSANetworkTraffic.json",
 		"subtitle": "",
 		"provider": "Microsoft"
@@ -8035,8 +8035,8 @@
 			"GSAEnrichedLogsWhite.png",
 			"GSAEnrichedLogsBlack.png"
 		],
-		"version": "1.0.1",
-		"title": "Microsoft Global Secure Access Enriched M365 Logs",
+		"version": "1.0.2",
+		"title": "Enriched Microsoft 365 logs Workbook",
 		"templateRelativePath": "GSAM365EnrichedEvents.json",
 		"provider": "Microsoft"
 	},

From db17f68dc9624db4a9e4ea54a2dd35205af71669 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Mon, 7 Oct 2024 09:06:54 +0300
Subject: [PATCH 21/27] Update Office 365 -
 sharepoint_file_transfer_above_threshold.yaml

---
 .../Office 365 - sharepoint_file_transfer_above_threshold.yaml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml
index 56ca53b9f8..27577a50ff 100644
--- a/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
+++ b/Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml	
@@ -83,5 +83,5 @@ incidentConfiguration:
     matchingMethod: Selected
     groupByEntities:
       - Account
-version: 1.0.5
+version: 1.0.6
 kind: Scheduled
\ No newline at end of file

From ed6453dc1e6559cc0d452bfcedfbc5b531c83ee4 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Mon, 7 Oct 2024 09:31:15 +0300
Subject: [PATCH 22/27] Update WorkbooksMetadata.json

---
 Workbooks/WorkbooksMetadata.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index e20201e86f..76c5edafa4 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -8017,7 +8017,7 @@
 			"GSATrafficLogsWhite.png",
 			"GSATrafficLogsBlack.png"
 		],
-		"version": "1.0.2",
+		"version": "1.1.0",
 		"title": "Network Traffic Insights",
 		"templateRelativePath": "GSANetworkTraffic.json",
 		"subtitle": "",

From 589bb9fb4373cc3a1b2acfffcc5f65d9bdd4f17f Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Mon, 7 Oct 2024 10:06:13 +0300
Subject: [PATCH 23/27] Update WorkbooksMetadata.json

---
 Workbooks/WorkbooksMetadata.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index 76c5edafa4..58625b2b89 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -8017,7 +8017,7 @@
 			"GSATrafficLogsWhite.png",
 			"GSATrafficLogsBlack.png"
 		],
-		"version": "1.1.0",
+		"version": "1.0.3",
 		"title": "Network Traffic Insights",
 		"templateRelativePath": "GSANetworkTraffic.json",
 		"subtitle": "",
@@ -8035,7 +8035,7 @@
 			"GSAEnrichedLogsWhite.png",
 			"GSAEnrichedLogsBlack.png"
 		],
-		"version": "1.0.2",
+		"version": "1.0.3",
 		"title": "Enriched Microsoft 365 logs Workbook",
 		"templateRelativePath": "GSAM365EnrichedEvents.json",
 		"provider": "Microsoft"

From 147673952bdf0e336e40c55918fb04c60ad6f4a1 Mon Sep 17 00:00:00 2001
From: v-shukore <v-shukore@microsoft.com>
Date: Mon, 7 Oct 2024 16:39:07 +0530
Subject: [PATCH 24/27] Update WorkbooksMetadata.json

---
 Workbooks/WorkbooksMetadata.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index 58625b2b89..711b8b2513 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -8017,7 +8017,7 @@
 			"GSATrafficLogsWhite.png",
 			"GSATrafficLogsBlack.png"
 		],
-		"version": "1.0.3",
+		"version": "1.0.1",
 		"title": "Network Traffic Insights",
 		"templateRelativePath": "GSANetworkTraffic.json",
 		"subtitle": "",
@@ -8035,7 +8035,7 @@
 			"GSAEnrichedLogsWhite.png",
 			"GSAEnrichedLogsBlack.png"
 		],
-		"version": "1.0.3",
+		"version": "1.0.1",
 		"title": "Enriched Microsoft 365 logs Workbook",
 		"templateRelativePath": "GSAM365EnrichedEvents.json",
 		"provider": "Microsoft"

From 5856d7f6cc0929d78c63da00f8d5267468dccef0 Mon Sep 17 00:00:00 2001
From: moti-ba <131643892+moti-ba@users.noreply.github.com>
Date: Tue, 8 Oct 2024 11:27:22 +0300
Subject: [PATCH 25/27] keep workbooks in Solution folder only

---
 Workbooks/GSAM365EnrichedEvents.json | 982 ---------------------------
 Workbooks/GSANetworkTraffic.json     | 787 ---------------------
 2 files changed, 1769 deletions(-)
 delete mode 100644 Workbooks/GSAM365EnrichedEvents.json
 delete mode 100644 Workbooks/GSANetworkTraffic.json

diff --git a/Workbooks/GSAM365EnrichedEvents.json b/Workbooks/GSAM365EnrichedEvents.json
deleted file mode 100644
index ea40be7808..0000000000
--- a/Workbooks/GSAM365EnrichedEvents.json
+++ /dev/null
@@ -1,982 +0,0 @@
-{
-  "version": "Notebook/1.0",
-  "items": [
-    {
-      "type": 1,
-      "content": {
-        "json": "## Enriched Microsoft 365 logs Workbook (Preview)\n---\n\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps."
-      },
-      "name": "text - 2"
-    },
-    {
-      "type": 9,
-      "content": {
-        "version": "KqlParameterItem/1.0",
-        "crossComponentResources": [
-          "value::all"
-        ],
-        "parameters": [
-          {
-            "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
-            "version": "KqlParameterItem/1.0",
-            "name": "LogAnalyticWorkspace",
-            "label": "Log Analytic Workspace",
-            "type": 5,
-            "description": "The Log Analytic Workspace In Which To Execute The Queries",
-            "isRequired": true,
-            "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
-            "crossComponentResources": [
-              "value::all"
-            ],
-            "typeSettings": {
-              "resourceTypeFilter": {
-                "microsoft.operationalinsights/workspaces": true
-              },
-              "additionalResourceOptions": [],
-              "showDefault": false
-            },
-            "timeContext": {
-              "durationMs": 86400000
-            },
-            "queryType": 1,
-            "resourceType": "microsoft.resourcegraph/resources",
-            "value": null
-          },
-          {
-            "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
-            "version": "KqlParameterItem/1.0",
-            "name": "TimeRange",
-            "label": "Time Range",
-            "type": 4,
-            "isRequired": true,
-            "typeSettings": {
-              "selectableValues": [
-                {
-                  "durationMs": 300000
-                },
-                {
-                  "durationMs": 900000
-                },
-                {
-                  "durationMs": 1800000
-                },
-                {
-                  "durationMs": 3600000
-                },
-                {
-                  "durationMs": 14400000
-                },
-                {
-                  "durationMs": 43200000
-                },
-                {
-                  "durationMs": 86400000
-                },
-                {
-                  "durationMs": 172800000
-                },
-                {
-                  "durationMs": 259200000
-                },
-                {
-                  "durationMs": 604800000
-                },
-                {
-                  "durationMs": 1209600000
-                },
-                {
-                  "durationMs": 2419200000
-                },
-                {
-                  "durationMs": 2592000000
-                }
-              ],
-              "allowCustom": true
-            },
-            "timeContext": {
-              "durationMs": 86400000
-            },
-            "value": {
-              "durationMs": 2592000000
-            }
-          },
-          {
-            "id": "8bab511b-53b3-4220-9d1c-372345b06728",
-            "version": "KqlParameterItem/1.0",
-            "name": "Users",
-            "type": 2,
-            "isRequired": true,
-            "multiSelect": true,
-            "quote": "'",
-            "delimiter": ",",
-            "query": "EnrichedMicrosoft365AuditLogs\r\n| summarize Count = count() by UserId\r\n| order by Count desc, UserId asc\r\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false",
-            "crossComponentResources": [
-              "{LogAnalyticWorkspace}"
-            ],
-            "typeSettings": {
-              "limitSelectTo": 20,
-              "additionalResourceOptions": [
-                "value::all"
-              ],
-              "selectAllValue": "*",
-              "showDefault": false
-            },
-            "timeContext": {
-              "durationMs": 0
-            },
-            "timeContextFromParameter": "TimeRange",
-            "queryType": 0,
-            "resourceType": "microsoft.operationalinsights/workspaces",
-            "value": [
-              "value::all"
-            ]
-          }
-        ],
-        "style": "pills",
-        "queryType": 1,
-        "resourceType": "microsoft.resourcegraph/resources"
-      },
-      "name": "parameters - 15"
-    },
-    {
-      "type": 11,
-      "content": {
-        "version": "LinkItem/1.0",
-        "style": "tabs",
-        "tabStyle": "bigger",
-        "links": [
-          {
-            "id": "e841bafb-6437-4d29-84ac-ba16c5a6d901",
-            "cellValue": "selTab",
-            "linkTarget": "parameter",
-            "linkLabel": "Overview",
-            "subTarget": "Overview",
-            "style": "link"
-          },
-          {
-            "id": "ac5f2082-50bc-4739-bdf2-20c93b613671",
-            "cellValue": "selTab",
-            "linkTarget": "parameter",
-            "linkLabel": "SharePoint/OneDrive Insights",
-            "subTarget": "Threat",
-            "style": "link"
-          },
-          {
-            "id": "dc2778e7-739b-44ba-9ae4-c81901277f57",
-            "cellValue": "selTab",
-            "linkTarget": "parameter",
-            "linkLabel": "Exchange Online Insights",
-            "subTarget": "ThreatEXO",
-            "style": "link"
-          },
-          {
-            "id": "666111e2-54ff-4fa4-a648-11a5c8c0235b",
-            "cellValue": "selTab",
-            "linkTarget": "parameter",
-            "linkLabel": "Teams Insights",
-            "subTarget": "ThreatTeams",
-            "style": "link"
-          }
-        ]
-      },
-      "name": "links - 7"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Exchange\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
-              "size": 0,
-              "title": "Access By Location",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "map",
-              "mapSettings": {
-                "locInfo": "CountryRegion",
-                "locInfoColumn": "Country",
-                "latitude": "Latitude",
-                "longitude": "Longitude",
-                "sizeSettings": "Count",
-                "sizeAggregation": "Sum",
-                "labelSettings": "Country",
-                "legendMetric": "Count",
-                "legendAggregation": "Sum",
-                "itemColorSettings": {
-                  "nodeColorField": "Count",
-                  "colorAggregation": "Sum",
-                  "type": "heatmap",
-                  "heatmapPalette": "turquoise"
-                }
-              }
-            },
-            "customWidth": "50",
-            "name": "query - 0"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Exchange\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n",
-              "size": 0,
-              "title": "Access By Location And OS",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 1"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Set-AdminAuditLogConfig\", \"Set-OrganizationConfig\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Audit Of Critical Configuration Changes",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 2"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Set-TransportRule\", \"Set-AtpPolicyForO365\", \"Set-MalwareFilterRule\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Changes In Email Security Policies",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 3"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"Add-RoleGroupMember\", \"Remove-ManagementRoleAssignment\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Monitoring Role Group Membership Changes",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 4"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"New-TenantAllowBlockListSpoofitems\", \"Remove-TenantAllowBlockListSpoofitems\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Spoofing Settings Management Activities",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 5"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Operation in (\"New-SafeAttachmentPolicy\", \"Set-SafeAttachmentPolicy\", \"Set-SafeAttachmentRule\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Safe Attachments Policy Changes",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 6"
-          }
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "ThreatEXO"
-      },
-      "name": "group - 18"
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "EnrichedMicrosoft365AuditLogs | where Workload == \"Exchange\" | where Operation in (\"Add-MailboxFolderPermission\", \"Add-RoleGroupMember\", \"New-TransportRule\", \"Remove-ManagementRoleAssignment\", \"Set-TransportRule\") | summarize Count = count(), Users = makeset(UserId) by Operation | order by Count desc",
-        "size": 0,
-        "title": "Permission changes and security policy updates",
-        "timeContext": {
-          "durationMs": 86400000
-        },
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "seltab",
-        "comparison": "isEqualTo",
-        "value": "ThreatEXO"
-      },
-      "name": "query - 13"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Teams\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
-              "size": 0,
-              "title": "Access By Location",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "map",
-              "mapSettings": {
-                "locInfo": "CountryRegion",
-                "locInfoColumn": "Country",
-                "latitude": "Latitude",
-                "longitude": "Longitude",
-                "sizeSettings": "Count",
-                "sizeAggregation": "Sum",
-                "labelSettings": "Country",
-                "legendMetric": "Count",
-                "legendAggregation": "Sum",
-                "itemColorSettings": {
-                  "nodeColorField": "Count",
-                  "colorAggregation": "Sum",
-                  "type": "heatmap",
-                  "heatmapPalette": "turquoise"
-                }
-              }
-            },
-            "customWidth": "50",
-            "name": "query - 0"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"Teams\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n",
-              "size": 0,
-              "title": "Access By Location And OS",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 1"
-          }
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "ThreatTeams"
-      },
-      "name": "group - 10"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"OneDrive\", \"SharePoint\",\"SPO/OneDrive\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n| summarize Count = count() by City, State, Country\r\n",
-              "size": 0,
-              "title": "Access By Location",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "map",
-              "mapSettings": {
-                "locInfo": "CountryRegion",
-                "locInfoColumn": "Country",
-                "latitude": "Latitude",
-                "longitude": "Longitude",
-                "sizeSettings": "Count",
-                "sizeAggregation": "Sum",
-                "labelSettings": "Country",
-                "legendMetric": "Country",
-                "numberOfMetrics": 19,
-                "legendAggregation": "Count",
-                "itemColorSettings": {
-                  "nodeColorField": "Count",
-                  "colorAggregation": "Sum",
-                  "type": "heatmap",
-                  "heatmapPalette": "turquoise"
-                }
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Threat"
-            },
-            "name": "query - 19"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| summarize [\"Event Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Event Count\"] desc\r\n",
-              "size": 2,
-              "title": "Access By Location And OS",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "filter": true
-              }
-            },
-            "customWidth": "50",
-            "name": "query - 20"
-          }
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "Threat"
-      },
-      "name": "group - 20",
-      "styleSettings": {
-        "showBorder": true
-      }
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload == \"Teams\"\r\n| where Operation in (\"MemberAdded\", \"MemberRemoved\", \"TeamDeleted\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-        "size": 0,
-        "title": "Changes In Team Memberships",
-        "timeContextFromParameter": "TimeRange",
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "ThreatTeams"
-      },
-      "customWidth": "50",
-      "name": "query - 11"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "let RiskyExtensions = dynamic([\"exe\", \"msi\", \"bat\", \"cmd\", \"com\", \"scr\", \"pif\", \"ps1\", \"vbs\", \"js\", \"jse\", \"wsf\", \"docm\", \"xlsm\", \"pptm\", \"dll\", \"ocx\", \"cpl\", \"app\", \"vb\", \"reg\", \"inf\", \"hta\"]);\r\n\r\nEnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"SPO/OneDrive\")\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend [\"File Extension\"] = tostring(parse_json(AdditionalProperties).SourceFileExtension)\r\n| where [\"File Extension\"] in (RiskyExtensions)\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, [\"File Extension\"], Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], [\"File Extension\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], [\"File Extension\"], Operation, Count\r\n",
-              "size": 0,
-              "title": "Risky File Operations",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "OperationCount",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "blue"
-                    }
-                  }
-                ]
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Threat"
-            },
-            "name": "query - 1"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation in (\"FileRecycled\", \"FileDownloaded\", \"FileUploaded\", \"FileCreated\", \"File Modified\")\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by Timestamp, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Bulk File Events",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "OperationCount",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "blue"
-                    }
-                  }
-                ]
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Threat"
-            },
-            "name": "query - 8"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where Workload in (\"SPO/OneDrive\")\r\n| where Operation == \"FileDeletedFirstStageRecycleBin\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by bin(Timestamp, 1h), [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n| where Count > 1\r\n",
-              "size": 0,
-              "title": " Bulk File Deletion Operations",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "FileDeletions",
-                    "formatter": 8,
-                    "formatOptions": {
-                      "palette": "blue"
-                    }
-                  }
-                ]
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Threat"
-            },
-            "name": "query - 3"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "let baselinePeriod = 30d;\r\nlet detectionWindow = 1h;\r\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\r\n\r\nEnrichedMicrosoft365AuditLogs\r\n| where TimeGenerated >= ago(baselinePeriod)\r\n| where Workload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation == \"FileDownloaded\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = ClientIp, Operation\r\n| summarize Count = count() by bin(Timestamp, detectionWindow), [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Bulk File Download",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "DownloadCount",
-                    "formatter": 8,
-                    "formatOptions": {
-                      "palette": "blue"
-                    }
-                  }
-                ]
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Threat"
-            },
-            "name": "query - 4"
-          }
-        ]
-      },
-      "name": "group - 9"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n    Country = tostring(GeoInfo.country), \r\n    State = tostring(GeoInfo.state), \r\n    City = tostring(GeoInfo.city), \r\n    Latitude = tostring(GeoInfo.latitude), \r\n    Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n    UserId, \r\n    Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n    Latitude, \r\n    Longitude, \r\n    City, \r\n    State, \r\n    Country\r\n      | where tostring(Country) != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n\r\n",
-              "size": 0,
-              "title": "Access By Location",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "map",
-              "mapSettings": {
-                "locInfo": "CountryRegion",
-                "locInfoColumn": "Country",
-                "latitude": "Latitude",
-                "longitude": "Longitude",
-                "sizeSettings": "Count",
-                "sizeAggregation": "Sum",
-                "minSize": 20,
-                "labelSettings": "Country",
-                "legendMetric": "Country",
-                "numberOfMetrics": 8,
-                "legendAggregation": "Count",
-                "itemColorSettings": {
-                  "nodeColorField": "Count",
-                  "colorAggregation": "Sum",
-                  "type": "heatmap",
-                  "heatmapPalette": "turquoise"
-                }
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Overview"
-            },
-            "name": "query - 5"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| summarize [\"Event Count\"] = count() by [\"Time Generated\"] = TimeGenerated, [\"User\"] = UserId, [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem, [\"Workload\"] = Workload\r\n| order by [\"Time Generated\"] desc\r\n",
-              "size": 0,
-              "title": "Access By Location And OS",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "rowLimit": 1000,
-                "filter": true
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Overview"
-            },
-            "name": "query - 1"
-          }
-        ]
-      },
-      "name": "group - 19"
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "let data = EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| project \r\n    Operation, \r\n    UserId, \r\n    Workload, \r\n    SourceIp, \r\n    DeviceId, \r\n    TimeGenerated, \r\n    Details = pack_all(),\r\n    OS = tostring(DeviceOperatingSystem)\r\n| extend Workload = tostring(Workload)\r\n| extend WorkloadStatus = case(\r\n    Workload == \"Exchange\", \"Exchange\",\r\n    Workload == \"Teams\", \"Teams\",\r\n    Workload == \"SharePoint\", \"SharePoint\",\r\n    \"Other\"\r\n);\r\n\r\nlet appData = data\r\n| summarize \r\n    TotalCount = count(), \r\n    ExchangeCount = countif(Workload == \"Exchange\"), \r\n    TeamsCount = countif(Workload == \"Teams\"), \r\n    SharePointCount = countif(Workload == \"SharePoint\"), \r\n    OtherCount = countif(Workload == \"Other\") \r\n    by UserId\r\n| where UserId != ''\r\n| join kind=inner (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId\r\n    | project-away TimeGenerated\r\n  ) on UserId\r\n| order by TotalCount desc, UserId asc\r\n| project UserId, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\r\n| serialize Id = row_number();\r\n\r\ndata\r\n| summarize \r\n    TotalCount = count(), \r\n    ExchangeCount = countif(Workload == \"Exchange\"), \r\n    TeamsCount = countif(Workload == \"Teams\"), \r\n    SharePointCount = countif(Workload == \"SharePoint\"), \r\n    OtherCount = countif(Workload == \"Other\") \r\n    by UserId, SourceIp = tostring(SourceIp)\r\n| join kind=inner (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserId, SourceIp\r\n    | project-away TimeGenerated\r\n  ) on UserId, SourceIp\r\n| order by TotalCount desc, UserId asc\r\n| project UserId, SourceIp, TotalCount, ExchangeCount, TeamsCount, SharePointCount, OtherCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on UserId\r\n| project Id, Name = SourceIp, Type = 'Client IP', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = Id1\r\n| union (\r\n    appData \r\n    | project Id, Name = UserId, Type = 'Operating System', ['Events Count'] = TotalCount, Trend, ['Exchange Events'] = ExchangeCount, ['Teams Events'] = TeamsCount, ['SharePoint Events'] = SharePointCount, ['Other Count'] = OtherCount, ParentId = -1\r\n  )\r\n| order by ['Events Count'] desc, Name asc\r\n",
-        "size": 2,
-        "title": "Activity Log",
-        "timeContextFromParameter": "TimeRange",
-        "showRefreshButton": true,
-        "showExportToExcel": true,
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ],
-        "gridSettings": {
-          "formatters": [
-            {
-              "columnMatch": "Id",
-              "formatter": 5
-            },
-            {
-              "columnMatch": "Type",
-              "formatter": 5
-            },
-            {
-              "columnMatch": "Trend",
-              "formatter": 9,
-              "formatOptions": {
-                "palette": "blue"
-              }
-            },
-            {
-              "columnMatch": "Other Count",
-              "formatter": 5
-            },
-            {
-              "columnMatch": "ParentId",
-              "formatter": 5
-            },
-            {
-              "columnMatch": "Operation Count",
-              "formatter": 8,
-              "formatOptions": {
-                "palette": "blue"
-              }
-            },
-            {
-              "columnMatch": "Exchange Count",
-              "formatter": 8,
-              "formatOptions": {
-                "min": 0,
-                "palette": "blue"
-              }
-            },
-            {
-              "columnMatch": "Teams Count",
-              "formatter": 8,
-              "formatOptions": {
-                "min": 0,
-                "palette": "purple"
-              }
-            },
-            {
-              "columnMatch": "SharePoint Count",
-              "formatter": 8,
-              "formatOptions": {
-                "min": 0,
-                "palette": "turquoise"
-              }
-            },
-            {
-              "columnMatch": "Details",
-              "formatter": 5,
-              "formatOptions": {
-                "linkTarget": "GenericDetails",
-                "linkIsContextBlade": true
-              }
-            }
-          ],
-          "rowLimit": 1000,
-          "filter": true,
-          "hierarchySettings": {
-            "idColumn": "Id",
-            "parentColumn": "ParentId",
-            "treeType": 0,
-            "expanderColumn": "Name"
-          }
-        }
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "Overview"
-      },
-      "name": "query - 6"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 1,
-            "content": {
-              "json": "<br />\r\n💡 _Click on a segment of the pie chart to explore more details_"
-            },
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Overview"
-            },
-            "name": "text - 2"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| extend \r\n    OS = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n    OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\")\r\n| summarize DeviceCount = count() by OS, OSVersion\r\n| order by DeviceCount desc\r\n",
-              "size": 3,
-              "title": "Devices Accessing M365",
-              "timeContextFromParameter": "TimeRange",
-              "exportParameterName": "Parampie",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "piechart"
-            },
-            "customWidth": "50",
-            "conditionalVisibility": {
-              "parameterName": "selTab",
-              "comparison": "isEqualTo",
-              "value": "Overview"
-            },
-            "name": "query - 6"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "EnrichedMicrosoft365AuditLogs\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend \r\n    [\"Operating System\"] = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n    [\"OS Version\"] = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\"),\r\n    [\"Device ID\"] = coalesce(tostring(DeviceId), \"Unknown DeviceId\")\r\n| where [\"Operating System\"] == dynamic({Parampie}).label\r\n| summarize [\"Device Count\"] = count() by [\"Operating System\"], [\"OS Version\"], [\"Device ID\"]\r\n| order by [\"Device Count\"] desc\r\n",
-              "size": 2,
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "$gen_group",
-                    "formatter": 1
-                  }
-                ],
-                "hierarchySettings": {
-                  "treeType": 1,
-                  "groupBy": [
-                    "OperatingSystem",
-                    "OSVersion"
-                  ],
-                  "expandTopLevel": false
-                }
-              }
-            },
-            "customWidth": "50",
-            "conditionalVisibilities": [
-              {
-                "parameterName": "selTab",
-                "comparison": "isEqualTo",
-                "value": "Overview"
-              },
-              {
-                "parameterName": "Parampie",
-                "comparison": "isNotEqualTo"
-              }
-            ],
-            "name": "query - 1"
-          }
-        ]
-      },
-      "name": "group - 19"
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "let BusinessHoursStart = 8; // 8 AM\r\nlet BusinessHoursEnd = 18; // 6 PM\r\n\r\nEnrichedMicrosoft365AuditLogs \r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend HourOfDay = hourofday(TimeGenerated)\r\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\r\n| summarize [\"Off-Hour Activities\"] = count() by [\"User ID\"] = UserId, [\"Date\"] = bin(TimeGenerated, 1d), [\"Operation\"]\r\n| order by [\"Off-Hour Activities\"] desc\r\n",
-        "size": 0,
-        "title": "Activity Outside Standard Working Hours (8:00 - 18:00)",
-        "timeContextFromParameter": "TimeRange",
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "Overview"
-      },
-      "name": "query - 14"
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "EnrichedMicrosoft365AuditLogs\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc\n",
-        "size": 0,
-        "title": "Microsoft 365 Transactions",
-        "timeContextFromParameter": "TimeRange",
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ],
-        "visualization": "unstackedbar"
-      },
-      "conditionalVisibility": {
-        "parameterName": "selTab",
-        "comparison": "isEqualTo",
-        "value": "Overview"
-      },
-      "name": "query - 2"
-    }
-  ],
-  "fallbackResourceIds": [
-    "Global Secure Access"
-  ],
-  "fromTemplateId": "GSA Enriched Microsoft 365 logs",
-  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
-}
\ No newline at end of file
diff --git a/Workbooks/GSANetworkTraffic.json b/Workbooks/GSANetworkTraffic.json
deleted file mode 100644
index e4e50d998a..0000000000
--- a/Workbooks/GSANetworkTraffic.json
+++ /dev/null
@@ -1,787 +0,0 @@
-{
-  "version": "Notebook/1.0",
-  "items": [
-    {
-      "type": 1,
-      "content": {
-        "json": "## Network Traffic Insights Workbook (Preview)\n---\nInformation in the dashboard is based on log data\n\n\n"
-      },
-      "name": "text - 2"
-    },
-    {
-      "type": 9,
-      "content": {
-        "version": "KqlParameterItem/1.0",
-        "crossComponentResources": [
-          "value::all"
-        ],
-        "parameters": [
-          {
-            "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
-            "version": "KqlParameterItem/1.0",
-            "name": "LogAnalyticWorkspace",
-            "label": "Log Analytic Workspace",
-            "type": 5,
-            "description": "The Log Analytic Workspace In Which To Execute The Queries",
-            "isRequired": true,
-            "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
-            "crossComponentResources": [
-              "value::all"
-            ],
-            "typeSettings": {
-              "resourceTypeFilter": {
-                "microsoft.operationalinsights/workspaces": true
-              },
-              "additionalResourceOptions": [],
-              "showDefault": false
-            },
-            "timeContext": {
-              "durationMs": 2592000000
-            },
-            "queryType": 1,
-            "resourceType": "microsoft.resourcegraph/resources",
-            "value": null
-          },
-          {
-            "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
-            "version": "KqlParameterItem/1.0",
-            "name": "TimeRange",
-            "label": "Time Range",
-            "type": 4,
-            "isRequired": true,
-            "typeSettings": {
-              "selectableValues": [
-                {
-                  "durationMs": 300000
-                },
-                {
-                  "durationMs": 900000
-                },
-                {
-                  "durationMs": 1800000
-                },
-                {
-                  "durationMs": 3600000
-                },
-                {
-                  "durationMs": 14400000
-                },
-                {
-                  "durationMs": 43200000
-                },
-                {
-                  "durationMs": 86400000
-                },
-                {
-                  "durationMs": 172800000
-                },
-                {
-                  "durationMs": 259200000
-                },
-                {
-                  "durationMs": 604800000
-                },
-                {
-                  "durationMs": 1209600000
-                },
-                {
-                  "durationMs": 2419200000
-                },
-                {
-                  "durationMs": 2592000000
-                }
-              ],
-              "allowCustom": true
-            },
-            "timeContext": {
-              "durationMs": 86400000
-            },
-            "value": {
-              "durationMs": 604800000
-            }
-          },
-          {
-            "id": "8bab511b-53b3-4220-9d1c-372345b06728",
-            "version": "KqlParameterItem/1.0",
-            "name": "Users",
-            "type": 2,
-            "isRequired": true,
-            "multiSelect": true,
-            "quote": "'",
-            "delimiter": ",",
-            "query": "NetworkAccessTraffic\r\n| summarize Count = count() by UserPrincipalName\r\n| order by Count desc, UserPrincipalName asc\r\n| project Value = UserPrincipalName, Label = strcat(UserPrincipalName, ' - ', Count, ' Logs'), Selected = false",
-            "crossComponentResources": [
-              "{LogAnalyticWorkspace}"
-            ],
-            "typeSettings": {
-              "limitSelectTo": 20,
-              "additionalResourceOptions": [
-                "value::all"
-              ],
-              "selectAllValue": "*",
-              "showDefault": false
-            },
-            "timeContext": {
-              "durationMs": 0
-            },
-            "timeContextFromParameter": "TimeRange",
-            "queryType": 0,
-            "resourceType": "microsoft.operationalinsights/workspaces",
-            "value": [
-              "value::all"
-            ]
-          },
-          {
-            "id": "527af4d2-3089-4aa4-9fbb-48ec697db20d",
-            "version": "KqlParameterItem/1.0",
-            "name": "WebCategories",
-            "label": "Web Categories",
-            "type": 2,
-            "multiSelect": true,
-            "quote": "'",
-            "delimiter": ",",
-            "query": "NetworkAccessTraffic\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| order by Count desc, firstCategory asc\r\n| project Value = firstCategory, Label = strcat(firstCategory, ' - ', Count, ' Logs')",
-            "crossComponentResources": [
-              "{LogAnalyticWorkspace}"
-            ],
-            "typeSettings": {
-              "additionalResourceOptions": [
-                "value::all"
-              ],
-              "selectAllValue": "*",
-              "showDefault": false
-            },
-            "timeContext": {
-              "durationMs": 604800000
-            },
-            "timeContextFromParameter": "TimeRange",
-            "defaultValue": "value::all",
-            "queryType": 0,
-            "resourceType": "microsoft.operationalinsights/workspaces",
-            "value": [
-              "value::all"
-            ]
-          }
-        ],
-        "style": "pills",
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces"
-      },
-      "name": "parameters - 15"
-    },
-    {
-      "type": 11,
-      "content": {
-        "version": "LinkItem/1.0",
-        "style": "tabs",
-        "links": [
-          {
-            "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
-            "cellValue": "tabSel",
-            "linkTarget": "parameter",
-            "linkLabel": "Overview",
-            "subTarget": "Overview",
-            "style": "link"
-          },
-          {
-            "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
-            "cellValue": "tabSel",
-            "linkTarget": "parameter",
-            "linkLabel": "All Traffic",
-            "subTarget": "AllTraffic",
-            "style": "link"
-          },
-          {
-            "id": "5ae54b5a-ac7b-4b7a-a1e1-1e574625caa3",
-            "cellValue": "tabSel",
-            "linkTarget": "parameter",
-            "linkLabel": "URL Lookup",
-            "subTarget": "URLLookup",
-            "style": "link"
-          },
-          {
-            "id": "68c566f8-957e-4a3f-8b66-730fc24135fb",
-            "cellValue": "tabSel",
-            "linkTarget": "parameter",
-            "linkLabel": "Security Insights",
-            "subTarget": "Security",
-            "style": "link"
-          }
-        ]
-      },
-      "name": "links - 7"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "let NetworkAccessTrafficData = NetworkAccessTraffic\r\n| where SourceIp != \"\" and isnotempty(SourceIp)\r\n| summarize arg_max(TimeGenerated, *) by SourceIp, TenantId;\r\n\r\nlet SigninLogsData = SigninLogs\r\n| where IPAddress != \"\" and isnotempty(IPAddress)\r\n| summarize arg_max(TimeGenerated, *) by IPAddress, TenantId, UserId, CorrelationId;\r\n\r\nSigninLogsData\r\n| join kind=leftanti (\r\n    NetworkAccessTrafficData\r\n    | where SourceIp != \"\" and isnotempty(SourceIp)\r\n) on $left.IPAddress == $right.SourceIp and $left.TenantId == $right.TenantId\r\n| project TimeGenerated, IPAddress, UserId, UserPrincipalName, AppDisplayName, DeviceDetail.deviceId\r\n",
-              "size": 0,
-              "title": "Sign-ins Outside Global Secure Access",
-              "timeContextFromParameter": "TimeRange",
-              "showExportToExcel": true,
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "rowLimit": 1000,
-                "filter": true
-              }
-            },
-            "name": "query - 0"
-          }
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "tabSel",
-        "comparison": "isEqualTo",
-        "value": "Security"
-      },
-      "name": "group - 10"
-    },
-    {
-      "type": 1,
-      "content": {
-        "json": "💡 Type the URL for detailed analysis"
-      },
-      "conditionalVisibility": {
-        "parameterName": "tabSel",
-        "comparison": "isEqualTo",
-        "value": "URLLookup"
-      },
-      "name": "text - 10"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 9,
-            "content": {
-              "version": "KqlParameterItem/1.0",
-              "parameters": [
-                {
-                  "id": "ec8c38c8-3064-4921-8dcd-a69d3895599b",
-                  "version": "KqlParameterItem/1.0",
-                  "name": "URL",
-                  "type": 1,
-                  "typeSettings": {
-                    "isSearchBox": true
-                  },
-                  "timeContext": {
-                    "durationMs": 86400000
-                  }
-                }
-              ],
-              "style": "above",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces"
-            },
-            "conditionalVisibility": {
-              "parameterName": "tabSel",
-              "comparison": "isEqualTo",
-              "value": "URLLookup"
-            },
-            "name": "parameters - 9"
-          },
-          {
-            "type": 1,
-            "content": {
-              "json": "# Web Categories"
-            },
-            "name": "text - 11"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "let CategoryData = NetworkAccessTraffic \r\n| where DestinationFqdn contains \"{URL}\"  // Filters logs based on the provided URL parameter\r\n| extend CategoriesList = split(DestinationWebCategories, \",\")  // Split categories into a list\r\n| mv-expand Category = CategoriesList  // Expand the list into individual rows\r\n| extend Category = trim_start(\" \", trim_end(\" \", tostring(Category)))  // Trim leading and trailing spaces\r\n| extend Category = iff(TrafficType == \"microsoft365\", \"Microsoft M365\", Category)  // Set category to \"Microsoft M365\" if TrafficType is \"microsoft365\"\r\n| summarize UniqueCategories = make_set(Category);  // Create a set of unique categories\r\n\r\nCategoryData\r\n| extend \r\n    PrimaryCategory = iff(array_length(UniqueCategories) > 0, tostring(UniqueCategories[0]), \"None\")\r\n| project \r\n    col1 = PrimaryCategory,\r\n    snapshot = \"Primary Category\"\r\n\r\n| union (\r\n    CategoryData\r\n    | extend \r\n        SecondaryCategory = iff(array_length(UniqueCategories) > 1, tostring(UniqueCategories[1]), \"None\")\r\n    | project \r\n        col1 = SecondaryCategory,\r\n        snapshot = \"Secondary Category\"\r\n)\r\n\r\n| order by snapshot asc\r\n",
-              "size": 4,
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "tiles",
-              "tileSettings": {
-                "titleContent": {
-                  "columnMatch": "snapshot"
-                },
-                "leftContent": {
-                  "columnMatch": "col1",
-                  "numberFormat": {
-                    "unit": 17,
-                    "options": {
-                      "style": "decimal",
-                      "maximumFractionDigits": 2
-                    }
-                  }
-                },
-                "showBorder": true,
-                "size": "auto"
-              }
-            },
-            "name": "query - 17"
-          },
-          {
-            "type": 1,
-            "content": {
-              "json": "# Traffic Access Details"
-            },
-            "name": "text - 15"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "let NetworkData = NetworkAccessTraffic\r\n| where DestinationFqdn contains \"{URL}\";  // Filters logs based on the provided URL parameter\r\n\r\nNetworkData\r\n| summarize \r\n    UniqueUsers = dcount(UserPrincipalName),\r\n    UniqueDevices = dcount(DeviceId),    \r\n    TotalAllow = countif(Action == \"Allow\"),\r\n    TotalBlock = countif(Action == \"Block\")\r\n| project \r\n    col1 = UniqueUsers, \r\n    snapshot = \"Unique Users\"\r\n| union (NetworkData\r\n    | summarize UniqueDevices = dcount(DeviceId)\r\n    | project col1 = UniqueDevices, snapshot = \"Unique Devices\")\r\n| union (NetworkData\r\n    | summarize TotalAllow = countif(Action == \"Allow\")\r\n    | project col1 = TotalAllow, snapshot = \"Total Allow\")\r\n| union (NetworkData\r\n    | summarize TotalBlock = countif(Action == \"Block\")\r\n    | project col1 = TotalBlock, snapshot = \"Total Block\")\r\n| order by snapshot asc",
-              "size": 4,
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "tiles",
-              "tileSettings": {
-                "titleContent": {
-                  "columnMatch": "snapshot",
-                  "formatter": 1
-                },
-                "leftContent": {
-                  "columnMatch": "col1",
-                  "formatter": 12,
-                  "formatOptions": {
-                    "palette": "auto"
-                  },
-                  "numberFormat": {
-                    "unit": 17,
-                    "options": {
-                      "style": "decimal",
-                      "maximumFractionDigits": 2,
-                      "maximumSignificantDigits": 3
-                    }
-                  }
-                },
-                "showBorder": true
-              }
-            },
-            "name": "query - 14"
-          },
-          {
-            "type": 1,
-            "content": {
-              "json": "# Bandwidth Usage"
-            },
-            "name": "text - 16"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "let NetworkData = NetworkAccessTraffic\r\n| where DestinationFqdn contains \"{URL}\";  // Filters logs based on the provided URL parameter\r\n\r\nNetworkData\r\n| summarize \r\n    TotalSent = sum(SentBytes),\r\n    TotalReceived = sum(ReceivedBytes),\r\n    TotalBandwidth = sum(SentBytes + ReceivedBytes)\r\n| extend \r\n    TotalSentMB = round(TotalSent / 1024.0 / 1024.0, 2),\r\n    TotalReceivedMB = round(TotalReceived / 1024.0 / 1024.0, 2),\r\n    TotalBandwidthMB = round(TotalBandwidth / 1024.0 / 1024.0, 2)\r\n| project \r\n    TotalSentMB,\r\n    TotalReceivedMB,\r\n    TotalBandwidthMB\r\n| extend dummy = 1\r\n| project-away dummy\r\n| mv-expand \r\n    Column = pack_array(\"TotalSentMB\", \"TotalReceivedMB\", \"TotalBandwidthMB\"),\r\n    Value = pack_array(TotalSentMB, TotalReceivedMB, TotalBandwidthMB)\r\n| extend \r\n    snapshot = case(\r\n        Column == \"TotalSentMB\", \"Total Sent (MB)\",\r\n        Column == \"TotalReceivedMB\", \"Total Received (MB)\",\r\n        Column == \"TotalBandwidthMB\", \"Total Bandwidth (MB)\",\r\n        \"Unknown\"\r\n    ),\r\n    col1 = iff(Value < 0.01, 0.00, Value)\r\n| project-away Column, Value\r\n| order by snapshot asc",
-              "size": 4,
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "tiles",
-              "tileSettings": {
-                "titleContent": {
-                  "columnMatch": "snapshot",
-                  "formatter": 1
-                },
-                "leftContent": {
-                  "columnMatch": "col1",
-                  "formatter": 12,
-                  "formatOptions": {
-                    "palette": "auto"
-                  },
-                  "numberFormat": {
-                    "unit": 17,
-                    "options": {
-                      "style": "decimal",
-                      "maximumFractionDigits": 2,
-                      "maximumSignificantDigits": 3
-                    }
-                  }
-                },
-                "showBorder": true
-              }
-            },
-            "name": "query - 17"
-          },
-          {
-            "type": 1,
-            "content": {
-              "json": "# Traffic Logs (filtered)"
-            },
-            "name": "text - 12"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where DestinationFqdn contains \"{URL}\"\r\n| project \r\n    Timestamp = TimeGenerated,\r\n    User = UserPrincipalName,\r\n    [\"Source IP\"] = SourceIp,\r\n    [\"Destination IP\"] = DestinationIp,\r\n    [\"Destination Port\"] = DestinationPort,\r\n    [\"Destination FQDN\"] = DestinationFqdn,\r\n    Action = case(\r\n        tolower(Action) == \"allow\", \"🟢 Allow\", \r\n        tolower(Action) == \"block\", \"🔴 Block\", \r\n        tolower(Action) // This returns the action in lowercase if it doesn't match \"allow\" or \"block\"\r\n    ),\r\n    [\"Policy Name\"] = PolicyName,\r\n    [\"Policy Rule ID\"] = PolicyRuleId,\r\n    [\"Received Bytes\"] = ReceivedBytes,\r\n    [\"Sent Bytes\"] = SentBytes,\r\n    [\"Device OS\"] = DeviceOperatingSystem    \r\n| order by Timestamp desc\r\n",
-              "size": 0,
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ]
-            },
-            "name": "query - 13"
-          }
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "tabSel",
-        "comparison": "isEqualTo",
-        "value": "URLLookup"
-      },
-      "name": "group - URL Lookup"
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| project \r\n    Timestamp = TimeGenerated,\r\n    User = UserPrincipalName,\r\n    [\"Source IP\"] = SourceIp,\r\n    [\"Destination IP\"] = DestinationIp,\r\n    [\"Destination Port\"] = DestinationPort,\r\n    [\"Destination FQDN\"] = DestinationFqdn,\r\n    Action = case(\r\n        tolower(Action) == \"allow\", \"🟢 Allow\", \r\n        tolower(Action) == \"block\", \"🔴 Block\", \r\n        tolower(Action) // This returns the action in lowercase if it doesn't match \"allow\" or \"block\"\r\n    ),\r\n    [\"Policy Name\"] = PolicyName,\r\n    [\"Web Category\"] = DestinationWebCategories,\r\n    [\"Transport Protocol\"] = TransportProtocol,\r\n    [\"Traffic Type\"] = TrafficType,\r\n    [\"Received Bytes\"] = ReceivedBytes,\r\n    [\"Sent Bytes\"] = SentBytes,\r\n    [\"Device OS\"] = DeviceOperatingSystem,\r\n    [\"Policy Rule ID\"] = PolicyRuleId\r\n| order by Timestamp desc\r\n",
-        "size": 3,
-        "title": "Traffic Logs",
-        "timeContextFromParameter": "TimeRange",
-        "showRefreshButton": true,
-        "showExportToExcel": true,
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ],
-        "gridSettings": {
-          "rowLimit": 1000,
-          "filter": true
-        }
-      },
-      "conditionalVisibility": {
-        "parameterName": "tabSel",
-        "comparison": "isEqualTo",
-        "value": "AllTraffic"
-      },
-      "name": "query - 6"
-    },
-    {
-      "type": 3,
-      "content": {
-        "version": "KqlItem/1.0",
-        "query": "// Unique Users\nNetworkAccessTraffic\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\n| project SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n    NetworkAccessTraffic\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\n    | extend BytesInGB = todouble(SentBytes + ReceivedBytes) / (1024 * 1024 * 1024)  // Convert bytes to gigabytes\n    | summarize TotalBytesGB = sum(BytesInGB)\n    | extend snapshot = \"Total Bytes (GB)\"\n    | project col1 =   tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n    NetworkAccessTraffic\n    | where UserPrincipalName in ({Users}) or '*' in ({Users})\n    | summarize TotalTransactions = count()\n    | extend snapshot = \"Total Transactions\"\n    | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
-        "size": 4,
-        "timeContextFromParameter": "TimeRange",
-        "queryType": 0,
-        "resourceType": "microsoft.operationalinsights/workspaces",
-        "crossComponentResources": [
-          "{LogAnalyticWorkspace}"
-        ],
-        "visualization": "tiles",
-        "tileSettings": {
-          "titleContent": {
-            "columnMatch": "snapshot",
-            "formatter": 1
-          },
-          "leftContent": {
-            "columnMatch": "col1",
-            "formatter": 12,
-            "formatOptions": {
-              "palette": "auto"
-            }
-          },
-          "showBorder": true,
-          "size": "auto"
-        },
-        "mapSettings": {
-          "locInfo": "LatLong",
-          "sizeSettings": "ExistingClients",
-          "sizeAggregation": "Sum",
-          "legendMetric": "ExistingClients",
-          "legendAggregation": "Sum",
-          "itemColorSettings": {
-            "type": "heatmap",
-            "colorAggregation": "Sum",
-            "nodeColorField": "ExistingClients",
-            "heatmapPalette": "greenRed"
-          }
-        },
-        "textSettings": {
-          "style": "bignumber"
-        }
-      },
-      "conditionalVisibility": {
-        "parameterName": "tabSel",
-        "comparison": "isEqualTo",
-        "value": "Overview"
-      },
-      "name": "query - 2"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend BytesIn = todouble(SentBytes + ReceivedBytes) / (1024 * 1024)  // Convert bytes to Mbytes\r\n| summarize TotalBytesMB = sum(BytesIn) by bin(TimeGenerated, 1h), TrafficType\r\n| order by bin(TimeGenerated, 1h) asc, TrafficType asc\r\n| project TimeGenerated, TrafficType, TotalBytesMB\r\n",
-              "size": 2,
-              "title": "Usage Over Time (MB)",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "barchart"
-            },
-            "conditionalVisibility": {
-              "parameterName": "tabSel",
-              "comparison": "isEqualTo",
-              "value": "Overview"
-            },
-            "name": "query - 0"
-          }
-        ]
-      },
-      "name": "group - 5"
-    },
-    {
-      "type": 12,
-      "content": {
-        "version": "NotebookGroup/1.0",
-        "groupType": "editable",
-        "items": [
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Extend each row with geolocation info\r\n| project  TimeGenerated, SourceIp, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
-              "size": 3,
-              "title": "Locations",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "map",
-              "mapSettings": {
-                "locInfo": "CountryRegion",
-                "locInfoColumn": "Country",
-                "latitude": "Latitude",
-                "longitude": "Longitude",
-                "sizeSettings": "Count",
-                "sizeAggregation": "Sum",
-                "labelSettings": "Country",
-                "legendMetric": "Country",
-                "legendAggregation": "Count",
-                "itemColorSettings": {
-                  "nodeColorField": "Count",
-                  "colorAggregation": "Sum",
-                  "type": "heatmap",
-                  "heatmapPalette": "turquoise"
-                }
-              }
-            },
-            "name": "query - 0"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"allow\" and DestinationWebCategories != '' // Filter for allowed traffic\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
-              "size": 2,
-              "title": "Top Allowed Web Categories",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "piechart"
-            },
-            "customWidth": "50",
-            "name": "query - 7"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"block\" and DestinationWebCategories != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(DestinationWebCategories, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
-              "size": 3,
-              "title": "Top Blocked Web Categories",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "piechart"
-            },
-            "customWidth": "50",
-            "name": "query - 6"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic  \r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where tolower(Action) == \"block\" and DestinationFqdn != ''  // Filter for blocked traffic with non-empty Destination FQDN\r\n| summarize Count = count() by [\"Destination FQDN\"] = DestinationFqdn, [\"Destination Web Categories\"] = DestinationWebCategories, [\"Policy Name\"] = PolicyName\r\n| order by Count\r\n",
-              "size": 0,
-              "title": "Top Blocked Destinations",
-              "timeContextFromParameter": "TimeRange",
-              "showRefreshButton": true,
-              "showExportToExcel": true,
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "Count",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "blue"
-                    }
-                  }
-                ],
-                "rowLimit": 1000,
-                "filter": true,
-                "sortBy": [
-                  {
-                    "itemKey": "$gen_bar_Count_3",
-                    "sortOrder": 2
-                  }
-                ]
-              },
-              "sortBy": [
-                {
-                  "itemKey": "$gen_bar_Count_3",
-                  "sortOrder": 2
-                }
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 5"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where DestinationWebCategories in ({WebCategories}) or '*' in ({WebCategories})\r\n| where SentBytes > 0\r\n| where tolower(Action) != \"block\"\r\n| summarize \r\n    Count = count(), \r\n    [\"Sent Bytes\"] = sum(SentBytes), \r\n    [\"Received Bytes\"] = sum(ReceivedBytes), \r\n    [\"Total Bytes\"] = sum(ReceivedBytes + SentBytes) \r\n    by [\"Destination FQDN\"] = DestinationFqdn\r\n| order by Count desc\r\n",
-              "size": 0,
-              "title": "Top Allowed Destinations",
-              "timeContextFromParameter": "TimeRange",
-              "showRefreshButton": true,
-              "showExportToExcel": true,
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "gridSettings": {
-                "formatters": [
-                  {
-                    "columnMatch": "Count",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "magenta"
-                    }
-                  },
-                  {
-                    "columnMatch": "Recived",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "turquoise"
-                    }
-                  },
-                  {
-                    "columnMatch": "Total",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "pink"
-                    }
-                  },
-                  {
-                    "columnMatch": "Sent",
-                    "formatter": 4,
-                    "formatOptions": {
-                      "palette": "blue"
-                    }
-                  }
-                ],
-                "rowLimit": 1000,
-                "filter": true,
-                "sortBy": [
-                  {
-                    "itemKey": "$gen_bar_Count_1",
-                    "sortOrder": 2
-                  }
-                ]
-              },
-              "sortBy": [
-                {
-                  "itemKey": "$gen_bar_Count_1",
-                  "sortOrder": 2
-                }
-              ]
-            },
-            "customWidth": "50",
-            "name": "query - 1"
-          },
-          {
-            "type": 3,
-            "content": {
-              "version": "KqlItem/1.0",
-              "query": "NetworkAccessTraffic\r\n| where UserPrincipalName in ({Users}) or '*' in ({Users})\r\n| where TransportProtocol != ''\r\n| summarize Count = count() by toupper(TransportProtocol)\r\n| top 10 by Count\r\n",
-              "size": 2,
-              "title": "Protocol Distribution",
-              "timeContextFromParameter": "TimeRange",
-              "queryType": 0,
-              "resourceType": "microsoft.operationalinsights/workspaces",
-              "crossComponentResources": [
-                "{LogAnalyticWorkspace}"
-              ],
-              "visualization": "piechart"
-            },
-            "customWidth": "50",
-            "name": "query - 3"
-          }
-        ]
-      },
-      "conditionalVisibility": {
-        "parameterName": "tabSel",
-        "comparison": "isEqualTo",
-        "value": "Overview"
-      },
-      "name": "group - 4"
-    }
-  ],
-  "fallbackResourceIds": [
-    "Global Secure Access"
-  ],
-  "fromTemplateId": "GSA Network Traffic Insights",
-  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
-}
\ No newline at end of file

From 60cdacc0b62d7f0c76cd6f68f4add9ca500c1316 Mon Sep 17 00:00:00 2001
From: v-shukore <v-shukore@microsoft.com>
Date: Wed, 9 Oct 2024 10:15:46 +0530
Subject: [PATCH 26/27] Update ReleaseNotes.md

---
 Solutions/Global Secure Access/ReleaseNotes.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Solutions/Global Secure Access/ReleaseNotes.md b/Solutions/Global Secure Access/ReleaseNotes.md
index 15e70717f1..c865104afe 100644
--- a/Solutions/Global Secure Access/ReleaseNotes.md	
+++ b/Solutions/Global Secure Access/ReleaseNotes.md	
@@ -1,3 +1,3 @@
-| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                                      |
-|-------------|--------------------------------|-----------------------------------------------------------------------------------------|
-| 3.0.0       | 05-09-2024                     | Initial Solution release								                                 |
+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                                       |
+|-------------|--------------------------------|------------------------------------------------------------------------------------------|
+| 3.0.0       | 05-09-2024                     | Initial Solution release								                                  |

From f36fc6622d3bf4bc1362a177752efd71fc59ccd5 Mon Sep 17 00:00:00 2001
From: v-shukore <v-shukore@microsoft.com>
Date: Thu, 10 Oct 2024 10:36:26 +0530
Subject: [PATCH 27/27] Update Solution_GlobalSecureAccess.json

---
 .../Global Secure Access/Data/Solution_GlobalSecureAccess.json  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json b/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json
index d1978bff0b..abe547db91 100644
--- a/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	
+++ b/Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	
@@ -55,7 +55,7 @@
     "Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml"
   ],  
   "BasePath": "C:\\git\\Azure-Sentinel\\Azure-Sentinel\\Solutions\\Global Secure Access",
-  "Version": "3.0.1",
+  "Version": "3.0.0",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [