From 2233b55bcb3096cfcd0d65d9d15dfafaaabdecf4 Mon Sep 17 00:00:00 2001
From: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com>
Date: Wed, 15 Feb 2023 10:30:01 -0500
Subject: [PATCH] [ASM] - EXPANDR - 1578 (#24380)
---
.../.pack-ignore | 5 +-
.../.secrets-ignore | 1 +
.../incidentfield-ASM_-_Asset_ID.json | 4 +-
...entfield-ASM_-_Attack_Surface_Rule_ID.json | 4 +-
...dentfield-ASM_-_Remediation_Path_Rule.json | 98 ++
.../incidentfield-ASM_-_Service_ID.json | 4 +-
.../CortexAttackSurfaceManagement.py | 91 +-
.../CortexAttackSurfaceManagement.yml | 48 +-
.../CortexAttackSurfaceManagement_test.py | 56 +-
.../CortexAttackSurfaceManagement/README.md | 83 +-
.../command_examples | 3 +-
.../test_data/expected_results.py | 26 +
.../test_data/raw_response.py | 33 +-
.../Playbooks/Cortex_ASM_-_ASM_Alert.yml | 970 ++++++++--------
.../Cortex_ASM_-_ASM_Alert_README.md | 14 +-
.../Cortex_ASM_-_CMDB_Enrichment.yml | 2 -
.../Playbooks/Cortex_ASM_-_Decision.yml | 345 ++++++
.../Playbooks/Cortex_ASM_-_Decision_README.md | 39 +
.../Playbooks/Cortex_ASM_-_Detect_Service.yml | 8 +-
.../Playbooks/Cortex_ASM_-_Enrichment.yml | 2 +-
.../Playbooks/Cortex_ASM_-_GCP_Enrichment.yml | 2 -
.../Playbooks/Cortex_ASM_-_Remediation.yml | 2 -
.../Cortex_ASM_-_Remediation_Guidance.yml | 2 -
.../Cortex_ASM_-_Remediation_Path_Rules.yml | 1010 +++++++++++++++++
...tex_ASM_-_Remediation_Path_Rules_README.md | 37 +
.../Cortex_ASM_-_Tenable.io_Enrichment.yml | 3 -
Packs/CortexAttackSurfaceManagement/README.md | 44 +-
.../ReleaseNotes/1_5_1.md | 52 +
.../GenerateASMReport/GenerateASMReport.py | 93 +-
.../GenerateASMReport/GenerateASMReport.yml | 7 +-
.../GenerateASMReport_test.py | 16 +
.../Scripts/GenerateASMReport/README.md | 26 +-
.../RemediationPathRuleEvaluation/README.md | 26 +
.../RemediationPathRuleEvaluation.py | 225 ++++
.../RemediationPathRuleEvaluation.yml | 39 +
.../RemediationPathRuleEvaluation_test.py | 245 ++++
...ook-CortexAttackSurfaceManagement_Test.yml | 2 -
.../doc_files/Cortex_ASM_-_ASM_Alert.png | Bin 873581 -> 818655 bytes
.../doc_files/Cortex_ASM_-_Decision.png | Bin 0 -> 73698 bytes
.../Cortex_ASM_-_Remediation_Path_Rules.png | Bin 0 -> 262260 bytes
.../RemediationPathRuleEvaluation.png | Bin 0 -> 20833 bytes
.../pack_metadata.json | 2 +-
42 files changed, 3013 insertions(+), 656 deletions(-)
create mode 100644 Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation_Path_Rule.json
create mode 100644 Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision.yml
create mode 100644 Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision_README.md
create mode 100644 Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules.yml
create mode 100644 Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules_README.md
create mode 100644 Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_5_1.md
create mode 100644 Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/README.md
create mode 100644 Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.py
create mode 100644 Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.yml
create mode 100644 Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation_test.py
create mode 100644 Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Decision.png
create mode 100644 Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Remediation_Path_Rules.png
create mode 100644 Packs/CortexAttackSurfaceManagement/doc_files/RemediationPathRuleEvaluation.png
diff --git a/Packs/CortexAttackSurfaceManagement/.pack-ignore b/Packs/CortexAttackSurfaceManagement/.pack-ignore
index 901865848992..31796d6cadbf 100644
--- a/Packs/CortexAttackSurfaceManagement/.pack-ignore
+++ b/Packs/CortexAttackSurfaceManagement/.pack-ignore
@@ -11,4 +11,7 @@ ignore=PB114
ASM
CMDB
subplaybooks
-GCP
\ No newline at end of file
+Xpanse
+GCP
+StripChars
+multiSelect
diff --git a/Packs/CortexAttackSurfaceManagement/.secrets-ignore b/Packs/CortexAttackSurfaceManagement/.secrets-ignore
index c3d829a37335..f2da11fba40d 100644
--- a/Packs/CortexAttackSurfaceManagement/.secrets-ignore
+++ b/Packs/CortexAttackSurfaceManagement/.secrets-ignore
@@ -1,5 +1,6 @@
inferredCveMatchType
1.1.1.1
+2.2.2.2.
noc@acme.com
cs@acme.com
https://xsiam.com
diff --git a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Asset_ID.json b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Asset_ID.json
index 8f4a44591a62..1642f57bc8c0 100644
--- a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Asset_ID.json
+++ b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Asset_ID.json
@@ -13,13 +13,13 @@
"locked": false,
"name": "ASM - Asset ID",
"neverSetAsRequired": false,
- "openEnded": false,
+ "openEnded": true,
"ownerOnly": false,
"required": false,
"sla": 0,
"system": false,
"threshold": 72,
- "type": "shortText",
+ "type": "multiSelect",
"unmapped": false,
"unsearchable": true,
"useAsKpi": false,
diff --git a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Attack_Surface_Rule_ID.json b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Attack_Surface_Rule_ID.json
index 4f33901ddf1a..ae0b58b4d094 100644
--- a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Attack_Surface_Rule_ID.json
+++ b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Attack_Surface_Rule_ID.json
@@ -13,13 +13,13 @@
"locked": false,
"name": "ASM - Attack Surface Rule ID",
"neverSetAsRequired": false,
- "openEnded": false,
+ "openEnded": true,
"ownerOnly": false,
"required": false,
"sla": 0,
"system": false,
"threshold": 72,
- "type": "shortText",
+ "type": "multiSelect",
"unmapped": false,
"unsearchable": true,
"useAsKpi": false,
diff --git a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation_Path_Rule.json b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation_Path_Rule.json
new file mode 100644
index 000000000000..6e5c5a6927f2
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation_Path_Rule.json
@@ -0,0 +1,98 @@
+{
+ "associatedToAll": true,
+ "caseInsensitive": true,
+ "cliName": "asmremediationpathrule",
+ "closeForm": false,
+ "columns": [
+ {
+ "displayName": "Name",
+ "fieldCalcScript": "",
+ "isDefault": true,
+ "isReadOnly": false,
+ "key": "name",
+ "orgType": "shortText",
+ "required": false,
+ "script": "",
+ "selectValues": null,
+ "type": "shortText",
+ "width": 150
+ },
+ {
+ "displayName": "Description",
+ "fieldCalcScript": "",
+ "isDefault": true,
+ "isReadOnly": false,
+ "key": "description",
+ "orgType": "shortText",
+ "required": false,
+ "script": "",
+ "selectValues": null,
+ "type": "shortText",
+ "width": 150
+ },
+ {
+ "displayName": "Action",
+ "fieldCalcScript": "",
+ "isDefault": true,
+ "isReadOnly": false,
+ "key": "action",
+ "orgType": "shortText",
+ "required": false,
+ "script": "",
+ "selectValues": null,
+ "type": "shortText",
+ "width": 150
+ },
+ {
+ "displayName": "Created_by",
+ "fieldCalcScript": "",
+ "isDefault": true,
+ "isReadOnly": false,
+ "key": "created_by",
+ "orgType": "shortText",
+ "required": false,
+ "script": "",
+ "selectValues": null,
+ "type": "shortText",
+ "width": 150
+ },
+ {
+ "displayName": "Criteria",
+ "fieldCalcScript": "",
+ "isDefault": true,
+ "isReadOnly": false,
+ "key": "criteria",
+ "orgType": "shortText",
+ "required": false,
+ "script": "",
+ "selectValues": null,
+ "type": "shortText",
+ "width": 150
+ }
+ ],
+ "content": true,
+ "defaultRows": [
+ {}
+ ],
+ "description": "Shows information on matching remediation path rule",
+ "editForm": true,
+ "group": 0,
+ "hidden": true,
+ "id": "incident_asmremediationpathrule",
+ "isReadOnly": false,
+ "locked": false,
+ "name": "ASM - Remediation Path Rule",
+ "neverSetAsRequired": false,
+ "openEnded": false,
+ "ownerOnly": false,
+ "required": false,
+ "sla": 0,
+ "system": false,
+ "threshold": 72,
+ "type": "grid",
+ "unmapped": false,
+ "unsearchable": true,
+ "useAsKpi": false,
+ "version": -1,
+ "fromVersion": "6.5.0"
+}
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Service_ID.json b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Service_ID.json
index 162eabd3e617..a3898bc5467f 100644
--- a/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Service_ID.json
+++ b/Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Service_ID.json
@@ -13,13 +13,13 @@
"locked": false,
"name": "ASM - Service ID",
"neverSetAsRequired": false,
- "openEnded": false,
+ "openEnded": true,
"ownerOnly": false,
"required": false,
"sla": 0,
"system": false,
"threshold": 72,
- "type": "shortText",
+ "type": "multiSelect",
"unmapped": false,
"unsearchable": true,
"useAsKpi": false,
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.py b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.py
index 8da2f5dffe28..37b04b5fc22f 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.py
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.py
@@ -14,11 +14,25 @@ class Client(BaseClient):
Client class to interact with the service API.
"""
- def __init__(self, base_url, verify, proxy, headers, auth):
+ def __init__(self, base_url, verify, proxy, headers):
"""
Class initialization.
"""
- super().__init__(base_url, verify=verify, proxy=proxy, headers=headers, auth=auth)
+ super().__init__(base_url, verify=verify, proxy=proxy, headers=headers)
+
+ def list_remediation_rule_request(self, request_data: Dict) -> Dict[str, Any]:
+ """Get a list of all your remediation rules using the 'xpanse_remediation_rules/rules/' endpoint.
+
+ Args:
+ request_data (dict): dict of parameters for API call.
+
+ Returns:
+ dict: dict containing list of external services.
+ """
+
+ response = self._http_request('POST', '/xpanse_remediation_rules/rules/', json_data=request_data)
+
+ return response
def list_external_service_request(self, search_params: List[Dict]) -> Dict[str, Any]:
"""Get a list of all your external services using the '/assets/get_external_services/' endpoint.
@@ -30,10 +44,8 @@ def list_external_service_request(self, search_params: List[Dict]) -> Dict[str,
dict: dict containing list of external services.
"""
data = {"request_data": {"filters": search_params, "search_to": DEFAULT_SEARCH_LIMIT}}
- headers = self._headers
- response = self._http_request('POST', '/assets/get_external_services/',
- json_data=data, headers=headers)
+ response = self._http_request('POST', '/assets/get_external_services/', json_data=data)
return response
@@ -47,10 +59,8 @@ def get_external_service_request(self, service_id_list: List[str]) -> Dict[str,
dict: dict containing information on single external service.
"""
data = {"request_data": {"service_id_list": service_id_list}}
- headers = self._headers
- response = self._http_request('POST', '/assets/get_external_service',
- json_data=data, headers=headers)
+ response = self._http_request('POST', '/assets/get_external_service', json_data=data)
return response
@@ -61,10 +71,8 @@ def list_external_ip_address_range_request(self) -> Dict[str, Any]:
dict: dict containing list of external ip address ranges.
"""
data = {"request_data": {"search_to": DEFAULT_SEARCH_LIMIT}}
- headers = self._headers
- response = self._http_request('POST', '/assets/get_external_ip_address_ranges/',
- json_data=data, headers=headers)
+ response = self._http_request('POST', '/assets/get_external_ip_address_ranges/', json_data=data)
return response
@@ -78,10 +86,8 @@ def get_external_ip_address_range_request(self, range_id_list: List[str]) -> Dic
dict: dict containing information on external ip address range.
"""
data = {"request_data": {"range_id_list": range_id_list}}
- headers = self._headers
- response = self._http_request('POST', '/assets/get_external_ip_address_range/',
- json_data=data, headers=headers)
+ response = self._http_request('POST', '/assets/get_external_ip_address_range/', json_data=data)
return response
@@ -95,10 +101,8 @@ def list_asset_internet_exposure_request(self, search_params: List[dict]) -> Dic
dict: dict containing list of internet exposure assets.
"""
data = {"request_data": {"filters": search_params, "search_to": DEFAULT_SEARCH_LIMIT}}
- headers = self._headers
- response = self._http_request('POST', '/assets/get_assets_internet_exposure/',
- json_data=data, headers=headers)
+ response = self._http_request('POST', '/assets/get_assets_internet_exposure/', json_data=data)
return response
@@ -112,10 +116,8 @@ def get_asset_internet_exposure_request(self, asm_id_list: List[str]) -> Dict[st
dict: dict containing information on an internet exposure asset.
"""
data = {"request_data": {"asm_id_list": asm_id_list}}
- headers = self._headers
- response = self._http_request('POST', '/assets/get_asset_internet_exposure/',
- json_data=data, headers=headers)
+ response = self._http_request('POST', '/assets/get_asset_internet_exposure/', json_data=data)
return response
@@ -145,6 +147,49 @@ def format_asm_id(formatted_response: List[dict]) -> List[dict]:
''' COMMAND FUNCTIONS '''
+def list_remediation_rule_command(client: Client, args: Dict[str, Any]) -> CommandResults:
+ """
+ asm-list-remediation-rule command: Returns list of remediation path rules.
+
+ Args:
+ client (Client): CortexAttackSurfaceManagment client to use.
+ args (dict): all command arguments, usually passed from ``demisto.args()``.
+ ``args['asm_rule_id']`` A string representing the ASM Rule ID you want to get association
+ remediation path rules for.
+ ``args['sort_by_creation_time']`` optional - enum (asc,desc).
+
+ Returns:
+ CommandResults: A ``CommandResults`` object that is then passed to ``return_results``,
+ that contains list of remediation path rules.
+ """
+ asm_rule_id = str(args.get('asm_rule_id'))
+ sort_by_creation_time = args.get('sort_by_creation_time')
+
+ # create list of search parameters or pass empty list.
+ search_params = []
+ if asm_rule_id:
+ search_params.append({"field": "attack_surface_rule_id", "operator": "eq", "value": asm_rule_id})
+ if sort_by_creation_time:
+ request_data = {"request_data": {"filters": search_params, 'search_from': 0,
+ 'search_to': DEFAULT_SEARCH_LIMIT, "sort": {"field": "created_at", "keyword": sort_by_creation_time}}}
+ else:
+ request_data = {"request_data": {"filters": search_params, 'search_from': 0,
+ 'search_to': DEFAULT_SEARCH_LIMIT}}
+
+ response = client.list_remediation_rule_request(request_data)
+ parsed = response.get('reply', {}).get('remediation_rules')
+ markdown = tableToMarkdown('Remediation Rules', parsed, removeNull=True, headerTransform=string_to_table_header)
+ command_results = CommandResults(
+ outputs_prefix='ASM.RemediationRule',
+ outputs_key_field='rule_id',
+ outputs=parsed,
+ raw_response=response,
+ readable_output=markdown
+ )
+
+ return command_results
+
+
def list_external_service_command(client: Client, args: Dict[str, Any]) -> CommandResults:
"""
asm-list-external-service command: Returns list of external services.
@@ -423,8 +468,7 @@ def main() -> None:
base_url=base_url,
verify=verify_certificate,
headers=headers,
- proxy=proxy,
- auth=None)
+ proxy=proxy)
commands = {
'asm-list-external-service': list_external_service_command,
@@ -432,7 +476,8 @@ def main() -> None:
'asm-list-external-ip-address-range': list_external_ip_address_range_command,
'asm-get-external-ip-address-range': get_external_ip_address_range_command,
'asm-list-asset-internet-exposure': list_asset_internet_exposure_command,
- 'asm-get-asset-internet-exposure': get_asset_internet_exposure_command
+ 'asm-get-asset-internet-exposure': get_asset_internet_exposure_command,
+ 'asm-list-remediation-rule': list_remediation_rule_command
}
if command == 'test-module':
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.yml b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.yml
index 9e57735a5e45..3a9183fd96df 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.yml
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement.yml
@@ -327,14 +327,54 @@ script:
- contextPath: ASM.AssetInternetExposure.externally_inferred_vulnerability_score
description: Asset vulnerability score.
type: Unknown
- dockerimage: demisto/python3:3.10.8.37753
+ - arguments:
+ - description: A string representing the ASM rule ID you want to get the associated remediation path rules for.
+ name: asm_rule_id
+ required: true
+ - auto: PREDEFINED
+ description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
+ name: sort_by_creation_time
+ predefined:
+ - asc
+ - desc
+ description: Returns list of remediation path rules.
+ name: asm-list-remediation-rule
+ outputs:
+ - contextPath: ASM.RemediationRule.rule_id
+ description: Remediation path rule UUID.
+ type: String
+ - contextPath: ASM.RemediationRule.rule_name
+ description: Remediation path rule name.
+ type: String
+ - contextPath: ASM.RemediationRule.description
+ description: Remediation path rule description.
+ type: String
+ - contextPath: ASM.RemediationRule.attack_surface_rule_id
+ description: Association ASM rule ID for the remediation path rules.
+ type: String
+ - contextPath: ASM.RemediationRule.criteria
+ description: Array of remediation path rule criteria.
+ type: Unknown
+ - contextPath: ASM.RemediationRule.criteria_conjunction
+ description: Whether criteria is processed with AND or OR.
+ type: String
+ - contextPath: ASM.RemediationRule.action
+ description: Action to take on rule match.
+ type: String
+ - contextPath: ASM.RemediationRule.created_by
+ description: Email of who created the rule.
+ type: String
+ - contextPath: ASM.RemediationRule.created_by_pretty
+ description: Readable name of who created the rule.
+ type: String
+ - contextPath: ASM.RemediationRule.created_at
+ description: Date the rule was created.
+ type: Date
+ dockerimage: demisto/python3:3.10.10.47713
runonce: false
script: ''
subtype: python3
type: python
fromversion: 6.5.0
-marketplaces:
-- marketplacev2
-- xpanse
tests:
- CortexAttackSurfaceManagement_Test
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement_test.py b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement_test.py
index 9d799e20df8b..4c883ddf9d70 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement_test.py
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/CortexAttackSurfaceManagement_test.py
@@ -49,8 +49,7 @@ def test_list_external_service_command(requests_mock):
"Authorizatio": "THISISAFAKEKEY",
"Content-Type": "application/json"
},
- proxy=False,
- auth=None)
+ proxy=False)
args = {
'domain': 'testdomain.com',
@@ -89,8 +88,7 @@ def test_get_external_service_command(requests_mock):
"Authorizatio": "THISISAFAKEKEY",
"Content-Type": "application/json"
},
- proxy=False,
- auth=None)
+ proxy=False)
args = {
'service_id': '94232f8a-f001-3292-aa65-63fa9d981427'
@@ -129,8 +127,7 @@ def test_list_external_ip_address_range_command(requests_mock):
"Authorizatio": "THISISAFAKEKEY",
"Content-Type": "application/json"
},
- proxy=False,
- auth=None)
+ proxy=False)
args = {}
response = list_external_ip_address_range_command(client, args)
@@ -166,8 +163,7 @@ def test_get_external_ip_address_range_command(requests_mock):
"Authorizatio": "THISISAFAKEKEY",
"Content-Type": "application/json"
},
- proxy=False,
- auth=None)
+ proxy=False)
args = {
'range_id': '1093124c-ce26-33ba-8fb8-937fecb4c7b6'
}
@@ -205,8 +201,7 @@ def test_list_asset_internet_exposure_command(requests_mock):
"Authorizatio": "THISISAFAKEKEY",
"Content-Type": "application/json"
},
- proxy=False,
- auth=None)
+ proxy=False)
args = {
'name': 'testdomain.com'
}
@@ -244,8 +239,7 @@ def test_get_asset_internet_exposure_command(requests_mock):
"Authorizatio": "THISISAFAKEKEY",
"Content-Type": "application/json"
},
- proxy=False,
- auth=None)
+ proxy=False)
args = {
'asm_id': 'testdomain.com'
}
@@ -255,3 +249,41 @@ def test_get_asset_internet_exposure_command(requests_mock):
assert response.outputs == EXTERNAL_EXPOSURE_RESULTS
assert response.outputs_prefix == 'ASM.AssetInternetExposure'
assert response.outputs_key_field == 'asm_ids'
+
+
+def test_list_remediation_rule_command(requests_mock):
+ """Tests list_remediation_rule_command function.
+
+ Given:
+ - requests_mock instance to generate the appropriate list_remediation_rule_command( API response,
+ loaded from a local JSON file.
+ When:
+ - Running the 'list_remediation_rule_command'.
+ Then:
+ - Checks the output of the command function with the expected output.
+ """
+ from CortexAttackSurfaceManagement import Client, list_remediation_rule_command
+
+ from test_data.raw_response import REMEDIATION_RULES_RESPONSE
+ from test_data.expected_results import REMEDIATION_RULES_RESULTS
+ requests_mock.post('https://test.com/api/webapp/public_api/v1/xpanse_remediation_rules/rules/',
+ json=REMEDIATION_RULES_RESPONSE)
+
+ client = Client(
+ base_url='https://test.com/api/webapp/public_api/v1',
+ verify=True,
+ headers={
+ "HOST": "test.com",
+ "Authorizatio": "THISISAFAKEKEY",
+ "Content-Type": "application/json"
+ },
+ proxy=False)
+ args = {
+ 'asm_rule_id': 'RdpServer'
+ }
+
+ response = list_remediation_rule_command(client, args)
+
+ assert response.outputs == REMEDIATION_RULES_RESULTS
+ assert response.outputs_prefix == 'ASM.RemediationRule'
+ assert response.outputs_key_field == 'rule_id'
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/README.md b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/README.md
index 14160e161041..2e8515c37e59 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/README.md
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/README.md
@@ -177,7 +177,7 @@ Get a list of all your external services filtered by business units, externally
#### Human Readable Output
>### External Services
->|active_classifications|business_units|discovery_type|domain|externally_detected_providers|first_observed|ip_address|is_active|last_observed|port|protocol|service_id|service_name|service_type|
+>|Active Classifications|Business Units|Discovery Type|Domain|Externally Detected Providers|First Observed|Ip Address|Is Active|Last Observed|Port|Protocol|Service Id|Service Name|Service Type|
>|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
>| HttpServer,
MicrosoftOWAServer,
ServerSoftware,
MicrosoftIisWebServer,
ApplicationServerSoftware | Acme,
VanDelay Industries | DirectlyDiscovered | autodiscover.acme.com | Microsoft Azure | 1659395040000 | 1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1 | Active | 1663024320000 | 80 | TCP | 4c755fea-59e8-3719-8829-9f6adde65068 | HTTP Server at autodiscover.acme.com:80 | HttpServer |
>| HttpServer,
ServerSoftware | Acme,
VanDelay Industries | DirectlyDiscovered | web.acme.com | Amazon Web Services | 1659396480000 | 1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1,
1.1.1.1 | Active | 1663029060000 | 80 | TCP | 32c85ab1-fc98-3061-a813-2fe5daf7e7c5 | HTTP Server at web.acme.com:80 | HttpServer |
@@ -563,7 +563,7 @@ Get service details according to the service ID.
#### Human Readable Output
>### External Service
->|active_classifications|business_units|details|discovery_type|externally_detected_providers|externally_inferred_cves|externally_inferred_vulnerability_score|first_observed|ip_address|is_active|last_observed|port|protocol|service_id|service_name|service_type|
+>|Active Classifications|Business Units|Details|Discovery Type|Externally Detected Providers|Externally Inferred Cves|Externally Inferred Vulnerability Score|First Observed|Ip Address|Is Active|Last Observed|Port|Protocol|Service Id|Service Name|Service Type|
>|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
>| SSHWeakMACAlgorithmsEnabled,
SshServer,
OpenSSH | Acme | serviceKey: 1.1.1.1:22
serviceKeyType: IP
businessUnits: {'name': 'Acme'}
providerDetails: {'name': 'AWS', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000}
certificates:
domains:
ips: {'ip': 873887795, 'protocol': 'TCP', 'provider': 'AWS', 'geolocation': {'latitude': 39.0438, 'longitude': -77.4879, 'countryCode': 'US', 'city': 'ASHBURN', 'regionCode': 'VA', 'timeZone': None}, 'activityStatus': 'Active', 'lastObserved': 1663026500000, 'firstObserved': 1662774169000}
classifications: {'name': 'SshServer', 'activityStatus': 'Active', 'values': [{'jsonValue': '{"version":"2.0","serverVersion":"OpenSSH_7.6p1","extraInfo":"Ubuntu-4ubuntu0.7"}', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000}], 'firstObserved': 1662774120000, 'lastObserved': 1663026480000},
{'name': 'SSHWeakMACAlgorithmsEnabled', 'activityStatus': 'Active', 'values': [{'jsonValue': '{}', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000}], 'firstObserved': 1662774120000, 'lastObserved': 1663026480000},
{'name': 'OpenSSH', 'activityStatus': 'Active', 'values': [{'jsonValue': '{"version":"7.6"}', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000}], 'firstObserved': 1662774120000, 'lastObserved': 1663026480000}
tlsVersions:
inferredCvesObserved: {'inferredCve': {'cveId': 'CVE-2020-15778', 'cvssScoreV2': 6.8, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 7.8, 'cveSeverityV3': 'HIGH', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2021-41617', 'cvssScoreV2': 4.4, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 7.0, 'cveSeverityV3': 'HIGH', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2019-6110', 'cvssScoreV2': 4.0, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 6.8, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2019-6109', 'cvssScoreV2': 4.0, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 6.8, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2020-14145', 'cvssScoreV2': 4.3, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 5.9, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2019-6111', 'cvssScoreV2': 5.8, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 5.9, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2018-20685', 'cvssScoreV2': 2.6, 'cveSeverityV2': 'LOW', 'cvssScoreV3': 5.3, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2018-15919', 'cvssScoreV2': 5.0, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 5.3, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2016-20012', 'cvssScoreV2': 4.3, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 5.3, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2018-15473', 'cvssScoreV2': 5.0, 'cveSeverityV2': 'MEDIUM', 'cvssScoreV3': 5.3, 'cveSeverityV3': 'MEDIUM', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000},
{'inferredCve': {'cveId': 'CVE-2021-36368', 'cvssScoreV2': 2.6, 'cveSeverityV2': 'LOW', 'cvssScoreV3': 3.7, 'cveSeverityV3': 'LOW', 'inferredCveMatchMetadata': {'inferredCveMatchType': 'ExactVersionMatch', 'product': 'openssh', 'confidence': 'High', 'vendor': 'openbsd', 'version': '7.6'}}, 'activityStatus': 'Active', 'firstObserved': 1662774169000, 'lastObserved': 1663026500000}
enrichedObservationSource: CLOUD
ip_ranges: {} | ColocatedOnIp | Amazon Web Services | CVE-2020-15778,
CVE-2021-41617,
CVE-2019-6110,
CVE-2019-6109,
CVE-2020-14145,
CVE-2019-6111,
CVE-2018-20685,
CVE-2018-15919,
CVE-2016-20012,
CVE-2018-15473,
CVE-2021-36368 | 7.8 | 1662774120000 | 1.1.1.1 | Active | 1663026480000 | 22 | TCP | 94232f8a-f001-3292-aa65-63fa9d981427 | SSH Server at 1.1.1.1:22 | SshServer |
@@ -643,7 +643,7 @@ Get a list of all your internet exposure filtered by business units and organiza
#### Human Readable Output
>### External IP Address Ranges
->|active_responsive_ips_count|business_units|date_added|first_ip|ips_count|last_ip|organization_handles|range_id|
+>|Active Responsive Ips Count|Business Units|Date Added|Details|First Ip|Ips Count|Last Ip|Organization Handles|Range Id|
>|---|---|---|---|---|---|---|---|
>| 0 | VanDelay Industries | 1663031000145 | 1.1.1.1 | 64 | 1.1.1.1 | MAINT-HK-PCCW-BIA-CS,
BNA2-AP,
TA66-AP | 4da29b7f-3086-3b52-981b-aa8ee5da1e60 |
>| 0 | VanDelay Industries | 1663031000144 | 1.1.1.1 | 16 | 1.1.1.1 | AR17615-RIPE,
EASYNET-UK-MNT,
JW372-RIPE,
EH92-RIPE | 6ef4638e-7788-3ef5-98a5-ad5b7f4e02f5 |
@@ -770,7 +770,7 @@ Get external IP address range details according to the range IDs.
#### Human Readable Output
>### External IP Address Range
->|active_responsive_ips_count|business_units|date_added|details|first_ip|ips_count|last_ip|organization_handles|range_id|
+>|Active Responsive Ips Count|Business Units|Date Added|First Ip|Ips Count|Last Ip|Organization Handles|Range Id|
>|---|---|---|---|---|---|---|---|---|
>| 0 | VanDelay Industries | 1663031000145 | networkRecords: {'handle': '1.1.1.1 - 1.1.1.1', 'firstIp': '1.1.1.1', 'lastIp': '1.1.1.1', 'name': 'SEARS-HK', 'whoIsServer': 'whois.apnic.net', 'lastChanged': 1663030241931, 'organizationRecords': [{'handle': 'MAINT-HK-PCCW-BIA-CS', 'dateAdded': 1663029346957, 'address': '', 'email': 'noc@acme.com', 'phone': '', 'org': '', 'formattedName': '', 'kind': 'group', 'roles': ['registrant'], 'lastChanged': None, 'firstRegistered': None, 'remarks': ''}, {'handle': 'BNA2-AP', 'dateAdded': 1663029346957, 'address': "27/F, PCCW Tower, Taikoo Place,\n979 King's Road, Quarry Bay, HK ", 'email': 'cs@acme.com', 'phone': '+852-2888-6932', 'org': '', 'formattedName': 'BIZ NETVIGATOR ADMINISTRATORS', 'kind': 'group', 'roles': ['administrative'], 'lastChanged': 1514892767000, 'firstRegistered': 1220514857000, 'remarks': ''}, {'handle': 'TA66-AP', 'dateAdded': 1663029346957, 'address': 'HKT Limited\nPO Box 9896 GPO ', 'email': 'noc@acme.com', 'phone': '+852-2883-5151', 'org': '', 'formattedName': 'TECHNICAL ADMINISTRATORS', 'kind': 'group', 'roles': ['technical'], 'lastChanged': 1468555410000, 'firstRegistered': 1220514856000, 'remarks': ''}], 'remarks': 'Sears Holdings Global Sourcing Ltd'} | 1.1.1.1 | 64 | 1.1.1.1 | MAINT-HK-PCCW-BIA-CS,
BNA2-AP,
TA66-AP | 4da29b7f-3086-3b52-981b-aa8ee5da1e60 |
@@ -914,7 +914,7 @@ Get a list of all your internet exposure filtered by ip address, domain, type, a
#### Human Readable Output
>### Asset Internet Exposures
->|asm_ids|asset_type|business_units|certificate_algorithm|certificate_classifications|certificate_issuer|domain_resolves|has_active_externally_services|has_xdr_agent|name|sensor|
+>|Asm Ids|Asset Type|Business Units|Certificate Algorithm|Certificate Classifications|Certificate Issuer|Domain Resolves|Has Active Externally Services|Has Xdr Agent|Name|Sensor|
>|---|---|---|---|---|---|---|---|---|---|---|
>| cfa1cd5a-77f1-3963-8557-7f652309a143 | CERTIFICATE | Acme,
VanDelay Industries | SHA256withRSA | LongExpiration,
Wildcard,
Expired | DigiCert | false | false | NA | *.digital-dev.acme.com | XPANSE |
>| 78a11e94-58a9-329c-99ca-e527d2db6cfb | CERTIFICATE | Acme,
VanDelay Industries | SHA256withRSA | LongExpiration,
Wildcard,
Expired | DigiCert | false | false | NA | *.digital-prod.acme.com | XPANSE |
@@ -1049,7 +1049,78 @@ Get internet exposure asset details according to the asset ID.
#### Human Readable Output
>### Asset Internet Exposure
->|asm_ids|business_units|certificate_algorithm|certificate_classifications|certificate_issuer|created|details|name|resolves|type|
+>|Asm Ids|Business Units|Certificate Algorithm|Certificate Classifications|Certificate Issuer|Created|Details|Name|Resolves|Type|
>|---|---|---|---|---|---|---|---|---|---|
>| 3c176460-8735-333c-b618-8262e2fb660c | Acme | SHA1withRSA | Wildcard,
Expired,
InsecureSignature | Thawte | 1663030146931 | providerDetails:
domain: null
topLevelAssetMapperDomain: null
domainAssetType: null
isPaidLevelDomain: false
domainDetails: null
dnsZone: null
latestSampledIp: null
subdomainMetadata: null
recentIps:
businessUnits: {'name': 'Acme'}
certificateDetails: {"issuer": "C=US,O=Thawte\\, Inc.,CN=Thawte SSL CA", "issuerAlternativeNames": "", "issuerCountry": "US", "issuerEmail": null, "issuerLocality": null, "issuerName": "Thawte SSL CA", "issuerOrg": "Thawte\\\\, Inc.", "formattedIssuerOrg": "Thawte", "issuerOrgUnit": null, "issuerState": null, "publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp21W/QVHuo0Nyy9l6Qp6Ye7yniuCccplWLdkL34pB0roNWBiklLJFftFTXJLtUuYEBhEbUtOPtNr5QRZFo+LQSj+JMQsGajEgNvIIMDms2xtc+vYkuJeNRsN/0zRm8iBjCNEZ0zBbWdupO6xee+Lngq5RiyRzAN2+Q5HlmHmVOcc7NtY5VIQhajp3a5Gc7tmLXa7ZxwQb+afdlpmE0iv4ZxmXFyHwlPXUlIxfETDDjtv2EzAgrnpZ5juo7TEFZA7AjsT0lO6cC2qPE9x9kC02PeC1Heg4hWf70CsXcKQBsprLqusrPYM9+OYfZnj+Dq9j6FjZD314Nz4qTGwmZrwDQIDAQAB", "publicKeyAlgorithm": "RSA", "publicKeyRsaExponent": 65537, "signatureAlgorithm": "SHA1withRSA", "subject": "C=US,ST=New Jersey,L=Wayne,O=Acme,OU=MIS,CN=*.babiesrus.com", "subjectAlternativeNames": "*.babiesrus.com", "subjectCountry": "US", "subjectEmail": null, "subjectLocality": "Wayne", "subjectName": "*.babiesrus.com", "subjectOrg": "Acme", "subjectOrgUnit": "MIS", "subjectState": "New Jersey", "serialNumber": "91384582774546160650506315451812470612", "validNotBefore": 1413158400000, "validNotAfter": 1444780799000, "version": "3", "publicKeyBits": 2048, "publicKeyModulus": "a76d56fd0547ba8d0dcb2f65e90a7a61eef29e2b8271ca6558b7642f7e29074ae83560629252c915fb454d724bb54b981018446d4b4e3ed36be50459168f8b4128fe24c42c19a8c480dbc820c0e6b36c6d73ebd892e25e351b0dff4cd19bc8818c2344674cc16d676ea4eeb179ef8b9e0ab9462c91cc0376f90e479661e654e71cecdb58e5521085a8e9ddae4673bb662d76bb671c106fe69f765a661348afe19c665c5c87c253d75252317c44c30e3b6fd84cc082b9e96798eea3b4c415903b023b13d253ba702daa3c4f71f640b4d8f782d477a0e2159fef40ac5dc29006ca6b2eabacacf60cf7e3987d99e3f83abd8fa163643df5e0dcf8a931b0999af00d", "publicKeySpki": "Up3fHwOddA9cXEeO4XBOgn63bfnvkXsOrOv6AycwQAk=", "sha1Fingerprint": "77d025c36f055e254063ae2ac3625fd4bf4507fb", "sha256Fingerprint": "9a37c952ee1169cfa6e91efb57fe6d405d1ca48b26a714e9a46f008c15ea62e8", "md5Fingerprint": "498ec19ebd6c6883ecd43d064e713002"}
inferredCvesObserved:
ip_ranges: {} | *.babiesrus.com | false | Certificate |
+### asm-list-remediation-rule
+***
+Returns list of remediation path rules.
+
+
+#### Base Command
+
+`asm-list-remediation-rule`
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| asm_rule_id | A string representing the ASM Rule ID you want to get association remediation path rules for. | Required |
+| sort_by_creation_time | Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending). Possible values are: asc, desc. | Optional |
+
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| ASM.RemediationRule.rule_id | String | Remediation path rule UUID. |
+| ASM.RemediationRule.rule_name | String | Remediation path rule name. |
+| ASM.RemediationRule.description | String | Remediation path rule description. |
+| ASM.RemediationRule.attack_surface_rule_id | String | Association ASM rule ID for Remediation path rules. |
+| ASM.RemediationRule.criteria | Unknown | Array of remediation path rule criteria. |
+| ASM.RemediationRule.criteria_conjunction | String | Whether criteria is processes with AND or OR. |
+| ASM.RemediationRule.action | String | Action to take on rule match. |
+| ASM.RemediationRule.created_by | String | Email of who created the rule. |
+| ASM.RemediationRule.created_by_pretty | String | Readable name of who created the rule. |
+| ASM.RemediationRule.created_at | Date | Date the rule was created. |
+
+#### Command example
+```!asm-list-remediation-rule asm_rule_id=RdpServer sort_by_creation_time=desc```
+#### Context Example
+```json
+{
+ "ASM": {
+ "RemediationRule": {
+ "action": "Email",
+ "attack_surface_rule_id": "RdpServer",
+ "created_at": 1672897301000,
+ "created_by": "test@test.com",
+ "created_by_pretty": "Test User",
+ "criteria": [
+ {
+ "field": "severity",
+ "operator": "eq",
+ "value": "high"
+ },
+ {
+ "field": "isCloudManaged",
+ "operator": "eq",
+ "value": "true"
+ }
+ ],
+ "criteria_conjunction": "AND",
+ "description": "for testing",
+ "rule_id": "b935cf69-add9-4e75-8c3d-fe32ee471554",
+ "rule_name": "TestRule"
+ }
+ }
+}
+```
+
+#### Human Readable Output
+
+>### Remediation Rules
+>|Action|Attack Surface Rule Id|Created At|Created By|Created By Pretty|Criteria|Criteria Conjunction|Description|Rule Id|Rule Name|
+>|---|---|---|---|---|---|---|---|---|---|
+>| Email | RdpServer | 1672897301000 | test@test.com | Test User | {'field': 'severity', 'value': 'high', 'operator': 'eq'},
{'field': 'isCloudManaged', 'value': 'true', 'operator': 'eq'} | AND | for testing | b935cf69-add9-4e75-8c3d-fe32ee471554 | TestRule |
+
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/command_examples b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/command_examples
index eb9479ae4cc9..88c6309c82bc 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/command_examples
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/command_examples
@@ -3,4 +3,5 @@
!asm-get-external-service service_id=94232f8a-f001-3292-aa65-63fa9d981427
!asm-list-external-ip-address-range
!asm-list-asset-internet-exposure name="acme.com" type=certificate has_active_external_services=no
-!asm-list-external-service domain=acme.com is_active=yes discovery_type=directly_discovery
\ No newline at end of file
+!asm-list-external-service domain=acme.com is_active=yes discovery_type=directly_discovery
+!asm-list-remediation-rule asm_rule_id=RdpServer sort_by_creation_time=desc
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/expected_results.py b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/expected_results.py
index 7d29567f6cea..205e51af9106 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/expected_results.py
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/expected_results.py
@@ -789,4 +789,30 @@
"externally_inferred_cves": [],
"agent_id": null
}
+]
+
+REMEDIATION_RULES_RESULTS = [
+ {
+ "action": "Email",
+ "attack_surface_rule_id": "RdpServer",
+ "created_at": 1672897301000,
+ "created_by": "test@test.com",
+ "created_by_pretty": "Test User",
+ "criteria": [
+ {
+ "field": "severity",
+ "operator": "eq",
+ "value": "high"
+ },
+ {
+ "field": "isCloudManaged",
+ "operator": "eq",
+ "value": "true"
+ }
+ ],
+ "criteria_conjunction": "AND",
+ "description": "for testing",
+ "rule_id": "b935cf69-add9-4e75-8c3d-fe32ee471554",
+ "rule_name": "TestRule"
+ }
]
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/raw_response.py b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/raw_response.py
index 6aa53544e7bb..c79c99298b51 100644
--- a/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/raw_response.py
+++ b/Packs/CortexAttackSurfaceManagement/Integrations/CortexAttackSurfaceManagement/test_data/raw_response.py
@@ -827,4 +827,35 @@
"externally_inferred_cves": [],
"agent_id": null
}
-]
\ No newline at end of file
+]
+
+REMEDIATION_RULES_RESPONSE = {
+ "reply": {
+ "remediation_rules": [
+ {
+ "action": "Email",
+ "attack_surface_rule_id": "RdpServer",
+ "created_at": 1672897301000,
+ "created_by": "test@test.com",
+ "created_by_pretty": "Test User",
+ "criteria": [
+ {
+ "field": "severity",
+ "operator": "eq",
+ "value": "high"
+ },
+ {
+ "field": "isCloudManaged",
+ "operator": "eq",
+ "value": "true"
+ }
+ ],
+ "criteria_conjunction": "AND",
+ "description": "for testing",
+ "rule_id": "b935cf69-add9-4e75-8c3d-fe32ee471554",
+ "rule_name": "TestRule"
+ }
+ ],
+ "result_count": 1
+ }
+}
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert.yml
index cf0e276986f3..9740c13b18f5 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert.yml
@@ -6,15 +6,15 @@ starttaskid: "0"
tasks:
"0":
id: "0"
- taskid: 424e0fea-5f3a-45ff-8e76-d67099ab04fc
+ taskid: 5cf41a0f-efe8-4939-89e9-bd5e916b76fd
type: start
task:
- id: 424e0fea-5f3a-45ff-8e76-d67099ab04fc
+ id: 5cf41a0f-efe8-4939-89e9-bd5e916b76fd
version: -1
name: ""
iscommand: false
brand: ""
- description: ""
+ description: ''
nexttasks:
'#none#':
- "5"
@@ -36,22 +36,22 @@ tasks:
continueonerrortype: ""
"4":
id: "4"
- taskid: 39b51292-cd25-4191-89f6-bb06558dccb3
+ taskid: 23c19053-1ae8-4e6a-8c9f-86f0f1bc978b
type: title
task:
- id: 39b51292-cd25-4191-89f6-bb06558dccb3
+ id: 23c19053-1ae8-4e6a-8c9f-86f0f1bc978b
version: -1
name: Complete
type: title
iscommand: false
brand: ""
- description: ""
+ description: ''
separatecontext: false
view: |-
{
"position": {
"x": 90,
- "y": 5250
+ "y": 5190
}
}
note: false
@@ -64,19 +64,19 @@ tasks:
continueonerrortype: ""
"5":
id: "5"
- taskid: 0b04418c-338c-4a7d-86a6-fb697699f6ba
+ taskid: cf841205-1bc1-4490-89f8-027e330c91d2
type: title
task:
- id: 0b04418c-338c-4a7d-86a6-fb697699f6ba
+ id: cf841205-1bc1-4490-89f8-027e330c91d2
version: -1
name: Triage and Qualifier Stage
- description: ''
type: title
iscommand: false
brand: ""
+ description: ''
nexttasks:
'#none#':
- - "99"
+ - "100"
separatecontext: false
view: |-
{
@@ -95,10 +95,10 @@ tasks:
continueonerrortype: ""
"6":
id: "6"
- taskid: b6c843ba-9282-4e49-84e9-aa10536d0ab0
+ taskid: 9aad1634-f6bf-45b0-8335-674800596d17
type: title
task:
- id: b6c843ba-9282-4e49-84e9-aa10536d0ab0
+ id: 9aad1634-f6bf-45b0-8335-674800596d17
version: -1
name: Enrichment Stage
type: title
@@ -126,10 +126,10 @@ tasks:
isautoswitchedtoquietmode: false
"8":
id: "8"
- taskid: 6dc57826-68a8-4e85-88eb-dc639e04057b
+ taskid: 020cb23f-19af-4415-8933-53fd42d1d36e
type: title
task:
- id: 6dc57826-68a8-4e85-88eb-dc639e04057b
+ id: 020cb23f-19af-4415-8933-53fd42d1d36e
version: -1
name: Decision Stage
type: title
@@ -138,7 +138,7 @@ tasks:
description: ''
nexttasks:
'#none#':
- - "96"
+ - "101"
separatecontext: false
continueonerrortype: ""
view: |-
@@ -157,10 +157,10 @@ tasks:
isautoswitchedtoquietmode: false
"10":
id: "10"
- taskid: ebd24488-c122-4791-8462-0aa99f0039a5
+ taskid: d6ae778e-0674-4e7b-8cef-66c7f909651a
type: title
task:
- id: ebd24488-c122-4791-8462-0aa99f0039a5
+ id: d6ae778e-0674-4e7b-8cef-66c7f909651a
version: -1
name: Ticketing Stage
type: title
@@ -175,8 +175,8 @@ tasks:
view: |-
{
"position": {
- "x": 900,
- "y": 2290
+ "x": 930,
+ "y": 2220
}
}
note: false
@@ -188,10 +188,10 @@ tasks:
isautoswitchedtoquietmode: false
"11":
id: "11"
- taskid: bf8d5ad9-9e65-43a2-8be7-80f8fdcab601
+ taskid: 97a8b99b-265b-493a-8a3c-5f22b17f5fc2
type: title
task:
- id: bf8d5ad9-9e65-43a2-8be7-80f8fdcab601
+ id: 97a8b99b-265b-493a-8a3c-5f22b17f5fc2
version: -1
name: Validation Stage
type: title
@@ -207,7 +207,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 3870
+ "y": 3810
}
}
note: false
@@ -219,10 +219,10 @@ tasks:
isautoswitchedtoquietmode: false
"12":
id: "12"
- taskid: f2ea9625-1fde-468c-880b-6a8c4117ddef
+ taskid: 623323fb-2af2-465a-8af5-35deadd40e66
type: title
task:
- id: f2ea9625-1fde-468c-880b-6a8c4117ddef
+ id: 623323fb-2af2-465a-8af5-35deadd40e66
version: -1
name: Remediation Stage
type: title
@@ -237,8 +237,8 @@ tasks:
view: |-
{
"position": {
- "x": -740,
- "y": 2290
+ "x": -1250,
+ "y": 2230
}
}
note: false
@@ -250,10 +250,10 @@ tasks:
isautoswitchedtoquietmode: false
"13":
id: "13"
- taskid: 5bfb0bdf-753b-4050-8219-b5113eb98d0b
+ taskid: ff614b68-6a60-4af6-886f-a6d9e7864f6e
type: title
task:
- id: 5bfb0bdf-753b-4050-8219-b5113eb98d0b
+ id: ff614b68-6a60-4af6-886f-a6d9e7864f6e
version: -1
name: Summarization Stage
type: title
@@ -269,7 +269,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 4455
+ "y": 4395
}
}
note: false
@@ -281,10 +281,10 @@ tasks:
isautoswitchedtoquietmode: false
"16":
id: "16"
- taskid: 4d655c27-cef8-479e-8bff-d4594937526e
+ taskid: d3d1f946-9f9e-4460-86f4-df31a6046530
type: condition
task:
- id: 4d655c27-cef8-479e-8bff-d4594937526e
+ id: d3d1f946-9f9e-4460-86f4-df31a6046530
version: -1
name: Service exposure still observable?
description: Determines if service was still observable.
@@ -327,10 +327,10 @@ tasks:
isautoswitchedtoquietmode: false
"17":
id: "17"
- taskid: 4c1e3d79-4e22-4581-88d1-d8b704265b39
+ taskid: 0667d597-b2fa-4717-8b01-828c679b34b0
type: title
task:
- id: 4c1e3d79-4e22-4581-88d1-d8b704265b39
+ id: 0667d597-b2fa-4717-8b01-828c679b34b0
version: -1
name: continue
type: title
@@ -345,8 +345,8 @@ tasks:
view: |-
{
"position": {
- "x": -1170,
- "y": 2290
+ "x": -1700,
+ "y": 2260
}
}
note: false
@@ -358,10 +358,10 @@ tasks:
isautoswitchedtoquietmode: false
"18":
id: "18"
- taskid: b7b72f5e-5dbf-4886-80b4-15cad4861ba2
+ taskid: 4c1488d4-0d9f-4f70-891b-0c9f476312ec
type: regular
task:
- id: b7b72f5e-5dbf-4886-80b4-15cad4861ba2
+ id: 4c1488d4-0d9f-4f70-891b-0c9f476312ec
version: -1
name: Close alert (service not observed)
description: Close the current alert because service is no longer observed.
@@ -383,7 +383,7 @@ tasks:
{
"position": {
"x": -780,
- "y": 5080
+ "y": 5020
}
}
note: false
@@ -395,10 +395,10 @@ tasks:
isautoswitchedtoquietmode: false
"20":
id: "20"
- taskid: c0234931-906c-43db-80f7-dc0943a6b2c8
+ taskid: 69be963e-3719-4710-8b09-945f1bd9d4a4
type: condition
task:
- id: c0234931-906c-43db-80f7-dc0943a6b2c8
+ id: 69be963e-3719-4710-8b09-945f1bd9d4a4
version: -1
name: Service exposure still observable?
description: Determines if service was still observable and also if automated remediation was done.
@@ -441,7 +441,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 4110
+ "y": 4050
}
}
note: false
@@ -453,10 +453,10 @@ tasks:
isautoswitchedtoquietmode: false
"21":
id: "21"
- taskid: df8d86bd-870c-4e5f-807d-56e56d5c7433
+ taskid: f9fa16ff-b86c-4b20-8694-cb9c88eb9090
type: collection
task:
- id: df8d86bd-870c-4e5f-807d-56e56d5c7433
+ id: f9fa16ff-b86c-4b20-8694-cb9c88eb9090
version: -1
name: What to do if NMAP scan is inconclusive?
description: Determines if alert should be closed or kept open for auto-closure based on analyst input.
@@ -472,7 +472,7 @@ tasks:
{
"position": {
"x": 500,
- "y": 4280
+ "y": 4220
}
}
note: false
@@ -522,10 +522,10 @@ tasks:
isautoswitchedtoquietmode: false
"23":
id: "23"
- taskid: 4f47720d-3b4f-4aa0-871c-c61c432cf7fc
+ taskid: bfa7a592-ab98-48d6-8013-8c41fe175667
type: condition
task:
- id: 4f47720d-3b4f-4aa0-871c-c61c432cf7fc
+ id: bfa7a592-ab98-48d6-8013-8c41fe175667
version: -1
name: Auto-close or keep open?
description: Determines if alert will be closed or kept open.
@@ -570,52 +570,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 4890
- }
- }
- note: false
- timertriggers: []
- ignoreworker: false
- skipunavailable: false
- quietmode: 0
- isoversize: false
- isautoswitchedtoquietmode: false
- "28":
- id: "28"
- taskid: cbc0066f-b6dd-4b02-8bb6-63b89101b9d1
- type: condition
- task:
- id: cbc0066f-b6dd-4b02-8bb6-63b89101b9d1
- version: -1
- name: Should remediate automatically?
- description: Determines if playbook input for bypassing analyst interaction was set in order to continue to automated remediation.
- type: condition
- iscommand: false
- brand: ""
- nexttasks:
- '#default#':
- - "32"
- "yes":
- - "47"
- separatecontext: false
- conditions:
- - label: "yes"
- condition:
- - - operator: isEqualString
- left:
- value:
- complex:
- root: inputs.AutomatedRemediation
- iscontext: true
- right:
- value:
- simple: "True"
- continueonerrortype: ""
- view: |-
- {
- "position": {
- "x": 50,
- "y": 1270
+ "y": 4830
}
}
note: false
@@ -627,10 +582,10 @@ tasks:
isautoswitchedtoquietmode: false
"31":
id: "31"
- taskid: 96e17978-9026-45fe-8943-db7251160060
+ taskid: b71c94ce-9a0d-4a5e-8d72-77d379bcfc0a
type: collection
task:
- id: 96e17978-9026-45fe-8943-db7251160060
+ id: b71c94ce-9a0d-4a5e-8d72-77d379bcfc0a
version: -1
name: Select remediation action (all options)
description: Determines the next action (remediation or ticket) based on user input. Options are based on if ServiceNowV2 integration is setup and/or the alert meets the requirement for automated remediation.
@@ -645,8 +600,8 @@ tasks:
view: |-
{
"position": {
- "x": 280,
- "y": 1640
+ "x": -530,
+ "y": 1470
}
}
note: false
@@ -667,7 +622,7 @@ tasks:
retriescount: 2
retriesinterval: 360
completeafterreplies: 1
- completeafterv2: false
+ completeafterv2: true
completeaftersla: false
form:
questions:
@@ -698,73 +653,12 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
- "32":
- id: "32"
- taskid: acb38f89-c88b-498f-8b8d-14f4e4e4d723
- type: condition
- task:
- id: acb38f89-c88b-498f-8b8d-14f4e4e4d723
- version: -1
- name: Is ServiceNow v2 enabled?
- description: Determines if the "ServiceNow v2" integration instance is enabled in order to find email accounts for ServiceNow usernames.
- type: condition
- iscommand: false
- brand: ""
- nexttasks:
- '#default#':
- - "35"
- "yes":
- - "31"
- separatecontext: false
- conditions:
- - label: "yes"
- condition:
- - - operator: isExists
- left:
- value:
- complex:
- root: modules
- filters:
- - - operator: isEqualString
- left:
- value:
- simple: modules.brand
- iscontext: true
- right:
- value:
- simple: ServiceNow v2
- - - operator: isEqualString
- left:
- value:
- simple: modules.state
- iscontext: true
- right:
- value:
- simple: active
- iscontext: true
- right:
- value: {}
- continueonerrortype: ""
- view: |-
- {
- "position": {
- "x": 80,
- "y": 1470
- }
- }
- note: false
- timertriggers: []
- ignoreworker: false
- skipunavailable: false
- quietmode: 0
- isoversize: false
- isautoswitchedtoquietmode: false
"34":
id: "34"
- taskid: a9ddeaab-307d-4fc7-8905-d4753996f1ad
+ taskid: ffee8538-b8bb-46ad-86e4-23c8c132825b
type: collection
task:
- id: a9ddeaab-307d-4fc7-8905-d4753996f1ad
+ id: ffee8538-b8bb-46ad-86e4-23c8c132825b
version: -1
name: Select remediation action (no automated-remediation)
description: Determines next action (remediation or ticket) based on user input. Options are based on if ServiceNowV2 integration is setup and/or the alert meets the requirement for automated remediation.
@@ -779,8 +673,8 @@ tasks:
view: |-
{
"position": {
- "x": 1190,
- "y": 1530
+ "x": -140,
+ "y": 1470
}
}
note: false
@@ -833,10 +727,10 @@ tasks:
isautoswitchedtoquietmode: false
"35":
id: "35"
- taskid: 097325e8-64b0-4bc5-897e-f94fa6c8dbf7
+ taskid: 6fcace7c-1a6d-4690-8101-47823d124c7f
type: collection
task:
- id: 097325e8-64b0-4bc5-897e-f94fa6c8dbf7
+ id: 6fcace7c-1a6d-4690-8101-47823d124c7f
version: -1
name: Select remediation action (no ServiceNow)
description: Determines the next action (remediation or ticket) based on user input. Options are based on if ServiceNowV2 integration is setup and/or the alert meets the requirement for automated remediation.
@@ -851,8 +745,8 @@ tasks:
view: |-
{
"position": {
- "x": -120,
- "y": 1640
+ "x": 250,
+ "y": 1470
}
}
note: false
@@ -905,10 +799,10 @@ tasks:
isautoswitchedtoquietmode: false
"36":
id: "36"
- taskid: 59f6e315-8429-401b-8ce2-8060f6767e1e
+ taskid: 5323c1de-2910-411c-8349-118f0979981e
type: collection
task:
- id: 59f6e315-8429-401b-8ce2-8060f6767e1e
+ id: 5323c1de-2910-411c-8349-118f0979981e
version: -1
name: Select remediation action (base)
description: Determines the next action (remediation or ticket) based on user input. Options are based on if ServiceNowV2 integration is setup and/or the alert meets the requirement for automated remediation.
@@ -923,8 +817,8 @@ tasks:
view: |-
{
"position": {
- "x": 790,
- "y": 1530
+ "x": 640,
+ "y": 1470
}
}
note: false
@@ -974,73 +868,12 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
- "37":
- id: "37"
- taskid: 1793a232-0e57-4b71-82db-f8e9cfc7c83e
- type: condition
- task:
- id: 1793a232-0e57-4b71-82db-f8e9cfc7c83e
- version: -1
- name: Is ServiceNow v2 enabled?
- description: Determines if the "ServiceNow v2" integration instance is enabled in order to find email accounts for ServiceNow usernames.
- type: condition
- iscommand: false
- brand: ""
- nexttasks:
- '#default#':
- - "36"
- "yes":
- - "34"
- separatecontext: false
- conditions:
- - label: "yes"
- condition:
- - - operator: isExists
- left:
- value:
- complex:
- root: modules
- filters:
- - - operator: isEqualString
- left:
- value:
- simple: modules.brand
- iscontext: true
- right:
- value:
- simple: ServiceNow v2
- - - operator: isEqualString
- left:
- value:
- simple: modules.state
- iscontext: true
- right:
- value:
- simple: active
- iscontext: true
- right:
- value: {}
- continueonerrortype: ""
- view: |-
- {
- "position": {
- "x": 980,
- "y": 1360
- }
- }
- note: false
- timertriggers: []
- ignoreworker: false
- skipunavailable: false
- quietmode: 0
- isoversize: false
- isautoswitchedtoquietmode: false
"38":
id: "38"
- taskid: c53b5940-aac5-432c-8df8-0d4f7f948598
+ taskid: d2591a15-8c93-4efb-8db4-10d8ead6a2d5
type: regular
task:
- id: c53b5940-aac5-432c-8df8-0d4f7f948598
+ id: d2591a15-8c93-4efb-8db4-10d8ead6a2d5
version: -1
name: Get current time
description: |
@@ -1057,8 +890,8 @@ tasks:
view: |-
{
"position": {
- "x": 1190,
- "y": 1680
+ "x": -140,
+ "y": 1630
}
}
note: false
@@ -1070,10 +903,10 @@ tasks:
isautoswitchedtoquietmode: false
"39":
id: "39"
- taskid: e55da047-f5ee-4386-8cd3-47ad62d8e6a2
+ taskid: 55463492-756f-41bc-86f5-411d791d49f7
type: regular
task:
- id: e55da047-f5ee-4386-8cd3-47ad62d8e6a2
+ id: 55463492-756f-41bc-86f5-411d791d49f7
version: -1
name: Set data collection grid field
description: |-
@@ -1111,8 +944,8 @@ tasks:
view: |-
{
"position": {
- "x": -120,
- "y": 1950
+ "x": 250,
+ "y": 1790
}
}
note: false
@@ -1124,10 +957,10 @@ tasks:
isautoswitchedtoquietmode: false
"41":
id: "41"
- taskid: f335548f-7de4-4589-8129-44bf776e4497
+ taskid: 4cb617b0-5dc9-40b6-88ca-c10df50b6fbf
type: regular
task:
- id: f335548f-7de4-4589-8129-44bf776e4497
+ id: 4cb617b0-5dc9-40b6-88ca-c10df50b6fbf
version: -1
name: Set data collection grid field
description: |-
@@ -1165,8 +998,8 @@ tasks:
view: |-
{
"position": {
- "x": 280,
- "y": 1950
+ "x": -530,
+ "y": 1790
}
}
note: false
@@ -1178,10 +1011,10 @@ tasks:
isautoswitchedtoquietmode: false
"42":
id: "42"
- taskid: bda9ed70-5d24-404e-8752-4ed636f7c794
+ taskid: 8ec07328-bc7d-43e2-8fe9-8d94b2672c9e
type: regular
task:
- id: bda9ed70-5d24-404e-8752-4ed636f7c794
+ id: 8ec07328-bc7d-43e2-8fe9-8d94b2672c9e
version: -1
name: Set data collection grid field
description: |-
@@ -1219,8 +1052,8 @@ tasks:
view: |-
{
"position": {
- "x": 790,
- "y": 1840
+ "x": 640,
+ "y": 1790
}
}
note: false
@@ -1232,10 +1065,10 @@ tasks:
isautoswitchedtoquietmode: false
"43":
id: "43"
- taskid: cc68753d-8541-4f58-8b15-2d1a7eb5642d
+ taskid: 5b4aec54-b338-483d-87b7-d4043fe34607
type: regular
task:
- id: cc68753d-8541-4f58-8b15-2d1a7eb5642d
+ id: 5b4aec54-b338-483d-87b7-d4043fe34607
version: -1
name: Set data collection grid field
description: |-
@@ -1273,8 +1106,8 @@ tasks:
view: |-
{
"position": {
- "x": 1190,
- "y": 1840
+ "x": -140,
+ "y": 1790
}
}
note: false
@@ -1286,10 +1119,10 @@ tasks:
isautoswitchedtoquietmode: false
"44":
id: "44"
- taskid: 10437640-779b-4a63-8528-cf6ca380306c
+ taskid: 29d99f8a-ef64-428c-8b00-00a340199e46
type: regular
task:
- id: 10437640-779b-4a63-8528-cf6ca380306c
+ id: 29d99f8a-ef64-428c-8b00-00a340199e46
version: -1
name: Get current time
description: |
@@ -1306,8 +1139,8 @@ tasks:
view: |-
{
"position": {
- "x": 790,
- "y": 1680
+ "x": 640,
+ "y": 1630
}
}
note: false
@@ -1319,10 +1152,10 @@ tasks:
isautoswitchedtoquietmode: false
"45":
id: "45"
- taskid: 31e79509-c0b4-41e7-84ee-647e4375166c
+ taskid: 06f4b70f-079d-4e9b-8232-024712548dbf
type: regular
task:
- id: 31e79509-c0b4-41e7-84ee-647e4375166c
+ id: 06f4b70f-079d-4e9b-8232-024712548dbf
version: -1
name: Get current time
description: |
@@ -1339,8 +1172,8 @@ tasks:
view: |-
{
"position": {
- "x": 280,
- "y": 1790
+ "x": -530,
+ "y": 1630
}
}
note: false
@@ -1352,10 +1185,10 @@ tasks:
isautoswitchedtoquietmode: false
"46":
id: "46"
- taskid: 6015bad4-2738-4c20-86dc-9ffe107430f1
+ taskid: 90a3d955-ace7-49b9-89af-af8e2d7fde5a
type: regular
task:
- id: 6015bad4-2738-4c20-86dc-9ffe107430f1
+ id: 90a3d955-ace7-49b9-89af-af8e2d7fde5a
version: -1
name: Get current time
description: |
@@ -1372,39 +1205,8 @@ tasks:
view: |-
{
"position": {
- "x": -120,
- "y": 1790
- }
- }
- note: false
- timertriggers: []
- ignoreworker: false
- skipunavailable: false
- quietmode: 0
- isoversize: false
- isautoswitchedtoquietmode: false
- "47":
- id: "47"
- taskid: e21d5d4b-6a56-4436-837e-b7e677d85526
- type: title
- task:
- id: e21d5d4b-6a56-4436-837e-b7e677d85526
- version: -1
- name: Bypass
- type: title
- iscommand: false
- brand: ""
- description: ''
- nexttasks:
- '#none#':
- - "12"
- separatecontext: false
- continueonerrortype: ""
- view: |-
- {
- "position": {
- "x": -740,
- "y": 1470
+ "x": 250,
+ "y": 1630
}
}
note: false
@@ -1416,10 +1218,10 @@ tasks:
isautoswitchedtoquietmode: false
"48":
id: "48"
- taskid: cff46ecc-2e68-4ea1-84fb-84de16a86fd7
+ taskid: 9e01b8a1-ad84-48e3-843d-a6b9454d82ae
type: condition
task:
- id: cff46ecc-2e68-4ea1-84fb-84de16a86fd7
+ id: 9e01b8a1-ad84-48e3-843d-a6b9454d82ae
version: -1
name: What was data collection task response?
description: Determines the next action (remediation or ticket) based on the previous data collection task.
@@ -1491,8 +1293,8 @@ tasks:
view: |-
{
"position": {
- "x": 90,
- "y": 2120
+ "x": 60,
+ "y": 1960
}
}
note: false
@@ -1504,10 +1306,10 @@ tasks:
isautoswitchedtoquietmode: false
"50":
id: "50"
- taskid: c44edf0b-35d0-4894-8332-09b07510f147
+ taskid: 638ad390-454d-4825-8aad-a4f69b60cabc
type: collection
task:
- id: c44edf0b-35d0-4894-8332-09b07510f147
+ id: 638ad390-454d-4825-8aad-a4f69b60cabc
version: -1
name: Verify service exposure resolved by service owner
description: Determines if manual remediation (by service owner or otherwise) was completed via analyst input.
@@ -1523,7 +1325,7 @@ tasks:
{
"position": {
"x": 360,
- "y": 3190
+ "y": 3130
}
}
note: false
@@ -1571,10 +1373,10 @@ tasks:
isautoswitchedtoquietmode: false
"54":
id: "54"
- taskid: 5e4ef714-9c51-4baf-8d68-3edea7b45ebd
+ taskid: a28b2338-d412-4934-8b38-68ba91942fd9
type: collection
task:
- id: 5e4ef714-9c51-4baf-8d68-3edea7b45ebd
+ id: a28b2338-d412-4934-8b38-68ba91942fd9
version: -1
name: Select owners to notify
description: Determines who to send notification emails to based on analyst input.
@@ -1589,8 +1391,8 @@ tasks:
view: |-
{
"position": {
- "x": 1340,
- "y": 2400
+ "x": 1370,
+ "y": 2340
}
}
note: false
@@ -1638,10 +1440,10 @@ tasks:
isautoswitchedtoquietmode: false
"55":
id: "55"
- taskid: 15cfaa65-c266-46fa-87c6-2dd16494eadd
+ taskid: f754535a-4d41-40b6-8eb9-7b7b2feebc94
type: regular
task:
- id: 15cfaa65-c266-46fa-87c6-2dd16494eadd
+ id: f754535a-4d41-40b6-8eb9-7b7b2feebc94
version: -1
name: Send email
description: Send an email to the service owner with alert information.
@@ -1682,8 +1484,8 @@ tasks:
view: |-
{
"position": {
- "x": 1340,
- "y": 2710
+ "x": 1370,
+ "y": 2650
}
}
note: false
@@ -1695,10 +1497,10 @@ tasks:
isautoswitchedtoquietmode: false
"59":
id: "59"
- taskid: 7a9234dc-2b7d-47ec-86df-a07f4d2e69e7
+ taskid: 3dfab8a6-f887-48f9-87c1-4066b2d04315
type: regular
task:
- id: 7a9234dc-2b7d-47ec-86df-a07f4d2e69e7
+ id: 3dfab8a6-f887-48f9-87c1-4066b2d04315
version: -1
name: Set notification grid field
description: |-
@@ -1735,8 +1537,8 @@ tasks:
view: |-
{
"position": {
- "x": 1340,
- "y": 3020
+ "x": 1370,
+ "y": 2960
}
}
note: false
@@ -1748,10 +1550,10 @@ tasks:
isautoswitchedtoquietmode: false
"60":
id: "60"
- taskid: 6783dbb1-198a-4b1f-8b8d-064812a1509d
+ taskid: da7e7969-fbbc-4cc1-8163-4a4402a185b5
type: title
task:
- id: 6783dbb1-198a-4b1f-8b8d-064812a1509d
+ id: da7e7969-fbbc-4cc1-8163-4a4402a185b5
version: -1
name: Ticketing Stage
type: title
@@ -1766,8 +1568,8 @@ tasks:
view: |-
{
"position": {
- "x": 1340,
- "y": 2290
+ "x": 1370,
+ "y": 2220
}
}
note: false
@@ -1779,10 +1581,10 @@ tasks:
isautoswitchedtoquietmode: false
"62":
id: "62"
- taskid: 63198f0d-1944-434b-80d9-7a74da7f5628
+ taskid: ffdf9937-8df9-42fe-8b75-d55541364ecf
type: regular
task:
- id: 63198f0d-1944-434b-80d9-7a74da7f5628
+ id: ffdf9937-8df9-42fe-8b75-d55541364ecf
version: -1
name: Get current time
description: |
@@ -1799,8 +1601,8 @@ tasks:
view: |-
{
"position": {
- "x": 1340,
- "y": 2865
+ "x": 1370,
+ "y": 2805
}
}
note: false
@@ -1812,10 +1614,10 @@ tasks:
isautoswitchedtoquietmode: false
"63":
id: "63"
- taskid: 1c0704d4-0a04-42f7-8574-46479be8bd1e
+ taskid: f55631c2-0718-421d-8243-add79760ceac
type: title
task:
- id: 1c0704d4-0a04-42f7-8574-46479be8bd1e
+ id: f55631c2-0718-421d-8243-add79760ceac
version: -1
name: Remediation Stage
type: title
@@ -1830,8 +1632,8 @@ tasks:
view: |-
{
"position": {
- "x": -320,
- "y": 2290
+ "x": -840,
+ "y": 2230
}
}
note: false
@@ -1843,10 +1645,10 @@ tasks:
isautoswitchedtoquietmode: false
"64":
id: "64"
- taskid: f5c90ad9-f358-4bd3-81ac-bb23d6dc1221
+ taskid: 35f1eea4-d5be-4755-8325-24023f33ad8a
type: regular
task:
- id: f5c90ad9-f358-4bd3-81ac-bb23d6dc1221
+ id: 35f1eea4-d5be-4755-8325-24023f33ad8a
version: -1
name: Get current time
description: |
@@ -1864,7 +1666,7 @@ tasks:
{
"position": {
"x": -390,
- "y": 3500
+ "y": 3315
}
}
note: false
@@ -1876,10 +1678,10 @@ tasks:
isautoswitchedtoquietmode: false
"65":
id: "65"
- taskid: 1e48bd91-34ce-47a7-8a5a-595e3b8f96f4
+ taskid: 9e822664-8ac0-472d-891d-fb89756a053a
type: regular
task:
- id: 1e48bd91-34ce-47a7-8a5a-595e3b8f96f4
+ id: 9e822664-8ac0-472d-891d-fb89756a053a
version: -1
name: Set remediation grid field
description: |-
@@ -1919,7 +1721,7 @@ tasks:
{
"position": {
"x": -390,
- "y": 3690
+ "y": 3630
}
}
note: false
@@ -1931,10 +1733,10 @@ tasks:
isautoswitchedtoquietmode: false
"69":
id: "69"
- taskid: 72e2eca2-d804-4925-804a-29d15735e625
+ taskid: 5a6e7348-d72d-4daf-8a1f-f805e0c79929
type: regular
task:
- id: 72e2eca2-d804-4925-804a-29d15735e625
+ id: 5a6e7348-d72d-4daf-8a1f-f805e0c79929
version: -1
name: Set remediation grid field
description: |-
@@ -1972,7 +1774,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 3700
+ "y": 3640
}
}
note: false
@@ -1984,10 +1786,10 @@ tasks:
isautoswitchedtoquietmode: false
"71":
id: "71"
- taskid: 48dede82-d79a-48b1-81a5-ce2b70f5e037
+ taskid: 9e429cfb-edd2-4562-8506-027018884f23
type: regular
task:
- id: 48dede82-d79a-48b1-81a5-ce2b70f5e037
+ id: 9e429cfb-edd2-4562-8506-027018884f23
version: -1
name: Get current time
description: |
@@ -2005,7 +1807,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 3360
+ "y": 3300
}
}
note: false
@@ -2017,10 +1819,10 @@ tasks:
isautoswitchedtoquietmode: false
"72":
id: "72"
- taskid: 5f716a25-0218-4e29-8045-053345549d2c
+ taskid: 22a0bdaa-e449-4744-8d77-35a64e6bdb42
type: condition
task:
- id: 5f716a25-0218-4e29-8045-053345549d2c
+ id: 22a0bdaa-e449-4744-8d77-35a64e6bdb42
version: -1
name: Manual remediation selected?
description: Determines if "manual remediation" was selected on main data collection task.
@@ -2030,11 +1832,13 @@ tasks:
nexttasks:
'#default#':
- "73"
- "yes":
+ manual from RPR:
+ - "103"
+ manual from data collection:
- "69"
separatecontext: false
conditions:
- - label: "yes"
+ - label: "manual from data collection"
condition:
- - operator: isEqualString
left:
@@ -2046,12 +1850,25 @@ tasks:
right:
value:
simple: Manual remediation
+ ignorecase: true
+ - label: manual from RPR
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: Manual
+ ignorecase: true
continueonerrortype: ""
view: |-
{
"position": {
"x": 90,
- "y": 3510
+ "y": 3450
}
}
note: false
@@ -2063,10 +1880,10 @@ tasks:
isautoswitchedtoquietmode: false
"73":
id: "73"
- taskid: 8c814d3f-60f8-4cdb-8339-400d949c3191
+ taskid: 709cf157-9d47-473f-8b65-39b731aabfff
type: regular
task:
- id: 8c814d3f-60f8-4cdb-8339-400d949c3191
+ id: 709cf157-9d47-473f-8b65-39b731aabfff
version: -1
name: Set remediation grid field
description: |-
@@ -2112,8 +1929,8 @@ tasks:
view: |-
{
"position": {
- "x": 520,
- "y": 3700
+ "x": 870,
+ "y": 3640
}
}
note: false
@@ -2125,10 +1942,10 @@ tasks:
isautoswitchedtoquietmode: false
"74":
id: "74"
- taskid: 88280c28-1f36-4ac1-8413-4dd1b59b6bc0
+ taskid: e555dece-d030-41ce-8859-da2ad3eac0be
type: regular
task:
- id: 88280c28-1f36-4ac1-8413-4dd1b59b6bc0
+ id: e555dece-d030-41ce-8859-da2ad3eac0be
version: -1
name: Close alert (Auto-Close)
description: Close the current alert because auto-close was selected,
@@ -2150,7 +1967,7 @@ tasks:
{
"position": {
"x": -180,
- "y": 5080
+ "y": 5020
}
}
note: false
@@ -2162,10 +1979,10 @@ tasks:
isautoswitchedtoquietmode: false
"75":
id: "75"
- taskid: c1d26a8b-aa47-4e96-8e17-92e72419f402
+ taskid: 306c3a59-d1bd-478c-8a8f-ee4d98b55547
type: regular
task:
- id: c1d26a8b-aa47-4e96-8e17-92e72419f402
+ id: 306c3a59-d1bd-478c-8a8f-ee4d98b55547
version: -1
name: Close alert (Remediated Automatically)
description: Close the current alert because Automated Remediation path was selected.
@@ -2187,7 +2004,7 @@ tasks:
{
"position": {
"x": 400,
- "y": 5080
+ "y": 5020
}
}
note: false
@@ -2199,10 +2016,10 @@ tasks:
isautoswitchedtoquietmode: false
"81":
id: "81"
- taskid: aa22f185-da3f-4edd-872f-054be73c6824
+ taskid: 1443dc39-c07c-4a04-879c-985f6da6b95e
type: regular
task:
- id: aa22f185-da3f-4edd-872f-054be73c6824
+ id: 1443dc39-c07c-4a04-879c-985f6da6b95e
version: -1
name: Set alert summary grid field
description: |-
@@ -2257,7 +2074,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 4730
+ "y": 4670
}
}
note: false
@@ -2269,10 +2086,10 @@ tasks:
isautoswitchedtoquietmode: false
"86":
id: "86"
- taskid: a35c5886-7223-43fa-8b84-077545ca37b4
+ taskid: be116371-fcc0-4038-829f-95d3535da4d6
type: playbook
task:
- id: a35c5886-7223-43fa-8b84-077545ca37b4
+ id: be116371-fcc0-4038-829f-95d3535da4d6
version: -1
name: Cortex ASM - Detect Service
description: Playbook that looks at what ASM sub-type the alert is and directs it to different pre/post mitigation scans (such as NMAP).
@@ -2309,7 +2126,7 @@ tasks:
{
"position": {
"x": 90,
- "y": 3980
+ "y": 3920
}
}
note: false
@@ -2321,10 +2138,10 @@ tasks:
isautoswitchedtoquietmode: false
"88":
id: "88"
- taskid: 37962116-5e12-4bf6-823b-651ab2d971ff
+ taskid: d198f805-9c50-49dd-8a71-a46465f6bea4
type: collection
task:
- id: 37962116-5e12-4bf6-823b-651ab2d971ff
+ id: d198f805-9c50-49dd-8a71-a46465f6bea4
version: -1
name: Complete manual remediation
description: Determines if manual remediation (by service owner or otherwise) was completed via analyst input.
@@ -2340,7 +2157,7 @@ tasks:
{
"position": {
"x": -120,
- "y": 3190
+ "y": 3130
}
}
note: false
@@ -2388,10 +2205,10 @@ tasks:
isautoswitchedtoquietmode: false
"91":
id: "91"
- taskid: f32906ae-9cd6-4804-81b4-bd3c83d17255
+ taskid: 558e07b1-d25e-4a1f-81ba-423b9f63d850
type: playbook
task:
- id: f32906ae-9cd6-4804-81b4-bd3c83d17255
+ id: 558e07b1-d25e-4a1f-81ba-423b9f63d850
version: -1
name: Cortex ASM - Remediation Guidance
playbookName: Cortex ASM - Remediation Guidance
@@ -2407,8 +2224,8 @@ tasks:
view: |-
{
"position": {
- "x": 900,
- "y": 2550
+ "x": 930,
+ "y": 2490
}
}
note: false
@@ -2428,7 +2245,7 @@ tasks:
args:
chars:
value:
- simple: '["]'
+ simple: '[\"]'
loop:
iscommand: false
exitCondition: ""
@@ -2436,10 +2253,10 @@ tasks:
max: 100
"92":
id: "92"
- taskid: 9fc44d3f-eed8-4e24-8965-e7e2ffbbc472
+ taskid: 90571172-18e1-40af-841e-71bbb5af1820
type: playbook
task:
- id: 9fc44d3f-eed8-4e24-8965-e7e2ffbbc472
+ id: 90571172-18e1-40af-841e-71bbb5af1820
version: -1
name: Cortex ASM - Remediation Guidance
playbookName: Cortex ASM - Remediation Guidance
@@ -2460,7 +2277,7 @@ tasks:
args:
chars:
value:
- simple: '["]'
+ simple: '[\"]]'
separatecontext: true
continueonerrortype: ""
loop:
@@ -2471,8 +2288,8 @@ tasks:
view: |-
{
"position": {
- "x": 1340,
- "y": 2550
+ "x": 1370,
+ "y": 2490
}
}
note: false
@@ -2484,10 +2301,10 @@ tasks:
isautoswitchedtoquietmode: false
"93":
id: "93"
- taskid: faab36d5-5ee1-45f7-8aff-58422e2bd65f
+ taskid: 4a0b20a3-16a1-421c-8ac8-1c1b89758d7e
type: regular
task:
- id: faab36d5-5ee1-45f7-8aff-58422e2bd65f
+ id: 4a0b20a3-16a1-421c-8ac8-1c1b89758d7e
version: -1
name: GenerateSummaryReport
description: Generate an ASM Alert Summary report.
@@ -2555,53 +2372,17 @@ tasks:
complex:
root: alert
accessor: asmtags
- asmcloud:
- complex:
- root: alert
- accessor: asmcloud
- asmdatacollection:
- complex:
- root: alert
- accessor: asmdatacollection
- asmnotification:
+ asm_remediation_path_rule:
complex:
root: alert
- accessor: asmnotification
- asmprivateip:
- complex:
- root: alert
- accessor: asmprivateip
- asmrelated:
- complex:
- root: alert
- accessor: asmrelated
- asmremediation:
- complex:
- root: alert
- accessor: asmremediation
- asmservicedetection:
- complex:
- root: alert
- accessor: asmservicedetection
- asmserviceowner:
- complex:
- root: alert
- accessor: asmserviceowner
- asmsystemids:
- complex:
- root: alert
- accessor: asmsystemids
- asmtags:
- complex:
- root: alert
- accessor: asmtags
+ accessor: asmremediationpathrule
separatecontext: false
continueonerrortype: ""
view: |-
{
"position": {
"x": 90,
- "y": 4580
+ "y": 4520
}
}
note: false
@@ -2613,10 +2394,10 @@ tasks:
isautoswitchedtoquietmode: false
"94":
id: "94"
- taskid: 3a855207-da7b-4b65-8637-54aaeb9b9cc1
+ taskid: 264911db-37bb-4927-82da-d85197381208
type: regular
task:
- id: 3a855207-da7b-4b65-8637-54aaeb9b9cc1
+ id: 264911db-37bb-4927-82da-d85197381208
version: -1
name: Create ServiceNow incident
description: Creates new ServiceNow ticket.
@@ -2656,8 +2437,8 @@ tasks:
view: |-
{
"position": {
- "x": 900,
- "y": 2710
+ "x": 930,
+ "y": 2650
}
}
note: false
@@ -2669,10 +2450,10 @@ tasks:
isautoswitchedtoquietmode: false
"95":
id: "95"
- taskid: 1bc71ddd-1ee7-47a0-83d4-bb539a4c73d7
+ taskid: f94578e7-7a91-48de-8f8a-86abc639f66e
type: regular
task:
- id: 1bc71ddd-1ee7-47a0-83d4-bb539a4c73d7
+ id: f94578e7-7a91-48de-8f8a-86abc639f66e
version: -1
name: Set notification grid field
description: |-
@@ -2723,85 +2504,8 @@ tasks:
view: |-
{
"position": {
- "x": 900,
- "y": 3020
- }
- }
- note: false
- timertriggers: []
- ignoreworker: false
- skipunavailable: false
- quietmode: 0
- isoversize: false
- isautoswitchedtoquietmode: false
- "96":
- id: "96"
- taskid: 0a258708-d7b0-4a77-82f7-e734c51313d8
- type: condition
- task:
- id: 0a258708-d7b0-4a77-82f7-e734c51313d8
- version: -1
- name: Meets automated remediation requirements?
- description: Determines if the alert meets the criteria for automated remediation.
- type: condition
- iscommand: false
- brand: ""
- nexttasks:
- '#default#':
- - "37"
- "yes":
- - "28"
- separatecontext: false
- conditions:
- - label: "yes"
- condition:
- - - operator: inList
- left:
- value:
- complex:
- root: alert
- accessor: asmattacksurfaceruleid
- transformers:
- - operator: StripChars
- args:
- chars:
- value:
- simple: '["]'
- iscontext: true
- right:
- value:
- simple: RdpServer,InsecureOpenSSH,TelnetServer,UnencryptedFtpServer,OpenSSH,SshServer,SnmpServer
- - - operator: inList
- left:
- value:
- complex:
- root: alert.asmcloud
- accessor: Provider
- iscontext: true
- right:
- value:
- simple: AWS,GCP,Azure
- - - operator: isNotEmpty
- left:
- value:
- complex:
- root: alert
- accessor: asmserviceowner
- iscontext: true
- - - operator: isTrue
- left:
- value:
- complex:
- root: alert
- accessor: asmdevcheck
- iscontext: true
- ignorecase: true
- continueonerrortype: ""
- view: |-
- {
- "position": {
- "x": 50,
- "y": 1100
+ "x": 930,
+ "y": 2960
}
}
note: false
@@ -2813,10 +2517,10 @@ tasks:
isautoswitchedtoquietmode: false
"97":
id: "97"
- taskid: 0348d8b7-2264-4b40-8693-3147326ae8d7
+ taskid: 4e518fc3-fa31-4168-88df-acc7d46860ec
type: playbook
task:
- id: 0348d8b7-2264-4b40-8693-3147326ae8d7
+ id: 4e518fc3-fa31-4168-88df-acc7d46860ec
version: -1
name: Cortex ASM - Enrichment
description: Used as a container folder for all enrichments of ASM alerts.
@@ -2845,10 +2549,10 @@ tasks:
isautoswitchedtoquietmode: false
"98":
id: "98"
- taskid: dc095dbc-eac6-4f96-8c5e-78c5402506af
+ taskid: 257c7072-d19b-47a8-830c-500288215015
type: playbook
task:
- id: dc095dbc-eac6-4f96-8c5e-78c5402506af
+ id: 257c7072-d19b-47a8-830c-500288215015
version: -1
name: Cortex ASM - Remediation
description: This playbook contains all the cloud provider sub playbooks for remediation
@@ -2903,8 +2607,8 @@ tasks:
view: |-
{
"position": {
- "x": -740,
- "y": 2455
+ "x": -1250,
+ "y": 2415
}
}
note: false
@@ -2914,12 +2618,12 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
- "99":
- id: "99"
- taskid: 8fd375b8-dc22-470d-835a-9afc2253c2ac
+ "100":
+ id: "100"
+ taskid: 775fedc2-21d6-426e-8509-9973ac13dac9
type: playbook
task:
- id: 8fd375b8-dc22-470d-835a-9afc2253c2ac
+ id: 775fedc2-21d6-426e-8509-9973ac13dac9
version: -1
name: Cortex ASM - Detect Service
playbookName: Cortex ASM - Detect Service
@@ -2966,49 +2670,263 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
+ "101":
+ id: "101"
+ taskid: 2bdb4a9e-2e38-4560-80de-52908d6873e6
+ type: playbook
+ task:
+ id: 2bdb4a9e-2e38-4560-80de-52908d6873e6
+ version: -1
+ name: Cortex ASM - Remediation Path Rules
+ description: This playbook returns "RemediationAction" options based return from Remediation Path Rules API, or defaults to data collection task options from "Cortex ADM - Decision" subplaybook.
+ playbookName: Cortex ASM - Remediation Path Rules
+ type: playbook
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "102"
+ scriptarguments:
+ ExternallyDetectedProviders:
+ complex:
+ root: ASM.ExternalService
+ accessor: externally_detected_providers
+ separatecontext: true
+ continueonerrortype: ""
+ loop:
+ iscommand: false
+ exitCondition: ""
+ wait: 1
+ max: 100
+ view: |-
+ {
+ "position": {
+ "x": 50,
+ "y": 1100
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "102":
+ id: "102"
+ taskid: 7b451b55-1fd2-465f-8a2d-9127abe3937e
+ type: condition
+ task:
+ id: 7b451b55-1fd2-465f-8a2d-9127abe3937e
+ version: -1
+ name: What is the remediation action?
+ description: Determines what the remediation action is (direct action or data collection task).
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "36"
+ Automated Remediation:
+ - "12"
+ Manual Remediation:
+ - "63"
+ Notification Email:
+ - "60"
+ Prompt All Options:
+ - "31"
+ Prompt no AR:
+ - "34"
+ Prompt no ServiceNow:
+ - "35"
+ ServiceNow Ticket:
+ - "10"
+ separatecontext: false
+ conditions:
+ - label: Automated Remediation
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: AR
+ - label: ServiceNow Ticket
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: SNOW
+ - label: Notification Email
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: Email
+ - label: Manual Remediation
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: Manual
+ - label: Prompt All Options
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: Prompt all options
+ - label: Prompt no AR
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: Prompt no ar
+ - label: Prompt no ServiceNow
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: RemediationAction
+ iscontext: true
+ right:
+ value:
+ simple: Prompt no snow
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 50,
+ "y": 1250
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "103":
+ id: "103"
+ taskid: 98f612fe-f024-448e-88ec-e09959054785
+ type: regular
+ task:
+ id: 98f612fe-f024-448e-88ec-e09959054785
+ version: -1
+ name: Set remediation grid field
+ description: |-
+ Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. For example:
+ `!GridFieldSetup keys=ip,src val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" gridfiled="gridfield"`
+ scriptName: GridFieldSetup
+ type: regular
+ iscommand: false
+ brand: Builtin
+ nexttasks:
+ '#none#':
+ - "11"
+ scriptarguments:
+ gridfield:
+ simple: asmremediation
+ keys:
+ simple: Action,ActionTimestamp,Outcome,OutcomeTimestamp
+ val1:
+ simple: Manual remediation
+ val2:
+ complex:
+ root: RPR_Timestamp
+ val3:
+ simple: Manual remediation completed
+ val4:
+ complex:
+ root: TimeNowUnix
+ transformers:
+ - operator: LastArrayElement
+ - operator: TimeStampToDate
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 3640
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
view: |-
{
"linkLabelsPosition": {
- "28_47_yes": 0.48,
+ "102_12_Automated Remediation": 0.79,
+ "102_31_Prompt All Options": 0.78,
"48_10_ServiceNow ticket": 0.82,
+ "48_12_Automated remediation": 0.87,
"48_60_Notification email": 0.88,
- "48_63_Manual remediation": 0.6
+ "48_63_Manual remediation": 0.54
},
"paper": {
"dimensions": {
- "height": 5165,
- "width": 2890,
- "x": -1170,
+ "height": 5105,
+ "width": 3450,
+ "x": -1700,
"y": 150
}
}
}
inputs:
-- key: AutomatedRemediation
- value:
- simple: "False"
- required: true
- description: "Decide whether to potentially skip analyst intervention and conduct automated remediation if meeting the criteria specified here: https://cortex.marketplace.pan.dev/marketplace/details/CortexAttackSurfaceManagement/ \n\nDefault is \"False\" (don't do automated remediation). Set \"True\" to turn this feature on."
- playbookInputQuery:
- key: OwnerNotificationSubject
value:
- simple: A new security risk was identified on an external service owned by your team
+ simple: "A new security risk was identified on an external service owned by your team"
required: true
- description: Subject of the notification (email or ticket) sent to potential service owner.
+ description: "Subject of the notification (email or ticket) sent to potential service owner."
playbookInputQuery:
- key: OwnerNotificationBody
value:
- simple: |+
+ simple: |
Infosec identified a security risk on an external service potentially owned by your team: ${alert.name}
+
Description: ${alert.details}
-
required: true
description: Body of the notification (email or ticket) sent to potential service owner.
playbookInputQuery:
- key: RemediationRule
value:
- simple: Remediation-Security-Group
+ simple: |-
+ Remediation-Security-Group
required: true
description: 'The firewall rule that will be used for remediating internet exposures. '
playbookInputQuery:
@@ -3016,7 +2934,3 @@ outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
-marketplaces:
-- marketplacev2
-contentitemexportablefields:
- contentitemfields: {}
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert_README.md b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert_README.md
index 1b600e24020c..5762ac11ca92 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert_README.md
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert_README.md
@@ -4,32 +4,32 @@ This playbook handles ASM alerts by enriching asset information and providing a
This playbook uses the following sub-playbooks, integrations, and scripts.
### Sub-playbooks
+* Cortex ASM - Detect Service
+* Cortex ASM - Enrichment
+* Cortex ASM - Remediation Path Rules
* Cortex ASM - Remediation
* Cortex ASM - Remediation Guidance
-* Cortex ASM - Enrichment
-* Cortex ASM - Detect Service
### Integrations
* ServiceNow v2
### Scripts
-* GenerateASMReport
* GridFieldSetup
+* GenerateASMReport
* GetTime
### Commands
-* servicenow-create-ticket
-* send-mail
* closeInvestigation
+* send-mail
+* servicenow-create-ticket
## Playbook Inputs
---
| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
-| AutomatedRemediation | Decide whether to potentially skip analyst intervention and conduct automated remediation if meeting the criteria specified here: https://cortex.marketplace.pan.dev/marketplace/details/CortexAttackSurfaceManagement/
Default is "False" \(don't do automated remediation\). Set "True" to turn this feature on. | False | Required |
| OwnerNotificationSubject | Subject of the notification \(email or ticket\) sent to potential service owner. | A new security risk was identified on an external service owned by your team | Required |
-| OwnerNotificationBody | Body of the notification \(email or ticket\) sent to potential service owner. | Infosec identified a security risk on an external service potentially owned by your team: ${alert.name}<br><br>
Description: ${alert.details}
<br><br>
| Required |
+| OwnerNotificationBody | Body of the notification \(email or ticket\) sent to a potential service owner. | Infosec identified a security risk on an external service potentially owned by your team: ${alert.name}
Description: ${alert.details}
| Required |
| RemediationRule | The firewall rule that will be used for remediating internet exposures. | Remediation-Security-Group | Required |
## Playbook Outputs
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_CMDB_Enrichment.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_CMDB_Enrichment.yml
index 44d6787498a8..16f0f83c8010 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_CMDB_Enrichment.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_CMDB_Enrichment.yml
@@ -553,5 +553,3 @@ tests:
- No tests
fromversion: 6.5.0
deprecated: true
-marketplaces:
- - marketplacev2
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision.yml
new file mode 100644
index 000000000000..eb5cbd5e912d
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision.yml
@@ -0,0 +1,345 @@
+id: Cortex ASM - Decision
+version: -1
+name: Cortex ASM - Decision
+description: |-
+ This playbook returns "RemediationAction" options based on meeting "Automated Remediation Requirements" (https://github.com/demisto/content/tree/master/Packs/CortexAttackSurfaceManagement#automated-remediation-requirements) as well as whether ServiceNowV2 integration is set up. Possible return values are:
+ - Prompt base - data collection task with only email/manual options.
+ - Prompt all options - data collection task with all options (meets Automated Remediation requirements and ServiceNow is enabled).
+ - Prompt no snow - all options except ServiceNow (Automated Remediation requirements are met).
+ - Prompt no ar - all options except Automated Remediation (ServiceNow is enabled).
+starttaskid: "0"
+tasks:
+ "0":
+ id: "0"
+ taskid: cbe2007e-0f53-48b9-895a-449aadc5e39b
+ type: start
+ task:
+ id: cbe2007e-0f53-48b9-895a-449aadc5e39b
+ version: -1
+ name: ""
+ iscommand: false
+ brand: ""
+ description: ''
+ nexttasks:
+ '#none#':
+ - "1"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 450,
+ "y": 50
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "1":
+ id: "1"
+ taskid: a6491b8e-4047-4d8d-86f0-766269ffc3bc
+ type: condition
+ task:
+ id: a6491b8e-4047-4d8d-86f0-766269ffc3bc
+ version: -1
+ name: Which option to return?
+ description: Checks playbook inputs to determine if "Automated Remediation Requirements" (https://github.com/demisto/content/tree/master/Packs/CortexAttackSurfaceManagement#automated-remediation-requirements) were met and if ServiceNowV2 integration is set up.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "3"
+ Prompt all options:
+ - "2"
+ Prompt no ar:
+ - "4"
+ Prompt no snow:
+ - "5"
+ separatecontext: false
+ conditions:
+ - label: Prompt all options
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: inputs.ServiceNowv2Enabled
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: inputs.AutoRemediationRequirements
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - label: Prompt no ar
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: inputs.ServiceNowv2Enabled
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - - operator: isNotEqualString
+ left:
+ value:
+ complex:
+ root: inputs.AutoRemediationRequirements
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - label: Prompt no snow
+ condition:
+ - - operator: isNotEqualString
+ left:
+ value:
+ complex:
+ root: inputs.ServiceNowv2Enabled
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: inputs.AutoRemediationRequirements
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 450,
+ "y": 220
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "2":
+ id: "2"
+ taskid: 3596fd61-45ee-4f8e-8e27-ad11e989f173
+ type: regular
+ task:
+ id: 3596fd61-45ee-4f8e-8e27-ad11e989f173
+ version: -1
+ name: Prompt all options
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "6"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: Prompt all options
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": -200,
+ "y": 400
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "3":
+ id: "3"
+ taskid: 5dda8d22-4ff6-4682-8925-59f82bbeba3e
+ type: regular
+ task:
+ id: 5dda8d22-4ff6-4682-8925-59f82bbeba3e
+ version: -1
+ name: Prompt base
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "6"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: Prompt base
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 1140,
+ "y": 400
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "4":
+ id: "4"
+ taskid: f4da0359-365f-474b-8ccf-75e90913c5b5
+ type: regular
+ task:
+ id: f4da0359-365f-474b-8ccf-75e90913c5b5
+ version: -1
+ name: Prompt no ar
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "6"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: Prompt no ar
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 260,
+ "y": 400
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "5":
+ id: "5"
+ taskid: ea5ab030-a3e6-4316-8d1d-7449c7d15232
+ type: regular
+ task:
+ id: ea5ab030-a3e6-4316-8d1d-7449c7d15232
+ version: -1
+ name: Prompt no snow
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "6"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: Prompt no snow
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 700,
+ "y": 400
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "6":
+ id: "6"
+ taskid: eb2d7591-48f4-4d8d-811e-cbb6a9757efb
+ type: title
+ task:
+ id: eb2d7591-48f4-4d8d-811e-cbb6a9757efb
+ version: -1
+ name: Complete
+ type: title
+ iscommand: false
+ brand: ""
+ description: ''
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 470,
+ "y": 700
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+view: |-
+ {
+ "linkLabelsPosition": {},
+ "paper": {
+ "dimensions": {
+ "height": 715,
+ "width": 1720,
+ "x": -200,
+ "y": 50
+ }
+ }
+ }
+inputs:
+- key: ServiceNowv2Enabled
+ value: {}
+ required: true
+ description: ServiceNow v2 integration enabled.
+ playbookInputQuery:
+- key: AutoRemediationRequirements
+ value: {}
+ required: true
+ description: Meets automated remediation requirements (https://github.com/demisto/content/tree/master/Packs/CortexAttackSurfaceManagement#automated-remediation-requirements).
+ playbookInputQuery:
+outputs:
+- contextPath: RemediationAction
+ description: Follow up action to perform (variety of data collection tasks).
+ type: string
+tests:
+- No tests (auto formatted)
+fromversion: 6.5.0
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision_README.md b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision_README.md
new file mode 100644
index 000000000000..c60fa51f8113
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Decision_README.md
@@ -0,0 +1,39 @@
+This playbook returns "RemediationAction" options based on meeting "Automated Remediation Requirements" (https://github.com/demisto/content/tree/master/Packs/CortexAttackSurfaceManagement#automated-remediation-requirements) as well as whether ServiceNowV2 integration is set up. Possible return values are:
+- Prompt base - data collection task with only email/manual options.
+- Prompt all options - data collection task with all options (meets Automated Remediation requirements and ServiceNow is enabled).
+- Prompt no snow - all options except ServiceNow (Automated Remediation requirements are met).
+- Prompt no ar - all options except Automated Remediation (ServiceNow is enabled).
+
+## Dependencies
+This playbook uses the following sub-playbooks, integrations, and scripts.
+
+### Sub-playbooks
+This playbook does not use any sub-playbooks.
+
+### Integrations
+This playbook does not use any integrations.
+
+### Scripts
+Set
+
+### Commands
+This playbook does not use any commands.
+
+## Playbook Inputs
+---
+
+| **Name** | **Description** | **Default Value** | **Required** |
+| --- | --- | --- | --- |
+| ServiceNowv2Enabled | ServiceNow v2 integration enabled. | | Required |
+| AutoRemediationRequirements | Meets automated remediation requirements \(https://github.com/demisto/content/tree/master/Packs/CortexAttackSurfaceManagement\#automated-remediation-requirements\). | | Required |
+
+## Playbook Outputs
+---
+
+| **Path** | **Description** | **Type** |
+| --- | --- | --- |
+| RemediationAction | Follow up action to perform \(variety of data collection tasks\). | string |
+
+## Playbook Image
+---
+
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Detect_Service.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Detect_Service.yml
index 467b560476ed..c785ffec2a9f 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Detect_Service.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Detect_Service.yml
@@ -69,7 +69,7 @@ tasks:
args:
chars:
value:
- simple: '["]'
+ simple: '[\"]'
iscontext: true
right:
value:
@@ -87,7 +87,7 @@ tasks:
args:
chars:
value:
- simple: '["]'
+ simple: '[\"]'
iscontext: true
right:
value:
@@ -105,7 +105,7 @@ tasks:
args:
chars:
value:
- simple: '["]'
+ simple: '[\"]'
iscontext: true
right:
value:
@@ -646,5 +646,3 @@ tests:
- No tests (auto formatted)
contentitemexportablefields:
contentitemfields: {}
-marketplaces:
- - marketplacev2
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Enrichment.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Enrichment.yml
index 2be51673adb7..87dc0f1c8a8c 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Enrichment.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Enrichment.yml
@@ -587,7 +587,7 @@ tasks:
args:
chars:
value:
- simple: '[]"'
+ simple: '[\"]'
separatecontext: false
continueonerrortype: ""
view: |-
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_GCP_Enrichment.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_GCP_Enrichment.yml
index 05623f073784..9af5a3d8a46f 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_GCP_Enrichment.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_GCP_Enrichment.yml
@@ -1144,5 +1144,3 @@ outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
-contentitemexportablefields:
- contentitemfields: {}
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation.yml
index d72ede6e3e64..97ff9d59124d 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation.yml
@@ -390,5 +390,3 @@ outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
-contentitemexportablefields:
- contentitemfields: {}
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Guidance.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Guidance.yml
index 8b074b01fb40..6022133f64da 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Guidance.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Guidance.yml
@@ -319,5 +319,3 @@ outputs:
tests:
- No tests (auto formatted)
fromversion: 6.5.0
-marketplaces:
- - marketplacev2
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules.yml
new file mode 100644
index 000000000000..7a54be86124c
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules.yml
@@ -0,0 +1,1010 @@
+id: Cortex ASM - Remediation Path Rules
+version: -1
+name: Cortex ASM - Remediation Path Rules
+description: This playbook returns "RemediationAction" options based return from Remediation Path Rules API, or defaults to data collection task options from "Cortex ADM - Decision" subplaybook.
+starttaskid: "0"
+tasks:
+ "0":
+ id: "0"
+ taskid: edfb3225-8311-460f-8ada-6880afcf1a27
+ type: start
+ task:
+ id: edfb3225-8311-460f-8ada-6880afcf1a27
+ version: -1
+ name: ""
+ iscommand: false
+ brand: ""
+ description: ''
+ nexttasks:
+ '#none#':
+ - "10"
+ - "16"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 450,
+ "y": -470
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "1":
+ id: "1"
+ taskid: dd8fa5b7-db52-4a2e-8b67-12e013dc9928
+ type: regular
+ task:
+ id: dd8fa5b7-db52-4a2e-8b67-12e013dc9928
+ version: -1
+ name: List remediation path rules
+ description: Returns list of remediation path rules.
+ script: '|||asm-list-remediation-rule'
+ type: regular
+ iscommand: true
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "3"
+ scriptarguments:
+ asm_rule_id:
+ complex:
+ root: alert
+ accessor: asmattacksurfaceruleid
+ transformers:
+ - operator: StripChars
+ args:
+ chars:
+ value:
+ simple: '[\"]'
+ sort_by_creation_time:
+ simple: desc
+ separatecontext: false
+ continueonerror: true
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 215
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "3":
+ id: "3"
+ taskid: 53cd243d-e2d6-49ca-8e7e-435d958c0ae5
+ type: condition
+ task:
+ id: 53cd243d-e2d6-49ca-8e7e-435d958c0ae5
+ version: -1
+ name: Was there a result?
+ description: Determines if there was a result from the previous command to continue.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "21"
+ "yes":
+ - "4"
+ separatecontext: false
+ conditions:
+ - label: "yes"
+ condition:
+ - - operator: isNotEmpty
+ left:
+ value:
+ simple: ASM.RemediationRule
+ iscontext: true
+ right:
+ value: {}
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 385
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "4":
+ id: "4"
+ taskid: 9d3d0c7b-7131-4557-85b8-e32f167c1c38
+ type: regular
+ task:
+ id: 9d3d0c7b-7131-4557-85b8-e32f167c1c38
+ version: -1
+ name: Evaluate remediation path rules
+ description: For a given alert and remediation path rules that are defined for that alert's attack surface rule, this takes each remediation path rule and looks at the rule criteria too see if the rule matches for the given alert. If multiple rules match, it will return the most recently created rule. This assumes that the rules passed in are filtered to correlate with the alert's attack surface rule.
+ scriptName: RemediationPathRuleEvaluation
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "22"
+ scriptarguments:
+ cloud_managed:
+ complex:
+ root: alert
+ accessor: asmcloud
+ development_environment:
+ complex:
+ root: alert
+ accessor: asmdevcheck
+ ip:
+ complex:
+ root: alert
+ accessor: remoteip
+ providers:
+ complex:
+ root: inputs.ExternallyDetectedProviders
+ remediation_path_rules:
+ complex:
+ root: ASM
+ accessor: RemediationRule
+ service_owner_identified:
+ complex:
+ root: alert
+ accessor: asmserviceowner
+ severity:
+ complex:
+ root: alert
+ accessor: severity
+ tags:
+ complex:
+ root: alert
+ accessor: asmtags
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 560
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "6":
+ id: "6"
+ taskid: 5e4c0cb4-c708-4b18-8fec-5dafaa201ef8
+ type: title
+ task:
+ id: 5e4c0cb4-c708-4b18-8fec-5dafaa201ef8
+ version: -1
+ name: Complete
+ type: title
+ iscommand: false
+ brand: ""
+ description: ''
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 490,
+ "y": 1665
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "10":
+ id: "10"
+ taskid: 59707f87-7c81-4617-89fc-cc923d071cbb
+ type: condition
+ task:
+ id: 59707f87-7c81-4617-89fc-cc923d071cbb
+ version: -1
+ name: Meets automated remediation requirements?
+ description: Determines if the alert meets the criteria for automated remediation.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "20"
+ "yes":
+ - "19"
+ separatecontext: false
+ conditions:
+ - label: "yes"
+ condition:
+ - - operator: inList
+ left:
+ value:
+ complex:
+ root: alert
+ accessor: asmattacksurfaceruleid
+ transformers:
+ - operator: StripChars
+ args:
+ chars:
+ value:
+ simple: '[\"]'
+ iscontext: true
+ right:
+ value:
+ simple: RdpServer,InsecureOpenSSH,TelnetServer,UnencryptedFtpServer,OpenSSH,SshServer,SnmpServer
+ - - operator: inList
+ left:
+ value:
+ complex:
+ root: alert.asmcloud
+ accessor: Provider
+ iscontext: true
+ right:
+ value:
+ simple: AWS,GCP,Azure
+ - - operator: isNotEmpty
+ left:
+ value:
+ complex:
+ root: alert
+ accessor: asmserviceowner
+ iscontext: true
+ - - operator: isTrue
+ left:
+ value:
+ complex:
+ root: alert
+ accessor: asmdevcheck
+ iscontext: true
+ ignorecase: true
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 230,
+ "y": -320
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "13":
+ id: "13"
+ taskid: 46bcd9bd-3ea9-4788-8976-147b158e6a80
+ type: condition
+ task:
+ id: 46bcd9bd-3ea9-4788-8976-147b158e6a80
+ version: -1
+ name: Is Cortex ASM enabled?
+ description: Determines if the "Cortex Attack Surface Management" integration instance is configured to pull Remediation Path Rules.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "21"
+ "yes":
+ - "1"
+ separatecontext: false
+ conditions:
+ - label: "yes"
+ condition:
+ - - operator: isExists
+ left:
+ value:
+ complex:
+ root: modules
+ filters:
+ - - operator: isEqualString
+ left:
+ value:
+ simple: modules.brand
+ iscontext: true
+ right:
+ value:
+ simple: Cortex Attack Surface Management
+ - - operator: isEqualString
+ left:
+ value:
+ simple: modules.state
+ iscontext: true
+ right:
+ value:
+ simple: active
+ iscontext: true
+ right:
+ value: {}
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 40
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "16":
+ id: "16"
+ taskid: 6f59063d-f5a0-45ce-8ba2-eca5c8500796
+ type: condition
+ task:
+ id: 6f59063d-f5a0-45ce-8ba2-eca5c8500796
+ version: -1
+ name: Is ServiceNow v2 enabled?
+ description: Determines if the "ServiceNow v2" integration instance is enabled in order to send ServiceNow tickets as notifications.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "18"
+ "yes":
+ - "17"
+ separatecontext: false
+ conditions:
+ - label: "yes"
+ condition:
+ - - operator: isExists
+ left:
+ value:
+ complex:
+ root: modules
+ filters:
+ - - operator: isEqualString
+ left:
+ value:
+ simple: modules.brand
+ iscontext: true
+ right:
+ value:
+ simple: ServiceNow v2
+ - - operator: isEqualString
+ left:
+ value:
+ simple: modules.state
+ iscontext: true
+ right:
+ value:
+ simple: active
+ iscontext: true
+ right:
+ value: {}
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 690,
+ "y": -320
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "17":
+ id: "17"
+ taskid: d766bc5a-dbe7-4212-8c25-df2066c04db2
+ type: regular
+ task:
+ id: d766bc5a-dbe7-4212-8c25-df2066c04db2
+ version: -1
+ name: Set ServiceNowv2Enabled to true
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "13"
+ scriptarguments:
+ key:
+ simple: ServiceNowv2Enabled
+ value:
+ simple: "True"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 690,
+ "y": -140
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "18":
+ id: "18"
+ taskid: ec2b3b7c-2b7e-452d-843b-3c008ff02f49
+ type: regular
+ task:
+ id: ec2b3b7c-2b7e-452d-843b-3c008ff02f49
+ version: -1
+ name: Set ServiceNowv2Enabled to false
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "13"
+ scriptarguments:
+ key:
+ simple: ServiceNowv2Enabled
+ value:
+ simple: "False"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 1100,
+ "y": -130
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "19":
+ id: "19"
+ taskid: 232f64dc-79ee-4cdc-8204-abdcc8bd6c31
+ type: regular
+ task:
+ id: 232f64dc-79ee-4cdc-8204-abdcc8bd6c31
+ version: -1
+ name: Set AutoRemediationRequirements to true
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "13"
+ scriptarguments:
+ key:
+ simple: AutoRemediationRequirements
+ value:
+ simple: "True"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 230,
+ "y": -140
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "20":
+ id: "20"
+ taskid: 11b9d93a-4c59-4d3b-856a-ce1e710c64ea
+ type: regular
+ task:
+ id: 11b9d93a-4c59-4d3b-856a-ce1e710c64ea
+ version: -1
+ name: Set AutoRemediationRequirements to false
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "13"
+ scriptarguments:
+ key:
+ simple: AutoRemediationRequirements
+ value:
+ simple: "False"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": -170,
+ "y": -140
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "21":
+ id: "21"
+ taskid: cf490238-a6ad-4810-8836-2f34a81643ba
+ type: playbook
+ task:
+ id: cf490238-a6ad-4810-8836-2f34a81643ba
+ version: -1
+ name: Cortex ASM - Decision
+ playbookName: Cortex ASM - Decision
+ type: playbook
+ iscommand: false
+ brand: ""
+ description: ''
+ nexttasks:
+ '#none#':
+ - "6"
+ scriptarguments:
+ AutoRemediationRequirements:
+ complex:
+ root: AutoRemediationRequirements
+ ServiceNowv2Enabled:
+ complex:
+ root: ServiceNowv2Enabled
+ separatecontext: true
+ continueonerrortype: ""
+ loop:
+ iscommand: false
+ exitCondition: ""
+ wait: 1
+ max: 100
+ view: |-
+ {
+ "position": {
+ "x": -400,
+ "y": 1160
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "22":
+ id: "22"
+ taskid: dfd5d2a3-1680-4e15-8d36-ca100b6953a6
+ type: condition
+ task:
+ id: dfd5d2a3-1680-4e15-8d36-ca100b6953a6
+ version: -1
+ name: Was there a match?
+ description: Determines if a matching remediation path rule was found based on population of the "ASM - Remediation Path Rule" field.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "21"
+ "yes":
+ - "23"
+ separatecontext: false
+ conditions:
+ - label: "yes"
+ condition:
+ - - operator: isNotEmpty
+ left:
+ value:
+ complex:
+ root: alert
+ accessor: asmremediationpathrule
+ iscontext: true
+ right:
+ value: {}
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 720
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "23":
+ id: "23"
+ taskid: b9afa33d-f4d0-42b1-8676-bd3180067bbd
+ type: condition
+ task:
+ id: b9afa33d-f4d0-42b1-8676-bd3180067bbd
+ version: -1
+ name: What is the action of the matched rule?
+ description: Determines what is returned to the parent playbook based on contents of "ASM - Remediation Path Rule" field and other requirements.
+ type: condition
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#default#':
+ - "21"
+ Manual:
+ - "27"
+ return AR:
+ - "24"
+ return Email:
+ - "26"
+ return SNOW:
+ - "25"
+ separatecontext: false
+ conditions:
+ - label: return AR
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: alert.asmremediationpathrule
+ accessor: action
+ iscontext: true
+ right:
+ value:
+ simple: automated_remediation
+ - - operator: isEqualString
+ left:
+ value:
+ simple: AutoRemediationRequirements
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - label: return SNOW
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: alert.asmremediationpathrule
+ accessor: action
+ iscontext: true
+ right:
+ value:
+ simple: servicenow
+ - - operator: isEqualString
+ left:
+ value:
+ simple: ServiceNowv2Enabled
+ iscontext: true
+ right:
+ value:
+ simple: "True"
+ - label: return Email
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: alert.asmremediationpathrule
+ accessor: action
+ iscontext: true
+ right:
+ value:
+ simple: email
+ - label: Manual
+ condition:
+ - - operator: isEqualString
+ left:
+ value:
+ complex:
+ root: alert.asmremediationpathrule
+ accessor: action
+ iscontext: true
+ right:
+ value:
+ simple: manual_remediation
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 480,
+ "y": 930
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "24":
+ id: "24"
+ taskid: 23ac2f5c-4a17-4d9d-8d00-2656f8ad4d4b
+ type: regular
+ task:
+ id: 23ac2f5c-4a17-4d9d-8d00-2656f8ad4d4b
+ version: -1
+ name: Return AR
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "31"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: AR
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 50,
+ "y": 1160
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "25":
+ id: "25"
+ taskid: 474d7ebe-d169-472a-8582-1e31d1eeedc4
+ type: regular
+ task:
+ id: 474d7ebe-d169-472a-8582-1e31d1eeedc4
+ version: -1
+ name: Return SNOW
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "31"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: SNOW
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 490,
+ "y": 1160
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "26":
+ id: "26"
+ taskid: 521d8d56-42fc-4d34-8e04-79fdedc75f07
+ type: regular
+ task:
+ id: 521d8d56-42fc-4d34-8e04-79fdedc75f07
+ version: -1
+ name: Return Email
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "31"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: Email
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 900,
+ "y": 1160
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "27":
+ id: "27"
+ taskid: 99b4d0f9-cef1-4b3f-8c2c-efcdb7dc2ee7
+ type: regular
+ task:
+ id: 99b4d0f9-cef1-4b3f-8c2c-efcdb7dc2ee7
+ version: -1
+ name: Return Manual
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "31"
+ scriptarguments:
+ key:
+ simple: RemediationAction
+ value:
+ simple: Manual
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 1330,
+ "y": 1160
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "31":
+ id: "31"
+ taskid: f5b40854-83e1-44db-8157-a2eaf51ed544
+ type: regular
+ task:
+ id: f5b40854-83e1-44db-8157-a2eaf51ed544
+ version: -1
+ name: Get current time
+ description: |
+ Retrieves the current date and time.
+ scriptName: GetTime
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "32"
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 490,
+ "y": 1340
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+ "32":
+ id: "32"
+ taskid: bff62ba0-bcad-4e52-8b6d-e2eff6a8b666
+ type: regular
+ task:
+ id: bff62ba0-bcad-4e52-8b6d-e2eff6a8b666
+ version: -1
+ name: Set timestamp
+ description: Set a value in context under the key you entered.
+ scriptName: Set
+ type: regular
+ iscommand: false
+ brand: ""
+ nexttasks:
+ '#none#':
+ - "6"
+ scriptarguments:
+ key:
+ simple: RPR_Timestamp
+ value:
+ complex:
+ root: TimeNowUnix
+ transformers:
+ - operator: TimeStampToDate
+ separatecontext: false
+ continueonerrortype: ""
+ view: |-
+ {
+ "position": {
+ "x": 490,
+ "y": 1480
+ }
+ }
+ note: false
+ timertriggers: []
+ ignoreworker: false
+ skipunavailable: false
+ quietmode: 0
+ isoversize: false
+ isautoswitchedtoquietmode: false
+view: |-
+ {
+ "linkLabelsPosition": {
+ "13_21_#default#": 0.3,
+ "3_21_#default#": 0.34
+ },
+ "paper": {
+ "dimensions": {
+ "height": 2200,
+ "width": 2110,
+ "x": -400,
+ "y": -470
+ }
+ }
+ }
+inputs:
+- key: ExternallyDetectedProviders
+ value: {}
+ required: false
+ description: Providers of external service.
+ playbookInputQuery:
+outputs:
+- contextPath: RemediationAction
+ description: Remediation action to be taken.
+ type: string
+- contextPath: RPR_Timestamp
+ description: Timestamp of when the remediation path rule action was determined.
+ type: string
+fromversion: 6.5.0
+tests:
+- No tests (auto formatted)
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules_README.md b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules_README.md
new file mode 100644
index 000000000000..04544a20c7b0
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_Path_Rules_README.md
@@ -0,0 +1,37 @@
+This playbook returns "RemediationAction" options based on the return from the Remediation Path Rules API, or defaults to data collection task options from the "Cortex ADM - Decision" sub-playbook.
+
+## Dependencies
+This playbook uses the following sub-playbooks, integrations, and scripts.
+
+### Sub-playbooks
+Cortex ASM - Decision
+
+### Integrations
+CortexAttackSurfaceManagement
+
+### Scripts
+* Set
+* GetTime
+* RemediationPathRuleEvaluation
+
+### Commands
+asm-list-remediation-rule
+
+## Playbook Inputs
+---
+
+| **Name** | **Description** | **Default Value** | **Required** |
+| --- | --- | --- | --- |
+| ExternallyDetectedProviders | Providers of the external service. | | Optional |
+
+## Playbook Outputs
+---
+
+| **Path** | **Description** | **Type** |
+| --- | --- | --- |
+| RemediationAction | Remediation action to be taken. | string |
+| RPR_Timestamp | Timestamp of when the remediation path rule action was determined. | string |
+
+## Playbook Image
+---
+
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Tenable.io_Enrichment.yml b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Tenable.io_Enrichment.yml
index 4f87a1032c6b..302c8f650365 100644
--- a/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Tenable.io_Enrichment.yml
+++ b/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Tenable.io_Enrichment.yml
@@ -720,6 +720,3 @@ tests:
fromversion: 6.5.0
contentitemexportablefields:
contentitemfields: {}
-marketplaces:
- - marketplacev2
- - xpanse
\ No newline at end of file
diff --git a/Packs/CortexAttackSurfaceManagement/README.md b/Packs/CortexAttackSurfaceManagement/README.md
index a3951facfa26..98a4a992ba4d 100644
--- a/Packs/CortexAttackSurfaceManagement/README.md
+++ b/Packs/CortexAttackSurfaceManagement/README.md
@@ -53,61 +53,71 @@ Automated remediation is only possible when the right conditions are met. These
- [Cortex ASM - Azure Enrichment](#cortex-asm---azure-enrichment)
- [Cortex ASM - GCP Enrichment](#cortex-asm---gcp-enrichment)
- [Cortex ASM - SNMP Check](#cortex-asm---snmp-check)
+- [Cortex ASM - Decision](#cortex-asm---decision)
+- [Cortex ASM - Remediation Path Rules](#cortex-asm---remediation-path-rules)
### Cortex ASM - ASM Alert
Playbook that enriches asset information for ASM alerts and provides means of remediation.
-
+
#### Cortex ASM - Detect Service
Playbook that looks at what ASM sub-type the alert is and directs it to different pre/post mitigation scans (such as NMAP, SNMP).
-
+
#### Cortex ASM - Enrichment
Playbook that is used as a container folder for all enrichments of ASM alerts.
-
+
#### Cortex ASM - AWS Enrichment
Playbook that given the IP address enriches AWS information relevant to ASM alerts.
-
+
#### Cortex ASM - ServiceNow CMDB Enrichment
Playbook that given the IP address enriches ServiceNow CMDB information relevant to ASM alerts.
-
+
#### Cortex ASM - Tenable.io Enrichment
Playbook that given the IP address enriches Tenable.io information relevant to ASM alerts.
-
+
#### Cortex ASM - Remediation Guidance
Playbook that pulls remediation guidance off of a list based on ASM RuleID to be used in service owner notifications (email or ticketing system).
-
+
#### Cortex ASM - Remediation
Playbook that is used as a container folder for all remediation of ASM alerts.
-
+
#### Cortex ASM - Azure Enrichment
-Given the IP address, this playbook enriches Azure information relevant to ASM alerts.
-
+Playbook that given the IP address enriches Azure information relevant to ASM alerts.
+
#### Cortex ASM - GCP Enrichment
Playbook that given the IP address enriches GCP information relevant to ASM alerts.
-
+
#### Cortex ASM - SNMP Check
Playbook that given the IP address checks if SNMP is enabled or not and returns versions running.
-
+
+
+#### Cortex ASM - Decision
+Playbook that returns "RemediationAction" options based on meeting "Automated Remediation Requirements" as well as whether ServiceNowV2 integration is set up.
+
+
+#### Cortex ASM - Remediation Path Rules
+Playbook that returns "RemediationAction" options based on the return from the Remediation Path Rules API, or defaults to data collection task options from the "Cortex ADM - Decision" sub-playbook.
+
### Automation Scripts
@@ -117,14 +127,18 @@ This content pack includes the [generateASMReport](#generateasmreport) script:
#### GenerateASMReport
This automation helps generate an ASM alert summary report with important information found via the playbook run.
-
+
#### SnmpDetection
This automation checks if SNMP is enabled or not and gets the running version on the remote server.
-
+
#### InferWhetherServiceIsDev
This automation identifies whether the service is a "development" server. Development servers have no external users and run no production workflows. These servers might be named "dev", but they might also be named "qa", "pre-production", "user acceptance testing", or use other non-production terms. This automation uses both public data visible to anyone (`active_classifications` as derived by Xpanse ASM) as well as checking internal data for AI-learned indicators of development systems (`asm_tags` as derived from integrations with non-public systems).
-
+
+
+#### RemediationPathRuleEvaluation
+This automation attempts to find a matching remediation path rule based on criteria. If multiple rules match, it will return the most recently created rule. This assumes that the rules passed in are filtered to correlate with the alert's attack surface rule (Xpanse only).
+
diff --git a/Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_5_1.md b/Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_5_1.md
new file mode 100644
index 000000000000..962a3dae5d1e
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_5_1.md
@@ -0,0 +1,52 @@
+
+#### Playbooks
+##### New: Cortex ASM - Decision
+Created a playbook that returns "Remediation Action" options based on meeting "Automated Remediation Requirements" (https://github.com/demisto/content/tree/master/Packs/CortexAttackSurfaceManagement#automated-remediation-requirements) as well as whether ServiceNowV2 integration is set up.
+
+##### New: Cortex ASM - Remediation Path Rules
+Created a playbook that returns "Remediation Action" options based on the return from the Remediation Path Rules API, or defaults to data collection task options from the "Cortex ADM - Decision" sub- playbook.
+
+##### Cortex ASM - ASM Alert
+- Updated the playbook to include the new "Cortex ASM - Remediation Path Rules" sub-playbook to include the remediation path logic.
+- Updated the yml file to no longer contain the *marketplaces* field.
+- Updated the StripChars transformer expression.
+
+##### Cortex ASM - CMDB Enrichment
+Updated the yml file to no longer contain the *marketplaces* field.
+
+##### Cortex ASM - Detect Service
+- Updated the yml file to no longer contain the *marketplaces* field.
+- Updated the StripChars transformer expression.
+
+##### Cortex ASM - Enrichment
+- Updated the yml file to no longer contain the *marketplaces* field.
+- Updated the StripChars transformer expression.
+
+##### Cortex ASM - GCP Enrichment
+Updated the yml file to no longer contain the *marketplaces* field.
+
+##### Cortex ASM - Remediation Guidance
+Updated the yml file to no longer contain the *marketplaces* field.
+
+##### Cortex ASM - Remediation
+Updated the yml file to no longer contain the *marketplaces* field.
+
+##### Cortex ASM - Tenable.io Enrichment
+Updated the yml file to no longer contain the *marketplaces* field.
+
+#### Scripts
+##### GenerateASMReport
+- Updated the GenerateASMReport to include the new *ASM - Remediation Path Rule* field.
+
+##### New: RemediationPathRuleEvaluation
+- Added the **RemediationPathRuleEvaluation** automation that checks for a matching remediation path rule (Xpanse only).
+
+#### Incident Fields
+- Added the **ASM - Remediation Path Rule** field.
+- Updated the **ASM - Asset ID**, **ASM - Attack Surface Rule ID**, and **ASM - Service ID** fields to multiSelect type.
+
+
+#### Integrations
+##### Cortex Attack Surface Management
+- Added the ***asm-list-remediation-rule*** command that returns a list of remediation path rules (Xpanse only).
+- Updated the yml file to no longer contain the *marketplaces* field.
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.py b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.py
index c1bc86148a96..a744d55aa5e7 100644
--- a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.py
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.py
@@ -1,11 +1,10 @@
-import demistomock as demisto # noqa: F401
-from CommonServerPython import * # noqa: F401
-
-
-import traceback
import json
-from typing import Any, List, Dict
+import traceback
from base64 import b64decode
+from typing import Any, Dict, List
+
+import demistomock as demisto # noqa: F401
+from CommonServerPython import * # noqa: F401
def build_report(template: List[Dict], alert_id: str) -> Dict:
@@ -231,7 +230,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
},
{
"type": "header",
- "data": "Service Owner Information",
+ "data": "Remediation Rule Match",
"layout": {
"rowPos": 9,
"columnPos": 1,
@@ -245,10 +244,39 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
},
{
"type": "table",
- "data": asm_args["asmserviceowner"],
+ "data": asm_args["asmremediationpathrule"],
"layout": {
"rowPos": 10,
"columnPos": 1,
+ "tableColumns": [
+ "RuleName",
+ "Criteria",
+ "CreatedBy",
+ "Action",
+ ],
+ "classes": "striped stackable",
+ },
+ },
+ {
+ "type": "header",
+ "data": "Service Owner Information",
+ "layout": {
+ "rowPos": 11,
+ "columnPos": 1,
+ "style": {
+ "textAlign": "left",
+ "fontSize": 16,
+ "color": "black",
+ "background-color": "#00cc66ff",
+ },
+ },
+ },
+ {
+ "type": "table",
+ "data": asm_args["asmserviceowner"],
+ "layout": {
+ "rowPos": 12,
+ "columnPos": 1,
"tableColumns": ["Name", "Email", "Source", "Timestamp"],
"classes": "striped stackable",
},
@@ -257,7 +285,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "header",
"data": "Notifications Sent",
"layout": {
- "rowPos": 11,
+ "rowPos": 13,
"columnPos": 1,
"style": {
"textAlign": "left",
@@ -271,7 +299,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "table",
"data": asm_args["asmnotification"],
"layout": {
- "rowPos": 12,
+ "rowPos": 14,
"columnPos": 1,
"tableColumns": ["Type", "Value", "URL", "Timestamp"],
"classes": "striped stackable",
@@ -281,7 +309,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "header",
"data": "Data Collected from Owner",
"layout": {
- "rowPos": 13,
+ "rowPos": 15,
"columnPos": 1,
"style": {
"textAlign": "left",
@@ -295,7 +323,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "table",
"data": asm_args["asmdatacollection"],
"layout": {
- "rowPos": 14,
+ "rowPos": 16,
"columnPos": 1,
"tableColumns": ["Options", "Selected", "Answerer", "Timestamp"],
"classes": "striped stackable",
@@ -305,7 +333,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "header",
"data": "Private IP Addresses",
"layout": {
- "rowPos": 15,
+ "rowPos": 17,
"columnPos": 1,
"style": {
"textAlign": "left",
@@ -319,7 +347,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "table",
"data": asm_args["asmprivateip"],
"layout": {
- "rowPos": 16,
+ "rowPos": 18,
"columnPos": 1,
"tableColumns": ["Source", "IP"],
"classes": "striped stackable",
@@ -329,7 +357,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "header",
"data": "Cloud Asset Information",
"layout": {
- "rowPos": 17,
+ "rowPos": 19,
"columnPos": 1,
"style": {
"textAlign": "left",
@@ -343,7 +371,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "table",
"data": asm_args["asmcloud"],
"layout": {
- "rowPos": 18,
+ "rowPos": 20,
"columnPos": 1,
"tableColumns": [
"Provider",
@@ -359,7 +387,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "header",
"data": "Object Tag Information",
"layout": {
- "rowPos": 19,
+ "rowPos": 21,
"columnPos": 1,
"style": {
"textAlign": "left",
@@ -373,7 +401,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "table",
"data": asm_args["asmtags"],
"layout": {
- "rowPos": 20,
+ "rowPos": 22,
"columnPos": 1,
"tableColumns": [
"Key",
@@ -387,7 +415,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "header",
"data": "Related System Identifiers",
"layout": {
- "rowPos": 21,
+ "rowPos": 23,
"columnPos": 1,
"style": {
"textAlign": "left",
@@ -401,7 +429,7 @@ def build_template(args: Dict[str, Any]) -> List[Dict[str, Any]]:
"type": "table",
"data": asm_args["asmsystemids"],
"layout": {
- "rowPos": 22,
+ "rowPos": 24,
"columnPos": 1,
"tableColumns": [
"Type",
@@ -421,6 +449,17 @@ def color_for_severity(severity: str) -> str:
return sev_map.get(severity.lower(), "black")
+def RPR_criteria(criteria: Any) -> Any:
+ if criteria:
+ criteria_dict = json.loads(criteria)
+ statements = []
+ for entry in criteria_dict:
+ statements.append(f"({entry.get('field')} {'=' if entry.get('operator') == 'eq' else '!='} {entry.get('value')})")
+ return " AND ".join(statements)
+ else:
+ return None
+
+
def get_asm_args(args: Dict[str, Any]) -> Dict[str, Any]:
"""Get relevant ASM Arguments & Keys for Report template
Args:
@@ -445,6 +484,20 @@ def get_asm_args(args: Dict[str, Any]) -> Dict[str, Any]:
"Region": "n/a",
}
),
+ "asmremediationpathrule":
+ {
+ "RuleName": args.get("asm_remediation_path_rule", {}).get("rule_name"),
+ "Criteria": RPR_criteria(args.get("asm_remediation_path_rule", {}).get("criteria")),
+ "CreatedBy": args.get("asm_remediation_path_rule", {}).get("created_by_pretty"),
+ "Action": args.get("asm_remediation_path_rule", {}).get("action")
+ }
+ if args.get("asm_remediation_path_rule")
+ else {
+ "RuleName": "n/a",
+ "Criteria": "n/a",
+ "CreatedBy": "n/a",
+ "Action": "n/a"
+ },
"asmdatacollection": args.get("asm_data_collection")
if args.get("asm_data_collection")
else {
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.yml b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.yml
index e87227b53da1..7d2c525d552e 100644
--- a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.yml
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport.yml
@@ -34,14 +34,17 @@ args:
- description: Private IP addresses found.
isArray: true
name: asm_private_ip
-- description: Related or duplicate objects. (More of a nice to have because not sure how to track this).
+- description: Related or duplicate objects.
isArray: true
name: asm_related
+- description: Matched remediation path rule (if there is a match).
+ isArray: true
+ name: asm_remediation_path_rule
comment: Generate an ASM Alert Summary report.
commonfields:
id: GenerateASMReport
version: -1
-dockerimage: demisto/python3:3.10.9.46032
+dockerimage: demisto/python3:3.10.10.47713
enabled: true
name: GenerateASMReport
runas: DBotWeakRole
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport_test.py b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport_test.py
index 6eabd727ba49..98019df70d87 100644
--- a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport_test.py
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/GenerateASMReport_test.py
@@ -106,3 +106,19 @@ def test_build_report(mocker):
result = build_report(template, 1234)
assert isinstance(result, dict)
assert result["Type"] == EntryType.ENTRY_INFO_FILE
+
+
+def test_RPR_criteria(mocker):
+ """Tests RPR_criteria helper function.
+
+ Given:
+ - Mock criteria_str (string).
+ When:
+ - Sending criteria_str (string) to RPR_criteria helper function.
+ Then:
+ - Checks the output of the helper function with the expected output.
+ """
+ from GenerateASMReport import RPR_criteria
+
+ result = RPR_criteria("""[{"field": "provider", "value": "amazon web services", "operator": "eq"}]""")
+ assert result == "(provider = amazon web services)"
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/README.md b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/README.md
index 0b5c53594f60..b6ee60a8fb07 100644
--- a/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/README.md
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/GenerateASMReport/README.md
@@ -8,6 +8,11 @@ Generate an ASM Alert Summary report.
| Script Type | python3 |
| Cortex XSOAR Version | 6.5.0 |
+## Used In
+---
+This script is used in the following playbooks and scripts.
+Cortex ASM - ASM Alert
+
## Inputs
---
@@ -17,16 +22,17 @@ Generate an ASM Alert Summary report.
| alert_name | Name of the alert that triggered this playbook. |
| alert_details | Details of the alert that triggered this playbook. |
| alert_severityStr | ASM alert severity string. |
-| asmserviceowner | Potential service owners gathered through the playbook. |
-| asmremediation | Collect information on remediation action\(s\). |
-| asmservicedetection | Pre/Post remediation scan to check if the service is still detectable. |
-| asmsystemids | Related system identifiers. |
-| asmcloud | Information on cloud assets. |
-| asmnotification | Information on notification\(s\) sent via the ASM playbook. |
-| asmdatacollection | Collect information on data collection tasks. |
-| asmtags | Tags from objects that can be used to determine other information \(if server is Dev for example\). |
-| asmprivateip | Private IP addresses found. |
-| asmrelated | Related or duplicate objects. \(More of a nice to have because not sure how to track this\) |
+| asm_service_owner | Potential service owners gathered through the playbook. |
+| asm_remediation | Collect information on remediation action\(s\). |
+| asm_service_detection | Pre/Post remediation scan to check if the service is still detectable. |
+| asm_system_ids | Related system identifiers. |
+| asm_cloud | Information on cloud assets. |
+| asm_notification | Information on notification\(s\) sent via the ASM playbook. |
+| asm_data_collection | Collect information on data collection tasks. |
+| asm_tags | Tags from objects that can be used to determine other information \(if server is Dev for example\). |
+| asm_private_ip | Private IP addresses found. |
+| asm_related | Related or duplicate objects. \(More of a nice to have because not sure how to track this\). |
+| asm_remediation_path_rule | Matched remediation path rule \(if there is a match\). |
## Outputs
---
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/README.md b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/README.md
new file mode 100644
index 000000000000..7949b857ce6b
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/README.md
@@ -0,0 +1,26 @@
+For a given alert and remediation path rules that are defined for that alert's attack surface rule, this script takes each remediation path rule and looks at the rule criteria to see if the rule matches for the given alert. If multiple rules match, it will return the most recently created rule. This assumes that the rules passed in are filtered to correlate with the alert's attack surface rule.
+
+## Script Data
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+
+## Inputs
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| severity | Alert's Severity. |
+| ip | Alert's Remote IP. |
+| development_environment | Is this in a development environment? |
+| cloud_managed | Is this cloud managed? |
+| service_owner_identified | Has a service owner been identified? |
+| tags | Includes Cloud and Xpanse tags |
+| providers | Externally Detected Providers |
+| remediation_path_rules | List of remediation path rules for the alert's attack surface rule. |
+
+## Outputs
+---
+There are no outputs for this script.
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.py b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.py
new file mode 100644
index 000000000000..94013b5f6753
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.py
@@ -0,0 +1,225 @@
+import demistomock as demisto # noqa: F401
+from CommonServerPython import * # noqa: F401
+
+"""
+Script for evaluating and finding a remediation path rule that matches for
+a given alert
+"""
+
+import traceback
+from typing import Any, Dict, List
+
+# should match IncidentSeverity in CommonServerPython
+SEVERITY_MAP = {
+ "unknown": 0,
+ "info": 0.5,
+ "low": 1,
+ "medium": 2,
+ "high": 3,
+ "critical": 4,
+}
+
+
+def match_remediation_rule(alert_context: Dict[str, Any], rules: List) -> List:
+ """
+ For the given alert (with the field in alert_context), finds the most recently created
+ remediation path rule where the alert meets the rule's criteria
+
+ Args:
+ alert_context: dictionary of relevant alert fields to check against
+ rules: list of remediation path rules to evaluate
+
+ Returns: the matching rule (list of 1)
+
+ """
+ matched_rules = []
+ # loop through remediation rules
+ if isinstance(rules, dict):
+ rules = [rules]
+ for rule in rules:
+ match = True
+ conditions = rule["criteria"]
+ if len(conditions) == 0:
+ demisto.info(
+ "Invalid Remediation Path Rule - no criteria condition to evaluate."
+ )
+ match = False
+ else:
+ # check criteria conjunction
+ if rule.get("criteria_conjunction") == "AND":
+ for cond in conditions:
+ rule_matched = evaluate_criteria(cond, alert_context)
+ if not rule_matched:
+ match = False
+ else:
+ demisto.info(
+ f"Criteria conjunction {rule.get('criteria_conjunction')} not supported at this time."
+ )
+ match = False
+
+ if match:
+ matched_rules.append(rule)
+
+ # sort matched rules by created_at timestamp in descending order
+ # return the most recent one
+ matched_rules_sorted = sorted(
+ matched_rules, key=lambda x: x["created_at"], reverse=True
+ )
+ if len(matched_rules_sorted) > 0:
+ return [matched_rules_sorted[0]]
+ else:
+ return []
+
+
+def evaluate_criteria(cond: Dict, alert_context: Dict) -> bool:
+ """
+ Evaluate whether a criteria condition is met based on the given alert's context fields
+
+ Args:
+ cond: Condition to evaluation (dictionary with keys: field, operator, value)
+ alert_context: dictionary of relevant alert fields to check against
+
+ Returns: True if the condition is met or False if not
+
+ """
+ field = cond["field"]
+ operator = cond["operator"]
+ value = cond["value"]
+
+ alert_context_value = alert_context.get(field)
+
+ # force lowercase for field and operator and value
+ if isinstance(field, str) and isinstance(operator, str) and isinstance(value, str):
+ field = field.lower()
+ operator = operator.lower()
+ value = value.lower()
+ else:
+ demisto.info("Invalid condition: field, operator or value must be strings")
+ return False
+
+ if operator == "eq":
+ # severity
+ if field == "severity":
+ if SEVERITY_MAP.get(value) == alert_context_value:
+ return True
+ return False
+ # boolean fields
+ elif (
+ field == "development_environment"
+ or field == "cloud_managed"
+ or field == "service_owner_identified"
+ ):
+ if value == "true" and (alert_context_value is True or alert_context_value):
+ return True
+ elif value == "false" and (
+ alert_context_value is False or not alert_context_value
+ ):
+ return True
+ return False
+ # text match fields
+ elif field == "provider":
+ # providers can be a string or a list
+ if alert_context_value:
+ if isinstance(alert_context_value, str):
+ alert_context_value = [alert_context_value]
+ providers_set = set(
+ [provider.lower() for provider in alert_context_value]
+ )
+ if value in providers_set:
+ return True
+ return False
+ elif isinstance(alert_context_value, str):
+ if field == "ip":
+ if value == alert_context_value.lower():
+ return True
+ return False
+ else:
+ demisto.info(f"Criteria field {field} not supported at this time.")
+ return False
+ # list fields
+ elif isinstance(alert_context_value, list):
+ if field == "tag":
+ # build set of tag values to check against
+ tags = set()
+ for tag in alert_context_value:
+ tags.add(tag.get("Value").lower())
+ tags.add(tag.get("Key").lower())
+
+ if value in tags:
+ return True
+ return False
+ else:
+ demisto.info(f"Criteria field {field} not supported at this time.")
+ return False
+ else:
+ return False
+ else:
+ demisto.info(f"Condition Operator {operator} is not supported at this time.")
+ return False
+
+
+""" MAIN FUNCTION """
+
+
+def main():
+ """
+ For a given alert and remediation path rules that are defined for that alert's
+ attack surface rule, this takes each remediation path rule and looks at the rule
+ criteria too see if the rule matches for the given alert. If multiple rules match,
+ it will return the most recently created rule.
+
+ This assumes that the rules passed in are filtered to correlate with the alert's
+ attack surface rule.
+
+ Args:
+ alert_context: dictionary of relevant alert fields we are checking against
+ remediation_path_rules: list of remediation path rules for the alert's
+ attack surface rule
+
+ Returns:
+ asmremediationpathrule: the remediation path rule if there is a match
+ Does not populate this alert field if no match is found.
+
+ """
+ try:
+ # parse args
+ args = demisto.args()
+ alert_context = {
+ "severity": args.get("severity"),
+ "ip": args.get("ip"),
+ "tag": args.get("tags"),
+ "provider": args.get("providers"),
+ "development_environment": args.get("development_environment"),
+ "cloud_managed": args.get("cloud_managed"),
+ "service_owner_identified": args.get("service_owner_identified"),
+ }
+ rules = args.get("remediation_path_rules")
+
+ matched_rule = match_remediation_rule(alert_context, rules)
+
+ if len(matched_rule) > 0:
+ demisto.executeCommand(
+ "setAlert", {"asmremediationpathrule": matched_rule[0]}
+ )
+ return_results(
+ CommandResults(readable_output="Remediation path rule match found")
+ )
+ else:
+ return_results(
+ CommandResults(
+ readable_output="No matched remediation path rules found"
+ )
+ )
+
+ except Exception as ex:
+ demisto.error(traceback.format_exc()) # print the traceback
+ return_error(
+ f"Failed to execute Remediation Path Rule Evaluation. Error: {str(ex)}"
+ )
+
+
+""" ENTRY POINT """
+
+
+if __name__ in ("__main__", "__builtin__", "builtins"):
+ main()
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.yml b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.yml
new file mode 100644
index 000000000000..bc1cd036a7c8
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation.yml
@@ -0,0 +1,39 @@
+args:
+- description: Alert's severity.
+ name: severity
+- description: Alert's remote IP.
+ name: ip
+- description: Is this in a development environment?
+ name: development_environment
+- description: Is this cloud managed?
+ isArray: true
+ name: cloud_managed
+- description: Has a service owner been identified?
+ isArray: true
+ name: service_owner_identified
+- description: Includes Cloud and Xpanse tags
+ isArray: true
+ name: tags
+- description: Externally Detected Providers
+ isArray: true
+ name: providers
+- description: List of remediation path rules for the alert's attack surface rule.
+ isArray: true
+ name: remediation_path_rules
+comment: For a given alert and remediation path rules that are defined for that alert's attack surface rule, this script takes each remediation path rule and looks at the rule criteria to see if the rule matches for the given alert. If multiple rules match, it will return the most recently created rule. This assumes that the rules passed in are filtered to correlate with the alert's attack surface rule.
+commonfields:
+ id: RemediationPathRuleEvaluation
+ version: -1
+dockerimage: demisto/python3:3.10.10.47713
+enabled: true
+name: RemediationPathRuleEvaluation
+runas: DBotWeakRole
+runonce: false
+script: ''
+scripttarget: 0
+subtype: python3
+tags: []
+type: python
+fromversion: 6.5.0
+tests:
+- No tests (auto formatted)
diff --git a/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation_test.py b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation_test.py
new file mode 100644
index 000000000000..43787be8dee7
--- /dev/null
+++ b/Packs/CortexAttackSurfaceManagement/Scripts/RemediationPathRuleEvaluation/RemediationPathRuleEvaluation_test.py
@@ -0,0 +1,245 @@
+from RemediationPathRuleEvaluation import evaluate_criteria, match_remediation_rule
+import demistomock as demisto # noqa: F401
+import pytest
+
+ALERT_CONTEXT = {
+ "severity": 1,
+ "ip": "1.1.1.1",
+ "tag": [
+ {"Key": "env", "Source": "AWS", "Value": "dev"},
+ {"Key": "Name", "Source": "AWS", "Value": "rdp_server"},
+ ],
+ "provider": ["Amazon Web Services", "Google"],
+ "development_environment": True,
+ "cloud_managed": [
+ {
+ "Organization": "n/a",
+ "Other": "us-east-1a",
+ "Project": "n/a",
+ "Provider": "AWS",
+ "Region": "us-east-1",
+ }
+ ],
+ "service_owner_identified": [
+ {
+ "Email": "n/a",
+ "Name": "service_XSOAR",
+ "Source": "AWS",
+ "Timestamp": "2023-01-26T15:51:17.346Z",
+ }
+ ],
+}
+
+
+# Evaluate Criteria Tests #
+@pytest.mark.parametrize(
+ "test_condition, test_alert_context, expected_result",
+ [
+ ({"field": "severity", "operator": "eq", "value": "LOW"}, ALERT_CONTEXT, True),
+ ({"field": "severity", "operator": "eq", "value": "HIGH"}, ALERT_CONTEXT, False),
+ ({"field": "severity", "operator": "eq", "value": "MEDIUM"}, {"severity": None}, False),
+ ]
+)
+def test_evaluate_criteria_severity(test_condition, test_alert_context, expected_result):
+ assert evaluate_criteria(test_condition, test_alert_context) is expected_result
+
+
+@pytest.mark.parametrize(
+ "test_condition, test_alert_context, expected_result",
+ [
+ ({"field": "ip", "operator": "eq", "value": "1.1.1.1"}, ALERT_CONTEXT, True),
+ ({"field": "ip", "operator": "eq", "value": "2.2.2.2"}, ALERT_CONTEXT, False),
+ ({"field": "ip", "operator": "eq", "value": "1.1.1.1"}, {"ip": None}, False),
+ ]
+)
+def test_evaluate_criteria_ip(test_condition, test_alert_context, expected_result):
+ assert evaluate_criteria(test_condition, test_alert_context) is expected_result
+
+
+@pytest.mark.parametrize(
+ "test_condition, test_alert_context, expected_result",
+ [
+ ({"field": "tag", "operator": "eq", "value": "rdp_server"}, ALERT_CONTEXT, True),
+ ({"field": "tag", "operator": "eq", "value": "env"}, ALERT_CONTEXT, True),
+ ({"field": "tag", "operator": "eq", "value": "wrong"}, ALERT_CONTEXT, False),
+ ]
+)
+def test_evaluate_criteria_tag(test_condition, test_alert_context, expected_result):
+ assert evaluate_criteria(test_condition, test_alert_context) is expected_result
+
+
+@pytest.mark.parametrize(
+ "test_condition, test_alert_context, expected_result",
+ [
+ ({"field": "provider", "operator": "eq", "value": "amazon web services"}, ALERT_CONTEXT, True),
+ ({"field": "provider", "operator": "eq", "value": "amazon web services"}, {"provider": "Amazon Web Services"}, True),
+ ({"field": "provider", "operator": "eq", "value": "amazon web services"}, {"provider": None}, False),
+ ({"field": "provider", "operator": "eq", "value": "aws"}, ALERT_CONTEXT, False),
+ ]
+)
+def test_evaluate_criteria_provider(test_condition, test_alert_context, expected_result):
+ assert evaluate_criteria(test_condition, test_alert_context) is expected_result
+
+
+test_data = [
+ ("development_environment", True),
+ ("cloud_managed", False),
+ ("service_owner_identified", False),
+]
+
+
+@pytest.mark.parametrize("field_name, is_boolean", test_data)
+def test_evaluate_criteria_boolean_type_check(field_name, is_boolean):
+ # is_boolean is True if the field can actually be a True/False value vs.
+ # is_boolean is False if True/False is determined by the presence of the field's value
+
+ # test criteria condition is true
+ cond = {"field": field_name, "operator": "eq", "value": "true"}
+ assert evaluate_criteria(cond, ALERT_CONTEXT) is True
+
+ if is_boolean:
+ alert_context = {field_name: False}
+ assert evaluate_criteria(cond, alert_context) is False
+
+ alert_context = {field_name: None}
+ assert evaluate_criteria(cond, alert_context) is False
+
+ # test criteria condition is false
+ cond = {"field": field_name, "operator": "eq", "value": "false"}
+ assert evaluate_criteria(cond, ALERT_CONTEXT) is False
+
+ if is_boolean:
+ alert_context = {field_name: False}
+ assert evaluate_criteria(cond, alert_context) is True
+
+ alert_context = {field_name: None}
+ assert evaluate_criteria(cond, alert_context) is True
+
+
+# Match Remediation Rule Tests #
+def test_match_remediation_rule_basic():
+ # multiple rule matches
+ rules = [
+ {
+ "rule_id": "8e4ff951-9e17-492a-8fd8-c2a0f45b0d36",
+ "rule_name": "RDP dev rule",
+ "description": "add a Rdp rule",
+ "attack_surface_rule_id": "RdpServer",
+ "criteria": [
+ {"field": "development_environment", "value": "true", "operator": "eq"},
+ {"field": "ip", "value": "1.1.1.1", "operator": "eq"},
+ ],
+ "criteria_conjunction": "AND",
+ "action": "email",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674264241000,
+ },
+ {
+ "rule_id": "36b215c3-a336-40e3-bf13-0b976c72ebb6",
+ "rule_name": "SSH Severity Rule",
+ "description": "A SshServer Rule",
+ "attack_surface_rule_id": "SshServer",
+ "criteria": [{"field": "severity", "value": "low", "operator": "eq"}],
+ "criteria_conjunction": "AND",
+ "action": "servicenow",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674540567000,
+ },
+ ]
+ matched_rule = match_remediation_rule(ALERT_CONTEXT, rules)
+ assert len(matched_rule) == 1
+ assert matched_rule[0]["rule_id"] == "36b215c3-a336-40e3-bf13-0b976c72ebb6"
+
+ # multiple criteria matches
+ rules = [
+ {
+ "rule_id": "8e4ff951-9e17-492a-8fd8-c2a0f45b0d36",
+ "rule_name": "RDP dev rule",
+ "description": "add a Rdp rule",
+ "attack_surface_rule_id": "RdpServer",
+ "criteria": [
+ {"field": "development_environment", "value": "true", "operator": "eq"},
+ {"field": "ip", "value": "1.1.1.1", "operator": "eq"},
+ ],
+ "criteria_conjunction": "AND",
+ "action": "email",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674264241000,
+ },
+ {
+ "rule_id": "36b215c3-a336-40e3-bf13-0b976c72ebb6",
+ "rule_name": "SSH Severity Rule",
+ "description": "A SshServer Rule",
+ "attack_surface_rule_id": "SshServer",
+ "criteria": [{"field": "severity", "value": "high", "operator": "eq"}],
+ "criteria_conjunction": "AND",
+ "action": "servicenow",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674540567000,
+ },
+ ]
+ matched_rule = match_remediation_rule(ALERT_CONTEXT, rules)
+ assert len(matched_rule) == 1
+ assert matched_rule[0]["rule_id"] == "8e4ff951-9e17-492a-8fd8-c2a0f45b0d36"
+
+ # pass in 1 rule
+ rules = {
+ "rule_id": "8e4ff951-9e17-492a-8fd8-c2a0f45b0d36",
+ "rule_name": "RDP dev rule",
+ "description": "add a Rdp rule",
+ "attack_surface_rule_id": "RdpServer",
+ "criteria": [
+ {"field": "development_environment", "value": "true", "operator": "eq"},
+ {"field": "ip", "value": "1.1.1.1", "operator": "eq"},
+ ],
+ "criteria_conjunction": "AND",
+ "action": "email",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674264241000,
+ }
+ matched_rule = match_remediation_rule(ALERT_CONTEXT, rules)
+ assert len(matched_rule) == 1
+ assert matched_rule[0]["rule_id"] == "8e4ff951-9e17-492a-8fd8-c2a0f45b0d36"
+
+ # only one criteria matches - no rule match
+ rules = [
+ {
+ "rule_id": "8e4ff951-9e17-492a-8fd8-c2a0f45b0d36",
+ "rule_name": "RDP dev rule",
+ "description": "add a Rdp rule",
+ "attack_surface_rule_id": "RdpServer",
+ "criteria": [
+ {"field": "development_environment", "value": "true", "operator": "eq"},
+ {"field": "ip", "value": "2.2.2.2", "operator": "eq"},
+ ],
+ "criteria_conjunction": "AND",
+ "action": "email",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674264241000,
+ },
+ {
+ "rule_id": "36b215c3-a336-40e3-bf13-0b976c72ebb6",
+ "rule_name": "SSH Severity Rule",
+ "description": "A SshServer Rule",
+ "attack_surface_rule_id": "SshServer",
+ "criteria": [{"field": "severity", "value": "high", "operator": "eq"}],
+ "criteria_conjunction": "AND",
+ "action": "servicenow",
+ "created_by": "noc@acme.com",
+ "created_by_pretty": "First Last",
+ "created_at": 1674540567000,
+ },
+ ]
+ matched_rule = match_remediation_rule(ALERT_CONTEXT, rules)
+ assert len(matched_rule) == 0
+
+ # empty list of rules
+ rules = []
+ matched_rule = match_remediation_rule(ALERT_CONTEXT, rules)
+ assert len(matched_rule) == 0
diff --git a/Packs/CortexAttackSurfaceManagement/TestPlaybooks/playbook-CortexAttackSurfaceManagement_Test.yml b/Packs/CortexAttackSurfaceManagement/TestPlaybooks/playbook-CortexAttackSurfaceManagement_Test.yml
index 5c53f5d65026..b692f8e1ef47 100644
--- a/Packs/CortexAttackSurfaceManagement/TestPlaybooks/playbook-CortexAttackSurfaceManagement_Test.yml
+++ b/Packs/CortexAttackSurfaceManagement/TestPlaybooks/playbook-CortexAttackSurfaceManagement_Test.yml
@@ -846,7 +846,5 @@ view: |-
}
inputs: []
outputs: []
-marketplaces:
-- marketplacev2
fromversion: 6.5.0
description: ''
diff --git a/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_ASM_Alert.png b/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_ASM_Alert.png
index 8febb81ee89b5161969380d1617afa3bbdf53c79..a3b098add32893448412033380a800ee44e6a309 100644
GIT binary patch
literal 818655
zcmeFabyQVr`!=cw1}LH;sHCzLX+gS86eI-cQkH}?(k&JO5{iJ*N=v!u4vB?yhom6g
z-Ei*dmi@Z-Uf}P1-#5k?<9zR5E}3i1`NaL)eO=QVst!-ymET$#}a{PbK-p&^z^Puq`DM3to#3X+B0b*
zDCBKaKz*8rHgI}HMV|S=j9u__R*30J%W77;{cIIi_fzLxyK!*$6HyC4`hWdF^m=Ge
zkHVM6`b+<7zlUFW9oX-Yx&MFh`TL2^v+gcLA7zN{`(GMAGHPMtN{auLx&N54unP>|
zN8u914vQFSjF-1O5b(J(Fz5(8sDK>rYpR|I_8(lMrRJ71JDYrO`yFw*O!`)U`rHM%
zq2tLy@HKYHy9>MC2`kQaygY+t3-501-|taHWf^;P`$@iu7RGmJ+6<@R+^}?^Y(vA;
zq&RWt&dX7e#BQcfDYU)mzI5Q<3rrmJs7ImBr}8YdcapKtM=obs)?b<@_MfVS4y_M7roX4nVcMjQ}#xlX5QhQ#>
ziFkkP;g?l!S!p6ALnt{oI9O-f3GZLCy+B3_KXbYjYM*UU7b6oj)=j}{rnB^bochW&
zY$ES;`6v-NL%41$!S?4u_%?o{
z9JZAUwT5M_GG%k!;oJ**uw%0N~c0)nUn6dkwR?c1-+DX?!)
zC=omi|2_V~_7X}h^#+HIU5<)8HYUd9i@IYF-dPmI7p`!L3mGV%E(A`Y`npK
z5A%tR%+uWG_?z`b_h35_WnpmgC{4uSm)psx)K}Qt2vzkc8c;cbxJhvL2eXE)tQOs&B3PuUm4S9pvzG?2GjsrmF|)nv4M1S=gZpypboU
z20h(Vk5Q^wW_2cU{o!4IU|A39!!R^!VUDxgjUDb~4O+`bBq-=LOfZ=MOvJHY2f1}1
zh@ZeZu-^GXiEWX7ehFV11dqBxLk4b8mJQ$Ua$&+Us7Jztu!9dD>ELfKE>1JVpc!hi
z_&8wXxR?&C<9EG;2>QqSp4bNbb5Zf=K+St;qUqpS-&KW;87GTLw&wKfx>N6imEsX*
z$HV%hAKNEvjSnlO-5KN$EA<#PfmI+%sNs1BWs^j9nA>AyZe>ZW#PF;cW@>I|;bO{@CnOO0EM&FZ`suIB?xaBk&wEbaMzh1*F2UT6
z-&fQ}G?X8^UVQ$ngH~b_(2#w69r3Y
z-P{=iM~a$zfDqePr4GXLN~F%(VmsYibGrd^d(7x24%(D@625OuoA$S{Z0#ct$U(*K
z4|H4q$8v1SW#CBhk4`kgHPBo8uzmIXUU;5H^lJgEw&2e}5r@OvF8P*3!VSDE;rltq
zl(DU<6FJC1|E@Y>EMwVvc0U|p&cUpfJMtpeoC)jRUvZwvAwO#|^7ZT2w>+j=W}v}~
zB?h>0mCjLfH?wgWAx7n&^RG>Vbukz<;J_+CKUUu9=+W~jJ*@`mU8m$#&6_Nr@|lki
z+pjLTkEeADrnMVp>$D`Oat?T1A#_<7|5_p|uO2k}Q9rLui}ik)*HTlR$e`WCWPowH
zs-?TEyfTx7ze?(tzvudIIxcD60Y2#__rP5+d
zKF7ZWyjWVBt?64H40hXG8x%sfsM(gB&R@E=z*UIebd=n*SsiCZmA-r~wpx5lvY5;$
z=ScQMnlfW+tbEa=40XKY=7zZ1LottV7h3F2S)Pw})dP@rGAKWx*LoX!<>aNTUoAm77SM0dC+HJM;N+hY)wMU`hS^m&xg1)@fiHa;e
zrrf!DrW}fhdH)`Ti4p6;Aj{J5&2<(+|0|1G9r47|8>^F;%6Au0?=*cM)TPi7TWnYl
zmZ0;O#YtZ3uZ8D#I&Q8{f1a%oX))~lAU0Ud`k+31s3}%{ETci<(6^>crnP=Q^-^al
z2X2hiKu1@|`eb76iZ0{VC`rbY+RL*mBmC~9tIPq10bw~`=>vj@78w%I*ojY?Rg
zZWW@#?N^4QFnyi^BWNy_v9^hMid@BYXB1_Y^)s%{R%{
z;9C^Uw_suub4j9tER^Q-8x?iR-_V(qp47hIx6oxf*=mQ5>bK5z!(0wEyWxmd`}9tYc&9ysHq&`5+!o9Ie%gaw8g5Lz&B}%@EO|?3s`Gmu
zFBMHXhCI`D=sJIpeZ!p#t{GK*=8KI_Q_|#5`9a
zRZG>Jm62HRPPO7#?+TCQVJPdOBtxEO4y5F>hw@BDnIz`Sh_0S%(v6e
zoo_b5P*@f}J#Z}PLQs@Bj=@RtY}?`&H{RE&T6Csf3y=s}47Oew=I$xjlRvv*-l7&@
zezN_+U{Ig4(AvF)MbIi^t9{cLs+ulEi#E-{tcg}Ms_*?is+WDvgh8XN0|%EnHT_C@
z4spJ4s#=QU($3>?KSHkO9&CwiuXPyUu%^9EBi#0^J`(?rO_lSU&VV+)v6HB
zWabMkW#mb&PUgYpntZN(k1jjoc0WHrPL)EEfBLGOfb~NalYSrcXMBdrhK#l+D6S6U
zD{IS=j^&^A_fb8(kv!3}h=-B(OCvmfT=DK$a*d#yI9DgT1kZe9t7VA&homI7c2gT^
z(#T^H+@}e;52@IWFX`5Y-`M@G5s%J2dt@Yb@PWz*@nS`oNBPL2cgWfwBQV35s1Of}
zBPMkvq?nlsmXIp0sCACT^}!HZW(of3;-RiEk+|%MtlJ>%iZ6@{@klFqB@TFSjN;o*
zhL#qhA?hrx;_4)B*H0E-$XuKAmefF(kW}zmL}br`fS2r>%%>t?$uWLOdGTCiOJi}U
zd5imei@K094PHw9V(qyA{rXQ@S(9|FOV!zvr7~gHH7PK1Di0!BA4CNu)%1bjA5Zio
z^J}_THEVybJbNPNB7t!v2boYG#?v#vFo%^;sP~0_ezMSm!^0ktH5~zc7|d*q5S8sj
zs(jI>eN=WARvFiN_6fbPoyg-Gz2n>5w)tpJZ(@2kCG40)IFTN{YUIQ{Fg6Aj`x?9-
zhw3Gy%Ee{$y0&dfgcKcd+_X)T!;kT>9Zwy*nAT-8T4FPrNX3#fb$M+y!Y^qu_^h7_
zTR^NxSgoEI13h=MG|wbfW9W+*!x#gm?d%8mTd$9vZ|rG>lhjgsdMx0D)o2x0U!4e5
z6%Gwuqt9p6;hU$!8o$K~7Mm@!X^Y?!cA5+ZDSl!Ui0P|kA>{dEl-OdbaGwai*x0A_
z1@r_AlxHxoL8_)fl8=etoqNXW1mo0e2tXU^CYkg3_Z~dqR6~y(Ci(Z511?Wx?g|-tUy{Y16)&mBAG99oBmv6R_w4hbm)pBctarL6V0Fg!g&ZP03rixqWe74~958%qbZcwi*{5O6HsPd_|M&
zHDJ+hL?tOSf9EAR58KMZI2oCK#yvY$6OHiNCPKc66MAvz>*06hZD`HcKRQRSap0=^Wpll1Q+vGtNEr|QJ$KM8F?s$KJh5)8otF2?wRPY
zQ-T5Wj*d(3os+7~@_8mQ&eibfHbyTEhIy7ghzg-($z9S|SZ}ZzbLZ;tvbWfK=+qlL
zYIVDB&lp?NK6^S4=L-x5j%9zN4KVb_8<5_Y+!!$_FG58z-k$F1#*)YFko4u8q7|b6
zmBZ3K6%KucK=Xw*#o93=$926qWlbMOJKt(A-mvktc*zyQv5rjBvDC$`cxDLuV-JY`
z$DIGi2M{I$?=N+C(%CIn4~s<`BUYqkMaE`%2a}TiPHijpmZUVA~0oYRFxPi;L@LS8*yje{2+I6rkfyTY0qG
zr0yDNRZ@_QB+pp_;ZBQo14Y00MTC5eY2Ejnxd+-aNB2b$DdX36*iPmuUI^#uqbF4e
zJg
zE2HsziP)=qL1s0J9VpMC#u)FOR{qZL$bDSL$;Ap2=az5PAf7=?SPKiG06T$)z+CMW
zleK9Km)V!B&Aip#Cx-=J6cGxo**-zRAyMfN(6~y{b8G(A;$&cQO*PH~u&_31%@r*9
zY+d{7w^73AAF%Y%n;$ZFG4
zq|GBX=5rXT)lW#S;bqth!rT0eNkAs@mJ30(kPv}w1T(6elw7P^JwJOa=|oQ9URL9t
zf;iiI_z4lUiuhp>lYxx}Oy+0w#%Z{ll`c&}SoR;W`03czk|1j8z5bz{)D$tIrV_Fz
zPE|0ct30tDxscK*Emp!-!RY;rb|eHOWq46m-TwHZ(3CKVpy+$FWw$-o$JkhuGlhlD
zevb&EGDYp+lY?su>FC0}WLHO+&1P=Wmb489dYg-jO5%GMfa7IS{7R%+dUYj1*-ybBu4(=uodoq8|LW&W=pFOJ>VhsEm)n>{7!QWW7DT;
z?-B2;&+EgIj;{Uk3a1G?s`By&@-|DCre9S%SdScCGhwopn?E
zupvG7LWTPJ$I~y~W*J3D+{J7Ra48y(LH^KPoyu0f=sul}56(ThH}m!s7_Gw|5eF#k
zdYtt0%>1M+6MY~a$+Dd6`hI;fdonMsL1A4xYdSP#1GBkqMB=4CV!iNAyZ4m{CR#3~sX$bKy*O6m6
z-21;PL+IZ9c>u{9Z{s4JS9H33$V1ht?i#C3ZD?jz4JCOtB>DTEk0#deibZ%_6=TXZ
zi_0AFpAJBI2A$>heXQ7SkZqu!QFr}^R|IY{S=h#W;t7+*&bI8~cQVFfdA5^PSzhZC
zGZlT~>0Pc22^nV+vQ|bI3+k6L`+b#r{bLh7?iD>R(M!y2jx$-$JLF*x{uLSmpkg>R
zr#6>s9D7&D3}2K43`MikhGybnz*Y7e&zx@H=9Z)KAhT$aRaA(WHl0g!INlH`UIE5|
z!Y}Jwki|%hVtT|iQq`0%22lx85L~WHkY=)HWP&IAWzCf#@nw^ovVpI;gwXn&)nun7
z9%f)A#((uujCd%0V4^yu%95*j8LkVh
z>UWs8sG=Jr_%wqaN$?JbKhKYX(-suuScsQQyty`8?S^<^&$}ILNmOn+Mbmil(i7Nl
zI7smHzgcSWmMnd7ghpeGA(36LQ)r)AB?8XV^ma9(o0^t84>dfWb7^C|8NWC0W6_-+d$O$?)itxGpm
zHzsoWJZ=Ql`rAmS7gRVdX178Rp)qdW{7$p%`^S$N-(QPqRK%y1m*5*uQRMZA$QM|jYcT0OKwC^{J9Y$#
zl~wG%oK++W-?&+bt`6eEh
zBe3`qA_zxcQ-Rsai$B7sdQk?=AKILv%c9j`btt#?vSMx2^z10g!v!%w6DzCTVXD~{
z5Y79qI^YwGCogs>5<&KYMPFf{&r_&+Bn>tP--BZir%JOjXD>#2NVlw6Sv$o0&M5df
z0(%cr2Cj$K+{0Ix$ZSzVPkkoPrYI|QCu<=h&)(cv?Ms#vs@kv|xo%OoJP1N0E2qlQ
z-k;i{ax69>OP6F#f9<8+_g6YCdG>2_Q9?m|59$Z$%|+UEW8;&SA;II{Ic%0keE(Kq
z8nLi=NH;@b#u@FLV&j)Dl
zJ9*576O}Kt8<2um^QE*4iEyan5Q!q*rJSjr-wM{@16WJN=(FZzV!K~4rFXEA*=)dy
z7kWK8%<~5)grIS;P3{nk#;i7-1UDlA9Z`Seg+!i&(X!>VO^b8DxHj^Ms
zdUgr9(nNYa1y-oFrHtjs05)&p0#PvQCoS9K(@SOLRekX0)4;2Y4&b>sy5M_DribO3
zPJP2240>*LATNaX(hm=?VE4ZJm$GkqpDQULRS$f&CVhdzKkeVJmM7cWFpSaz@y
zB=CdLQMCHQ{IIC%Q;0OupQB?;rAF|5n-d(Rd;TydJ;ipvjNcQHigOv0d8Nx3Pp_v;b(V27gV#)UGmK~7B>{}U4{E>aA
z&u{R)e39;L+Ui8Mwo}ktCCt5J5vktN@h^P$mgM9f&uTYp6I6Ft1_hPb72H8+wGtDh
zF$T(Y=$^BtYN|AMoR}YTx8fgoVfFSmDDuEtD4@rSlul2WL-Ij()BS$vp$~4HJS{oF
z)SdCfpfuv$1?^WV(cbba#5Rqy6oj$%$3
zk-`4{{$s1>tizL|)+1=gS>!!?6cYZZx`M?46c$7(EHQe9JM9k%WbGB0KQ+9QjtU_z
z(;-i~aW842GrOi9t+zDw&7|qmJ(KpSZ_`Co8^#_Lo0AnRePNzL9>;yv1$nuS*xY21
zSX-O5f&{UKlUi<4!43QL4{fvt6B#NB-!(kGzr$hu!Ylyh%rY(=^g{6wkxDjuQ%nS*
zE|?BE5@IpccO!!a6KVmg8yG74xlO&a&-it*@`(cyMk*e7r}kkU@|zb*$WxK8)_FSI
z`DA;G>=-%2&`c{iHfOgRYH*qO*v#ZsX-Mh3lq(n(>G0&q>>5Eu`6L47oKKmFJ|!8%
z#C&U?ih40m_SMw8jDz8Rd4*7r8*zYI?cA7>gcVIoeenFRaME4Ss(gEb%TQ%3e{(~V
z<_#~AVLGH}Iv!RWpL>Ug!O!C76v46+1?g~75^%7M`sa9^Nbuk28IM`|sgl4#+zywj
z_;j!6LpObFiqt1Fb-wB1W2nlZI##PEhctSW^h#($?2ayWJ36izqf2^Ui!r-^`q6YY
zn#id4dB}!Sf>dn-&6D-8YjU@Som9>0v>N2m6zrx;!qoE}OnNTuyS6ydN#^mj!zAKL3-*$UB^(
z|K9S@IHaAUT8~ZJUR~sSa-`(Z3z0
zf%Hc`t!oL7=6BGPu5x!5dRpJm$!H94bzjxg)T|5sQi^>4?gWmktn6(WRf>yRm1TLe
z+2*6?xH&C3X||5~uUbF{1saQUZ#q_!|K}Hl9~=muLVDwFg$N2j@7+yVS#;TF0>9?d
zLC=ve>NN&v|GTJN
zUHKT*)YQbfJen8=sfjF);|A9Z5KY<5;+5qdF}eCcCh9u$=|LTWvMxf*??xdS+DApQ
zEyjtksAjMy)L>8WKOE%TsXHhR2eO0?;Dx+0hg25k<2lLdjey6vIJhNBimT8vR1k+V
zob8}wZXT|nuyXVLH}K^|(xD7*I#`YLevI*TFXjbc^%mbFJw>8t$DaIcr~kGmq34m#
zIXYn}$csJ0M2ZLang`ufEgQ)@rW8il
zd_SY;F8JcyAI^_Crnq8{?;AnuK2LQ1j#FKjh_+=0Q!sJLNp>A6Wk$_IIPoCrk0b6X
z;6qVYBZ$|$90xU=Kg=A}J<8ckuf>ARD*jIzM%HkpsTrRY)l1^LHElLJmyQ%^_S5zi
zm;5o+>&9{&ggrn%6Uw>GDyC3LsW^kH#2`h5uSZTPwmWIg+d;nDATD*(Dg^7gXF|7I
zMMPxg-}d3}2CZBvRFGVbidyVFdZoL`@>GLKTwLOfLaL2;$j%-XTndF!E+j-s@fqT3
z&*>>X1$StK&!fp1Q|~C_j4pLTudv1|Vz6!lQCTXO%7klG*u2`G4Tt!dcES%v4S{WVM>=$w|2P5NDa_ZEo^g3DmL_CoQ%k
zo(Wyk6+YqCJFMvb%4@=pDv#6cbvkhDTycg;-%M7M!}?0eQ8C6>EgZKbsQqwoG%_36
zv8oV*v(QK-SKo}SlleazC;VzZl0rEr?*GQG6UjOv)kMEcaV);%pFdg)fkvP9?VXxG
zbyPCaTU`RZ1Z0^Lul=$(~4&0yHSC$Nm9_%E(gP)4n2o2&T2!MN`Z>M^=
zSspS%Lk&@q5`#ZHJFE*?n*zfP*g=#1n29)k_*5%&h$wejGn$_o?at4yeQS%Y%?TOo
zS1C}W!x9ee$fuSSxFm`6x+DQR`&_CSqudW`3~G8L{5jB>WllzX9qZ
z2|-nUvaf;*fS0uwwFn|TbIdi>82sI?JiKaBmz
zHn;i3>)z%YhzL8)AfSds8$KrNUn2Gdd7W-7m)ODcfVoN;!(i~_kCJV--S0p=-TpIp
z>`VJEaiF+cV6c=X)xpmEiJ=X_5ijg)C%t6nr>ksfqf7^_t0q>
zc9pYR?CzdzHZ}Anv@nzIV7-6bUWpO3lLjvfRu2T0KL-gUeOkV6^N^oIJZ}IZQJ;|5
zfUQAh=eY4#iJgU(a{WBNg1y*R<`IB89;2A|VwZ%!Bs)a`^g@Z5+ICI8*2h8NGbDc5
zW*2`B=vN%VuVdU={$98XL)X_fo}EWC0G<1-b}UYZ{u|)N0|F-_b
zp9>km1QzJ)yg4uS+niT}yY$8f1??=qck^Jgs}_&8ZY}sfr=|l@LS@N6_wFCN=0pN_
zNqt-Gwv9+oC&DgT_jCN_V2eVpMO@10s2TR#?39!GWuXh~038xAdG-_by(Xfrh1UPK
zZol)J{%e@FS-<}preB2ZZ^!1V%3Y{aA&9!?=G{;T8|y|YgGG~(x85CHUtKhs%~kaJ
z+Yf#@MoZuUvZgz2clqZ5^glZ_92HW^keG86Aa~t-c^^KUfrgw^1t{+Ya3pT;8Bc)D
zd1$129lNsFI^J*M3Zid^oiQg~&7(E{gN)zG_{%Bo6Whtb{{UqJsxVX-0c%1$!vPtU
zy6+ym7Go!%XWtdjoYE}qTTlMG&UBhVJb~`7e7{i`N`Fk*t76Q^^p3>%{j!$7-c-06
znYo1S<=@OaO?ZTN0s61685oQ+?rSmtJv6bM9#R2qRwB!iy+i&Rh9G=tKYNq;t#tI`
z^X}q*pWk0A>U0aV>$P9Ui$wsOtV!PHjw(14QXu{G?oB>8*SC5Bpi|2%cyMOhvX_@F
zSb>fJ|Lr`2pTp8TU7Iob))1w6`=K*-7tiSo5;J_zXrupY>{vhG-=sFDSY6ED3^I5C
zEmm3X$E8iio?)33{JLBX)csiEu3bBCO^Qm-H)pD9H3YDsBF+8+R&s
zfnhnX>VzOZ&PfEG@IEK*3Vn^&4Gat{T0JQEt|M7I`9w8z?PY>%&_69kTKHugUwIqeeve?iqDxThipXK>y}(>Daao?k%C0|&y3Z6bMF`eJ7_9o
zg}``eAizk;ywPI(>$S~|^)Sg0!FYd61$HY9f`c(%PYh0C&Jy
z7*g*8n51T`T0}S&DH4|qYVNd;-N%1WS`7FSyA>==_w}tWb{lz*Gb8DrURQ>+FG?h*
zy%?O@_T0zO%zVv(wRW*GyuS$
z;UQUBS|0nnG35(3#3h9xaLl6P;|;uXksK6fhjG!L8El%`J5q6A;J>CDg{-p^
zdZ%hpU~Li-rfvag%Ov5T+Fss-74gG`73}XKjkv7#D|6AnJMgaCf|@~$*qNEvX|c;T
zQG786I(E{BZAfTpPdNdC^cu9~B+>Dj4b@IHa0@s4FXuv|z`q~yKbk(RRQCf$^Alp<
z&^5FYFNrBf0esQyQu;$hm9Ti_jmGNfe)wR&8a>u_kxvT$b;N{q%$|4Es1kJ)?UqXX
z#fD1h!i*#2ZV&E|0oIXmTB%jQf7#UBTuQ3$@D6W3bh5RZQIY(p$fX^D6lQteB%j3)
z5i~khUH(kR@5}3Xz%y0+P~2rK^Aw&1;q@Q9k6_}r)WSbMK;{98H;_S0dC<`72pw+F
zFnJ3hH^CKE=t0nDhQP%^JJuYpOhP$Y`~FFf!hx2KIxKf1Mo1l4<*I^r5Mli5)PQYE
zM-MkdVW996W;k%GvlKs)mlHn6w&_|uz0y(b4y(q
zIb^S}CRP8-+5!9~klXt&YX>O2|FU-c|C+TUV>Ea~9vWnzDZmxFG`L1D3W
zC`>^gx*UzV^KRe1T^DEBu2BoTPkr8!f-caxdw)>3A}TA37byxNeZdHW0a6M~S*H9t
zlhaIZ1nPYzA-@5OTYR1bu4%-)vBzc?erj>zz=Ab=k3#|*OI83C9vne`)r~Cy=8LxP
z8DcEC>=Tr%XEv5wQFzDg{72tEZIOT_>4ttTTNkol+&7y$BSPenLSRq=z
z)WcobD4U6pcPLZ=!op;ZMSzkZd;{e6b9Ly_Q+ma~XK}(25R0g8`$cyI49K!7>P@)X
zM}>k$YIL6jUkOkM1U~yL-I5Ibwvky0L*2!`DBmVSN_p{AmnFL_pGA-d==AETP%`h3QiWxm_)J$vo6V;uA6q_y&)
zJ-xIlz2hjtJ@>^TZ!ri^pyG$RbSs!p0Dk(y8=cxDqpVCO)UM&i__q0uWj2i`Kbv&f
zc;4!yC-BA@$Hmj5g6xo>L%DSgn@98gG9(X3T?epu&RebvwDxEKyfi_wMsW64pjG|N
z>6ZKr4oZii_Zh=ANy5?twZ6XY~3;9~G{iT#lq^7*w>iak6zKlLkqx}-l!BrBU-tpR;Gl1JfBQ9&?
zBYK{*o&98<|2htbHVee)@;NKz3?^%}?@g*WT8iCRa=gU77wlTUIoBNR5p{|Hz86+9
z?-5Sp@l;fhd9w>KzSyN$cdoYZFMMmz{!_{d5O8I~OwB;!UKi7xK|d8clMd4wfp@bt
z4hzXv-H4f^svOaC@K)29kyV$AlAi{?&
zEW{vF6KT^UyJ%}X2B<;z{4NLEvGmQ2+jV*N&5HWa7K0>-G$*Nmc?4;Y$(VjlrjeMt
z;CftMDdyf`Pk{vm{;7gJ(;K#vB?wTF%rN6#^Kk&@oX%wLW^r7uIKgM3|AQCg1&wEA
z*4wI$@B}T}@l0*~l)CGRnAElqgim4v&`e{%7xQYODg>7J^(Fi^rqsFmA8aYw`W~13
z`8s0)jPiK08xRkFzFC=NuhFMV9mebPKLFqlE0|iwOnv+Pe6I{bqLESi%{gqfdTLK_
zVy%lg5GFHhej`W`)C7sI80)uEZJwaH{_=&>o_$({ABg3$zLk>o9d=y0f?&7TX3>}r
z;Pjt!*svxytG&dkS^lQgIL!S+4T$?JOAZl&P$W1#j>b?bvdZjYd=@XgUkA4PB~U4p
zHb@FlK#zn%&MXiIl$E`z%QPKi?3o4J6>n+Y+C#u4okJt=(ph`%dzVQHzUn7e4OsE`
zXZs;4dV}@h{W&lwx{;Ee9D5JGm?>lH+yx
zj+@V05I8b7AZGgf^%C8W%d4;wpecN^9_G%79#lZNGhSF2Sekw}oHd$2Myg_UZ(#y7
z8}SA&qUldE=9HZ=83m|RnFu9f*ot-6S1~~JLxoT)b(7ob2U>0{qc>JYwP(W%x;Igi
z)kR~JHJeV|M-=}^B6{l8y7+nn_x&ANH+m&i9fJpYO!4ulsp`tHIx!z2&RQ_RAJ1Qt
zNr~{i%5;rM_UibXt7qJ%vL~XtFLvK#d-dge;1?cKwHos(AKt-PYu}dj%DKcv^Ub-W
zigMnQ7r-20&J>x1bUcWXPHfh*Hye$2n+(15q*u9n!vcYpn34+_q_4JOG)92&qVcxK
zwY&zvSaH5fDr#p*%=*}hkbt18vqno#JCjS}+#P4V5z8+*VHppAt>eyz+-ytT-8R-&
ze6lS^9z>Oty`pKiuTEHR`7*4F)G_t2n<=S7V5W3;HdAzXrvOr27zM!OcwB$_Zy^WC
zQwcp(Eyq($zQU81NmYmt=8BlXlo%P5pQ?omv}l$BeqKhfqFSk~WGs$qu
zEQJ6!Z&KnTpJujSPp<(~hmxIcRFKkVwedq9vb+}d{S4}K6v^~`Lt!5DL0=7Xh9i#_
z+a&h1zBt6im}qa8JuW&lITYr}ycu*Uv$+s`P#yv7p{qFC-&E`Pm{ju&zM0S*bf;AP
zeBUQE=~(MG5%SwvE}9v}hBSH(Kq25mq%y%V**Y~Qm;UW}M1{)etDtVdq$as(K=bnw
z^32uF$l4w%^`Ic@-e^wO=w4rN6If^s%Lxc7CtRBGs~|s_RPjmGwx;ckV+wf|l8uqw
zrY(sB%KWjX6A%u$E!*?Y4_Rr#GhjEX_$)S%gLD`iYzkWk7mm&Ko%!z?Bak&uSnZtr0N^4fkK}!r8MlM;YbIl@8ITR6
zDN;VU%cjqrOC!QZo*A4oH3uHS*>^Q5xG$AR&*mdUW@5(rb(8|41^Qpk`n^0tbG=eJ
zo9mp!OFqMVfjpbqOK8yKHK_@+U&Znic#5b>J%S=^+m?YY3bDyc<8N6JzKx_ofVt(F
z-P9AH1Rt-}sM{Xa-lErqwv@^+kB2$G*Hz)(v*QC<-3KG>huzd)dLkSu=8d<<2|Z-b
z-I`T4%H;@loXC88;ofBg#n>OKyB9+!@ZHM_$bGaA5Xm*?0}+E*dV;rvVCGrwg&=PU
z*TW7|PiEJ%{ZtE*+S?|LGLZbce3nm;ZI^Y#sH!qFke?b$8%;py#4tm%H6fakhxw<3
z$>*99({M3gZL60B-;(Z6fohm3#sA*g8)hvJ)Z53h0m((D{bHvH!s`LX{N!lfq&>R4
zoB_iNHY9&}J`q)}Y~<6UaF#q3pwk$`>`6f}apv6buQR}p6g5WJc+q_xe5DA(8kkf4
zWQ%tF>~WPVH^c5AEGpk-^aD0q5d~NQ5uuq^3XV%tGj^k|3Nu(T2e)fly63yY_~&t$)0X#^Z(K`lvek>qx9$HR|Li
z8$f1?T7H5x&s%!N@<#Y8c;6jb;&SRJ_Y)ktjpUtGU88<1i$U70I$`b_udb22>#IXp
zdYChpdY3+v<`LPB=UN8*Sn-S^LUi+2Jq(aoaaQmmxI1#Y+DlAuEjXEZGrILo5u}hf
zZpG-o`F9deSO#2S4)bM-9f~-2FX3iM8|#B#cD^%#8K9{r!1pGo$OAMiASBL*NCxxs
z2MnE>=g+zZp>LaW~0sV
z;u{NNXVvwM;MSd%o=BD3!E${*`Dp-Ks73KN=X`DBxcVyHqC;FS8?*_6J8deM&g%H7
zma-YohqS13ecMkKdSB6_F)ySJEMGE`32nFix<7w8Mo4e+VLy0L*Qf
z=>U?dWAf|0q$Z%gu5a$%GqB&Z6TCc=&(j#vCr8K(6}l?E>QBEvTmnp3svCUS4ivyE
zf}!hPH?-^7L-oRl+}^AMNFUC6`I@FtD)t?8(6s!N4_`5vyDd@z{5d2vA|7@%>aRpE
zFcuk)#^-O4*KDkIZ+eUorxk&S0i#fzmT_F}UIcHNGuP{O_EyWv#M%H?zDqLb#V}A^J9-5t5dPk%~V{tKT7v8950ta6%_iS9UQk*(KA(zIq1&>{E
zKE$A!{%|a5wi@v;GZwN&l|J*evFawW*weAyxP8Eb!lvx>bb9_elY{Ae6GF-2%fkX3
zKN(Yx33}@*nB9DUQOhGM@`3GQeOFKGO+edoby}eUK>?tl10X%_U17pOEBjI9ZdWFu
zwQreS=tK$&g_j6t2H@A18l!|dXF5)52Oeoru{TGU-ll7>94>JHH!geAh&GMi_SF3s
zdfA?iIXM@h(9&v~n2T`YJs1YQOd;ShG+95yb=8wnpxhMTEiVy9v0$rSmyZ_Yv1ZTs
zCYJj8XsDKNRPfM$gCoJmXtB~5HNe1a0fd2Xgq6;o;Nj5
zdI8*mEWXB6^(fdLk^qXZjOoREPXOOukb_S0q&v@vlG_zl948xPP~PI4F8>Elm8dae
z_AS}RqA)_0xMWz3DOe5gkotgf!V__F5qcYh0q4NP{YQgOl=Y8kyqcx*aZ4b
ztdmlN`p1p)G5h4i(yK0_So!JtC{ckes(=A!RIT8SuidDBp
z00k@!o{3ZrR*dN#52t|}@pMAQ+DtvGzFHv~z`JZ7{Jk%%;5(?~Do!_X&Q5j&xBr&c
zTsLs~2~{z0-l=Dqt1bim5yWT8)jqQmu;Bgq7rlJIvrlk2_&~EKyxt_PUQxg1c3AJR
zkfp2qvvUp8Zm|ij&Knzx_20$=sWvm7b|&#DjWXY*fbE@c12U!$mWgT+t1acRaYvCL
za9D|CGLMW@{ozdrP%QHvqn7!+RI9+`kV4mvtQ~mSsMgx|)8(;=rMVEbKu+VN7~!cq
z6E%Q1RwQQ=<_vY*WcCJpO4{?K?(Bvnnc_E-h0au~h
zq{CwN**R~gNb(j{TLUC(HC@h-comrFMDOar#Z|*!(ucZal?H=?|2-H
zHppLJh`1=9$CX~!m7BuF?K`?QpXkUGl*m@=LvzI#Luso|{&1>r_Mk`q>@f%y5r*2M
z4z>V&S4!)GU}Fh*2^Aj8&ISY!_rG<7sqP8Ot|F_MLe^lRKW6Mbkg~pf$Az(^cT1d~QkOaHNq+Lec
zeQ6(6NBwT*#d@1~>-8D&KyKD*Dgj>L@5)ltpP{_J?^B}Pd@RB@lyb{kb&z?ptwwap
zuo9ff)q2V&g-`Zjo*d?v%IaO8b)j{YwfIuO=cCOF0*lI>Z($it84R4|^_x79;|Cpx
ztJpdag=r8wcX?;pX=c2Uv)ppxfd^{%k2OHd3(OlF09}xatWH1yo0HqYi4@9{pUVpr
zJP;ECL^vBq2GxxV8Ed}Vp6vbNRRWtujwC{|)A@vKAJl|5L`t}eY)pF|b*-3{#W5VW
zPM@hn@~`TWf+uSPHtiTWbfkvA`s{6UA1gL;}KjttlqHfc}mreyW^^v#WbcdE#dC
zScIQC^QEGWMF=*(2CgE2s!62bA;yD3`7%}QuU_mzq=Bz80|7Jk!X
znd*6RxD>c$j`jiB4rIdLWG|v2@dA-(+=833lQ0m>vbJC=^g3OKvZdbBooU}y@!9o^
zv*t^D29l8=Owp%}=a
z*B=z{&p|;F4h3!%hg|NM@4v5Y{Uy``WN{?=L>kfrAOWHG=v93&YzUItd+Zpk0myu6L$oSr!b$Sylwh$mlH1pOtE1at@yADyvXZ6j$sFx
z2|FW8xqWjyY?c#J;nrIq>w(laJJSB2EZ3EZCA+}x3)fIh6^2-@ZRH|HZop7HT<jp+CxDq}ZJ6G=2KM(b7xK;W&w7sW
zF02&0peyUeEaR{69zsS~d1k6tjOCi=L?@J5PeO_Tx|q_;$cwOIUY%^fM#VbQx9-r(
zDO`kq-*_y@vWxCdc5h@^DFtkXc$+^RPc?xj=A;W-kX7U_8i@lAU}fG7c+dE47AGi9
zk}KbTb?pNntM_BoQBtH}hs`v`K7dwt~}m
zkf=CFR0$6FQw&lgt~WoI?NznbeOEDO)$mGiO=N&r50F8QH||ON^cg=WE4XAo;|t;E
zB|zg!38h2&!X9AEj9a^}!^kHtmj!eMOfQnK64ggXf;#8e5xQRc2FGVg!Qy1al)~Op
zHeugQE!w0t{wJC|Gm1}ybMX=0&3;15(z4Jhs6X(b==6vbsGUTK7@yobNnTN{0fZe8
z=&W%~K6FTEZ^dD?eYa&*fAJ8UP9dwZtLY6E$=edjDq1h6PY0d*C7+kj3;EP4oKqE?KXRfMScJt!Y-lKb2AnT8_ok!sqx&s2sWqRwt@fuTzaP$^_p?>kceeEb+ZR*
zs$vLQJW_cA&b>aoWsgI(=sT|N=?k{ntU;x^@AW0Ht=UKLUF4WA&6B2G0WR4(lPZz^|$L;3&
z=Wa!#oS@SJJ!S|bknw%nvlZwFLhLZ`TegDGoyvkRlIV}1(Pe*dgl+FR>~b1_&_OR@
zTebpr54cO;@7W405nH+gTfw#e2@;DCaX+@lxrRo@_V*z%pdnUD
zxL=PI0RruRzXP;C07mm$X#elxQx1UQ#nSx_+FzRrhAC@%(D*4t*iC*58dn&CArtHX
z8vpt~0*x2JT`0B(jYlKobmG4SjVC~7LUZc2aOBzyc#1oAio9QP3I&%TTvZ<00geog
z&F|sJzsYV0i^KZs{+1`h3?Y?B`14JWzlzdNz2H;|o2}RJTLuP_EMQ=`yaNLRCyeH|
z3=Bh`U>lsbXJF8UoP(UqZy6Z$4j`{!LNd_BfPsnn8^`wSBYYX*
zt3(g%KaHt`6YSgQz|cZa_ow3SreOuS{H36ro}IpM@AFeDc<&YRUea-;Jm^|QkV&OL
zh}%A&6$(qa?_17xygq*p$|->vtTs#Wp2Pe^K;%1tLy-!x2hwna)IhR@XRWY#
zygweGlMfGAjpxUPQ237^IYk~Rt8E3umU`1HA(fztRour9KM3&tKF2@Z08<30z_;CU
z{rtsUk{{L^f~(Aepi(XEs%jLFRNsX42-z0XCx!6Yo%$`N&;6Wni>f7pomBHSI84rc
z;kpO8qWAwcJrvV_+{81;E0YdV@TNp=55Hqa;CIP8!|!0dgc+Rj*ZNtIWVOFP((A_A
zZ8z(WaB*Q5r`j=4PE`(j0ftt$)w~ZnLQccKcHZYb%Z3Y6<#I
zpLhC5z`rsSHa*uMS!3FjhQmH<+aeDoIt9}zj=@adeft{&ghy9dZpj%np{cMW6<~Ds)mGQPxM7*yZ-!!yyn0J$f(}
zx0LN_+e*~T^5?H1*y-eJA>H}b7F*I}>wMnbji=;X3Yihb$6PX9HnF&6PfJLMT1JED
zry6A>Q{((7ibYS1Ir0rv>Cvq3JNUMR#?&q!-V{)^$frjA=>i@bV{^8A;!L{09-ots
zDvdQG$U>@71j)S3SW@W1cOj?EYPrLUVILLX;NO2ly$7{?(WE{cf!5AVwj|;nIEdp;
zKLw2>SNDFQw_MGwMqXZtw1bn)M=ywncH*4eU!6Y-g>{!}*_NIF)w~Auk78Dgj?kPV
zK70w=PVpjqlgGT6c37KQb3FRa(j>kHr0fL+DUW+soP8zO_c|p|Bm9D;@X7;9q_UPX
zXy6WwhD>ts{>=nq6>aJZl1^&^R$8B*9wn+qI{lAQR^+dqBtJ$OK>Hr+yGe)sfO8`8
zIPD-dmH6jb7H%Of>rt=>eaDKrK72X(2B>IwWsrGQ5wENa!5y6YC%r0HyKKNkoNv-8
zFUp@OXJ9q|nlfb8O2NI=3qW!Nq7bHUXh=i7kpKpJaqF|>Sm1BMs$i3vH2-|5E_OvC
z9C{mn_ERgc
zsp6JJ0%tr@#Ei?|SRv43Xg*szj00($|A)Qz4vI4A-auDWRK$cJf+Qmu1<44^u4x4Y
z1j$Jmk(?xnBr%|*!9)-w7!V{nAc$lU7$gcv&LAK`keuP3M%ne-eVN^=-&eQpt@`}S
zV$$2EyHB4!=Xsv<>RaRCOUHnvE?Y~idB?9!63^VX1B;Cu4%kxuT5<~%w{EQlQ1s3O
ztE81f*uS;PWE1z@Rf$mK6&YACdkkei0nv$qJP&@rhweOd9=Cxo-d7zH(HYpLcJdr1
z`yPj)~{;Mtux
zABQaO>p!zoIA%1T7tWe`{Qb4%zl8InIOmz19USFu#^6GgHL;n?pHLxnM|3xq@qYZI
zAr&m<7aU1PfnIZdGuSf#%bx$T&iCg^6oSYgMhv^Xa})v)(UEQM{P8h5`~IQ5^S`UJ
zLoMw`d*>jqRP|%*_Ri;!gP|hZ-q}zNEYT4a}a9pEJnV)^S^_)
z!q^)19|7b3NAs4e+|ZYC2UInpif5Efl!h`!GI^Cfe7u-tTIK2fxDhXPY
zsZ%I#6lZanYF9IU8KDPFDAYf`?4EY1L0v{K9+_;iwt~)~d4RoJ5NiPhm1D<4XqJl7
zw_WK?jR6n~PUW#nRgBc5&T_ue3s;^
zX&?1J`zjRQP;e>u3zYf^s11v{L5On9{*uOPV24d=f|?i+z{i{L+8H&QlNhfpUyq{*
zIl1czXMzM@-ZX1q+-3UeSKG}sZt98YYLxdAtLhLnf?-E69D~sPf!7MsU?ez3>y~N$?{8%s8i~NBLR(S0k
z0k#ca7BmY2OqP@yg))P%1mG`G+P7Wk7dLabYiCt#2
z2#bcg35I%rY(x6Z_{%;`vic!&1F=bET))N-)zE)o*1zxcp^wChnkP+}_2^46M3BK#PF9y(1Vh4Hc)SenA7DRmMnW2Ce){VY
z1wRZLGepS-Qwv>+(+K13f81P#ba?AvyLf#-OH#Dc`>@Pib40U}cNuxWD`fIjRJvfg
z1xTzq;*F>)nSM*T^Pn~V<QA+vW9-h`t{6M5$St`anbr<8n_&<{2ARW|0P@pmd=8v2lxRo)b?H!
z;S#|E1Q|GtOjC~`BGUdtLeLPMCZ`W-LDTloOVvkru7iI6p%kDE=K-czIadya^WZw(
ztjQ8spMvo7z&2JFH`v4^`s${=K-7aLVbtvUb=;&2x0zLb`%P8bR(Zn}{VNyR{Ng(hI2(Xk_9XhIl$U%GG+c3PInd_0(
zoydZfTmZ;;&r~PK
zWFCI}1}-dqhuQ}4F5XGO8Z`!hB<*r(f-Y}J*{O1z*JKjb*2ByM7*CgLPe?NixG1Dl
z;@+Y*!`s%y$;AcT$CkMp_J0n5LN8nQkW)+k5&Ig!p^G&Fb!QuDWdeCf=v<&ti(d0-Bz-`~
zk2!0H`o()Ar?VU(X%`@b@_;nwi`W#hg0+bRXckAK7Svccl(bRRz4)?I=dRW}2ob-3
z%(@5}m+cC7-_C;yoeISz
z_415^ew*#zzM&R!`Erz%YqIPMBOFKC&j@lD*W>UQRPPw4k|3unREl<^?CiJqTLNB{
z*k{i+SLz$-;3GrqJfTCW-`2DJ!$e=_*qiYLXvF8=R%Zd6_7PM4*P98YkHwOXgt;YA
z-%vhbccUn$o-^_>4Qx)^Y0>oG^x30;GM(2Klb~~5nqkDqSEFG9SHYte}WjFsDR4A(OVs(s_u&9wtZCqZLLoEcqDcmlO+z-DAHtI!I}dndLx+oy21ZG&fR9?C5t8qSP7XQ+Mq&1CkW=xodFg$`
zg!02k>%fTsW?;B=2Np`GF)(Z`zINVDq*&qng1vh`0Lb09X#)Lfv;LIK&ypOE2&nngAD068rxq3v6l
zW)GTChNeJRRcXs9aWz>eQB#%DXXGt4mp+HdQ08Q4SH&F9YE^?UXS)rA5QpwZ5yh(g
z72={31JIe7=9eJnW|>KVR+uD%{y#QW~gjmoh;OqpbJ7;snU}`5}5*+0eN9#-Pw`<3{
z>6j#d(j`kuLg&~p93tu3?vMsZOlkto@23Mt-N!2r_Gf^r%ToncCme>3L)znFSJ6T9z
zEHGrOfl-$4?Zpit4BAKG9%AyTf)gV#VPgxSN4(C39y0oQQIAk$+jSu^U6BC1(agD7
zK)PqnN$BO>2@0{**=_-(1Y&oPNrA7+*fTMf5Gm)Yy-vvp!9FNoe~UZal-c3)y`&?-
zPhzPDk^B8h1xLu<+Gdy$8T*)e)b;%-$nbS_QeT43@K0CEPS7r#k4f)qXqQ
zODy7wd1!tKCP=sCu&6L#2xv5-y@B=ZAKpBG2Yv9>+=ErC-8pyMStdGBVC
z*+R*#mc%mk$pLc}28NcRcznH2KXh#k1Rhjo0f>E^=PyxcfoM&f6bgQr7I`utfH{du
zgvCL7+z7e)cYHT&>*;t;_O}5An^{Htg+6;m&0dqFIz2DH)(;sb^$tAge#tBhY^M+Z
z7dC>L+B;&An?Tz`Jdk>YB=C;xWqc}dQ_!g|27vpaVw0sqG$4K;aQvRH)4mfvjC9Z{
z(g(VfMt7lG86P?l9&Xigw{NJj;?Zq^W`lZ}<27C|mKZQJo8P-v)Dm$hAYtF&|c2HS^mQH7kDRy6M*qyG7OV4VCmof0#6Wo5mBY)NNuo%
zzzppGtw8G_586LG0}P+O3B%TsyK3(F0&4=>Q^6$}#Cm7!g)qvY*UsOzD5qxm;xc;W
zt5BJOT1zmsL)Sd;X#o_lW*)II5_L40Nh9@8EQnUhnb
zU%Fh+vo?7%9G0f
zn{&AlsR_y_9I2C}7-(gKcOP{>W_PC8{5(ToQMd}_8@|-G>xGuup(em?I@nXh$O??u
z{T%j_&GrG}u5hY*Lb_TC$*fd5@NG)MYuViib}sQ9Ms5;G+{hYQqRy#M_{tiXL|rGH
zMuS^Rd+!?9AhLe^*^`lfyQ=}kp&C+EX;*KB_$~+W7-9V-ijZwg$cxLU
zz94v`p64}i(;;LuJh2xz_rNU*Zgmk|^8+c#;PW4zuZFaRhLrpp6vN*%5;)|yI{_%;
z;;7@Y8qimZ4_o((+Ck*+cdZioJR(A)76Wb3E5$M)$Ys-L6o)HFjUv(*L2Bkp;b!%)
z*`}VNCO~*`EK1zaW)L-zw5!(-*ePn+rj?$m-^Tl1b-D^Ldx(#Dkv@764lv#-q`)IJ
zLG<;@IR_}&q8>P%7Jy8Y52e*z5bWSLob8ITvy2^oE3nlsqz#o9(-QQxx$rvf(^{0N
zBLfJJ)VssqAR7(>h}4(juv5{&EGoG
zF{`o0Fku*^rL`!mI!V3EI<;3av~}-oXLqc|88X1!C+t
z3R@^_{92P?vxM8|6c5_gd+^n^0Fe_99%A6*kY7L_%DqYT>#1T@0!pA5-+khb>o>-K
zzJ%ipfVR2j!IKz*H$ct~p77pTaZi>0O9=I+BfzSUu&#p|eG|>jVCPCFs5a}@CQv)*
z7rv0(n{J@5@RCNV$X+1to(UgFI}!V$V^R!)q9q@^dl?z#lD6iSfQ`R_d5oh<^^Vwz
zW1|8k*K})QZ39wb^I@s$7{4hK?|+z6Gk^ze3Lu!-T{MX)U`Q)YzrQ>7tsS&Q$Xf?EU1!PnFdfEA;Vl>gN@Z)Z$sAarCbamLsz%h@rukH5mlH|IL|
zz^2)R0=u@gud%8qXMoL9v+tJOX);gMxABvJXbO_6K!P!(7xqZur2Xdhh9jq4T$*ib
zONX0*;j9Nh-s*LS_Cnbu=p3wuQyYisFjfO2sL8~>qq>CM(CYh;#`h`|x79)3v#$GB
z5rDexl)P#a+zNRI7b^%bQ>L3ip`~wKnH*T{V;gw%=OMVmS*IF~#`3TkA0XgAhk8dD?ln+scG|9f0_l*`cgTQl_
zwt<`ft<|J5-~3%zoE(T&K^APK(HDd*%c5Im?}#{RK-i7^%w-Js!uJ2`QiQgD
z{tK8a1#7TI&~{C%RpZ75_d4ZO6|^hNGx|&^G#IIQOkPs+-%;#g1M?N@AyQq`Ti89N
z9=upfnQWH!hrjCvNS;Yqngo)M0+DXab;^h;WZR-I`jQ!&Eo!M8pikt4h5ktk-rt?K
z18aYUQ-McN#tC9vf0ut7XN|U$L30SoFs`)eeV{^CvtBvzDe0mFqOTaA~p4u*-2e3VS{)P8?qopDT
z+Xa!T?M6u8nqG*~e6W1}{&e2DO#{q5SeL&XBewq|;+WEfBV9e=H}|wG`@WY;0!g~&
z*_k&pxK@FJr6W(M>%#O@C-0j)E|7ZB-6<5^)rG{dhO5Hnc~B3BommSr!)*W;SQfJ)
zLJBhP4Y;2)4YJMcm-cn3;(
zG#3KU4JlxLY0Y*;GK57pd#~oc$)ZDvM$?Rn6Hpkm2Smfc)*dElvB{>Xh6}g--l7hR
zHi*h%;H8O`*Ks4DLdCIC335-nAky}5cjTkP1_b~)=`4jl2CC(uAR{X)>{kwt*Z~!1
zkJ-U&X_PIN-NblKoM1K&1%Cmk(;LUcH*_qaLh?>MxU_*V-v+gA5h6e{UPFa)i|bDA
zgx88rS7PFpuro+c59wr#%tIrd4hc|wf||TZEL0SQ{F2|(uqm*D-Nw(ZOaEg9{Pdr;
zOfY=Y)|Dg0RTRv$AFWJPQV*Alb4xA0Ezgfh$lL+h8Q-&xgJQP_Kn2vk#etn5-F}mX
zLet=DvS#RFeOJIqw6m(ti1@(PB3Y4Gb^#jLe0rggJ#=TIdD0ngCb7gD)uX6utT?*=
zTS-`8T{%BGz@vv4nC)Nr`P}#pu!&BzUcW>lo`Sv{hH5{bp2EBI8x(UK>-Wbgt~Q8LY{zrGFvP(1`wT8q{@dX7`(HpDurG;U%fE`E}BF7N@&K@JQ_LS%=wL
z5?|`KT+}USX;+Oh;3RrKKfojT;5m4*!QQ;plwe`QvQBF{M+m36KTL#sdM$30i1W9uj|Nzse+1=B-DYYSKr^`3>3Nyw<{R
z?>6$O0$75~|F{G<=azOQ10o{k=10gIGBu~!26w(hS>LXt{r+lC(>4a9q}(W6S%t&S
zvtZ<{aOa!ys&ockGr-Fx;Dlu95;aH$(e&JNNM&X5iGNPae_CNiM&~<4Jv#d
zM-K-_|DIbm$Ss!uw6o6Xx&v0zC%0Qj{70dVcf~&FkdZ^^thC?gLXd9H=s_6e;-wZW
zqlKehU*fGzp5J|Z&Z5Ck*|YxWzJf*9Ai>_d!o05^UVo?<{_UCJ+4HAd*FQadoHl>M
z)>XeA+ZLHn$RV{yH2m6~s5?);v0bMUDCC%7(|uBMV~cWB$wz_4%KIrs4+Oj3OibA0
zHGT^|Fxk=)JS%RZzp7Mhc3{5Y_QIqNR#M4r)gCscU2MCI7~qlAj;?C2W4!(r11tTD
zTQa;+lY2mij2#YbU2_w^`T~6%vV#d9yx;n;JXUf_!DUsu+H`3qnRamJudQECqAWb2
zfl6C73OLae_w(kMD<=-#SVNT_KxXAouW=h}SJTwgz^pyws(7k50WPa56upttoT
zfr$aM#x!>`y~lExzktxgR)TUaUm!Upk7}ytmZsAqU1E%yX*NbYW+q-WH8qATVgk^<
zC)!T?z!Gmhf&O>b*6fDL`<-nm5wfGF@Vy48&%?)$cNbe&1r4`icjP^H^O|Mso|Jd{
zu=e+ltre}zb_?Ij9wPogj#+kCElm;UFSkc?p}}NZFX?zV)f(jR63Z?>^AYCipUv>b
zxvo{D6;92P+Hp|lu{^^rDW@xh0>)jttWW#99AxTGNbJFq72)uQ2T{9UK&E9;l)4)&
zA>wzQ`R7++)c#6(q4bX
zMA*dgSe|~Dz{TGePF1KmJ3B9I^BE6rz|v`3Pm9*TvC~JfY9l}V{P7VYT
z)jPG_2e{|5gl%Kfg4VEHX>&6)GU6zKF-%uIFI8o)z0fhA*iQL($wxq`gb$l6Dd=#}reY@a$^Md>!65f1p08SfCw>
z`JxBpL$&l{HVd
zl`yXQ5&KzwtT`2$FD{9JN(D|V)dvm%ZpP5ejJNmo?JcYDOZlx!>S*b_Kh_x6`N+{CQA^8luEZkyyWLZhW`
zTw0HA#_56xycgdr9
zDF>bqL1Ejza}|L@E2(n)3oi`j#U*ce{rYuYta_5(yX$M6gJuARf{%$y@$ByImXaLW
zy^?*yEhut{S#KRY{~R^e>47hP6ZM?dTzb>1!5JdLy5960B6M`V?-?my_Q$?R-QF`1HY^j5Ol_wS=U
z1HURLvwDT$xjm&?Px34>Iz;|kJ|SP9GSO&^br3)n<|>3Y)k&(C$b>-PirqZ7!_nE~
zAGj530>LbWu#;FV77}#ki`DbDKXaMdjtoI1i
z(lIAnh6|iMXTrOc4EOy*hhBmCRy(@J5wO1{8g1T8M}uziPovfkmPyW9yCQ|?D(zOn
z^dYiy1gpFpzD26aVWr;d56{8FDC*o;(Qr!-dH(!H2;V0bG?+2%vi@8Gtc9zSWhLY-
z^Qs0cW8%E=^a}P}KgPkvG05NQl6(xiu~>uA-$Sl)kR64$+rLiu?f+wssJJ2S2I%u1ieS;0{A#|2RmjLbw+KE%n&%9aEP
zafcnM3E&RFr2y^WxV5#lF3aSKT%E(l|#%2U{r2VgiE!&aKFdhPd{f{P4AaI-6j^jfeC04e2X`wCb
zh2<>t)3Yu6&OZV-w44KS9*bFbK!Yy6mxYj?)q^#$-}&}RP6ihTMlhb=_{xRsl2~uE
z9a2gscyuySpC5p0FtJKb!f%Xu#Z8e6_xqUfgE=!~c5u<2Z@}{M>yp&@EnJ#nw7b*`
z%#l!g6k7U4^|uJk7XZF#7J&p4TDwkAm}rL2PG+U_bj)L}fG<9?E1$oQucm(hHn%;y9uUwPnx~P{Z)5tu!
z{H?N2CWV)=06)(|csc}>lUUQS?6bpvhdjc8`J`F-d+s9CZud8$rfS6V@2<17KA?C6
zeSoh#Q@B*0sBa>ejeG_0bS8wZ7L=~x`ju^7`r|x%=_#Db1_}ITtii|fz`8i|^Yi@a
zm%jf#$93FpT6FodS>&8^xSAgnT6pfJ5ySNy#tooC|FZp|LA>i&3@U-xC1--+2cvYT;G8DVV`+0gv}rSYH@K*X7!op4xgf`n@7@G
zEud?e$(;AP^|5E%XuUQu3+!8L4!vGPi+hopXvrA%fK<~xctr&3dAQLo-;QOsWsA*l
z-le!s>m3p1e`_PYJ@;0{k;@l1Z_rv3t-K`ULVKSs>#K4c9x1qpWcHq^PCGYx;G>Bf
z?V8B!9(1|8(ch1UK?ne*;~bfBbx+~%8A
zLeOQL$v0wqp`z#kmYC9^+-Qu4IrkKvg~mSrF`0RaK7mpwYl0xoccMDe9RBN4mg-Tq
z2hEo_+-^2mw~I3^>AJbZ7Opgl@b&2E^G`|655Hq*Y+N*~cJ$~`DI-NuVFkN-af}~1
zmkkdvGx?DUwnM}wU7jm^2kd(tmj-}Q6t}Bj0}N762vh<%~v;)In}=;;5-XdHj^MF
zNJX02*gqY;m1E6C*#JHy?UN5BwivyZ1E<1wQgAZK62B!92!`h7WswBiEu_cdD%ARz
z$&!z{a7wzal_Ybcg-2_CPfSTkahmbAjJ+g%J4pKqRbh>;>wJ)Q_O03%U=kfOBM-vF
z1Y*g-<54qI+I9q5#tLU|jKPTR6pUb~GL75*aAM2W{mJlAj3@;vZfjK0k)KP9u9w^n
zhY+rHEmgakqo$^+sIbi!g?6>pQ<7MkRk#gs^VyFR+K09KzVADn8Khy2@nLcIVgIkZ
zAgfm41b7(?f&FBjOC1f(>;d>y|qkGGH;5YXx!Ue;$Vf^JAqsH4x-zP
zzB=US{ZKG6#w;L>72@0nE8G9&YyRUG!hI>a)|0M!7Eo2u`How4q6pW`1y;_?hA&8w
z`fp<^f?5do#-xD1z3}H-sgJoS-p0qkcZT}y@J)X61`(K8d3kyHL5cuKKTWu%t0sGJ
z;RP^>LJO_Z-IwIk{u_wU3h-d=YVw-=ros73e2Vr9Pk$DO@;
zQ2!{(mS;cP4C)BOw+=e(USi1I*|t~jWB9K`o8HR!?a@^Il3fp#mdJR|2;y9d855zC
z8SG&?e)0851|$%6VBpjV2GOyMe(fPoU#HJ|k?O_VtPMqtFZAwA1$o4$Sy@sb{&>F
z&<~E2K>j|wFjJddFw#|w2Qu^>AS7}RLUY|zpqTD)K&xrB>xIp)_EV84>)bUq|9!sP
zRzad?SNJXybqsH@y#6BSIWCE+cpJvP>PX(^3xXo8UO-Da62|4<5es6-J#{gW&_-=W
zMGK_Ch;UINK>%XC&;RKQL`neJ|G>^9T5m-B6gwd?_wD_&h=~0lQW2K7Nu+6OXMs=g
z`xk0PVa^jD_|<0&JYx`7pGhHeZlst9m#nVvJ_K7iGEs-Onjfzv0VS=)X-3`A(UHmN
z+dCxd(-+)54)x^K$HDaO>Ow(uG_7AK1f64j|b^e6U$cZ^bm?+Qpi?s<^ACn5whb0}8|;
z3$=_-k!#I?&VCPit^zaUB>Z#wc7wHq#mM}F1Ei)MMBCMR7qdp(JHUT?_8Vbxk7VGQ
z&FvF&mP`<0j0;z5SL1(1q;P!ONklFP=~N(eTIg?{SuGPOZ}Oq#p}(u*z{7a;q)T0|
z`au_>EynultNpXCWLoPbMamr%rmGOG4E60qx>_NZQ%@67}bs#Pfds;g(O;=X_yzj*f0
zD|<*6dyl=Mjo5$NCQ)7EWcy4*ZPpIhiDq_R%|ufYtu1QnnhzXzFp@Ni&Gj(o-IpwQ
z`?WM@u0(ereq@6Muy@T}#(+dfL#WPay|>!I1Cp>A=`|RB?R*=m+?VNSZ20>=S^f*|
z(OS=K1iw9u+=m`Yu*eRb8LnowZ`$TM+t|8}_Dm1{e{-V5|6rV9t#H2(QZ(Q%g&`jqkk}g8*D0z*If%
z(-ysJj$wcGX7bfskF8W{^GA
z=SmNKTU*=Vnm1WOVLYmJyV}*v7MR8Es`4`JDoi&q!>|S=0ZJ5Y0}+0Ip7DPP^Vh6@
zs2;wvT`lM`ryMhPj}c;WYB{xU)V+hA05#yvHm9%raNfG7taMvFlIBPSh0{)GjcK;o
zJ53iv`r*r!>XHwZrLuXR1qp!ijRdru(WpG!J<2qrSHp^LUy-II02`}h&H(mfQkzt!AyYY
zsxwk*)E@f1HHUTK+wI?7L%T!ewgFAHQzh^{1VEujV_z@i`cWjpH%prXL3wTO%AtE??4BF%Y7!kiPH@(zk
z4o<4{f-fx4pY+QUqG83;DF_5w$7jRl2Mnx0RqOK=N|`
znj%#&ZYUsctvkVE6}_vg1xj$n1XAmQ3{D*#A>u(5;w#6iGJ$Tyz1+7p#;W2kxkIAR
zA8qFsU_yOSYuRDH1gHIovYaoHJzeS)R1fgldfRdkUb(+Fk@ic(`F@~8UuXgWuj$O@
zY@+fle5N+uK6tF`bI?Tc*3~Zz&Czk(depP+CO&!E{xeP|+0vA4C_Wh@YThXdUcfCW
zKxL_~5XJ&WQS&7?J$JlOU;Z6Z5wj0nVL2RwOgAFVbKm+62`D{(P{@}(H!^3PyMaCL
zq}0egr;b`gu0|oE^|^<7abvTz>dxR|%XWX-6(Z{2;wQ%~I~mcF7WUcCrB;$@79@fm
zcfLY&_?Fq0$pXpArtOiTSB(kDNChnr!~vg&^RCt8{3OG!9}(UMFnNN5&Eb|2<6SBfm%c&p)XMod%pZ-oM4}^
zH-SIorhj*s9&xNia8j@a?j7`yeioCH1yB1c>esv^Iv6Q6{*tLP#HxT{x@C-a07Av-
za#je*r@%+}$s21bi`E1S#Zy0^$fRwIP-@yN+IG!JLzAjYaZSMWMBbFTJ>}B3uJ)E!
zHXHq9Ein^-UClx%5GGWzp9cKimh%
zjHF&us+CojpKAO!ZJRBm%7cn(c5v@HZeU>G%_zim63_XXkzena%OJ@8lntu{&7!as
zY5>z~k_5|kX~zW30@7Nksj31=#e<6@GXj5l|^n)tTu`o@vRRn>s+Y7NUG!CBf5_s&B8rt51r
zUjAlRt*p9%#5H0e^q?;eGCOY+2eB&C=gnXiYF=d7uUIRB+gUQYovo=1xMFH{0^cmc
zA7bdI_X2J{pvMLn@zUKDMXFRUP`BXUBb6hfj6N6M+dsX-pHG_+$=8LR^!xbQ)-P^SR1d-0Rq79}#40`|N(t0_!b3LEhAPPG7q>o?rs~Oh
zgpxPQ*Nz|mank@;LUjW{6Fa59^ln_m8W{#c#Hon`EZcqP%p{5h?pnt3ltA_7{~V(z
z^jY$}jOT*yRc^JPgvf#f1wuTC>39IVq)+o2!*;g2U>B)1e|vBkN;Jw~ZA!mL`0Jp4
z8YUg50>P4pHzV@OX+f2HVK+~0V^i1*K9#ZFuowezpwI=cakb*A$fSqW94We}NR?FS
zB>Yoi@|&I(C_}sLgGvlDR*<2v3BJ*|Zof6guPtYvqJBpiu?=kb_+FXzz$F-3O(+B|
zU+WzY|1_3AhWT$wqAFWC>_y#|lUf}I#<&+qu-3x4`ftOn%kHj>ZRK_KwG!0W~Z
zsW|0n${?(~6eFZnstZqOlFLgC!(`@*2q6eI+1UecyZWbx{F`BCAkoyn_b~|_e`KbN
z+*B_cpCb!A&eV$&Fh4l5`PKG73#?dZd4h1PFg6p)T1X;n+O+Acs_L6dTT}|0BSKxl
zOG3z30R7UqFXq4a^;*uZ4KTi4SmXP5rwL$yX3ZQ>U$8gLc3#$HV(fNJR-_hbwcYj;
zmllvuVzSIxwIqHE$pS~o(Xl27?--LVm3oeyF-z-xVO4pGJs-;CRsH-;zhA>Sz>{~4
zPY7devY7*5>EPhVzxa*iQ7_#}J{PjjKUaE+yr|cXgM{5aK8W;EseUS4q+NOcv++v{
z&KpRToR?TuEs4y+=`iBF2>qrzkggag
zTnH_?z?H-sC0qeOJu>tF_-HzeoT)+5t}YqlaTcZbszGe^p=(&nJjz%h3C&c9vpXTi
z^8(#6@v!ywa3&=jYFCmI+rLDx>5F=%2Nh>42y62}ON0g80W!LHEj-||&EEny*2$|2
zlDF^xWf=ywMbYwSe@WswG|_s`!R$iouIXV!X#-6eIAQPetm1@r-)1@=#uR-yF
za*9$D1CRP2{DQw-$bRhhF7P$;q$Bxf>2;l~m>}Ng2RTyIhpiK-;#xTOYoesE?JYcl
zC7}K*>!iN9!NJac+0gFuy_4OAJZm+Ps?`7(QmjFSSdCKPOzzImhraNjY-a=;&st>!
zK!L0XKO!QEf>It*q&<7*jpCHw!o1{=gS_dhca+0OP5PEnCQ3^(#YF_Rjl|b4V*z;P
zM`7j&=$cOiS*)I&UqKD1bm){-JxZnNl)82;f&Dj2O|@O=1s)+v2XAgi@iA?kE)>;)TycokRqsq#vmisy`K_kA4J%1
zf~MT-EI3tW$0DUeT*D@W<9b0Z*zvJV2MtbVq
z7U&BUUwBqCjcOFGA6WsCDp@Y$F}ht2^IuL%7Y*6Lf&K_KY*7<^5=OljcmDXQ_P~Q=
zG$pPrIqpUG^mg}M9WdCdTF^;^2%)aM5vTzB4TlUlu_Ni>ox-MSn%Y_w3pJp6Wsk
zx_2_U(8bff-ozlVuM93!b0@<=Nlb#=2s`b2l$$1+OV4XLpI;A~H3zz1|TM=s9+P$CSQD(~u
z?2(U>G*K}z#qZP@`+=tCjov?9zLYic1S~=3g{8F7TnnumuU6`zGU>&+De$;E0l+Zr
zj8eY{HaMJr(1kyx!8nE~4!N#7w6P(ebgRuyh%;U&_U8qz&Ma(%pq_`<-}oii%&1e9
zrs?+5z8)KdRhr_f`y65(A(_e`!F+I-|&4yx6q4^9u-X9us2w<(8iiwp?dg${e|>})vc
zE)Up#O|C6K85hyflEb4P&O@WI-n1SPFljgERQ6u7u<1}s6DzfXN)f;7!dxKqI#vxI
zM`?pdP;-t~DzD7sq-ca(z^FXr)L;=n9SSXiUwA^&{N?y%M`cx^c7YsF3P~FB
zlbE)natISd658x`LV|*yxArp+T{$@inJM4xa-zE{KWL#6dM7wnLITv5tiT6%MMXn_
zHEaUu=rQ^8sweK70JXU*pdt8}^!v6N#1^I3xpG13gDFZ!>O-1#DJN5T7-=Mix{CXl
zg8o-oMJ+f921s4#%^_d-M1zW?*fat6|L$*Q;4j29WJl#9??mu#5&L`>HCyWhvE}20
z-by1=i>p<^DpPx^noy0mQykUGc_FYGnCF+k3al33#nJtLi^6}33BNo88%bNr9~nNz
zy^saWTynK82i6+)3MN8nIS&%`PoF*8
zi`aHZqBaLoUTFK<6b-R
zKYw^I>YSg7!fSb{>5HL`RP~jhggehoGJ?=YJ3*~^PBl~(ZW*YKCuS22_5ICNT96BQ
z1KU1rvU~vJ0Y7=dYbtgP;uxkWgJT
zipKMWA7LPn+=3u{te#{4h0L8TJOQ3OtH=QX?5olGADlnzh%wWMW!zl~%LW
z9#tCfDFq=k)Ad{k2=;Ty2^|FrRcNMLT)Z$G>GHe3_@ZymcdeK9&z|{0rDRrjC2VI}
z^UL{1SxXxQP&Gg#$aTQtQ@JI=&8ev9t3KAL{p0ahp9*JcuQOrZh_A36a$?r3iqG~*
zJFB^QpPUIKF>uugA$2L{^uxbCJG_RDG2^SVyrF-8ZTT;NM+VG~f2O4@&)fblbT8CJ
zoNgEfxg2$UF}QT&{Bj$nkM#-*hH-G=rZBR^vyMx&+GS(^=RD-#wsV{mtq~seHgxT%
zr2FEY(G_UeG}o!^nvyX-eTQ&Mj%}AAYv4GTnh0O!+03{dD-jwV4A`ZfWs5KGv7dkP
zJ9bIKV)mR(S*GhPhRvsQcWqg!7_v(=lJPA-A9z33ou6hJQ7@
zTO!!3NN(`fUtjp?t*eit8Oe=lso{>_y;yGW)GB7LqisSk8hW@ZeD}h%14fsMU))Au
zu8KMbc*%XYLii`ZC!UENPuZ)&jh3q5ne5$^Lf%?mGtJS!-4@^hXDkdc6NEAc!GUEG
zMSix-UlujB0s>@xO)B$Baa}M?zACp%llR^(wARV6TX7!XruJVKA`>&^3h
zjC^W6IM0oHQI%ggu0eVlFU>lfr5PeD{7qVfdmk?RI(!q|YlatC^&K)*hvgB?a6kst
zv|ZW4i`KK+w^?eDTE}8GYFD!UbLoRxn|2LtKl(-@*_Zp5pvp6!V^EjQ_uJ*e7=~+z0I#byW%xBUU
zg!@jIseck0H+VHMF)`KB8%f$gVr4ySo-JAFN>4#N$?7bK;+ZKR8{{E4TbStQyYZ^Y
zzzvlzmpGUbDzJYY9yP7evi_PpJYDY0hcY$`r#~dYV{mwY^Vt`R$rA|&`XF)74aOC?
zVoQ6`ZcWVz(UdP~A)U#D<7cJq(syQ!9^|5&4TZZL=;}i=kb5WfP|pcaERsBcK<3bW
zkci}Ng=)37%QiOXl|2@l7EFYDJ}SqJ((~N8u|+(}L{eUA{G6aK)1x6<}fB5Rsn7K+Pb;#}F9vH5N@-Ne?#RdK$
zKh+LUF!wzQ`5)WHRwYrpnk_C{Av=tKm~}SLv2(oK^#mS|cN+H6g(ey&s6WdWHUODP
z5w?Y&`C}uDLRS<&yyjz;+C>JUNGl)S^yj+dw`o**dZA<1>&;yk!b1p~D{AG-Bt?(_
z5kj)*At4=TLDBt7>})kWV$sXU?pcDwL>*GQ0Of|?`Rm~}&+2$4tfjnuNem?)A}hMq
zPj|3PMym_k#z|=}nWy`72ce3O*M4QX!Fb|C)z~gBnW^l>+3cmBp=D)dNaXkkOEvA#FC#r+C-y+pp`CKWUsnO><$-c1vLR
z8C*CcEXwLvvfV3DGLgr>N6|%1f~e(po`vF7boLEu7x3{5?^*S340m?&S~$o)-#YL-
z!9@tNusUxnAVEs6b>#xJk*PNVJ8DlNVH;l*(n~?kO67A)Fo437QBe7H{>|0D9jp*=
zqM*`0L_i+nwI7xR&M=38Xbtjw!+HCco=8cN$FA_*x}FE5g-O>%k=P7N^X>`L
z!%gvY_s>W3Uye;uXv*y(>LclRoV!id>;h4cXd*0+fhc8h0KVyC1uGO8j#16QL
z&-y7i{Bvr_*86@eNIC$m#T1(HBl+ToS}@MbdIvFWz8;-+Y>Z^my5YiW0qJLEW=6EE
zc)GK)ZYM&#nO#>yHE`o&;adr|uiucO&OUnzi9BG^&>#|=;m7c~POQ~(EvEtWGvdB7
zeBj^@!|GEEY5X-z67i2_2Wmwjn^uQrZ`QHF!}Im
zrwIb(>p0{b;M`{bP@Zx+-*$8>bgSL?JbOqNcuIipI@wqmG5wr4b{L3hhK7cPu0vZG
z1=nM9zqx*c>E70Oo`%ejtGVvx62~6Mg`A2cL|oy~=46v)zsKwPHTlk1=N^T%6sVG@
zZt%9^#4f*aXPpz_*%X{qyR>v!z32~?MS7$1!%1Xzu>-Q%^q}cdkE!WGE?)hy6+guS
z7fW%Uzl-7#I3WF9D>*N6a&YJA_lEIN`0-dmL>q!-HiFFrSng|gb>or0M&X21Mx0f5Op5tm}mizit7`^TOzRtn$h&a0bsgoM9!
zK6dK^Iv3qwaTV<|6sT7b=#4zoF9I1UB1FCZUD^QG*hz8gO6*n-I*P=xR+uvgRwxrO
z6=yi2!8b%bro_5@{^XD3wm)t;5?cY($udJ_Zn`j1feai$0C
z@_b90LauA6*gfbvh_s%zh==Oh+UbBbZGjfzr`I57#GR)n#~9OF
z{)CHO8p_D2iwm>G0+T4Z2duZ!lA4en74074AW>~M4|lhtH;|!z+B!d$7$^?G-I4nX
z_OtwON!%N3q}59}@lw9VOHAn3DJlLo4T#zgHHw$dhYpFlDQ>Xw&0B+yP!#6-`;V-m
z$VXt^qZMRDBUJXXv5k71^ZJ9r-D?vG4N;MmKqBK)o6!pU!y6=c(O`o
zMd2B-(nd?)`vsIyx{Fs{H%o>9MH0m$s1LhK*b#p@#$a*VXu}eF47B>v*vPS&{#>8o
z4Qn(sH1wb{idfxJXPlu67V(E}LRjeJN^&o3A4MRLZ*4k)xitTn6t^Inz{3V|N1$9n
zyfWOO6PFI>6|g>b!qWIsJ#UWb&Cy!-gvuRvd}IX~_W>`#?Yg@(m>z+f+3zN&q?`ca
zgpLI;c&WizR&Kx}a5g`_fZA}K*Gj&CEXnTAUqAOM=Zr}6Ljw_LhD;S2@p6SN?$&_t
zXf2_d{C}7L^FN*dOW|gWaQpKI{#fbgKe)3HWF7BXSqbX<{28O%gyyVSGWMaPAPHec
zUp@C>taRV^1|Fl+X)WQK{k2+5pnwS)q1AjB{<4V}Q@aM3h?vF73!-`w2)Q0E?kSu#`
zVg>m3x8*7;c*%b&>qO@Ui3Nlm!h=4V_7FWG&M)qp;tD6`H+Qt4F(DH_nKt$w;>jXJ
z3=zNqd2`dFqe;0$p*=R3kWKg?Inw%1MlYgM1HFzT(C~f<;ofoFOK;jFAxQZlm3^{=BK0yUi;+mQFB*?Gg
zLu_jYffjV-+q-qo<`?lpE$`!a`sapSg>P>f*tCmQ;n(5yEWaN=J9^Cj(WAr8yk~ZS
zy6DIeAC=Lss(m(7I`}FhE^bm~$;e$5LifYY&rgB`k6ioh<%T^*JJ&~@Pjz$tMc64}
zb~n~|?20vZFA^(`ZS7sE&0SA2-GiC=NDymOeB{TO4Xdv|LVV7kDg@ygE9C(kB
z(L?UWtq+=_#SE?}jI}%};ccm%Bx!=Gjzh##Wjla4i1t2zz?F6)AKS%)U@P>Ajv3qh
z5-W22VH0$a9jBT4I#ACKXY(E(m4*ulL|A8^Juf5SQL)01adaTHtZZe?i;}26ZHwh6
zU0z_jHa1-zEd_YI#b*kAlw7WY{Fv6K=-*fPkb(!8+OLjIXoV3iPh=rQ0*^K$YBPE7
zB=1+tp2v>nfbX)B;0IdJDx4t-|KKrXI1WMN88|%Ex&QH#siUm3W%dQAzvY~p&q`TIV;s&hmNLlH
zgN%XUC8W?)@|b_G>eeCAi8=(KyR4j~x6;H#pcYv&?4QVpQJ@t`Lp25sXXE4f+_$iX
zIzxyH(pO@_rga}Xjn|T{?z_B_=;s#|oMlP(N@wWzf#5c+H{}&g8FHD;hnDNCTcpPn
zki!c$I_=ol*n#u~(m~K%?X}_A$Fq~Jtb0#*e^L25Ok(jujMdp`zU>F{pnt@!XD596
z(p;;fmH9h|Nq8tuX!_AJ#klzxtza(&0dNxcD;NXGFIm66AAv8&DmwlN5j{KogDpUF
zWgZ|#;5)t_TDor
z%5>=#9uXA5fJ#t6#Y|{WRD#4dD<~jJPD+-n1j*Pc2BM09f+UsPfK8N)C?FZhAW2Y=
zERyr7yV2Qu&pfUBz0UjNeBU*HX1L_x33sTfyK2>1^9L*6br!hmOx;^QQvY^sDV5&j
z+<*Z(B$z#mbF$?|8;g_}p9jZSy3x3wn1
zX6f`m1I0FAk|1hki_D796lrQEb0V7;SC6{vgu4gLK|3#fw<1v)is*TSz|7-bW0H?Xh3JQDo#~;<+z{|cN9sib^md(5N*@4|=xr3=w
z&_%`$XO?@DA&%GPxufme|hs;I;UgiHrV*
zgkjaQ@FpAgo^u1mYkp10qoc+)oJy83l$`86cL>)Ta|>a=#UBJD-flwo>z9BrftR>{
z8DLvp8{0;MZK0hoX)&jNDIy7^4ew}#Hb;OinI24MT%9@YrQMeNu#G~qEq(#U>3hRLCJF}nr)9rHI0{M}kzTFS+ZG=NF-&yx
zkQcC_dst#H9ozm(_<_{fAq1k+i+s@fEoj(k_FjjwY=ASFR~%z3GQb5U{U+d%TTX@0
zjX14Tq7qM#@D=%I03;vT2F>R{`_ww{v~5L^j5vtmf<+QrXw(Vxy!!e4sRG3EA>_0;
zOS<-@gtvaTaDA*z`h5zv#pFDg#lqj1MJ9T*V3_LMbs+9H)*!3Hy+SV2O?FGcjl7HnS*vq4eETYTakBfE5a
z`{ZcIbv2(3<%H%hdoY(I1IMcqAlk=>^d_|7-8aL`&vtLEa=pz_|W6fihFL)zK}~f*X{R^v~e{sEc5jJc`6iSn!4)
zw~_0j;^L@>p7QZ4hKBblDnTB|KD?%_ZEJh_!i;9C+A1Mb0^kE`B`MAmYbbo`pJ$F(
z5HxrvuZ(jol!uxJg0aA1Ws``N;l!E6%+Z5@t~CmO^{WxsK-=O1ZR>MccDpyFPaTsv
z{54brTJmO-iIuRa4Ue%P<1E(^gC(z*2y;=?9>HiQl3luSD}k
zANEX<7sj>ii0QMy+j;7(TY@$C^s5u?^BRy_%<42&;GnR2qb|Z6OAUHt7@g$Ee&ztM
z*ypeh`}+HnLX~GspyN$I=TaDjK|@ddvhm4}B{jXL<<3*+Gk*PK&M(d6t%pv0iQ
z;XdqxCnDBHpzqEB|E~Dx@M?-2?8j-nnrNs?c0JHc46jn|Iis`pnZ?nk`hsgHfAJrL
zHhO>&?FSa4n%R}9pDKWjsR)9e)K6!;|7C0c;?c9=kl7#ic$RkTNN7rm0KKR6g5t?A
zlEfu@3`FYBQHHcwO{A=MU96J7l~-Y5;S)hq)iXW&DW!L#tYIKk+n3dAT_b>9h1H(w
zQz*q}O3BO1O;fQ6nnca*P*AQRCn)xYI40s&+}&z#=&@Bi184d4HeQPc!ps?w+n8!6
z9C9}B#6+LKSANv;h9)TGWmFeq(gZcQ@F6uG>>;d8%nMwuO{J5P#r8dA!fv#?0O&<7
z`aQo6jWNj2lpOFs1K_}p@?{4IiQ2`iSVD&cd9XviN9&$Y?|2SLM%1>ioNaI2z5S5B
z8igq!G&7vuPO6Yq9VuMYV53reYCu53cy3HQC5gAszc^Wd7|;^S^g#S$!|5ZWidV`#
zF7)0^(hb5``-V{s;;Y8zg*zG61IgQca3RNm6#6&M|GN5qoK~(xb>xc|FL;FO?fRb7
z00-v2&(^-{BH1CSPQ^4#Y*J&L7ml;1Cx}SLq7m
zUwV3&MfugGBPvR-05|DxE#b5Nt9#y!j0|v?m3NTfT7yB?A1Ydflh{C4H(tnln4Isb
zONRZ7h}eg^a4g-1bMS^2H@$u!Y65ZS<2$n(+`N$Cji>*
zgVh=+RS-%TPe*#i&6bLGqJ|rED9y>q>8~Y~5LGeZD766)BgI*_*t>H-(4<=IQ_6Ki
zU0k;d-AarpDQi5SC%~Cum`>h;X!oUr*bQ=%pP$>DKnLu+)KxD-E!1F5QlM5nKRCshfKQt$=is7nJg~_z>#q*_#y|%4jpF
zr*PA+ru7=XU-uSFK$I=KnlXr0d8HU<-bBl@m(FXIw}K-*6GoOUbPsrPqvz$!Ds(_P
zXv^WS{uy5wNuHJsOEMJ={ly%3+b@%+5ul#a70(Qh@=P(Ve+T3MFGwVQIIV3rJ&Uzy
zW+2H}&mvw~Pt2R2Y;RAo2?HAA70i?ly@^@}8tgiexEWD3yZOG(1j5_`d)-0d)QIeC
z9x|~npf>Qsyck@v|B6p;=RrRyYwvD6%qREr-EM#Jc7K}8c~HizHy_&r2L^mD=*Exp
zxquneb{LPtj$H<@QbiS=i0<
z)aI&KlR&ottna`aTf8txY7N&3V1;+(;1!i?+R&*(@FDnU3|+OE*3PSp^CB5f9urUUm9Ql*WHf
z%hC_{HWY5w^N;&!ka^8f7b-tu7y^@BDv`SiV<^eal~95*<}Gbe2y_w72%jDvPr|ww
z)X+MVNxM8Rq);I)0dz`2@gNXZD%Hi;o4#ko59E#k6HB+2uafaZ{|FaHhfi(+kQ$bB0jDa13vK^(Php#?3<_3Jab{
z0Nn+zrtQ=j>y>kzoot$wA)YuJBq9J{!BWa9Pp|IZ=y-zYqk&cp?p?kFwfxJ#60%^G
zeTmcQ;|B{KN~znp(NvD|nE#vhQk4TmHcg6UpgvQIt>i$~jt6?5^(!>Id8
z)xS<>c_Lt}h*L|&MaTrP0&=GOe{)oTM{Pr_Vw@Z5?}vSWSSyI=
zP&v&^gB_}A2m|}uQBfOK0LNKdS9b!`37rEn*7)XpFX0(M^i5Dq(CHcJ(kW{secbPM
z3S_N(VD^JE!WA*bIfVx%Ei*gq`&R0q+{J|fFKCx0F#UCs|6Ev*wS(l>?5DxBBIrL!
ztE*VeCWsq?NX0uR_1kcTgeZh@o$U$PsSU@%4Nd~YO$mabZ0Cqva}zT&FGkwUpbp1u
z|FKyBTFa*pgwla0^EwIWj;uR$zZ8^nDFXL24~o&A_M2Y?kExU?kfO8Hk8SPu)s
z1Ul}EV49Ayy};Zru;Jv6Q28>jJ5)NfZ4@0!u3=VKv5u9|V6nBG>BIo^X?rmq&xDR;
z2XW1jB*>mJi
z!qAJ)b_0D4Xvxs=X5%K6EG-5cgxWSCItH6gV4dEYalZ!??K(q%3=xWD7rLrT`AVJl
z2rK&W8f>7_gI&kNmV#+^zTSeTZ~G>u+6u2)*Gfr<3}GkVUx42Gg~4_*`yHHj3O(EB
z&446qFPdQBz;(=8{Opq{3?v!mx{-!KKjnLv!(TM5LR!e1ego=?BeBWU3om8yZoz;pL~UYSE#2ZQbVqBn`!n7q7Dz0h!G
zueGO-5gR0W(f+s!q}uOlWW||QvRmMvO}trG2*CwAnFj);C90|zQ1f^f=$W*?bTZEx
zIhh)P$YDN^oSoPmtBzcq*=%4{_t0#pe5R&(o67)6Im`AcGXHJhlg+i0MqZ-srMb>G
zE4yZeS{YIDYtQ&gr;#}01Q4GnDgu(p4QgzYh<#LSuIktbkX`Eb2VSc>!f)D~T%Lbp
zG}wX9EO&ka6^af7=FarzdZCgIs0<4Cv{+_#4||^ApUB~-t<8W5h#UT+9|MN@U>z)O
z$FVcM^Bk~N)_sk@GS+BQ9^MF(gL8eoV)Z5lR3JF}><|~?%6xJd1cM+3kQi;M)DMfZ
z3h!tLB`iqonR^XCi5Dl?5Mx4y4RO&3678
zi3|-7!j2^wG&g_Lse?q-C7dfszv9_ucV=EUm-N0E+!Nn;tM&}*{v9;@@?VJ%J6Gkk^kwyb_B?)yuKhdizQ
zhN#;eji@FC@7l^NE#B)iTzc~yP|6XlRO^6~^wU&F``o#SR;2iwd_mT8@|mqR^Cc-I
zI11LpRTt~BXj+{|Fx&oVI2ox<0(m}LdGE`FVW)kmz!g3ajBqWlfjOZo2Ko|F@*@7Q
z=ZBVsB^a;QEC)aA3C2@8D*or|;Y_6kN10+)$x!x>#jxTJL!NzR-<8!UD>XJI_S
z;7Br~{cIjrmDww;MCYSn`-Y||No(f2KfUTA
z;xm_gJzoDB5~R<8x6v#OPZtxO*9iM
zych3nv1ttJ&+(LHcbI50=-S4YzN!I=c=!JNi;V8GlL86qo1tENy}>DWs$gGdjLWotqwrb3Jt95NEVWNNIXU*+
zVN2v_Djs%mK{U9)KI3#{=tTT
zbtP6Qp~7er=oT}ZWsW75qC!&Bbv0HY*NSQ`!=T9L;j{8z2R&+JD{tCtn{O=Au7Cg%
zkvuJa0}843x!vFVhtwb@W}cCT_Kpta?aWMLN~gJ~uR)aH_pzP}12l*~2eDV(#Z2B*
z2C!L2lUtN`qtQ)Lb$*lDfXhUBZrR1F6XL?9rfMkIIFRMW5FC*4Mq%
zsSeOBneW!CS_n&8%*8Z`;@ml9k307!~LthoTl3sc-KnKeTzRVxYkP?5V9jr
z!56?%4rv6xnxMU~y5X1hYVkLBIZJ#Quhrh{len
zvT?H2#bxzYF_NkN1F@a)s
z-}hKLjqTiaAG&sM!ix7!?4I8uPfy5#Vfm6`*@sc>lv9HMC8f?hmKP1rAGkD17!X#b
zsJaeigVVj85JMcS5KD@kg?y{K15jk)-V03gn)eD46^I>;S$3nH`Sg7EkPro5_CVq}
zo691;L?FJQHw}+{@`jXLu@Ph|a0BBhu?cORL$Z;#!)x+~W{PFCfeI>+rl|V9Ze)*h{A1(YAXXXNz0NBoC8Yov6_2e4_f+?4uxTxh0fY87U^<*C
zZoPg=Lqp^IEuAaD^c9klY>V~V<~T&{OuBez>MO*1o}GU4XmPGrHfdY-^sXd>U}uqq
zk!_3o5@TWO3J&)Ke;l7Wmb+l>*nKdhSLCY62%JKYG|8zg))yTY=(WCPpbU+BspNEV
zBN)CUWLUx%94&vu-?lg_YH|G
z-lRu%FMF+w2E-8jq49iVV{zv!P(y)MXRelm>BPKJ?ss40#yUYv#64|`<=Hu#i2-nJ
zYKUnu$ED_+T2PYmUaxQwXWQAqt3a1lfEX$f^1_O!wGBQ*wsY_GR$rPVnc0q&N%js7
zosCGAV5(UumlZW7vqND3G1r?voPbcn%Uj(>1z6~INLaPmp-dG@>LT^Ykr&(MIlF;h
zO5OIuiIFsy*|ern^R3sXzI_@YT#&gB&Src3>+dCvplG2DeN`j#5DCx|wp{)E@G3-A
zr!t1!wdS;20QXVU9&D}1Zu2#4qy-Aax75tbWiBF?F7j9_j44&g(~hB3Ozww3EKD1L
z3i4BQdDo0hku_J$jl(W|P}7>Y<97qPB4##Ha#jUMuVWhCL<2IXK3;=O$z{-Zq_d%FmDZ}^@qf-;MNxxI98)@EZelxWk>5LkA;-|6jvcpwAI6inPDj@UoJ`+|X0xT3?0kv_ru!kjCp9OI3&g%2-C
zI<$ep@jprttdh~7$rmCIO+j_EAwmtZs9PLSx=g0afJhN>qZek%3Wr^zQ(Q#=He&YJ
zhnQ@{glCX~`;tW{*%t(hve(3uQin*)2{8JqA}US&&1BrDLK3V!d6>e=P`i(Wz!KY
zVBAOCy)b2hi1HoL;yHfJ8b$MWjZOi+71GkNVftzql2HV9^sTS$r1r(Zw_b7bq*O5Y
z_XI4bI(&o0L0K%rFXs&N@I5e)e=p3};VX|1P)Z<3qF`fZPBi?!${Vhozh{n>oTIjf
zDk4Hx*8i*{QM%zLxQT0^9m@8BHXks5Yb0YuGIjglck|+@`KA!ad^{w(fTu6_Q3IE4kzc^4jh_;EQ(TEU?a(7zL<%v7l~<-t&@Vwgq;2D-{2zY(x++IEJFr_iA?G
z{j-aNF*2qCC5HZEV}|B}xtPgZ-kqQfhTP56lTvvOUqG96SU44eBIVr6$Dp@H;jAYe
zD$x=;=?@7BodSJWqFNf?tWa)P*b!jRFGCFae}5b@{Z7N=V6AC+^yfE0DqVa|V`P=x7MchR7FPL8H
z1w2-u*|u~@1?-u@&g)ngkzaQ`ocW#SXK=!BCS>MOigN?r3Q=ov0}I40FKY^`b0_0K
zpA$frP8g3ws4dg;=y_OW?KL4NgK*E?)%Yyd~xj`&KD@YF*2
z3vyTQBw$u>-hjC
zJHHz$(E+)Gf-g8Wg_IiY|5%s*S~~bMG$Lso{3R5-OQ4y#&=cF$vJz)#5wFRd0rj0x2QG*VV43>|3RmC61kGw+8n?walKUl*nBVgrJp?-
zx{oSoub1_mqUw;|+a%BBIzf|TdRr?oLl@wdfWVtsKoh7ly%f&z@ZSF0CSIDG#|oFE
zkMLh6C8p--LM0wR<7EK?vFmn@Eqpk(_V6yK$F$C_Y&jE3MGeyz{n+!CE|Xlq2Fy?T
zQKAfGgYvB!#eRTBMS{@E0_vhvg=)+B?faoQ5xOe5dTW6|4V60{Ra~~93TLn#Ee0|W
z9@j*EtibV4Xo59-r9y)|J*6YlJRb+XewbGdzmJ-kPkj?~>h%@`eRM7b@?E5&^ikr*
z-c^rP@OWZbM+6q^J(Lq3aN_cz(*nrQ>3BvEe_{c2l;S8CYw@8%R8X?G$Hb#J)?I&d
zcr&UqIZu6}k?i@a<^FSrgzg8+ouAdBaSR?QP-`L$At!}7V`w}c3T=B^fs&bXg3GSA
zHe#oj@D8Yx-owD3EXB#Y5yFuF)u&OEc5QEq#z?#Vd|2o(6;ee9HL#fB<)(-7p;CzW
z1G)R2P-c!vg|e!?!S8Ar0F<#NFm81K(&|~q@5&-q1^{Ki$QnDoMsNN<{n^himqX{n
z#A|^#6zJOZ`Ke;9h94&Zsohm@4o3adFzhBZjL=8uhN!(^TvB`O)=@B(%cwqrSx+@J
z3yxU^&tf%9q|lc}9-cAPOCWSgZsG2$i**=3i(02rKbj%ffoAJ4r4|`{=xccYg7HJD
zOz2>I{vfaG&(Z$*rT?1jP(w1DSFhAh57;|^LlPNr(#myP*>W5Ky`VKMjm~9)^#}wQ$_xO
zFAU!_QrIFt`zkxK=xyKlPOgoi2%Ljn1a_*nSl?q!nA&(ShCds2&hMnsv_Kst*j|u4
zxj>!K7CU~w62UOB&g`MOur+qS5U^;Y$?7O^SXqa`ApUcc$gN#ATvrlivi2|G@1MVa
z4a@zLesI+KW&2(mz5L+!3&!!Py>PFYcRiOW-RnnNvG6c_^gko_qHSB6xJbH7mttS
zIiy_U45Z|Y8Tnvqzka&c=s0X`)+@<+n6bpt=#HI%dr6GgVdZ+s&-&4uT9J8!MICjd
zP*{h^+NbAlQWL8?=T0W4@Ml%>SzS
za?L}sqKL^=yTA=mzd?VhZcS}N!zoCBBOOvG6m5j!Fkit~Ayz(sY$5(z5E?Q787#`L
zEiPw`RZFA#j3&Q;pkN^sq?rE;{xe}kb=emR55WjB3Dn5{-FE!>FR3ahNbar(3Jltx
z%Bv(oFaZb^>asMoYdMHvbjW|0CkTPQDQFP>2~VbUC47b&i*kn56|woT8WJGgCC=B?
z)fGU)z$R2i2`L<*WWhPA93awcQ%g@Ogf(qM{NzUo-~g}m>ON}20UX{5g{KGf+`cKF
zKe2`qwcU@Nc&nWdj2r*WsQx)Hw6!sK(B&3enCfzpxH3@g-20jI;{ajgTc1I}ZsVKa
zWlK()KL3eF{>Ax((=QKt4`D4a6|kE5Tt)IPcegp){*st*5kkYJHNQDB!_qN2k3w*M
zP!)T`=kx>dOFlGWPn29ggcm6}%Za&a2vtnU6QZDonFjUf1Kx$Nw;FOXIzW23JLqi(
z_I>f8^^kHia$2eEk_Jzp==wS2&JxzJ2{Kv=>#XOzkM>y?U^@oJ8-c1*W0E