From fd1b2eeb7bb24c3f6898d56283513a348764fbe9 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Wed, 13 Nov 2024 09:48:50 -0700 Subject: [PATCH 01/19] Committing renumbered labs and updates. --- ...AB_AK_01_Lab1_Ex1_Explore_M365_Defender.md | 13 +-- ...AK_02_Lab1_Ex1_Explore_Copilot_Security.md | 92 ++++++++++++++++++ .../LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit | 45 +++++++++ ...K_04_Lab1_Ex1_Deploy_Defender_Endpoint.md} | 4 +- ...=> LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md} | 4 +- ... => LAB_AK_05_Lab1_Ex1_Enable_Defender.md} | 30 ++---- ...d => LAB_AK_05_Lab1_Ex2_Azure_Defender.md} | 7 +- ...1_Ex1_KQL.md => LAB_AK_06_Lab1_Ex1_KQL.md} | 4 +- ...LAB_AK_06_Lab1_Ex4_Connect_Defender_XDR.md | 91 ----------------- ... => LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md} | 4 +- ...=> LAB_AK_08_Lab1_Ex1_Connect_Services.md} | 4 +- ... => LAB_AK_08_Lab1_Ex2_Connect_Windows.md} | 6 +- ...md => LAB_AK_08_Lab1_Ex3_Connect_Linux.md} | 6 +- ...ks.md => LAB_AK_09_Lab1_Ex10_Workbooks.md} | 0 ...LAB_AK_09_Lab1_Ex11_Content_Management.md} | 0 ...md => LAB_AK_09_Lab1_Ex1_Security_Rule.md} | 2 +- ...book.md => LAB_AK_09_Lab1_Ex2_Playbook.md} | 4 +- ... => LAB_AK_09_Lab1_Ex3_Scheduled_Query.md} | 1 - ... => LAB_AK_09_Lab1_Ex4_Entity_Behavior.md} | 1 - ...tacks.md => LAB_AK_09_Lab1_Ex5_Attacks.md} | 0 ... => LAB_AK_09_Lab1_Ex6_Perform_Attacks.md} | 0 ...ns.md => LAB_AK_09_Lab1_Ex7_Detections.md} | 0 ...e.md => LAB_AK_09_Lab1_Ex8_Investigate.md} | 0 ...Ex9_ASIM.md => LAB_AK_09_Lab1_Ex9_ASIM.md} | 0 ...nting.md => LAB_AK_10_Lab1_Ex1_Hunting.md} | 0 ...oks.md => LAB_AK_10_Lab1_Ex2_Notebooks.md} | 0 .../Media/simulation-pop-up-error.png | Bin 0 -> 4994 bytes 27 files changed, 168 insertions(+), 150 deletions(-) create mode 100644 Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md create mode 100644 Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit rename Instructions/Labs/{LAB_AK_02_Lab1_Ex1_Deploy_Defender_Endpoint.md => LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md} (98%) rename Instructions/Labs/{LAB_AK_02_Lab1_Ex2_Mitigate_Attacks.md => LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md} (98%) rename Instructions/Labs/{LAB_AK_03_Lab1_Ex1_Enable_Defender.md => LAB_AK_05_Lab1_Ex1_Enable_Defender.md} (84%) rename Instructions/Labs/{LAB_AK_03_Lab1_Ex2_Azure_Defender.md => LAB_AK_05_Lab1_Ex2_Azure_Defender.md} (90%) rename Instructions/Labs/{LAB_AK_04_Lab1_Ex1_KQL.md => LAB_AK_06_Lab1_Ex1_KQL.md} (99%) delete mode 100644 Instructions/Labs/LAB_AK_06_Lab1_Ex4_Connect_Defender_XDR.md rename Instructions/Labs/{LAB_AK_05_Lab1_Ex1_Deploy_Sentinel.md => LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md} (97%) rename Instructions/Labs/{LAB_AK_06_Lab1_Ex1_Connect_Services.md => LAB_AK_08_Lab1_Ex1_Connect_Services.md} (97%) rename Instructions/Labs/{LAB_AK_06_Lab1_Ex2_Connect_Windows.md => LAB_AK_08_Lab1_Ex2_Connect_Windows.md} (97%) rename Instructions/Labs/{LAB_AK_06_Lab1_Ex3_Connect_Linux.md => LAB_AK_08_Lab1_Ex3_Connect_Linux.md} (96%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex10_Workbooks.md => LAB_AK_09_Lab1_Ex10_Workbooks.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex11_Content_Management.md => LAB_AK_09_Lab1_Ex11_Content_Management.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex1_Security_Rule.md => LAB_AK_09_Lab1_Ex1_Security_Rule.md} (97%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex2_Playbook.md => LAB_AK_09_Lab1_Ex2_Playbook.md} (93%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex3_Scheduled_Query.md => LAB_AK_09_Lab1_Ex3_Scheduled_Query.md} (99%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex4_Entity_Behavior.md => LAB_AK_09_Lab1_Ex4_Entity_Behavior.md} (99%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex5_Attacks.md => LAB_AK_09_Lab1_Ex5_Attacks.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex6_Perform_Attacks.md => LAB_AK_09_Lab1_Ex6_Perform_Attacks.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex7_Detections.md => LAB_AK_09_Lab1_Ex7_Detections.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex8_Investigate.md => LAB_AK_09_Lab1_Ex8_Investigate.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex9_ASIM.md => LAB_AK_09_Lab1_Ex9_ASIM.md} (100%) rename Instructions/Labs/{LAB_AK_08_Lab1_Ex1_Hunting.md => LAB_AK_10_Lab1_Ex1_Hunting.md} (100%) rename Instructions/Labs/{LAB_AK_08_Lab1_Ex2_Notebooks.md => LAB_AK_10_Lab1_Ex2_Notebooks.md} (100%) create mode 100644 Instructions/Media/simulation-pop-up-error.png diff --git a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md index 8a0535fe..b3637c1d 100644 --- a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md +++ b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md @@ -12,17 +12,14 @@ lab: You're a Security Operations Analyst working at a company that is implementing Microsoft Defender XDR. You start by assigning preset security policies used in Exchange Online Protection (EOP) and Microsoft Defender for Office 365. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Explore%20Microsoft%20365%20Defender)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - >**Note:** **WWL Tenants - Terms of Use** -If you are being provided with a tenant as a part of an instructor-led training delivery, please note that the tenant is made available for the purpose of supporting the hands-on labs in the instructor-led training. -Tenants should not be shared or used for purposes outside of hands-on labs. The tenant used in this course is a trial tenant and cannot be used or accessed after the class is over and are not eligible for extension. -Tenants must not be converted to a paid subscription. Tenants obtained as a part of this course remain the property of Microsoft Corporation and we reserve the right to obtain access and repossess at any time. - +If you are being provided with a tenant as a part of an instructor-led training delivery, please note that the tenant is made available for the purpose of supporting the hands-on labs in the instructor-led training. +Tenants should not be shared or used for purposes outside of hands-on labs. The tenant used in this course is a trial tenant and cannot be used or accessed after the class is over and are not eligible for extension. +Tenants must not be converted to a paid subscription. Tenants obtained as a part of this course remain the property of Microsoft Corporation and we reserve the right to obtain access and repossess at any time. ### Task 1: Obtain Your Microsoft 365 Credentials -Once you launch the lab, a free trial tenant is made available to you to access in the Microsoft virtual Lab environment. This tenant is automatically assigned a unique username and password. You must retrieve this username and password so that you can sign into Azure and Microsoft 365 within the Microsoft Virtual Lab environment. +Once you launch the lab, a Microsoft 365 E5 tenant is made available to you to access in the Microsoft virtual Lab environment. This tenant is automatically assigned a unique username and password. You must retrieve this username and password so that you can sign into and Microsoft 365 within the Microsoft Virtual Lab environment. Because this course can be offered by learning partners using any one of several Authorized Lab Hosting (ALH) providers, the actual steps involved to retrieve the tenant ID associated with your tenant may vary by lab hosting provider. Therefore, your instructor will provide you with the necessary instructions for how to retrieve this information for your course. The information that you should note for later use includes: @@ -37,7 +34,7 @@ In this task, you'll assign preset security policies for Exchange Online Protect 1. Start the Microsoft Edge browser. -1. In the Microsoft Edge browser, go to the Microsoft Defender XDR portal at (https://security.microsoft.com). +1. In the Microsoft Edge browser, go to the Microsoft Defender XDR portal at (). 1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md b/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md new file mode 100644 index 00000000..57f9f30f --- /dev/null +++ b/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md @@ -0,0 +1,92 @@ +--- +lab: + title: 'Exercise 1 - Explore use cases in Microsoft Copilot for Security' + module: 'Learning Path 2 - Mitigate threats using Microsoft Copilot for Security' +--- + +# Learning Path 2 - Lab 1 - Exercise 1 - Explore Microsoft Copilot for Security + +## Lab scenario + +The organization you work for wants to increase the efficiency and capabilities for its security operations analysts, and to improve security outcomes. In support of that objective, the office of the CISO determined that deploying Microsoft Copilot for Security is a key step towards that objective. As a Security administrator for your organization, you're tasked with setting up Copilot. + +In this exercise, you go through the *first run experience* of Microsoft Copilot for Security to provision Copilot with one security compute unit (SCU). + +>**Note:** +> The environment for this exercise is a simulation generated from the product. As a limited simulation, links on a page may not be enabled and text-based inputs that fall outside of the specified script may not be supported. A pop-up message will display stating, "This feature is not available within the simulation." When this occurs, select OK and continue the exercise steps. +>:::image type="content" source="../media/simulation-pop-up-error.png" alt-text="Screenshot of pop-up screen indicating that this feature is not available within the simulation."::: + +### Task 1: Provision Microsoft Copilot for Security + +For this exercise, you're logged in as Avery Howard and you have the global administrator role in Microsoft Entra. You'll work in both the Azure portal and Microsoft Copilot for Security. + +This exercise should take approximately **15** minutes to complete. + +>**Note:** +> When a lab instruction calls for opening a link to the simulated environment, it is generally recommended that you open the link in a new browser window so that you can simultaneously view the instructions and the exercise environment. To do so, select the right mouse key and select the option. + +Before users can start using Copilot, admins need to provision and allocate capacity. To provision capacity: + +- You must have an Azure subscription. +- You need to be an Azure owner or Azure contributor, at a resource group level, as a minimum. + +In this task, you walk through the process of ensuring you have the appropriate role permissions. This starts by enabling access management for Azure resources. + +Once you're assigned the User Access Administrator role in Azure, you can assign a user the necessary access to provision SCUs for Copilot. For the purpose of this exercise only, which is to show you the steps involved, you will be assigning yourself the necessary access. The steps that follow will guide you through the process. + +1. Open the simulated environment by selecting this link: **[Azure portal](https://app.highlights.guide/start/6373500f-1f10-4584-a14e-ca0b4aa7399f?link=1&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. + +1. You'll start by enabling Access management for Azure resources. To access this setting: + 1. From the Azure portal, select **Microsoft Entra ID**. + 1. From the left navigation panel, expand **Manage**. + 1. From the left navigation panel, scroll down and select **Properties**. + 1. Enable the toggle switch for **Access management for Azure resources**, then select **Save**. + +1. Now that you can view all resources and assign access in any subscription or management group in the directory, assign yourself the Owner role for the Azure subscription. + 1. From the blue banner on the top of the page, select **Microsoft Azure** to return to the landing page of the Azure portal. + 1. Select **Subscriptions** then select the subscription listed **Woodgrove - GTP Demos (Exernal/Sponsored)**. + 1. Select **Access control (IAM)**. + 1. Select **Add**, then **Add role assignment**. + 1. From the Role tab, select **Privileged administrator roles**. + 1. Select **Owner**, then select **Next**. + 1. Select **+ Select members**. + 1. Avery Howard is the first name on this list, select the **+** to the right of the name. Avery Howard is now listed under selected members. Select the **Select** button, then select **Next**. + 1. Select **Allow user to assign all roles except privileged administrator roles, Owner, UAA, RBAC (Recommended)**. + 1. Select **Review + assign**, then select **Review + assign** one last time. + +As an owner to the Azure subscription, you'll now be able to provision capacity within Copilot. + +#### Task: Provision capacity + +In this task, you go through the steps of provisioning capacity for your organization. There are two options for provisioning capacity: + +- Provision capacity within Copilot for Security (recommended) +- Provision capacity through Azure + +For this exercise, you provision capacity through Copilot for Security. When you first open Copilot for Security, a wizard guides you through the steps in setting up capacity for your organization. + +1. Open the simulated environment by selecting this link: **[Microsoft Copilot for Security](https://app.highlights.guide/start/6373500f-1f10-4584-a14e-ca0b4aa7399f?link=0&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. + +1. Follow the steps in the Wizard, select **Get started**. +1. On this page, you set up your security capacity. For any of the fields listed below, you can select the information icon for more information. + 1. Azure subscription: From the drop-down, select **Woodgrove - GTP Demos (External/Sponsored)**. + 1. Resource group: From the drop-down, select **RG-1**. + 1. Capacity name: Enter a capacity name. + 1. Prompt evaluation location [Geo]: From the drop-down, select your region. + 1. You can choose whether you want to select the option, "If this location has too much traffic, allow Copilot to evaluate prompts anywhere in the world (recommended for optimal performance). + 1. Capacity region is set based on location selected. + 1. Security compute: This field is automatically populated with the minimum required SCU units, which is 1. Leave field with the value of **1**. + 1. Select the box, **"I acknowledge that I have read, understood, and agree to the Terms and Conditions**. + 1. Select **Continue** on the bottom right corner of the page. + +1. The wizard displays information about where your customer data will be stored. The region displayed is based on the region you selected in the Prompt evaluation field. Select **Continue**. + +1. You can select options to help improve Copilot. You can select the toggle based on your preferences. Select **Continue**. + +1. As part of the initial setup, Copilot provides contributor access to everyone by default and includes Global administrators and Security administrators as Copilot owners. In your production environment, you can change who has access to Copilot, once you've completed the initial setup. Select **Continue**. +1. You're all set! Select **Finish**. +1. Close the browser tab, as the next exercise will use a separate link to the lab-like environment. + +#### Review + +In this exercise, you successfully provisioned Copilot for Security. You're now ready to move to the next exercise where you'll explore the core functionality of Microsoft Copilot for Security. \ No newline at end of file diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit new file mode 100644 index 00000000..402e78a9 --- /dev/null +++ b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit @@ -0,0 +1,45 @@ +--- +lab: + title: 'Exercise 1 - Explore Microsoft Purview Audit logs' + module: 'Learning Path 3 - Mitigate threats using Microsoft Purview' +--- + +# Learning Path 3 - Lab 1 - Exercise 1 - Explore Microsoft Purview Audit logs + +## Lab scenario + +You're a Security Operations Analyst working at a company that is implementing Microsoft Defender XDR and Microsoft Purview. You're assisting colleagues on the the IT compliance team with configuring both Purview Audit (Standard) and Audit (Premium). Their objective is to ensure that all access and modifications to patient data in our network of healthcare facilitie sare accurately logged to meet health data protection regulations. + +### Task 1: Enable Purview Audit logs + +In this task, you'll assign preset security policies for Exchange Online Protection (EOP) and Microsoft Defender for Office 365 in the Microsoft 365 security portal. + +1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. + +1. Start the Microsoft Edge browser. + +1. In the Microsoft Edge browser, go to the Microsoft Defender XDR portal at (). + +1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. + +1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. + +1. From the navigation menu, expand *Operational technology* and select **More resources**. + +1. In the **More resources** pane, select the **Open** button om the *Microsoft Purview portal* tile. + +1. In the Microsoft Purview compliance portal left navigation menu select **Solutiona**. +1. In the **Solutions** pane, select **Audit**. + +1. If auditing isn't enabled, a banner is displayed prompting you to **Start recording user and admin activity**. Select this banner to enable auditing. + + >**Note:** + > It might take 60 minutes to start recording activities. + + + +More resources +Microsoft Purview portal +Solutions +Audit +Start auditing diff --git a/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Deploy_Defender_Endpoint.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md similarity index 98% rename from Instructions/Labs/LAB_AK_02_Lab1_Ex1_Deploy_Defender_Endpoint.md rename to Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md index f52b0269..b66533f5 100644 --- a/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Deploy_Defender_Endpoint.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 1 - Deploy Microsoft Defender for Endpoint' - module: 'Learning Path 2 - Mitigate threats using Microsoft Defender for Endpoint' + module: 'Learning Path 4 - Mitigate threats using Microsoft Defender for Endpoint' --- -# Learning Path 2 - Lab 1 - Exercise 1 - Deploy Microsoft Defender for Endpoint +# Learning Path 4 - Lab 1 - Exercise 1 - Deploy Microsoft Defender for Endpoint ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_02_Lab1_Ex2_Mitigate_Attacks.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md similarity index 98% rename from Instructions/Labs/LAB_AK_02_Lab1_Ex2_Mitigate_Attacks.md rename to Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md index 66d65a26..365df167 100644 --- a/Instructions/Labs/LAB_AK_02_Lab1_Ex2_Mitigate_Attacks.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md @@ -4,7 +4,7 @@ lab: module: 'Learning Path 2 - Mitigate threats using Microsoft Defender for Endpoint' --- -# Learning Path 2 - Lab 1 - Exercise 2 - Mitigate Attacks with Microsoft Defender for Endpoint +# Learning Path 4 - Lab 1 - Exercise 2 - Mitigate Attacks with Microsoft Defender for Endpoint ## Lab scenario @@ -20,7 +20,7 @@ To explore the Defender for Endpoint attack mitigation capabilities, you will ve In this task, you will confirm that the device is onboarded successfully and create a test alert. -1. If you are not already at the Microsoft Defender XDR portal in your Microsoft Edge browser, go to (https://security.microsoft.com) and login as Admin for your tenant. +1. If you are not already at the Microsoft Defender XDR portal in your Microsoft Edge browser, go to () and login as Admin for your tenant. 1. In the left-hand menu, under the **Assets** area, select **Devices**. Please wait until WIN1 appears in the Devices page before you continue. Otherwise, you might need to repeat this task to see the alerts that will be generated later. diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Enable_Defender.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md similarity index 84% rename from Instructions/Labs/LAB_AK_03_Lab1_Ex1_Enable_Defender.md rename to Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md index 23efb8f1..33ea6238 100644 --- a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Enable_Defender.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 1 - Enable Microsoft Defender for Cloud' - module: 'Learning Path 3 - Mitigate threats using Microsoft Defender for Cloud' + module: 'Learning Path 5 - Mitigate threats using Microsoft Defender for Cloud' --- -# Learning Path 3 - Lab 1 - Exercise 1 - Enable Microsoft Defender for Cloud +# Learning Path 5 - Lab 1 - Exercise 1 - Enable Microsoft Defender for Cloud ## Lab scenario @@ -12,9 +12,6 @@ lab: You're a Security Operations Analyst working at a company that is implementing cloud workload protection with Microsoft Defender for Cloud. In this lab, you enable Microsoft Defender for Cloud. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Enable%20Microsoft%20Defender%20for%20Cloud)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - - ### Task 1: Access the Azure portal and set up a Subscription In this task, you'll set up an Azure Subscription required to complete this lab and future labs. @@ -29,24 +26,15 @@ In this task, you'll set up an Azure Subscription required to complete this lab 1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. -1. In the Search bar of the Azure portal, type *Subscription*, then select **Subscriptions**. +1. In the Search bar of the Azure portal, type *Subscription*, then select **Subscriptions**. 1. Select the *"Azure Pass - Sponsorship"* subscription shown (or equivalent name in your selected language). - >**Note:** If the subscription is not shown, ask your instructor on how to create the Azure subscription with your tenant admin user credentials. **Note:** The subscription creation process could take up to 10 minutes. - -1. Select **Access control (IAM)** and then select **Add role assignment** from the *Grant access to this resource* box. - -1. Select the **Privileged administrator roles** tab and then select **Owner**. Select **Next** to continue. - -1. Under the *Members* tab, select **+ Select members** and select the **MOD Administrator** account and select **Select** to continue. + >**Note:** If the subscription is not shown, ask your instructor on how to create the Azure subscription with your tenant admin user credentials. **Note:** The subscription creation process could take up to 10 minutes. - >**Note:** If the **Conditions** tab displays a red dot, select **Next**, and either select **Not constrained** if presented with the *Delegation* type, or select **Allow user to assign all roles (highly privileged)** if presented with *What user can do*. - -1. Select **Review + assign** twice to assign the owner role to your admin account. - ->**Important:** These labs have been designed to use less than USD $10 of Azure services during the class. +1. Select **Access control (IAM)** and then select **View my access** from the *Check access* tab. +1. Verify that the **Current role assignments** tab has a *Role assignments Role* for **LOD Owner**. Select the **X** in the top right of the *assignments - MOC Subscription-lodxxxxxxxx* window to close it. ### Task 2: Create a Log Analytics Workspace @@ -73,12 +61,6 @@ In this task, you'll enable and configure Microsoft Defender for Cloud. 1. In the Search bar of the Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. -1. On the **Getting started** page, under the **Upgrade** tab, make sure your subscription is selected, and then select the **Upgrade** button at the bottom of the page. Wait for the *Trial started* notification to appear, it takes about 2 minutes. - - >**Hint:** You can click the bell button on the top bar to review your Azure portal notifications. - - >**Note:** If you see the error *"Could not start Azure Defender trial on the subscription"*, continue with the next steps to enable all the Defender plans in Step 5. - 1. In the left menu for Microsoft Defender for Cloud, under the Management, select **Environment settings**. 1. Select the **"Azure Pass - Sponsorship"** subscription (or equivalent name in your Language). diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex2_Azure_Defender.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Azure_Defender.md similarity index 90% rename from Instructions/Labs/LAB_AK_03_Lab1_Ex2_Azure_Defender.md rename to Instructions/Labs/LAB_AK_05_Lab1_Ex2_Azure_Defender.md index 39c19972..1ad0abc7 100644 --- a/Instructions/Labs/LAB_AK_03_Lab1_Ex2_Azure_Defender.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Azure_Defender.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 2 - Mitigate threats using Microsoft Defender for Cloud' - module: 'Learning Path 3 - Mitigate threats using Microsoft Defender for Cloud' + module: 'Learning Path 5 - Mitigate threats using Microsoft Defender for Cloud' --- -# Learning Path 3 - Lab 1 - Exercise 2 - Mitigate threats using Microsoft Defender for Cloud +# Learning Path 5 - Lab 1 - Exercise 2 - Mitigate threats using Microsoft Defender for Cloud ## Lab scenario @@ -12,9 +12,6 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Defender for Cloud. You need to respond to recommendations and security alerts generated by Microsoft Defender for Cloud. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Mitigate%20threats%20using%20Microsoft%20Defender%20for%20Cloud)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - - ### Task 1: Explore Regulatory Compliance In this task, you'll review Regulatory compliance configuration in Microsoft Defender for Cloud. diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_KQL.md b/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md similarity index 99% rename from Instructions/Labs/LAB_AK_04_Lab1_Ex1_KQL.md rename to Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md index 0ad94c9c..e3639760 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_KQL.md +++ b/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 1 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL)' - module: 'Learning Path 4 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL)' + module: 'Learning Path 6 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL)' --- -# Learning Path 4 - Lab 1 - Exercise 1 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL) +# Learning Path 6 - Lab 1 - Exercise 1 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL) ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex4_Connect_Defender_XDR.md b/Instructions/Labs/LAB_AK_06_Lab1_Ex4_Connect_Defender_XDR.md deleted file mode 100644 index a4ba9ba5..00000000 --- a/Instructions/Labs/LAB_AK_06_Lab1_Ex4_Connect_Defender_XDR.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -lab: - title: 'Exercise 4 - Connect Defender XDR to Microsoft Sentinel using data connectors' - module: 'Learning Path 6 - Connect logs to Microsoft Sentinel' ---- - -# Learning Path 6 - Lab 1 - Exercise 4 - Connect Defender XDR to Microsoft Sentinel using data connectors - -## Lab scenario - -![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod6_L1_Ex4.png) - -You're a Security Operations Analyst working at a company that deployed both Microsoft Defender XDR and Microsoft Sentinel. You need to prepare for the Unified Security Operations Platform connecting Microsoft Sentinel to Defender XDR. Your next step will be to install the Defender XDR Content Hub solution and deploy the Defender XDR data connector to Microsoft Sentinel. - ->**Important:** Be aware that there are capability differences between the azure Microsoft Sentinel portal and Sentinel in the Microsoft Defender XDR portal **[Portal capability differences](https://learn.microsoft.com/azure/sentinel/microsoft-sentinel-defender-portal#capability-differences-between-portals)**. - -### Task 1: Connect Defender XDR - -In this task, you deploy the Microsoft Defender XDR connector. - -1. Login to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. - -1. In the Microsoft Edge browser, navigate to the Azure portal at (). - -1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. - -1. In the **Enter password** dialog box, copy, and paste in the **Tenant Password** provided by your lab hosting provider and then select **Sign in**. - -1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. - -1. Select your Microsoft Sentinel Workspace you created earlier. - -1. In the Microsoft Sentinel left menus, scroll down to the **Content management** section and select **Content Hub**. - -1. In the *Content hub*, search for the **Microsoft Defender XDR** solution and select it from the list. - -1. On the *Microsoft Defender XDR* solution details page, select **Install**. - -1. When the installation completes, search for the **Microsoft Defender XDR** solution and select it. - -1. On the *Microsoft Defender XDR* solution details page, select **Manage** - -1. Select the *Microsoft Defender XDR* Data connector check-box, and select **Open connector page**. - -1. In the *Configuration* section, under the *Instructions* tab, **deselect** the checkbox for the *Turn off all Microsoft incident creation rules for these products. Recommended*, and select the **Connect incidents & alerts** button. - -1. You should see a message that the connection was successful. - -### Task 2: Connect Microsoft Sentinel and Microsoft Defender XDR - -In this task, you'll connect a Microsoft Sentinel workspace to Microsoft Defender XDR. - ->**Note:** Microsoft Sentinel in the Microsoft Defender XDR portal is in public preview and the user interface experience and steps may differ from the lab instructions. - -1. Log in to the **WIN1** virtual machine as *Admin* with the password: **Pa55w.rd**. - -1. Start the Microsoft Edge browser. - -1. In the Edge browser, go to the Microsoft Defender XDR portal at . - -1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. - -1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. - - >**Tip:** The admin's tenant email account and password can be found on the Resources tab. - -1. On the **Defender XDR** portal **Home** screen, you should see a banner at the top with the message, *Get your SIEM and XDR in one place*. Select the **Connect a workspaces** button. - -1. On the *Choose a workspace* page, select the **Microsoft Sentinel** workspace you created earlier. - - >**Hint:** It should have a name like *uniquenameDefender*. - -1. Select the **Next** button. - - >**Note:** if the *Next* button is disabled, or greyed out, and you see an error message that the Microsoft Sentinel workspace is *not onboarded* to Defender XDR, try refreshing the Defender XDR portal page as it may take 5 to 10 minutes to sync up. - -1. On the *Review changes* page, verify that the *Workspace* selection is correct and review the bulleted items under the *What to expect when the workspace is connected* section. Select the **Connect** button. - -1. You should see a *Connecting the workspace* message followed by a *Workspace successfully connected* message. - -1. Select the **Close** button. - -1. On the **Defender XDR** portal **Home** screen, you should see a banner at the top with the message, *Your unified SIEM and XDR is ready*. Select the **Start Hunting** button. - -1. In *Advanced hunting*, you should see a message to "Explore your content from Sentinel". In the left menu pane, note the *Microsoft Sentinel* tables, functions, and queries under the corresponding tabs. - -1. Expand the left main menu pane if collapsed and expand the new **Microsoft Sentinel** menu items. You should see *Threat management*, *Content management* and *Configuration* selections. - - >**Note:** The syncronization between Microsoft Sentinel and Microsoft Defender XDR may take a few minutes to complete, so you may not see all the installed *Data connectors* for example. - -## You completed the lab - Please proceed to Learning Path 7 - Lab 1 - Exercise 2 - Create a Playbook in Microsoft Sentinel diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Deploy_Sentinel.md b/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md similarity index 97% rename from Instructions/Labs/LAB_AK_05_Lab1_Ex1_Deploy_Sentinel.md rename to Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md index ba63f7df..5ffc689a 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Deploy_Sentinel.md +++ b/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 1 - Configure your Microsoft Sentinel environment' - module: 'Learning Path 5 - Configure your Microsoft Sentinel environment' + module: 'Learning Path 7 - Configure your Microsoft Sentinel environment' --- -# Learning Path 5 - Lab 1 - Exercise 1 - Configure your Microsoft Sentinel environment +# Learning Path 7 - Lab 1 - Exercise 1 - Configure your Microsoft Sentinel environment ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_Connect_Services.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md similarity index 97% rename from Instructions/Labs/LAB_AK_06_Lab1_Ex1_Connect_Services.md rename to Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md index e40863de..b9479f52 100644 --- a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_Connect_Services.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 1 - Connect data to Microsoft Sentinel using data connectors' - module: 'Learning Path 6 - Connect logs to Microsoft Sentinel' + module: 'Learning Path 8 - Connect logs to Microsoft Sentinel' --- -# Learning Path 6 - Lab 1 - Exercise 1 - Connect data to Microsoft Sentinel using data connectors +# Learning Path 8 - Lab 1 - Exercise 1 - Connect data to Microsoft Sentinel using data connectors ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex2_Connect_Windows.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md similarity index 97% rename from Instructions/Labs/LAB_AK_06_Lab1_Ex2_Connect_Windows.md rename to Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md index ed50f4f2..ecb0fe04 100644 --- a/Instructions/Labs/LAB_AK_06_Lab1_Ex2_Connect_Windows.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 2 - Connect Windows devices to Microsoft Sentinel using data connectors' - module: 'Learning Path 6 - Connect logs to Microsoft Sentinel' + module: 'Learning Path 8 - Connect logs to Microsoft Sentinel' --- -# Learning Path 6 - Lab 1 - Exercise 2 - Connect Windows devices to Microsoft Sentinel using data connectors +# Learning Path 8 - Lab 1 - Exercise 2 - Connect Windows devices to Microsoft Sentinel using data connectors ## Lab scenario @@ -21,7 +21,7 @@ In this task, you'll create a Windows virtual machine in Azure. 1. Login to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Microsoft Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Microsoft Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex3_Connect_Linux.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md similarity index 96% rename from Instructions/Labs/LAB_AK_06_Lab1_Ex3_Connect_Linux.md rename to Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md index 8a54bb89..c434e791 100644 --- a/Instructions/Labs/LAB_AK_06_Lab1_Ex3_Connect_Linux.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 3 - Connect Linux hosts to Microsoft Sentinel using data connectors' - module: 'Learning Path 6 - Connect logs to Microsoft Sentinel' + module: 'Learning Path 8 - Connect logs to Microsoft Sentinel' --- -# Learning Path 6 - Lab 1 - Exercise 3 - Connect Linux hosts to Microsoft Sentinel using data connectors +# Learning Path 8 - Lab 1 - Exercise 3 - Connect Linux hosts to Microsoft Sentinel using data connectors ## Lab scenario @@ -49,7 +49,7 @@ In this task, you will connect a Linux host to Microsoft Sentinel with the Commo >**Note:** The *Common Event Format* solution installs both the *Common Events Format (CEF) via AMA* and the *Common Events Format (CEF)* Data connectors. -1. Select the *Common Events Format (CEF)* Data connector, and select **Open connector page** on the connector information blade. +1. Select the *Common Events Format (CEF) via AMA* Data connector, and select **Open connector page** on the connector information blade. 1. In the *Configuration* section, under the *Instructions* tab, copy to the clipboard the command shown in *1.2 Install the CEF collector on the Linux machine*. diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex10_Workbooks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex10_Workbooks.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex11_Content_Management.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex11_Content_Management.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Security_Rule.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md similarity index 97% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex1_Security_Rule.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md index f4cd1bc5..2fffeaf9 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Security_Rule.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md @@ -4,7 +4,7 @@ lab: module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 1 - Modify a Microsoft Security rule +# Learning Path 9 - Lab 1 - Exercise 1 - Modify a Microsoft Security rule ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex2_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md similarity index 93% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex2_Playbook.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md index 3d61e96c..8eedb560 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex2_Playbook.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md @@ -4,7 +4,7 @@ lab: module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 2 - Create a Playbook +# Learning Path 9 - Lab 1 - Exercise 2 - Create a Playbook in Microsoft Sentinel ## Lab scenario @@ -14,8 +14,6 @@ You're a Security Operations Analyst working at a company that implemented Micro With a playbook, you can help automate and orchestrate your threat response, integrate with other systems both internal and external, and can be set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20a%20playbook)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - ### Task 1: Create a Security Operations Center Team in Microsoft Teams In this task, you'll create a Microsoft Teams team for use in the lab. diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex3_Scheduled_Query.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md similarity index 99% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex3_Scheduled_Query.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md index 130dc260..499c859a 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex3_Scheduled_Query.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md @@ -16,7 +16,6 @@ Analytics rules search for specific events or sets of events across your environ >**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20a%20scheduled%20query)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - ### Task 1: Create a Scheduled Query In this task, you create a scheduled query and connect it to the Teams channel you created in the previous exercise. diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex4_Entity_Behavior.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md similarity index 99% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex4_Entity_Behavior.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md index 023bbad7..41ef7be8 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex4_Entity_Behavior.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md @@ -77,6 +77,5 @@ In this task, you will confirm Anomalies analytics rules are enabled. 1. Select **Next: Review and Create** and then **Save** to update the rule. >**Note:** You can upgrade the **Flighting** rule to **Production** by changing the setting on this rule and save the changes. The **Production** rule will become the **Flighting** rule afterwards. - ## Proceed to Exercise 5 diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex5_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex5_Attacks.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex6_Perform_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex6_Perform_Attacks.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex7_Detections.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex7_Detections.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex8_Investigate.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex8_Investigate.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex9_ASIM.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex9_ASIM.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Hunting.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md similarity index 100% rename from Instructions/Labs/LAB_AK_08_Lab1_Ex1_Hunting.md rename to Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Notebooks.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md similarity index 100% rename from Instructions/Labs/LAB_AK_08_Lab1_Ex2_Notebooks.md rename to Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md diff --git a/Instructions/Media/simulation-pop-up-error.png b/Instructions/Media/simulation-pop-up-error.png new file mode 100644 index 0000000000000000000000000000000000000000..97a9b261109ce2d1fcef135cdf86391e09f190c2 GIT binary patch literal 4994 zcmcI|XEYpM(EjSt2}0CFjS@A9wZalTT0~hPS_nb()vdB3I!V}&ELN}4yNwHUM&y()tQC4EF$rEoA2}43Y>9#8T(o z5386fHdGX7#xoT7jy}n-(7{Z(;9CY-6m|TjmMXOojSfH8(>20pfD-DGNbD)uyAlW&;_iN%S#>iD3twb2bZ8 z@+BKcD3_hHHsh!avPR^&b#DCTY>aZ?Jj8}Wa`VDw2JV|uoG`naultBCup}VYxb#u^ z=P+?V$XO1BBVxhfZ9(gLA)itGp6WvPuCQ-GeJcM9Yc$-Q!hFb!lBaQCV{cZtaJ%QW zL$^HrZq?7%N+QbNv~a8LZFo}8-c$S6cJ&8g_`DlaSi5==B@y@KPxz<$w$3S9vJ`HOGXYY1cGJ&7;uaYSqEG%*pebWIggy;&%0zF=H+IP0w(M(@}7g)CLbs z)>-=0Jx1kIo5_bwkjpFR%hUDK%y&o!jnuE~s|C%#QpZ9LniQlfND&!^>_FVxca!FY*eul@* zw^fJOqqbgH7RyxiN-`!pOV);3KS&CFuOh1NvqQHdot_jL#xEW(M9HC-{@yj7Mq!oBqWdkBKKgw z5dVo=y>QL-P~fl{RdP)SDbB697yUY}($U;qWF!uLEFZt?$uE!~0rgFRv6%$L-J9IS z$bSj?sNthq$36b`<=`sqUj9%voUj;DrIPrSB%NdIHSgP#SCz0p8bP2aGWo4Xe&>A8 z3$01Loju4?lGjj?&Gy*6VzL{L{~TlZzugRUVFHXqzv5kjf!~iT8XpV#7@S0c|4mTst0G%gfTB7D@lq zlrZ6MD-IrxiyFho4e|BX$R2i9z*CVtO&@^Y!QDD%h(m4~fSs*|%M3wySoXP_NKk1b zANMol%)bAxf;XqA?h=#woM;wSXd8pE+0kHr9X*`jC@GM@q~73?z+_PI90dP3H`UAD z@Ii8kGS#PJrnF9gk3&=M#qY?A273-R_K{%~Z$l%Ve&Qcr068;(!1aVNn6n-$3Cx9X zE`{hXY{kbg*@pVdA2PGYH{P7xC;c--Tlz5*Ib&#_hu6@VJ}@-J>M~|Cz@TH(n_c#w z_2pi{9;4kwK5KmbrTbk)Sa%?l*{ty+fvY^Nk%l%}(l?*C(2gwiiuc{y;oog;g}B#& z8~5ykj2A`+?tH1In?2Jt(i=*K3cM?Gc&-DluTS(72MqPMKd~Fx`cmf9{bZ`?SbR6P zbSuknxTd*pwwt|SMRJMEV1-Hdk}dNd?#mXlVDxP+&8Y?U4(2313vY>n6zb!ysyEXI zPT?h0lER$AoA(**!QCpll4MbVqB-HrnQ7sp*sztePZv*3EIwfr zI0j40YBLFg^zT;ug+D`edrFqMsvbLi9)_qPG>dp2GL6<>$|D>eW)Bz`7wu4twmjP< zvMxuX@)-YQ6ua1A3u1tLkXB>H;_r;fB~QnNeyDg^fNa0Xmmq1*twFM#AX_Hk3s7No zo7O-TdWU5~ce#QZy_8nvVAX;2f=tMx0%a0cG)k88lxye3xaz0PkAA)FW(b_wGY>2* zQ5YLZ$8pP@LrhAyU#P~e2zF@h%)p}7989MVBN}|`#L-Iq_fQ}LK>PfNeq@yl8Id4% z@<=gdTX1gt1A)IC!=YqP{@RSmZYxdtRz`s%w}*NC3D);lHP0jy(8dJ8`tl(#etImT zeDeC5Z{_ALZw}h@S+&u`*>#gLV37Vz?pH%e& zbh^9x(?k2ycSb7A95$e!jdxEji-qefnu^V${hXh1%GwQv*y21FTGF#Jpq1b2D`Fem z@(ZtbJIiwMGrO=*>w;Eu=^vG$ig}@_knnfm<1}71wvluzcc`@CCp4F}yVCd|LMo@Nd!uHE1kmxlHpas#H zBP3@m&6U}piAQS7T-1>Eo#eRXZwWwpUh)>8M_I<>;tfi7SNa+g6F$d|-xPm^@9Ts6187L+ z$W@D65f5yCzg1vlC^2ri1&J>y0Q3Xqx^ES^KCV{)lf&(LZGtF?4zB<-H+j&~1~70m ze66Fw#_xKsZ8XNkal@K^+%s$_+Z1_6Gbqnt6}c-Gb6nOOFloZIJ}xw`Hf+uzRSwS~ z?93GD*tQfJn`&cez!F{1eUxtfCgvn9Ej~&B)VI7(vGp?JuPkRLKSud@FLvnRPTijX zV*oyrp-ldR1gcX&$D2IgxJ_ly!j8cbDsrmq3-(p)fcxF$>=bxQWb#DbU82$;m*=iy zJ)V-~re3?TJ3Yz!-p}Lm^Ov}g-Mm_!ls3LGuwkZa>LqAAM&^QuOnWWu20Y62!257{ zDqT0y>pg92e+&2XdEqXW0?x0_UToBAVSA7RE2IaDm%Hnx5|McwLq|%hmV9uz6_$u} z$H#6F);{t;O9;qW0QAQ9$UQKj1$whR-FPu<(NEr4hEW%g#*Y&6+fj3+4N4$$w%HrO zkFuM*bCcQHG299$zEiVA>t7ZHBDq_#LLzFcrTUbGj6b-WoZdK3ZXO(F-s2x}&F+_= zhGdK!(yKOZxG-zRe2Vg9GU$!$9SK+MFn;`PASXv1J3-I5Y@I4I2IVXmxA(cvoS1+| zJ2$NfirZ~k7k?{r8m?0Uhmo8UIwIxyrvIb``K2ptGc~(3P^OFJu_M2o<{YU9iKgCK zftqj~ni+uCtY)=)uyKvR-(QFAjAQvXN{)H$bDRB4E(%`_4GL2ccC0)y@ZRAwWMfU% zu(?m-F-KzvWrzEpk zKTZGr*YV%;*(#R$#E%{hS-w>~f3Xo)AT@&%dGt*`aA&Y)TR$_G=1dliAs3}z0kY;w zjAFXA?l-<>pkSv0@y9I<+%YZLsrW+Xwgd@P8(qvHm?a{4=Ia}qW0?N-96=(umV zFg|ED?FNHg<1UjI9mEmiz_%3jT(u7UtS7TQx}#L<2h*kSuU@6qa;aPgn}@}|FK?h<7! zs}?bPZz{$Ph|2f#|NSETZsf>D5IfK@oS>tA1GHKg-LUujv@KxL&kc{Tv_zWiKVbEn zCtf3N^|>LZ6`{v)`*EZvvacX^O|Mn{Cy@xv*K0NB<3*p!*}$PqR6{IYGA*hsL>uBa5Z4lUaO<39eI|D zQ4Q=fERr{E1tpEVKNcPuO?VHpEI)Cnh5q?P*ytubAMacBh4aM=%W2ikk>m@ltCG04 zVvQ@q;iPMa9-ARF9F;0!8pWHMM-C7#&jmdz4($X+I~Tpn;IKDsh|>hv@Du&D!F|ke z8!l#1U3V#;-88qpYY`3}n5T1!*s z%3Gs1N;<*mXTIUM{{aZ)i-?Fg*`&yph`iC!t#J_%Ch`Bra&Ij|SV392uW>CfVgv_n zMednl7CY9%OZv^{>S08uY4x!Q%uP`)_7>9)7B?U#^%`#qZG8XyCEdbR*EIG3fAggqmxw{h)Q4(1@f4wqj2uyaG>A(4{L$xm#1h7qN zkhe26Qvab)9|SS0Dl2D*wfUXDqC(fYu1f&UsIEf8f#>Vq5<#~B-Us8tx=T}J*P#N< zr&5^yk+Y;`KMFN27y!R_#a7By^A}N9!NbiBh;O~A86T046?&G88S1x!!jQus+e-pKr#C@iPy! zUMGkxqX(KpCl=J71RcnFOZb>zt{h#KSFfLHAtqW89Q5>y=is_9y94rFS+1P_UorJ_*@Ej^&|E~dF8q-# zvfe>N6oKUHR|ESeIpgjgR9?!;AH0K(W%kdskK9qSot5!KwBV+Q1>Z9akq8*?N!5g} zhWq|GQXDLls_l74Z1>}U91{; z^87PR{PTd*b}xu#H9nBdrSa&|)eWE6pxOcF<5~Va^EKFb z=K*?pGpPlii}8#iSMiye)SD#Q_ Date: Wed, 13 Nov 2024 11:02:31 -0700 Subject: [PATCH 02/19] Added images to Purview audit instructions --- .../LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit | 23 +++++++++--------- Instructions/Media/enable-audit-button.png | Bin 0 -> 10822 bytes Instructions/Media/welcome-purview-portal.png | Bin 0 -> 108829 bytes 3 files changed, 12 insertions(+), 11 deletions(-) create mode 100644 Instructions/Media/enable-audit-button.png create mode 100644 Instructions/Media/welcome-purview-portal.png diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit index 402e78a9..74d23859 100644 --- a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit +++ b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit @@ -28,18 +28,19 @@ In this task, you'll assign preset security policies for Exchange Online Protect 1. In the **More resources** pane, select the **Open** button om the *Microsoft Purview portal* tile. -1. In the Microsoft Purview compliance portal left navigation menu select **Solutiona**. -1. In the **Solutions** pane, select **Audit**. +1. When the Microsoft Purview portal opens, a message about the *new Microsoft Purview portal* will appear on the screen. Select the option to agree with the terms of data flow disclosure and the privacy statement, then select **Try now**. -1. If auditing isn't enabled, a banner is displayed prompting you to **Start recording user and admin activity**. Select this banner to enable auditing. - - >**Note:** - > It might take 60 minutes to start recording activities. + ![Screenshot showing the Welcome to the new Microsoft Purview portal screen.](../Media/welcome-purview-portal.png) + +1. Select **Solutions** from the left sidebar, then select **Audit**. + +1. On the **Search** page, select the blue **Start recording user and admin activity** bar to enable audit logging. + ![Screenshot showing the Start recording user and admin activity button.](../Media/enable-audit-button.png) +1. Once you select this option, the blue bar should disappear from this page. + + >**Note:** + > It might take 60 minutes to start recording activities. -More resources -Microsoft Purview portal -Solutions -Audit -Start auditing +## You have completed the lab. \ No newline at end of file diff --git a/Instructions/Media/enable-audit-button.png b/Instructions/Media/enable-audit-button.png new file mode 100644 index 0000000000000000000000000000000000000000..b54aba577db1b6c799d203e1d3889eb79478c0d4 GIT binary patch literal 10822 zcmch7XIPUAojg1{EHMx=>|NDE5uh)NfbUJOO)J%rvBwy=>VHMD?~P(tsa1dK=x zMF>TDkS36TKxhepFYZ(RpYy)wyRMWqlX)ihTF*SQ?pbTaywp`^Vz|RVLqo%)sqx%^ zhUOxWDwD2UrhY~R4USO1E_fTLKc%S}=GdS%=p0paRA^{w6B$omU!u0Jf;G&&X=s?c ze!nmDdY0NzJ6U~H&3p_!9en&>L+okPA@=qj-cFuAR>oJTmk6LVpQ{)JSP|yWT|q~v z_1)78WI{A0|7gLQDIclq<|9ynd>_#KvYtoMt}OrRgjIU>8hzRmy0dO(I?0a*?$QrI zo8SJ7O@A)UcT->iS*s#4pphh=&gXv*lYZ0K+O5*AH`9fn<;T(A7_hVMt(51z<~^Jv zZhb${L1}FNf~P{3>|$rAm3K!Rx8WI7F#q9)f`=bmc1du=ILkkBfko{gBMr@46IJj9 z8k&W>NUBDje}Jex(pRX)`OHoSprOGrMNr55x{Ri36cCBKNJG=E^6whHBdodOf7IU* z+SD;yzHouY#?uLg+gr_9(dB{;?{I!Rlqz{`(s-Utzw+6TbL^nUIg>o**Xekj3NhGp zKN8bbaIGEk@=#uduZ>xA$9Hxy_qQf^%ONHp%X-lfTgmk*3pxN5zm2G?3s|6iX8SKz zT$z%AFXy2>k!h*lX zLXLSe_dRy14Ql))MUkMLv}gKG`V)Z`e~UCy%@*L3uFECJX`SN|zT5C8_e{du2ltQx z(YTAa(NXm3xBg>&zANI1H>|$h$pU~rP{x)nLwi{?ciJg#-7$_ ziJwJ#ot<`q8$KL#KR7&_-*Io_lg=`YXYt@f(tk=dmyo%_cWzx(&3$xAD+K?u1TVn?PJm}$fl#+n&SAq~9vf@_JI$4SXKGB?@ z<>4B8^D|dUU{AMf@y`)#Yxw{d{}4bvJmX~XylbD6hd945&I zvf4?a9bPP+!_^74d~Jr7jvw1Ph6rAUdTjVzw8_p|XrP%ajzY%(XeNvp?=P);WR%H% z{sSbKk=zlk@X)>bYv+QJLG3{;umx(IJzmxEbEf=8cfN=0X=Oq>qZ@Ta4Q!SuLS$Mi zQc67)MNt#OpB02P{M)c2;)(`HcjfxY>Lcxv*`XtHk(09ci`(DNjhcyi>GTg2<7;ik zCq*ui&F^0a5f5;oiOt$mZH5Npv>`~K_YTW*%8;x)YUAt^N9dv-yM=XHOFmcN*#QH( z+k~u5fonfyF@^sMf*ixdYSzPjZ$FVdpaUE&W>Jy%X+o7udOJ#$-WX4++pe{R>97Fb z&0g9FA9lEazO$2jv~2U0c?6%ROwe^zfons?3cQaGNbeXZLjAb9 zYMs`)2M%rcK;dB(xAgOD zfU>9{JWso1Y8O1myrVgerxirkX)9F}2)eTwXZ1ALvjZa^F;s@l2*DPmns5Hx*f|eu z=WY((pAqn%$*z!$h;5Wx;J4JXpDQ0-5GYY@=2ZI;fBbH$1Wy)Vm8SJ?2Pm%_OuS`( z!90-N|0(Gj(B9Ek>%)%k*H*%*rP^oBv}-{6qICr2A&+csg%J}?zQZMe_pMe-xy8Jc z9}ue`Vl|@KUz_L39odb*e02z^SF>xRK=h*&vNUX7H1>5@dFSyOblvFJW5@jZ1d6t& zzvdCyu+B($V2%tMtBQ6W3CqBZJs{{QiYjhuZ;#pK$;MW92-8E2zgWNXG|kI1?#j@| zlJ(@CH)2M4C}~J7@YOK4g9e{XuTB2uafyoJkd!Kkc;iUSI)Z83I-}Fuh{O*aoDK=* zyC;IIs78nqtGCD!ELtN-i|uBi&_>USbOvDlL^);5-O#;aX5ymn?6D}}!@^VhZ71t0 zM7$V3ZAsATF-AR-KW=Q>TVQsV6}^fZ>GGsqy=(=EIzVQXw0iudMF(xbnB?ad!ncj6 zyRi{A2bY{uh|qTr?hf3Bw7;4$YF3ZNFIIgAyMa$s!ts~_=f7CAt&iUyEj{6czWJfT zdkr|hK2$P8+8H!IwIShaoAxWPNaaE8W+m*6({c4Q9Bb*3f&QBe;|R={=z+r5&Yw~H ze;nRml>3nB3A{OB@2lYD8G|@9g*nKr5-lpz=0+#0S&E|Jae}`Q!$W$n@kOZ5mn?4n zRIUxFE4fM&=c00-%?#noopKW-$bpIUI0y~i$;v~3J2kSFilmSG)sPmCzPUdc(dLBw z(p+Dc!0$>nUhrS*{wu|>?$y=xYh#Pj{*g8Y7(D;rv*}CO1$U9uf@cp2${OF zq`lFs&7ph)DQj+JApMOC{R-wjFXgNZ<~t{aO3tTSplWGtUUXE)>URNaCfl2lIHQZrG9_THYiC-)J2r4}Ao_UR>y@=uP@Q@K`<=DL)JQ~LR-|^Cb6oL~Kiv6|}OGSFZ$5u1l49E7}9gi1f1!?yMruGn* zQi394$;xlq*daPp*jy-=cXsmV)nCdieV?am_Qa0hp?^*(S(fcAnPuUj%c4j0z0%%I zxQ`slo%g%hLL)1JU(CM4)ww04xs%rBeP>M~!rp0r2$(W?=$wJ`cZYvn0D)$XuiTS;!kq@uk0guwFvaEKptelGZsUUNdiC$HX9O;E2; z>d2~u<4XEsm@Igufhg+;YWVS_nd3ul&1Tvc@;2m!xkFGEfmWOx{!JZxJydfGG7jAN?471KA8RXs?<3jveiMnJwdld*-nDe>idp<914_v*k z_gm4PvRf}U8GxUeovgrD*+~@oqUBX9+0X^6HY4th-kJ~Mfg8b0aZ7^vnV%}?u z`;&YyNKTMK!->B1nb&A56YxntiyO3A<``rcu270Mb&4E2Zz-TmpYboB2fnVjpm(-c zRrQnqyo;OU46WiF>20010_&T2kEL-`i%{}}CeKpNsg(5d!e~1VQYC+IKCUSms#sP1 zWi{0|Gx+G_m=8WUW9>%(AB6ay7^>T8PKyNullp2(FA-HVE>hc&v(C)S}2o@k~AM{Xn|b^KQp?U^hiJ6LWkXG+9mM zlzmHMnF+nKMU-I6F~9=o;9-QejpYZbL&FA|F^6EUJ|IC{}CmtH=l$5Ih`N^jZ4%4RCZ4@=Ef`f z`y}$j*8N`=Bt(!P%XSgV&g182``Vpp{9)sIzY(NH!)LwbbGQ6Z4!$ezi;C$0ir#d$ zejk!%6ydW6SzX%kfjl~f5wW@s&f+@%T+s=iJ<1x-0E|iSA;C@W#}0_q4t8#<@7&yG zm~8j+g#l`YZS$_ao9R|}%OP6l^NKvS{#*kybH;&kqnv5NjTPJFs{ZGU8=92%VG;pQ zSA4lyN<8T-urbJ0<<_?H$M?It#1VEA$0A3P&@{5`9%|k>Prmz5&ArfvY?X3n|7lh+ z)$?Y;56yf>`iQiRkKGWFr163rRL#Rk@$$_^_qz*LA2-@q?CpbMnbgeWC37yD3L{Tn zNQSwXyU&?@1hCHQ_q){MSPvI}5~|(WxRVW~xjrbooE;xwoqr%?A1wd)Agy8}Y<~Np zV4;hFt(C?zaDJBI;oA<-ZN%|OI(uA=pNkArl^HmHv-B1ta0tPf>(Qi+$VF&UZN-Fs z@1lzeH8dgifR7kucT>JPuA4>@idNpmQJSo+WP%NEjW_r8&CBm)H@{F;6ekgfXftzL zd0k0k*vj{VOJ92qcn=5$;YO!V)l7&rT^?#Hu*_fwvl&XT7-Tb!upY<3e)=@sm)1EA z=v8)BY%O{C0?68D5($`9*FfE8u0m^CqMWVa&7ATdoQN$ zk1B3Qd0@E<)>X7w%_M!*tjEuqfxA$wKz_QNcjx(X-A-k7U(EMIhi0a!%2|k}9(hye z#B2N)o5D&KyvN91RVgO>8lp>z}S}4?K*W0=u2+DetXjYH-{mUG5E77(@Jf# zauUGk*+k(*^p~&3vS){-ITFHonfc^@}#cy_a=7{$XkYpY=u$HeL5+x9SM_l?IY4ftE7> znnn}o0g{T{*<)n1F`GaZ4w+BNG@;}mZJL+_fLR#fGPJ7x)*7Dv(gv(s zAOauECP=iD@`JWf7?3^@mfA57jfkCz>ecxO<7!y0wZ3msOhn0SANr|T{p3tT-_=-5 zQIX{AT_B-yGO+uUv^e7Q86gCi=$NAdKQx*s>S_NNg?lR5m`j*qf-1UxV*YHtXoL}3 z_#Vad)aNd9`6d{zVi9VnkRIac+~ni^1II~85YA!j%$(_w-BgDXMBN%9=MsYneMXqIQ`2Z9Xa>=m3tSL9k9_xPntC_W+!wYpE;>Q3DeP>Vi)WUOpNw zX*&o)G~{S?^|_^D2XaNOlwc*AbZMti4>6=l8}lNOo$@ueCnjLc)Y%N>{EKC`Tth~x z=+O7LKsg(=d7i?cM#}dCwglx`it1MQLj~95I=oP-JgPV1Gx=rl`Aa$48^!~E+}Trk znX9*To7qfctYZiw)73!s1f6fS`|yZ;&w<0ME}|wnE`yBDSAa&^+&IDgU`G@PiTh)7-fT7G($QxYj~Yq-RR+a#QXoO2e+8zwGwvwwIl zEwI1Bd^FB9UyJSgsYMqNV9W>J zsii$jxC|gK^o&JtU`u*nLA(6Ujv7BG@H{X5eRxOw5~I)Kk^bB7HLP_JWCW&T(Fzjq2gu5s5zx+cgW4I1H z-0_^r;iy7UKJ^wIaJK%j{~)}~YT{U~E1dK+z+|8$+O980g<(Cv77gDc7Q@VA1zlTn zoTc}RNy?7Hxv9e!`I?$j!?Y>ke7x&K^OCrYPltB@rJQ8R@O)BZ+D*0=8}9eIbBwHE z*~}3G-wJXB{|Xny#5BW#X%Uy8D`3)%yb_M0LUr|tUtfY-+uXH~^G;{0-FcO*%A} z6Df=WY(JN7DyD~qNzRiDCFjNK(J0oX_+keRMu_GjHlNnEli_k}K2wDD>Z*}8_^~4s zF~0kf>{?uNF^)BC%M^=JP!!@<%1Em%uwc$acOSa$OvvUpt5E!9P9Je7Bl&HgL07-N z+_;Pfa}5-)CtZdLV%ZlkMa9y7iLqzG_HClp>1%Z}Goh%#IgG+8`FTU`a2a7gBw%9% z^mH!ZQ_}^H0eH?o4v|V87?q!>EAHmY{alb{^0V20*P1M=&g7D$^y#1=#%{(wYN4Gj$OYbM>g7Cp4uZ6ro{F0_WA~=ZTCA z_C1!jF2impu@&Ya^ygW6?qq(IFku7=KH=>AR6L>^*-?AIDT%TG@5B)JO|}gmyU1E* zf%A%6gl&hhAa;M#RebQ_Y#@Bq=ovVWG_JGGI*z!8c!HR?1sY%U+$eFuH(c6Mc@G`D zYvXx^1&XP(XNyrpr6KPZukSA(D@aHojq(;8l|c!L&dq+VqYLH6)ZI`NW8k!q(Z+#- zHtErA^)u^Qvob8QkXd$o^Ghwsv_7XR%Bqre!+r9xt?%@i9L&LmrInLx82axF|lRyhDMVLEV01g-6y0(tozvmgA#1U|&2nl%$SQLtx*n z#w46`riNKUZOAh}#99}GqVLq`Y&Xm$g^o!&o&QQ@7Ct{qn^oDE^4$%AZ5@;(Mw4XV z*3rG?JylbD8^56c0sN0~Xkk773xV^9E zFY~+0f>shZl7YsJmHU%2W}Z_XSN<8#WmWAR`r_21Itu~W4hki1W#A%u_IZ&K`LFLI z$I)b}hfnmN6O_2@MF%yhJ;41qk>f{x{R4D(OF2UO+pl!p_YXE;;_Y!pn>|Fs!;bl- z;K(pH+p5LbR>_@APM#7!EpizCZodCyP4N2XKXQU}w-%DbfI~3)=EW5sy8Wd%{yWXE z>YU9Ee7%ji44Thg4%?geIIs3-LS?IH9jz+DQXg8x`Bw_&?wS9iMSb1^sCWCh9WU!4 zv_oX7t{rwXfABMI%1s>QKxUcJ?vdNM<8ye!pVPsuB!7jbv^aNJvjq52p}jp+1)DJCq?teLVv}ZB9pS?WkVJ{iefmGP_>UJt@PDn ziw>vT$6sD=MLu_1*VE#J=0@8o!#SmuIAdT#Fz8B%06fwpBw*Ls)V@R@>?0;?Bz0rR zEGoVUj!Oo4)OKoPM5=lYKBdQ+`=>Qy|K2u5?RfZ4Z>fZ*->%~HJZxeIST7DQs@Sev zlfKi$Y26T#<*AK^PfP|*HjM9PwgKy{vIDhsQ!+~$+#f8!1W}3V`v5IrsK!i_f%7Zf z1Z+nh=rUVx7T#ScI45Y@NWrSmKJYdu)oFQX#u=~shdWN!KZcX11syH8b0tm6udVQ_ zpBZl`C}<|RODLXqLGMkN5Jz9bn2L~VfY&O0OT)>FK;>ndF{f8ofkA;^SzKDhn6r`? zws=T`ga@OcH{0Nw?c%_aQI{(BxHNh zH)O2}Q!%w!9p_#alC62hDHz^45VE-u*OWG}?Af?1X#wR%t8!}0(^j-4ZE=bdXb_8u zQY$v=nv2)p#o*sw!V8nIEB^1dW>EFxKntB8*|xG2v$sw@1n^6hv^+hve`UEX5*%%a*iUmUFJ>d zdaFysgOqPab2`k3X|P#CNZR3!iS_quJx2FVuK@j)V>>uo*dcrM;1UL@Up2uuL%uMH zx9~clhXFgv!Rp_L3Ag>KqpPCOF zU}m?a2GwP~?2#3+i$cdjPIi-s6T0aJu=-f+3e>pa+Cd1Esh4Qz@~9z>FrL=x?zFLm zwoFth+-T36JA1P==Lhf{XASQy=9|mKLRG~lI6)TfFd_4;S~rgE#h4MXF0FX7&xE_0 z@igRHTA;VbWK*(ISp8|&k;Tt|`1BP`u!^y>{4tlIKlt6zCNq$xT^&3vas@~SRs0)w z5wA!GosYmh1y4s_0e)V121Zw@fTx51Re9MIEKA9eNAH>SvXL*;z;JbUtHZmdtGLLm z?Mkl7Pqk-*z^`Gn9fE}BLseck0p$H>+GdLZmYfl9D=$OsXiX67y0g09>Zm(}+4|d& zoY2X3r@u&%7`8xQ&dcC*`=t`=<{QJ(e7C8Kdv#X-q$z5$F%9=cj{el)aPiY%tXio& zaOvE<(?QX0?992ooo}yj)Y|9p?lU zV4iPJ-(2?*T}=Ko&J7Z4${!~%RhFLpo;$?xaN?i2rIAJ9?Dvp&tIlxAUXuxGgX{+}m0$#33ZoCl z8~y(6?9qRN$oa_1<)%e{N0;!WR2f<1uD&{Z$HJ6?e(%eCJdE#D$ppl|3-=e?=3MQe9y zE{m3Xye?L1RTbZ*5pCh9yS%&r`>=_Q3rRYSp*i9hFT<*SRa9u4bv<{~+!0|bt~Fqu zSR1$#^&)Yd56Y;F(cJ!0Q88~yVPP8hi4VoTzSJB>@;&K3SFk<5NF!n49f|ps@nU2I z(~j8a*JnHFlXw8AHuZdR(H{W+6~mxl>dL~9Xw-;H7DEY{s*fuq_W8sPKHYa8sMPKf zlYyw3NF6LT(m^F#?3)Wu%5B9e7Pz^xrNYZw8;hez>(2eN1fla@A+hp>Jd_wu;WF06 z_0MT!m_8)3FgepwiIjA@sjSG~r5y4!>;RA1BcJa{o+x*o4TN2xaY|jg449Xh_P=cBshM^E{%Ck0zQ28At?)G)<%M;}BdMK1?IqAKF`GRpW+Mh~ll+)!#X&Xz zR@*s8`v$LHjtf%zX!R`lP7|zTX_PHk>gjB1=O91}qwxJy7BJ(gCA=Y{`8wi+%w9x2nBr_1%NJ#t zzs`1&M5HwPuZ|qvpn0;~5CGQHkkYb`AAj>LW0gUB)cm?RkdA4!Tb1m8X=(Zr_RpE9 z-4y4m+24mwYR4Kb#e;slI$ghkrre|k-pXf6(-Xy!i@b8Q@VQ*SD6dz=z8R2KXq$NQ zRGu};eG&Y9cU{S{&a+74MWOkFz)a@IZ^bRCwihEg&wEo0T0htE)EBmL*K>H%AN`V{ zV6p~RCf3)BjTcuVcDui5&_-&1^JJR8K$BIx8ll~ubW%Q-o1I#F`u8=KS#2hd!c?~+ z{NihW5BQ~g95utM-_OD#ua|W{B6jwXT>gMWUyK?MJ{ni{8)SX^sN{Uc>+jo!g1&bQ zN~-t75~5{?U}`u1Oj$w`dfRo&8onXMIY3`%4tk&8)5+|OpVpTg&iNBDFLRTqO?{$F zCJoT``?)T0K5uWsn6}@2&%ip$K*WL$(&swb9vpRQNKkEP6wqU@KWTL2F)tcSO(n$1 z$`pvAOFg#T`$8&`be$i;a0YT@1D9*k)U-b=;1L)f0IqdZ*u&N(XDkMjgM=5?%9mDuK*?Y1Ij!nG6b;%2bnW2! zivAQ*bmz`dt%qK`KqFGtg6P->BVTk!A$YymnP^lfSGZ%^!iPOPi!If!gX%yE zu@F~ht6QF)eLuK;rMn=zdc{1GN4YOfy&l~9crCce=IcUmez>0Mxuq>Q=1y1sW{sfY-AZzS!Ak?r`Ydw-T3;FSl!WP#m(yev|3F`e*uF#2QC;S1gyX7IX34lzPHgn zC%BM&qBo={s;?~Mmph`D^){gS;Z#*zzg-Vp-rLXa#TxA6n>BqV@09}3NlIAUNkO2G zmAg=EKUse)BDPMz`vufd~Z_0a=O^4BZ-)h5wfaHNvPsXnr4RA$Ijw|T)=7roD z*6TZk%?t~&WkYs)8bH_bJjUSR#Fu$6My2XK83~$Cd=dgko2i-h*Fb{ZT*xcfKCRCo zOzn~K6X>qQEt*gEe}HPJwP&mKbw=aR)iwLQcG*IG%*eXq2g*t~?RWL2dalvSG!4uV zj7{sYLdo0^AT84>{E`1Fg){CF8XA$fe{VV9|C|W?%e9I6xBeqOQ=m}VyB8zbRbdBg2wBdBVC-_6T0Gk5=PN%&B0^QCYhuEDxew^x0IUR8H7X~KxY^BiPnOr-w#`Dzz)%Ij#L{Hp`gnRg@2_op#h-zW+iO4grz z(7)Nv|AJ@QqpK5|b{kR)v@5$*Q^zjleo|8VnlQV%T|U6v4*T^-+Gn!Ab&ArRa^|GR z`iz!2qSnDhJ%PNztFl}H(wKBmcj~=k-uBJ_v%#Z=Uy4gt|7I3wHmKk7^>bAr{;Su$ z)g$EwuYS!XRmgs`7}%43*FEjy=XQyiqfe8s+&XdKe0VJFeW>rP#hu~4$5%d0esG_A zdi=r7U#*=^rH3A`3-jT4Ui5k2van?6()=;xOn7g=_7LpityfZ2_TX@Ob z&}*HOCQZ|QOD*MuK%*Cv3L&Ze{o!ZcUkxy?DXAU7tZRrX7QorgcFni=kENR%Kd8Ozaa_Bz!|>1C5B{3rQ*vfN%) z9myhrrea(ta{#-BTJeCB1EX%Uh^N{0u_1awZ@Qvy5}NgU2`<0tsD%J(TxnENH86TB z&9)D+RjHGLJ_D;o!i`l8og|D^aV!~Q$nL?CgB4~}h!T~zAr4JaG4^#7pp4rx_=6hdM7K^)?yS48?Cnd0|MNSwt!sO{U`Jr61^ZEC+;*=*#-+5n5C+_Ps z7^=@Pq#}JDzK>70dHgQ9Fed+l6j$Cc+q*WwCc!A%R+*xWX~?c0@zT4MsFE>B@vMf; zN7*M;kB3Qm9}lgj(9+{hlkT&pN-f%8OSUx|Bvo$&3-!XW0?z z94(S*;1dtNkO{PdyWNh&_85?Y_93A=gjl$W0T2ANo+eDAgpBs>mTqpuIvdA5$PLio+rDB$p}!2X_9$2>%^JY7BwKp4wJ^~y zBlA`;A({1(Ni=1+w-^&{*&%M0poAqooH$u+#gjxlch84f3JsBl8oLOR5m=f8e2rdb zJZ4HU?#9xP_}SYkD487SSuS3&2$6yv>k$t|V@*4v(hsFWc67>GT96;7Ycv+n{5vEa z)*@x8J40qY^*m*BIPh_tudF=IIhr#wpOI4Fp;fiVN$74X5X0NU@f~82GVjXehL;uKu;uot(M>=c2FsH4@!W0Mr6 za<>Wl^+sWLxwY}!hPZl--1t;6A04l!!~kxD{FH)ht@D;&*NA0Nvo*ajL_A-zV#__8N6Jpy5Bq#$Er}+4{wxn!WkXQ6CFCY5t#`E{u%eZu+ILQUNHNIX zK$FG86<$tQ=dJLXw6-ftMtjk(R54Nuf=X{|pPTGyl8(R<1HP9NUV$69M3%K;V7#jn zCg_-{Er<>o%FdAS%eXPw%juKw`JMxCZ`4_C9HJvp+aZAK;e*(XHK`z>WiNAi627vR z!7||+;Sed})Y~qrhiZIfb6j>=$T$Q%bw%_{Fw`)4bj*4JpTA`ThVlw}bf5!bCdASc zX-2#xqr43a1322iRUmGO=H>QV+sVn~NR2xa?5!O`kdgthqFV`iI!d_cutmX2EQ6k9 zi>y09_WFm#Gs;*rd+78VJGF#2$nFs zJ+`W2r7?WXK(>;u?inlBy`8fc)9Gm6IP?@7O+{>kRZGb@)k?K@#HUB2ed^=IgG5_7 z{p#Gb!3Y)wC9UpbBTrR>8UkN4WdwEQ?#bsvwg~NYe7I#p^$tND_71B0-ukEvZxv&x z-YtX|xVku4agBc6V7JF8hrB1(M1j)4*nKKVxqi={KA9u(hGE0lEL&x8p**H?)&?%5 zzJ3II)2m|`dy{FBmFv*Q-6d4tE?Cm*_;@J=!J=8V3Aj3 zatamSew)&vV(bX0IE?pBG9@Vk$qXh38Sqx0>y}KiO%^CyrUg_Bl&!QG!5#=+0WAg1 zRA&g?8i_%n*EA4CiYpPD+!6EM{_myRQOdj~@X}WaPPx#?-Tp1lEr)W!VO(FCNw08 zgYAxU-kDtQK7Oq9-Ath*c;jbt>x&;5fI_DX|3!>`S!TB77iQ@(Dqelz=$1Xcf%1!) zZ8v)7l67d1D`b`mV>ge8V+9qVWU{56QC1y@%~xaBDm>ii^)bJYeZwf)yPo)X#g=kh zwu)1I{Am==rYup(XUGOO3S}8R?1)FlrT)MYqU5J8Xb~4&PK<1lQqU3GgfQRQI>+ z;U{eS4jA6;=JFjKiOq)|+PTX0BbyJ=6<)S&rqC6pg2lT$8(>&p*IP=4PCi8}_j)dr zxP@_*8I$-#l76%QT+t_oFd|K%f5dNY*lvB<=Q*-$YzX;xYUa}B`6`^25&V+=lJSJvJow*P0t)2(5VC#-iPPofzk{Tta_<}Z1iE+NyECse5>{l@+Jzd+d_d}1i>+-5t$%Ld) z72lpNg3bHEw%Z_^tQ*L*6o{GqYS$vG5J=t{=66pC-o(iwt9D7n=Qk1KeC!xo8qonh zWZY$`2rO4JE1QFj%zEyrMOtBLPA5M;thOs8mPDhgMq;GeJ%sN0Q5ceb?*s$mi^
RgiH^K+^x&DsjdN9()|Zl`P0bd}8FPNptu5sbnmjIL z$@z^A@2e+;Ripfzh;G%{oE!;i5i7%6-WWguh~ktc{7O3(5>G>8nCR$&5vHt@)XYs^ zcSroK>HcByLp$x7De6Al2*pTcj2EWlL;i%as1{5cW9KqvAv#@T_cKnGq!WGfr@gN@ z@kmBeC58D-xf0Y(`4jQVjFo6mak$k|5x1D>r_g>Ld$apj7}Kh=eZ_c`yi}7C$$b8F zU^T2UD}ucrrAmrT&4E!44b^AaVog=fJj$Qc^*mcJEKUJc3tT=|7_T(7(*5>_eETzk zuxeOs=YbX_+vS(KXO3fJYDqSGIO`x@H(qm{A6Uf2I1rPh>)) zAjZOr2axuN?JS>aD^N|Q3I&%zk1-9tU1+Q?0e@WUD3_H7+5vg)%{12{d9?*9tt4dw#i@aE;}vTj*kFFz?q!Y=-rOS25@`&&aoS2xq&rtICYv3D zQkgPwJ>|oO?my&aJNn_~hv;FlOt$Y(N?aY0Jw9toid7oaRgcEy7YyA(Lu?2!Ht~|K zH(iJyeeZr@f7P#oOJ%{E<(;aKS^K6m&GbO2>Ic0Z^^(3jq?uUL)(;VkK}Gcgx*s%e_CewohT>rAflf{KhamejzFb+fQj#K}cOojaYPL@W#j`F` zj7v4gnsnWL+#Lfot+72;yYQsl@?($p$_R0(p7DRd3|TqpvX>iVZrG*k!G}b!p>_%s z_3<$rfMB{qd}_uxr9qD_L*RSIs7b0x0MK_)O|so1jqU;dhUW6?Qr|^T-&Ll{yYv!# z#X>WJZVIHWWG&6~tU2oW#>|cwvIKm?+;k`3Nopt?z&gGWG=TdEY~=0d;JRg_lG8ac zfluu+!mgY~Uf;JW{GMIL`8v+FVd>&oX%Dz1M^CfeJ4r2qENh7tlX3_Q&6{bmY0rlG zi7~jW0{}1*!B6jx&l*sao8eZ=6x+!dX0aL^L0yT*4C?dwW3oAJ5H+ZkMIy~i!AfqY zG`h$8-1$}G{4etWUxI&ur%cW=00KR4W>}oM({9#a118^)DL&{Q2+43T{~8q;Hhn$! za-o%@WQinQ`xZU@)S)4)J)WAvWzWc;v2wJ8>BOe(FHw8g>BrJcN}r6n^zx=H0eiFl z5`EuER>Y_+>=~t@^9+nT8}kRkVA=LLJJz(Y`QnFGf@1Jn`OqyG6|qSO>VqF_>k3ey z)=p_E7z#mEfu0qAAr_qG2Ybk^CtZ_FV)8ns&t3sw;|sm%rmY6MV7UI~^3BXHOzG4~ zMQj+Vx5`}urVue|3Ir$oY~4wLZ54j*^n*Q%O3ddIUHS|FFzIWk>A$W{)rTJ7qC~ec zg%hkaPL*`1WM$aLat@jXaQ8q@3Bw3?KnVstJzX5`U8ERWptg(Ux>20hq_GPImkfOl za7UJ%N9NtToLn#g*dT9#3cvIJggnqQ{(<`w=J^NU_NcSV2p>Mb3q}yP>;f}@iW^w3S0n)oO54RL7zEx_epLgL)9N$4z_^qr30NlLyEdrmh~8ZP5T zU&8(P_dS^CAnybvFc2wy-LH_`0X1AC)96>)WpQ2Hv`IGcOB1=_%``>Ki+)wi%YYsW zfR~rS*QQq2v~lO|m}>)WdKyqi07V)iZ!LOW+UY3C*0z;#vXUCQ$&A@@#sHsDjI5 z33UcU8bozU^UQ6QO|q8{iH6wLMb;PxZ=Dc#BN#kkO?X<*2DrB=qeO$D!|Z?%gr5%} z&v7PeW5|R*-s~*C7aIJx7ES2&j=)G+WcM!)a0V2`{BCn?HEvOmC#puOWR55=x-%;tb`aH2cW(0ak{*h%rDIQ;7Zn)&3tb8E?mL zI|RZF&CakmGdU$q*z-jnXWvXi^uk85Jlnn5E)ELDE?85v*dA%aG@g8uo&8~)4>8NtU~tW7X<%IA*f|(Z{MuzkJ46l!0Itgj>X(*L_G$dlgW!G0fs3cT zkH7EdL(GM~GC7ipa&UX)SpzS&K~?Sp$<a9y(0% z?|mF3Q-_fwx&28*22(Q0U^w@8EEqJbWs;qyUL(%l?!SKjTG>AM=lW!uWSU%71J}l} z)=`aCZB@?8y);w2wYzs=41MG_|JYjGV7b7lm5}EpXs zi(9^%**01??+SU?1FxkVZsw*=BJsMe-btz6^Po@Tv5+`0wu|E?tnB~;0be^6tvJOt z@d~A{nIfut8Ca}(+_0x3{%Vg+v&?~0c_@woTZ!1#e?wKqOaI!P+h1EB1p05D3^?_r z{K(b$#a(mdU0)h2E_FW4MsfDfP0LW)=`F6|(_|xfTDz*rapZaUD=YzOZUmM?)Ve8k z@X((FXu?J_#J}~aP$O0g)i>7309@xTqbb$r{6}*xOQvHo#sjKk9tu`ii6FE&?Pj*i zZi{wE#g!|6_GPsh;^vdW@ae=SbS+H2tQAhd3M@M_8Gx?DGQKE&MBKcuvCGNQaRcBA z3Kchz0zd_R3?3THOsKjeR~HQH*TL=;x9s4NR>8et#$8)9|LmqubC?`7|EKV^+=vY7r_!di5I3{2A323K*Y%@@?==%HdAXIQ^_Flw_!MwmOx5)vM3Cvvyk9 zSoeLucP$AkmZn;QOHDzk{%uIt6aLcKnf9nSuXgBIr1<}7I8UD#Y<(M(9-U@?3C#X) z>1pO?1nM?@o?;Iv#v}D`N5JJZN1Zr3l$(a8c^zyUd}JlnL(DjR0+c-yw`e~P6Um`$ zUl~u_WfJ3tqJ>rxCc)D2Om%i4z#p^qj%M`LfwEQrm?8`cH5di}v}D;G<_V%ibCx8d zB;vY=$pB znY=p7X==Y{BIsz%0pEX^jqv$PH;lq0)V0$y%bXBH8l=WTC;-zw&mv0E0H{kbHi6Ew zf#K6rU{xPQXNWtSfUd9!imxM%G?6Xhjb?7@x@zBKy2>5q-DEdq*Sj-?m|P`%mqN*G zeLRh*gs&h0C}ZN4AF;MBUV&9 zszK(t6-9>7a<8n>V@c9Gf{SV^+wC*PIj!LQW zlRiC?EY6m>X=Ff=6;G+%Q(_3P&3Pu0jN21|MOIl8=Djgc(7SBg0i!{a1^ft?B|~wy zgL|tp40uUT=nYTm93?H$aW}~S_;M#s6v1XG_+W0tbuoqk)QZ<~Ic+j%QXW8U=fn7W zci(zyNw%|QAy@)e!cXW%Q8cCtx;-ytq4X}>$hK#b8gVKzIp728y0RFFf&xg4ByM@7 ziJZ2Q5enh>6z@#_BA-49F#{AFD50X8Nb@WbtN@^fd`Ca>XvS2XE?hAu0T>|Kg|87pc>{o+BW!!(aIJd*Ec;HNN z$oH7M@0ZACpn$&+dKC&&su67@IEslXOo2 zdm~-M@aIZX#eBF6oEeBd1(VwqWyf;IPC(KW0OkLiq=Q}G(46O)Ja$1YAlPov(IgE} zHGJ@1+|AJi_1W0Ema+7i&cYg&N^I&(kG;coM%Fs!#}9~){R;ysSz3Tle_|tJ-0tKX zK~}PgQuSR8W>yHs0GbzjBa{w`D_q3M3zzF*UzCb3$|6rF7nxP?p-%UsXn@4P zOZZ!A-FNM5Om#-7zWpoFo>2bVc1->T=Fc`807g5P-wQp+XFe^3+RQEXDh%I!JpB9g zRPo@M1r_~{d(U3i|Im5EoC=Fh539NbM%fqL!nX3Eea3C-FFt&DLYSJkV9@P8eB#Kt zDN-o;!3LHJsivHeCJwg`nHfu|OSZ_1&aw}BPgb>(LUi1B%U7}#+9M1edri&)!N5AX zZn;m(!Oy_9cO@1AV(<2o7@K4RwFV<-gL|X;E_6@96Uhh(sd)sGe%+_L2Julvwo_Wv z2rlNJRDDIvp^j+$g6};HKUXD_b<-@l^C4^GR*L<6ABUcH>X0kee*MqZtb~VdDRtKK zkipwzmU(0rXZv=SdN!Rj^Z%RkDL3*rv8WHf&|T8RBnB!cD|2iiJ4Rgcey zY!>1Sn{}`umhtb2IzDpELC-W>C^0Uz@pkc?$$;u+*Wl?y(eNK%*X(&6aN9jiBpM`r z%eCSh|M3D_8BN`Gk#@36Mw3(m_W9)iJmVu!dnhPS_w|_oW1BJZp&V1ugI-}OYys_E zQC!Ad%S0EasWz4+X;iMK2@NKq{B%S(E8@CO1EBgrN$Liy+)r{9(D*{Pjq3Rl%zP&i z(Bh0+BMkv;D-Fy`%Qi=j9LmiCPqEZJ&T=-QqHDyeM+Wkb>!n$)_ z#?i-D->;8CUkl(GKo|fGd>r7|_IY+hgNjt5gcn-uff_>%i`G61;7M89l#w8c)FDxI zkv3k3AD$>`E%Rd>_9)lw6Ds?TUikLnm%i&eT+#|7AGaiil$1+v>vK8NB1IM4yHv7j zYk9Trj|CT{ZTOZCkNm=0=i|0|C=Tya$Tee6a}T=w|1;yajj?At3nOC^>&Zd+P-PoO zWhB(dX|a@Gh^*_B$+6dyhYbPJ1j>M$zXGyAdv>A2{@=+0!2JC)gRJTcbwDw9BRUQs zr2q!LWBZ-54Eb+}_&Bl9oCuZ3EFb#%xA##Q(Q4HRw9UxRJBImN+z{=2YS}>WJ74kV zJ*?K52iuDI3WSe~+YhWga<=ra*OhbqKQ5`hN+b*iR5%;XslO;ik}Jf3anH?TdTEM!i1K;g6q9f`(lP+GHW3<27UlYpIk#Z?Sma59G;gZ;O9KL_b%Z z_eIQl;<*w@Q{g?(T*4z~4Oq-BBXLHS2`#r4v}`#&Ct{7K1eo^SY!ClAlE?beZE!3*srH*B zwR~GYulG2M7hK;FxaV%k)v`|+ zJ3gFb|In$ZKHXn%BBQN=J@V|Ea4;z8T)SICiDCC($NDS3j(TdLAjgXwXr>2*4z!KS zas?b`*eMdZ_H{yZ4tCBGdeyROzvR1dxz-7m#8{wC-gIf>n)ep6e>;5~s;%M(%b^rU zV{+%L?SLp^Or{Yb@>AX?Meu`@SvD$LODf^tAI?hyY{^eqq6pDJyw@ZR%@YD%c=@pd z)XDGHt{HZ=r5W-{pbjr<=chE&p~tE91Ds`dQdj3P!TRM zICALRRLgwd<_D#}4ZeH)En`yCo6!4POd^J|i9{;`+=Zm5PI2*w4zL;2+M`5dr633{ z1)$+ym8l0zvM3y1Zmo!!PH63q*x~8${JfVTlkIc z6&M4#Qs`T8>&ggFsW(u$hAs+J>v}wmTKQ=Jf?lNUe|horv0)`bW8Buq3s{ByYks;I zdLD4oIV^o+XkG_jXdcfxBXv zUrez|z}k>tRN|r0Wkn)Q9^VC6#BMbY)L!7l(9W_IL@URkeQgtr+B-t3HKejm?S;Lt z0Im(rBxMsyHSWe)xaD@_D-SJGZDw#d;Z6%!#Jn~>@;XgX{X0dZPQ$-Dq5y##`Ub$` zJODpL+R!o%8JUjGDp>4OnY#MlxfV#@emR%Kxys7Wv~YMFmisn%6!#{hyng-V?rT?z zSsWi=FhKL{!1MwzH_*l-GwP8nY|pIWu-XtDejL{cY8jfD20R8)7N{~9W2K^xt;kFv z8iH6rT3!Z1?E<~w->`k1LiqfRR*ihR+ImaiR1kbV`)e%Vn!#Eoi_Nn4!xtCaUq0>a zCh+cU8{1YqQ8n6^?6K7^WL>znM94GdoY%3yaPzf((AeATi7O_wr>K3UBJ=?Cjv^@g>8dPIlvk47oY?z0kZfsQ+EUQ2qmy4 ze)Yo+IedreR&)|u-)kk1I3-b>fqZ+MAmnDYZ0&5tky}lqfNl5Q_kOJ{eP=|Q{-t#7 z3EsP|5Kftw%bP7nI!m2S%xt~-D?=&n8XSiv^nP$H1mNch+Z*4j+cf(pUDlwc6XVYW%MJmSeWp=BbEgTAK)E$^7ZXX0^XgTW=5JlP{s0`+%TKEcec{r zswhkQ7FaUYb|H{!#ot1w$rg?Ze_9!`asX>(l_e=+xRUK00YNb2;USwtYUFPLB7+G0 zB^IbrvfBEG73Q;a8Nm2L5Mq}}hsW=L2CmECu98HI#E{p5ZvaUM3_fEXS|-93YaF{Wq%HYf2khKZ8eP(qs=T zEdRc@K}3Ut`Uiv*7rW$KM%M0s^*4~{>wSQ%h0%%x^g*(LpFqq~$Rj-lH|>*f<4Ie8 z?{nS9i+ojM)TaJ*t_@#OUM6VPaw|KpG_>aMND!j-iat*PT^Y0lT@jWE2+GG;UYw%< z`uC4*j?Jokr-4UJqF~AHK8Z+q~7AqtEI}cc={aUAaRD z99hdDe6njb3y<_K{$7>od{ls>in;EVZT39F0=_NXvH&qD4thqfreZ8K0DwnD_!=!!betO0;WV-fpy0JQXA6-50jN_b zfMn%aMV2J#Eqj=;*^C)5d$Amg}a|Ntel&i1!5|oI4#=80H?;80ksc6 zd@2_T*mP}%0T8Caa&>}x`z$+m(jg{7z%#8xWyo8tfq#XVbO8y&Hx4sJ1mA}cVzb1N zw?52^I9%PIxQkQ@h$)d{>T+eo`OR~jUjqFJ>qBn5`~+u6i_K61*)tTn%51X77Qex7 zU5;WTB~!ymc&A@(`%lQyteG(h*i0Z0iCtCqL0}74=)|U)0){4E$~_I|GzBUP*JGK$ z2~7vk;9RpKY-_C2AB@U@=GnP>Iy+-&l`PIqv=%`X*N0_=6$w6+5+Lzhy968J3cL|4 zW74@>;CTM+_wJmH5-yFJ{7X@o)+Oc z@L|w*=QT+$t1a?|^i_ctL_?sK0@{Wb2S8LbTI8R>CW$Z!$-6dQoWj3g8lWknuy!EgTQE&yWpuM4!kgFD=*x3sdWUl0{~c}F(m6`@p-<& zOwSY1it@m9N{WOe+OlYUyOMepam10NqR&kYt>p_T z{^23*rEg9LOkWAP9`eTKncDl+epj>z`usu`2eh>gef|V+PyjoH3X^#Twk=Gg#z3tO z$^-q}sYYg*>;K8#?j=_;YNB6XR{4ar-ndZgo9UZxn~{0tc8Z`$H#BpsBD zKTA6BNVto@{gx+s^ z`++qrT3ZVyrgk|KcUu4)q-quWAUIf6f*onFL@l2ZScxm0%V{77<%G03EgcOxH zH9I@iNVV^?NWg~ou0*MLZZ7Vm*{$&tnE%o@R&A_{4?5&};`h(CcpyWIbd7_^D;kLB zZX4GpVFt_J_d|o-B}4|LGcdC*1prp8fmYnEt&V`~METuTd@j+$PXw4y;(Oo!f&;3^ zyYl(ftGSVa)@u@H-zNh3v_sXj)Dx!(E<}+VC<6*M0HG(BfeC=f_ml``GPNqQo;Z=Q z5-?GHz%~hV7BR+c-(}NIA&FNg@>hz}Zu{;WvV@t7ynDjWdW=vz_~ROpT~uuXV7_dv zNHzKi<{FyY_~b1o6=kuu;2N!`r>Tbg#mdiH{WA|a=nuA{zM9#zwgsju4lJyF-aYYs zP<7p)#919?MbUS1RJuu!Pmhv}7k1b`P|T+Y^m)xNSMd-kbkB)qc*&TEC25uqn@$WH zNPJ?C2l9tPq$1UJ&!oYcM#Wl6UXz9`3iRP~yq-=yV7{!5uOGD;m961mY+v#=tc?S_ z%0vRdn-zzxWjq{5wYHJI+NDmyn<1OJ$iPPh#R*k#R(gd}V3=wi3Y(VZbtvOI;g{)3 z^}C%mv2oG%fMSx(RzZnM1sa$tbD61io?D|oaAIso45g%NIZC>PaqJJ#V2_d6slvAY zgOtt19jy(r)^H;nuL)jUQ+VyE!|84OmOUlCuJgCl4y$Yk;-B)Lg(h<33foTtFX>Y8t zF-dJ_l93yNr!8_m{y~2Lvh6T0yI%xofK7pRQy?euD5SXxR#^d6%-|0?4)|l^K@+h~ zrU8AS7<`2_gns}N67c5*yGEOc%#gh?Szi?8#^q(fSThsQ5V$h)2;2+}(E^fTOr6YdeSn2yM+@R@0%)KiKw#PnGdYj^ zMP>|;f4V3YlBy+ITt*H+DN47;G6NOC*?+AV6uG4J0$|m#AOj9M65~CT3v`S1)FEtu zwS$uw(DTh zx37kjVhT{AD)mo?Cu^-SdI+q5L_h@tZ{@SVJm9W07|CUzsrB(j?fZDZNhC4sntYi9LYMm;5WG-T?_ehdjyD8!^fIY*p^|e8_&wl# zL5*BP2@vz&uK8lV{Ma3)Yj2WO2=)W{s_&t|kI0=Z# z0x}SpB*6gX2s4V!GEx*fmAfO*ZkQGK4-SkqqM7wihu^=+&rBI1I^f7&tVx=esW{=eo}RH-}Lst=c5xwLNWbXQaV zqeo*$Q7Z`C!H*l0I5iVyNotmfG_>mpx9Y?&sYd?MGg?QU3$G`mMC(NrpQdfltCkNu zRsy}=0ySG$Eii%><%?t-i$XA&11~7hg|y*Uz5uuGPmM}UDav)<$v^F&w+sQ|(eWBP ze9&UIgop%z?%!!w>n!jo^3YFi0{-uS(CI|1t2j$JDYZS-wdhZ={BtAzLC`a2rv_x8 z6wVuR83qT`@OJ-o_j^+OuF35Y$m@$&QKhu4bfT4;12~h8tx;-+Y-R13*0*{z=Nw1O;B%i-w2dKm!vvJAd_7m=URcWSc_}t zu!E(N^*1$1Qc;W=tg#FKFeGpvl4JT|i$iQx89B|bVJ!WBMXY47I2Uofy(yVjkEBgb zl6&3cr+|m=wXDHH;VnFB-mbJI>-P?1W3m9|DK) zYe$|xcWrRBMLA|G%>x5Pj>NJF91s^%n!Z}5!gGD{fctPRu|G}x9pP?Z(-+m0_^&~d z)SGSnd;cju5;n>NzTDS`4{1~3hL67-q&A?;w8h^a3cgfmMkNBDiIh*U$b)Ww#tA8+ zgZ?kFFD{k|nd8op3+H}Z^s7SPO6(my{80V{$|hc7;pL%qVXuN7!?b38Z4ERvx+vwY zwf%8?dF`TrQU36eIhKGX3@b$ei{UZ{0{_D!3YZs@vi&_r^FMTGMOU1|*$?rqy zs#EeJ!3TVPN?t0m29E(T(JyD2_5@h3K&42q6S=nk!5L~_d3(B0aJIt(&(0%gkxB#( z=iDKgJ*uXY;pegR+CEz+7CaSfd`RVYgZ(>N?a>?I`9ZMbMdU1Qi5;Am0xO!a#itM z`YkQ5hi?=f22>#f>3g=UX_j%8$2$SV4!!W5Lww8r06m0sF9AqG;Eb_yEmXl}15^{K zok%loo`-DK#c525e4*MNxpZJD{{zr~-Hf&*2A6IMz?KBQNh?$R{7ljG-CM%?7`Arq zzfv%`-ev3hPn460y@*VyikIZw1lrPnlO2)bD%Sep54o?!fxF_60}i=*#hM064Au%$ zvDTxDjeYN4X^q42G zwVdyB{O+j*?@>E)*TB>H$Jr|m^KZ9Xi9`3_<|LV)kO+xeCl&trS@-d~er@E@a)PQ! zDUftwM)zdKz!-F@y7e8uE*qW8|EJXNuFSj zeBk~qi@pI&4!{Q{YncWV!1iq2A@6FDBVl=35qW{O3se7Y0PXY#)W?PVG7vyvTpvJm z8d8!N#+u{DCSE#NCW|Zg!%n2pB0l0(`X z)G7Zpha$ftExfUby!Id00&v{`%?R{_A+Oy4snAv~8%1*%YV=%XCU(x#4r?+cB1Zlb zK4hsKpp*v8F4!!4nW143!5so6&-=6HabJe?rH79YTaNnL>dc1c7%0tzxt4BE%#yI4@Q4-jCP!@0QDD3Dufc#nEVC_*}W0zs`wO@w3 zBW|D>22zNWFGEcm;+C@pteFAey#P9;OO41Y1N>e-Ej<$vnCWPcy#wi$22BvJ0ohg$ zoV<*)?{cCp(N`?7PNW_^1lJNN3LbrF_za%?G7$^e>3m~bB00P;ru3%J@9u6-1 z4HOulX>i~}1;BemOWP2>qk8cZBfT^{w{pvL_tz6U*JefD_sEM%r7H?t^zf3IWhh4$ z2{>TC@s>rSR<@*H({fToq#G_gQ}Jba0SKZij_U(PQ=>|B@KeH6Y)HRHTls7AwCcf` zs$-uzU%WrF`Tf~LwaAAZEAi;0wF!2}K!&0(?Aj3>uRlDn^Hf>OcuUfXtzD3fz`5a0 zgrKI}LEMxcLk@gJA3_*rq9*(}n5Qk;?V25-Z1y z=4S9)9X_0HGy6XKVtPLA^tsBO*NREk)_LViZiM3FujGn+K`fBC0WnytD{%Q3@M391 zDSTYhQJGN?Q%r;7RkzwNLz+=p4=sW$PFD|qFtaT3%~WH+8>b!p@s&(fnQSoU3F1?a z=(Sj$4j!7A&Q$2pBy@QLUr;QI7@!FupIWV&j%GeRI#9&otP8#^3%6etAjT*XIht1m zaZe&ffGI^)%lzPU|_8Ox4bqSshRAS2_wEe?y{wWu8WpQ3LOM2K;QucEj@N+Iave2qDG)H zs2zG%cJ{hOqms_M`90JYa==qy%?Ar|6XK&A{Oi@2L~Ig93WfmV*IDknLd6uBv+X?c zofn6Jqo*Os`yZ4gppvgP_CuN6%+m%duw-v)9^r6_(*7Rp@AvQad1@)swY;-(g(+$c zM~5n&_9ccskajp{>R0V~;s&#ce5_=6_L8#5uG=t@+w$tRIyD8zNcM4(4zeH)XYfZn zevg!~eelpR zYSjDwuh%lE(-n`N-~XJqNsEnhu}Yws1s(cW{Ods7qChPDY4}k;|BSaAX{UU8Qc3T- z3&=q!_71B>;Yq}fPI`iRz7!LZUQxm6`qvQeHW1>aVyqTU&^rb|mHufQM$G&sPD3(o0|UZK%r2CkXXf2LajS*Wd#fv>hh`E(rV;}C z+)fNA@>qK;k|*Ruc481+-3SJIME?1auibqQm>DA<{EL^`-fS^Hdc2$UH7stu@-ykl z@hB}~F#Y;Sj>LEj$mCl6J$JKP5luvK-kJ;$gAC{(k@Yigqbky>{`17mi%5yV=IRH@ zm?+okN4-^}Pf0-rO2}dRreiMCtIuXiYn)icl*XE1Y1q(1H2wJV~nt2ik?>dXY`7 zpXW?pQ$uFFS1VQ_2PA^^KJzQ{-i$wp=ng3QbS>}bNcUh~rTEc1H-TxojL9~DJon6; z3@YJfPC8yizrET+m0vok(tL-udUd!OEkrcjBXH+s|)u_!%bRvN%YNY52Ibf`#YlooCA=jj?iOfj5 zD#Cim&}xBK2Ml<9zEy+6J!mO_6PYrh#;QFeZtBZ1#-4=Z($xP<8KwEL$id7{##!PE z)q@^V#=Je^hN4qR{w9ajQbsSRT8R5WT;*}W+IzIjdrqG#$y)ISVtj4zi_EBaR@L^W zbcO4%=By7&bh|UKyRNGnHzr;%o9*;db%Z_Z`^IyU43M#G-!q&dpKDH8_ioW77F{+o zpmu^CLPHp)uMal&kWg`BHIP*CXiJgqC*3pL=@in+0%HX_k| z0jV<-gwFO(%HPj4@f0a-P9$q^{EEI2h%c!c*GabRpLU9p>*L0s_I7*zDb=Rf@6m%t zt2M;0mC($;h}lXp%(nb8T;AK=`*LwX{cxj!MEkIPVrf8KPfW>gG34t&WyHVy=AmdR z1ZNsdp&5UNh09_bAkc7~3oj4$SKgKehYZLJ+x?H{pgazpZoT|H_5b5_CD4^YGy?&PP4k{gU)K zhy$_{;*AO5E{>%{7znKPO0&qXwUe@-A3=9IfF zc5Xv5Y{KhWEw7pXndx`-P)$sd3u`A zvjK$D9}e0246R^Wjvi3Uo_ja`Y7@}$rrWBDivv<30qz~NS7TMh*X>~_CU7Q${tR2O zC-vO9PR(Pe$^^rEcQe>H5L}J>DfneiL?|)hXx1QZqJlRE01_*UM`v9`|8eTe7I!Ak zoxmCA@|r!vrdy4soo<||(a)%Xy1f-^J1o|Je+FUAzMy={tE2ve^vF0MSu+@6dll$lm!k(`03Y{+%B{MBf@2% zbm9!*=fJA8=#KV3?Z0HTB*T8!x6r?{xbn*DC&hi$#T66e@M%~$ZRrj;69z64^;R+I zoGk#?twek*1g7uYaWj)UQ#6yovdC_TDi7wjcXA^`p0MrrCh6Sm!FWAPr2iMw;oSo- zFLs}Mn!PH-V&jh9^RaW1K^rYrV)eh>(=kXq*8%Hs-g3{JS11sRPUo&TT(u3&H@(tXy-X_-_+aNt%SIuwo#sL#(> zAr@QNX_i?Wo@E%gwVv9fYJI<8y52Ux9L@tef?n`tVpG8JIbd>b53Hd z4ySK?|3E4pYB^o9VS-IoX&3VZ6#dV0UWiS=+mP;>mfccyOM8k)7aa}3KIH$@EYME5 zWMbCQQtZVJBo%q;tkQUO_zACPuceqR`m^Ed0(8&4JNz9zpgbP_;2|iS`L$n4+@5i3 zrK*6_e61*_60vqF*hiF+S><|4hpO&_1aTB#0i~x6G&YUo+QgPLjXCk8jc3#yj$Ga7 zV=#+$@SS-&a*M8P{wtPXGHluXFcQ3E6SMcd{MWO<$jngV<*s3f1~Jk+ZT~y_)x){} zu@efPe6GvIp=9aE55Kv(SJLM)54&nqw`0y934knE+bzP_0@U|K|qpW?od1(u2x@HN2Z={emGT-nlyG!WY^L}f(W z58OeEM|(<&CEl+)Ejx*MPhz}eoUPov2R2U0`+(R)1ZP+Q%^5cCT(*Y61vWlBNFT$% zibv~Rt{=7gN$03HYLSCB_MMyW0f$(@wsU|OJH-da%_Gz5-#0SS7<=4=x>#Uz8pDCy zw0lTN&w=LuSB@uQYg4O&-O-7Pht;yvt6r=hHZL1boYt~)nNTR1I9CjTo`8zAigi~` zzpk8qPyKOnY5L2B8Q-OXA6IQiwaCYIdz}8_iW(^;7(wD^$HH#vyLL$9g}%7#R3wW- zgk1ier9uv8sknOWBhv=7xH=&(4^vx}2gdg7SL}KAbyy2(NGp0|F!lL!@s4j%d4v+K zp+p$%;>$tW`T)42EZ_$zP$FpSAbj2-IztM$w6j3UjF%&I*8l|aa?N|a$w0wV#dof$ zb=II1JZXrt1dekMev_Ua1@^ko zcuHJ*=yl-Jwz-Q}Y@cquyRACxLP1zx_wNJ@<^(k9`qu|Hjw~9_`3nV0w7K$t6ekeb zU)BuUESBTiBC#;H)3d=NkG>r8-=ru;dFnhsX5R%3C^DY!}mB}{A`-6a}8O_xR*E$lF49()gH|?AC@f9&ea zwtaH3Dg9_@{C>^l7svdKEBclao&y$7l#+7>rs?IQTzo+^4dluzfYXUD9w3h+fm2;V z0FrbDE{tUd)T8f^Gc4d}@)W>~*K`6;d3G*{Q*T+dw8K@fFks*A{^<@ugSNjy!#yvp zWob5X$DPGApks;-nFv@uAg>Yyu%uKiH*JQpuUS*Y0u{SnnWVa;7ql^zXRkP1B^u8Y2fAdtQPz@d(AHSJr$K<1P)*L zFVB<#TX;2yfrw6odAvc~(yLnVUKmhoIQ^*-{mQ)ZdExY`>mGe4*1qg&321~Tt$V&E z++(acMCtg*9qQb|$i|9y?vrVGLdIT|ut||aW;i(cx;4G-t?7XzuJ8xA9 zy12{maga{S`t(a&rjHIYADX@&h}@K&__M)vz*ZwVtqzzJzyvLf)Vc-?I3_l5pc#BS z_-o}yw-V_8!`XX4HMy=`y9opc(gl@X1Og}^HArtNA_<__Kq=Be=~Zed0@900Z-Ri8 zF1;f~s-RLsuL7YHI_HUNt^KXNzqQZ#&p(D^pks(YeDl8dGw(UCIb^0<{{_7wC z_fR!`#bW)6nrcQn+5-a8e!sB>z!whiIKUzbJU4)^r(KHv9cuYZe)%k6KC9O(MZ@JR z>(zi21_Z0GMX!RG-M^z~2KXEUdLE}2Ohlis&_25tz(+W+XV zf*B3{TBB&XS6;X!En7iQ`Y4UpQrNuiuxVW|4>>=-x0adRTLf~qh`F9UiNMUL+ zU^fUpbYx!NJ-~gzPy31%$jU(W~V%57* zaWnH(eDSbJP!f<3o90I5d&0YttykT}4q87WCw`g<(762nLgE(@#}fQE<%$4DRO;H zFZw+NlQA=v${^>CpiXNrF$4~bxIfu?qDpkRBUf@)^K;75{$Ws4q1JNKGq!-zB&9#Z z=g8vP@mRHMLgn8W^FO-v$l})B&Oc=LJ}@a0u0hVd#mAj&VtS^$4h0W8(~kKlAHCWgZg5lh4Wk7WW0u-at^?KT9g54uJFgk$LRZoA6=znAQ0K>zp+%LJ8P9D4` zts}U?GT0eklRi1`uZMC)u>8%eW#v@yF66&Dwb%(KXn^#LB*1H~jbzJAE?U@#OnKmk zerRQwo~VC{ z{X&R9xN-3MlxWuKqemM7xx&+u6L2k^mVDCPg9ob{{V$KeN+ad_mf9uhY&)=m=|kU!-e{ zrf&Xc<$(=8+b>GktHpZs3g{`(6APldk zWq`}p#i2h%(AJ)V#?1*#gfOFTn)W)%RAsFwaw)DA+|ak%Ak31HJDkE!aB0!`{7+Q48AD;S9_{MYiYx{vo6GGr)W+5>5M_CD68mXj3s=7$k33x>WHtCBmnr8`C z^+GCR2_0b4CIESI9u?`RhJz^A*}n{4#w#AdN6VxqQm)A-<>-uIc)z zZr&lX=E*a4O_xb0`0@U}XAzM#% zla0@sc=i8Uo>#OVepbsIOfw`A`ikkAFNAD9f^33^umWS6XFvY8H zqADJC4 zLMRsu+tF;gN5v_OGT&h40OaiGYCz9K{PPRe&PC#f;ag&7G5+M#IoI5UI9p(CF^k`J zzXs<1oyGjL)AC<{B>~bnHfz~QtKu{dyh$xht3L@it3Q0**jV=7zIa`5plC!d`qK))= zr}DmKmy7-hW0LHmPm^&)<^e;_a*eD!0>p#WE$Bsffcxcw+HcMx0oR;|FDtI}y~74z zEL@FIpMwE3qMk+)aFN>F6qKS|Lo-3j5c~oZWDF+`$l|Zy{*@n`>^xh%&Gj3*E9c95 zJ~$!g)61%`N4}~!t>S5UT>4$P?_G`?^e|TcZYvm@3U!9~QhSf1uha=! z$G<>MZ%KDE|83R15Yg#H)BS#3Drs8mbdD^B#z)*^`{E*0Hn_E&dIv(4(abLfK&E8r z{m*))BvEe80$yur!ZlVE_aI5V;i-;9fH(kx5%4wje@jm;QhK0oklQL5ug(PoTZGb8~u?&5D>to z;Sbt#;3tz--xxV8>uGs#j( zdV=OF?3NufleZZfx&-;;r_H6;nWQ$!+xl_%dv#O3)>U_|hPPJ}il&8OQ?LI68-D$Y2$fyw9aO73`jq(Nolck^YP?fkT; zoPnQpWqa@Ecko7&#aU@y<41$QS2M3)>!B%9h{svpYU5<;OaQLltDRt>^Ly(5Cm8fU z82Uuy-GVDanPk5Jp8|p5?cljapveFaL*d&;mj9nQN)lBJK!W@)Xw-!stW_154#JZ4 zr;fb?DEOzbb@{%vffJidUsHllB)@du9RTBkq<^$(FV{>bz?;mv`*#oKN;`d9_hd^G z2@#0&VtEgeQeaR0zrfLXtu?YgAVA~?SpfpUhGjwx#AqvIu?U%@9eOr(rD!C;6Y+`mdcmj#?k7UCCA1M+Hp0>>q>Sv_--n2)K6%!yBgmksEJZ<({ zBX|KoCit#W8_|Oewnv|8`C=d!6ePj~gN(rtMF?Qpg8(K(nJ9fDPz}UGCJ0n-2nX(b z5KytLs_x3~YvLEt!Y=7!yQj$;=EtQ@?>_OWmb1sv@7KjIrEQ~NJ=dnOlq2c$=IrR+ zn=`Bj*)s`z*t_%wQ$3}+J87xeeyl5~|A9;V04FXI5|5k_8o~G*j0Z|@)A>&GE4S5BVj7W$9!=n7dCxYgebu9m!7ry}Z z6K$4|k-GN(8?XAebMS3ui>7l4diX=x_(_|$>t+YG&PFUotl?;+CH|JM!^vkl$HJ;* zEdjkCl$UZr@irB%_;Cbf`5v9)clwmXYjQYq_Ps#Qve`F+4I1hHlhq8cDI%`F?)e=e zMAB&qIkUne*?Ap8;N#kcF?E?HESnN#l%y@&? zE^FJDs(gpn74UVk`jb9h&Y`T`F;P_&{hYYX_o9A5% zJo}~*0E^Amf97wgOVxvP8|lV~iiId#X0GAXxPa7~v&VY7kJ;TOyKG~GB2k=i8emTx znrKZ}et^kJVhWt{la1@%+(}vPtZlfT_RF4F27KF~Gs0?smM0Zm9}Nz%d8~&H|sh>2ShmMLC@*(b$d z9X|D!3lJ0aSvk6dOiTDTI>IkJ)WBMHgW&qJGJ6x3I`?Oy68YZ*KSHEZr$Iv! z5(>T`BY_p2Ff($WO+-~hnHbpdz5p}cdMxK3{Tahu3GG3vLosO#OXYmy^M*7IlVR)0 zch6O?LF~nE7DCgsePvt9@j>lg%6bsj_G%y=W z1pKOyMF5TkK5ZEy^Mw#m3<2BykW6ZjH~39{c%G`NB?;Iaet%IRz~hEWd9(}um4Gux z1B>uiz@mI-1P2JIf6q_?)bsCbY_t_{_R5Tc8$Mu`5jLtGfJ+JLPkv9Fd@^*ZUF7f^ zIPBZ3T%e-JlJ^oI=$7Z`IltSy?#JKj@4Avp1@g6jUz46u?*Cd8$EK7ESpP8qq4^s& z{M-Bla<&~;)PN}-T!=8>`W&_*?Z1*+X|Jn+kgZ3rwrhf5=dTC4fh;5SpsoX(Rt54E zXC#pN4#Wk`JD9@4{|lF0XtHUe>d`lbYIf`@FqNGB3yJv=AqRNzge3#$yBH$AkZKS1 z3?N|;#NrOfEg*z8AfmG(T;A>_`<~5~2cl8caVPduIrP5XbWTTLuo&;^_JZ5ws%R9m z4d=B7kl)Cx|1Dr)!&$EI$tjLlXP>y4u6?@t`SNR!L;(2$*S~96QoN~areKHJyAJn=`ik^#;Q|bJ9ZBJ*cV7USgK|`hg0AlG zgjyKmJMM+Td4tW9JIvJ-zEQ64{t#&bBmdw^|Ir-tN37uQhPWeNS&e^Dr9EgS}N&Sl}w-;gc|^dXx=2`VkWooJGwSgZ5?G) zb2w@m;Z#8s$%>Ely{i>HJL5`48M1J7} z7(N1S0i1ZKYoU^ZAR{Vd`h-*t@;XEiDQeq8<)CVR;c&872?O-mgqm&%(mOR zqr;*c4Q2KevA*eBdrxY;HqK$Yox3wqmT3WN^Dm&d%8AEd;&I)L0Jo1tON)=dPVv9v zrU?;(94UVZ@SlK5LBYkw4X0`MSNA7v{kkF@!fa%Rg%oE@%MLa9)_wfYQFD0nhet;E zJ1Ug5e!Sz2!&QAR@53BUIMSAT+1qZygi5iNCw%T}pT3l_T^(d%jZ2mIJCVcYYl$Nm z3!Sv-TJ*8$=}) z#HX2q+aG`TV&^akwQ{vqn#oy(?Y1TQeX}W1v9kMreHl(b6Ank2q*WN=$k|T%` z0}huiznWmQZ(tW{CG+THy{@RC*EGK;KjA-ZclZlJlSI5*JkA-t_W1iG`6|PAUdt8tuy@=Prdl3)C68>EKgUUVrr~O<_Wf`dVd427uIoO!guk=@ z`1q0}CV(`kml^Wb6~)=We!pQJCUn|cUVbb9Z}_@JH0#-pr4L)Hf@5`+;#g|bNpO-X zC-^I(#|ho<*@=Y*oeoT{QgI}c(};i|_hv6ME6v&3tNJ;`_+d$C*E#zq2suaA zM*%$$kx-Tt3x}pw*x4^#^YNpJnA6}>1Z`(7Hf4qU9j-*M)9cBZW6o1BEA*^FnOPt7PB?`!J73N*dKb|1 zqd>eh$VAnA+&M-R6{Ywh3=r*&8Yga${9?P7xX4QUrinEsLPZZy%P`$)-W-U9F$LNMgGaBG6 zHt8ruQ!FoC4%L3ACc?wkr2P&___*oa&szWd0r*{(d*$&M-(j6B0Q9@{Ov6%Cy{Sd9 ztdJ052CH+Y*RHHhdU}=1CzPNC(|GE25K8ot8QJc!JNK==KamCUOha~5piqy9L8h>w% ze`-g&uNyH%?imzEm61)jJ6q5rRO@3uD=og0<=8pFQKh-eve8ss5|)2~QC0W2H{?Xf zkf_UrW^<=7YSi|_Lsi6MVW@?WHz7G5t?(qdgmS+u>()R|ABlRpZKVMhy!;YUdP=Ws zjT&5U)D^upiu(w+4nxF|FGpOi_$Ga#=praB6QP=9}(~>5qGq6oFu*Bxq z;1DLGpHYQIlC!C%RxNUcCy?D*>6&c2N8%ijBjLnKx}e*0fd?fAYZ` zkI# z&gc@le(?+{HqW7gqMxUB`3_}fFmpzOLE4DUB2Qpiugi?r^NH9UToJyDo-1@J=arcV zbQqg@8GNIB4;_;a&O>Lz0-3G+!T};seSx>sgh5JFY@HmfR5M=5pp1g!Kd5$0;kz2^jIEZu(iTuLHipPVAPFd5cbAy&2BoOi?Wjg5(L*p_! zufTQE1_M*9AsN{#JR#9KZ9@Zc6DQnBhfCpVnikcE$59Us?)_SN=9cCbX0WB>w%|>+ zx&BkirXhW3^7W*T%8T}4$BOV||3$6R{%}+>XP~@NU=3&cHR1R-Xh`2()@Q7ViwPoU zh(gPw*0hV*0tBLwMf*65(;mk&?7p~Cf&EhF!_u{n?;QeD?gU3ncRUvVB%1QTF>leM z_B|DY1IOvA=*wqfJ50y9AnRkF$uT@a@n5phaHY@C^UHPHk1GTbSXQO$`J}p9<`HF$ntYW^a7pnGB~pfW`!$}(t6opB2Ro;REbleDFw&GG<3e07zs!H~kY zi~dqgmrw=P0aq8#G`H4qL;Cn!d<**pPuoWAoH*J*m1M|ufV@g8mrpvpk|&k+>$zp$ z?cUquIZC6L(^A?J%_p)yyyXv<$LS|J>sBhl(}UCYsyq*Bb~)SBOBIR-sd3`RZqDj< zmuRlc*iwVfs@E>1pkqipP7IEjJLTQgB8UV)=-gF@9X~@m9%6l*QK%RQdYxlaAZP_xA4fZI6!hR918+NA&2L zH=aHmp4HNtnJyJJj8am`nDh+7BoCH5lPnLm)F>B{i(2~Mu=JpbFDP-aeWDU>Lqy?2 zD*VW5dUP-_K`#p46_=Jxerao{M3f}9g;&U?LTzEqqu+CQa*Wg33$gR4ul(GC)G<4k zwWnRQMCO~H- zXWM1@JZSvj?h{KDjp3?I3;U>Oq#^s`UuJGuEfOI~1_vD0)dQnVd7^Bwq_;~PG;4yB zNR7PcuOB}c$-3rouOEV{Sr><#Th!kz?(=_TJuP17_6m{Usdw--o${MsAK>!Bj++mjeO62l zIQn*Od{rRTO?%$7mbq6Ilv*LBkol?tsbG)<3H0t83ZG4j<5NYjm?sfSJdz0{eZj1y6HoCsvcc;nk z^4dY!p7p0bk3VImvKFHtLk`JKrHQ`6HJHJ46O_vO^H`xgex;Jq1ICl7*b51S(y(Ya z-#8$57YYFSJAcH)^(2*g@UjYf9#PyNL!XBd{*a~SI{3^R%yi^TUa5ZweXkNQ4dy=d@J0Rymo-Y@C+o9HSA{hEo0 zciE|^KWP;+8~8AP7&5uBQ6)BYGRvztJuTgn`lZVO*IAvudRRf^Tu{)uwEHA9aq#z9 zD{hcoGW;dt`~6OB`rE^Q1dCP}>j~w7;|NTcE1UTD`Y_{`-wl3%lp#KD0m4aVRy;Nm ztb&t5n5?5-<-kqF@<34-vONnCXQ=CRgdNu9`|t_i*$ zCf4?Km|gNkNPNzfPNVe3H_~UtM`6*Q6F?z>NS0L?69>@^S+E!tO&}uaWQcoBYCmak zmre&QZeAWAVt_}R{(SEUx6VBV?rOoKvu$YA$qRG1mUIc?~nBYI-g3(&r!=Q zeHvc+!7A!wgui-9PbP!(`Zr;ozmR!9fa$PAol17|iKB{;lbvI=1VXMvOD4H+)afQ4 zH1b^+QwbAx*sfu!L@mZ#P&H=rS)Vj=oAm7#$u@pW~njCSYKMA}dM zV$n)EA!_txYH^EVX}_S+CA{@9uJQ@TJX8#zLNXclQJMeLN@2Fm>Gdo8r&6CQ$4NYD zd;L5>!;q|Edq=hvoEfrfG95%d_UD(k9vP2(6Kl{VSs&*wp2V-+IT)O!4SYg;ZE!^M zRyvH=eX7I!Gr9WU0V$^79_tSkNbFb~9zwhGc{8TN9DE#QXt{}W975@dWV6}7xFVda zPJt?(B&-34f7lUwfGOkbqe* zV_-w0*Qq9qdM4WE@^~OUkCyzl zI~Z{^I3<9AB%f;3o+cjDU5npM<_xF-z0u_L+}_CWTDB@(gxl z?9((639PZhP`5D_lM*z@J5K<5-k(}cVq>36(LDzFus=Q>JY1$ zjJdggB$AlCi^)oc6w)_G>y@q6jD%v|rJ4%$GoS+A2|*)E&^{L<-qP+k+<>uK4Fp(4 zBTb&)%*Li*5JcJwDiGck82WJnvO(fHGh-i8SKbB{P(T)F{&2;ptl@aR(!#(8d-C?M zu9%QyENhIW$4dE@<{!-EG0b?)2Tm6(Qv}^vZUH&sEmd?4_|holGAceUO@Z z6)mvaSs3qpqIlWxzGJJ`tLS67?fHrmPEXvNm!{`B8+bytS)jpvs|39aBTsFJY<<3p zjOln-|9m;FoAiF-R(wUyT;;E!i%cT!c@w2Q`qPFVFFpL#$C89kvNsn0g9p@t`i%o( zY&PPc1F54#P%h$OM0$NvLF_ZR5$JP-MR9z*T8IX9(fzDxK@fjZ!f)3I*F}~|1 zev-ULikwYsMIf+;H+#2d?MU&AQB1UUnx#MK zEtVIimX%c6B;}fU`8>Blng(HWt(KUaqq}8%?*nFiuP`=Asx9f7&ho3~l|L97Uxw8ah%#FCg>eRSwSt(DSE8(A@9+CytN%HF8_V*cV3OGVb%|8ab~AYzum6afoH<0Sgn%p%MGPCt)%ZM zMu9fTmw4am69Er>%!{c-c-ffGe8o8f&$ymPB8ehN7uddK>(dB7cOXWM26C^cY;6qE z_^9%$WT`0;4 z@+Mm-ZI~w&_NY=P1tz3*{gjZA3h}j?bp~QatCJ{KYV^yst>C^My{Gx)y7kWO%m;=z zU%jgBbd8l4=IV==0$TzB7Sw3JiHhM_^RGB5he#s}%4~=@t%$WGmpki*)VVfo zJd7<#X)0+k2qZLk!r!|O0YNWc7C6P#7C1N9@sNl$S-k=rO7-2Q-t<(&Arw~GeJAx# ztXE0CZ|z^rs50xar%)}v2+1so$ZfLXOQNL z+f%b@?J_NLnaY}*_p>&lKLRqgO?!+Ly(RMUgxt06=$rB4_TAfq4W5@@vC{1)td|kq z`JaA=+cjGsw&X*R!#4g0f#pz6TccbiRloxYE(jp?C{VK?g8VLHRQyEFobXbZ2DO9X zLu)vf8q35tTWS-KK3I(4q9SfX_Ub6n)n~EYoLN`ZCp@KO-(J<6NlS-FD6YhH&%tne zpgU#*;N`od(>x7qAKrQl2TvJ6eD-~g>Vv`uo`Yv_@gt+NJ{3*!w(I&hCyiyFIu@UG zCtQTv2zGFLj?AvIm_xqb#_=e~HmBHp#>ltZ#G;~1!KUF3d>i-!xwC86{}EiMRRD)xRA{D*$U9`$Yprp9CQC~%w$ZKey=OY9Q^?A|+) zW#9bHt$7ZN9bMK6u&0DQ@?M*4#ohOyxnFrOIlm`~@?+4b6ya^WVrikM-e`RN+tVSZ z0jBoeZ`*z2QwN6?M?L2*e_Z)?#k=E3OFU#vTEalq{Lp3#&v;VovxLQC7s7BEzFj>P zR6B}Mxhj|Ed!p*vJSE1OWafttu(T@l3IWgFe)Bj;)tILXflE;G*q)N12O5Y74Y$NI z3}_~Y#IoZa1^#6H<#T;-Z}ziE(|G^Z9mCycZ^CR{J{)wvJE&Ow@L6#dGOXb{;w&A= z+b<{Z+PhDE2fd#>3ge>ECXiopSynw$e4mkKsjC_>yUof2B~zhChfy$vm=mfc)obDW z=yb_GF1K&b4cLR$rGrylYCJ)f3;Q!T%I*EC>nW|sV|U-`Ex#Uc!}1Pin^?@(`jY#Y z_zH&3r^P!;q16*Yeo`Y74k`In5Qine2Ii+$ZI+sP@Oa8ZMu{(xZd<>)Xf7T_H{-+NnKk)n>`B3Xj)9yVldd@|v|N$FO!F@$sFlH=-a${b~Nddp)c zfzTBcglkbTn`;8#oH4zU%YwUAaaf|{)MojU9KIm)(G1aTD{vN1b|`*sC6fz!+@7F3 z)Q`{qV;iM9ju+bd%VgP>+;9TXUFl%WzEXIE*B%b zn)U5h$FZ%>IHjK{ERl{*Hn4)`w0>m6mHqq5G-XC_hIdhx{vkH?u=G-)wr>hDHY)AQ zEN!zFZBkec_-z3NC5gODu34UAXiLH;>RKM#RbN!3p{7*T5@6t;6oeEjaLo%7Q7Hrrh|(D^_x3c-(?WO;QA9ma zaKx^l;Wd*{R#3EIIc)*GP)h1}p(}5a-8RX-ILAsx?SSktkxX!

@#YycRm_@f$9_ zbu%HQ`H?!r%!eCoR+cD#dv>kBlEoU2)ei7zcVtKsX>3#OulPZFeNA^HJQ$6n1h7}HL}91ZpQtZ*pjaUyffx=+4e0V2j?swDZ3eg*V^ z2S{XHW=2BP39rE?Ip7+s?QLNyVLy(Ah(pW-=ud-R`v-^5j8(;XEb;N@Dnr>YLyg=**1 zv8NACz6d!isM@x3bGT@*Z6-Xh-lDhd-%JDGn3J>y&$k`#uUT+Jn84yg zM7f6N*4DkAQhkg==zB%cDZ}sgbvzzrRk^*uSn=T%Ig}sxXR}j-))`Oovbv+7XC2LLEg?_Hi_?u7RR+{N-1((2^mLwT zpW|7vfvd&JF^?))qT5Gt64|PgA)(sw0HRbnSnAEFsyC6oeL~(F{kDt!X$~6c>mNq& zIRm5PV=Kol_zS>eDM-k7FO>@bwg3xekxa^CC@k4n*$Jp>lWV*}{uE06;i(tponhjk zpwqIjIINZW^&r#|dA@nV+qCnG+t&(8=CD*n&*kbHtNIOjHw%n<@X*AG>R*j}34)Kr zVA=e($hAS`i`FpN@^D_D&Gu^5?Yfm6L+771Z}|ZpQwVcJ0~K+rl$IAxbTBxdh6O1dH4(tWR zU3C8J)ntQkSCJvEW!i@rCb>7v{XCef%1#{V9EHTAMkg*Rl)_G%w3{uY)D!wnM|1i_@+k%G*%HJ4l!u&D)VidN@@KfkEXkbY(7wqOG zBN=keY%DK?-X(tf*ps75hvsQZ1n)x1b?KKG;?#q>2ZAl#r^}sPLV~*;w94OTd3_b~ z-WRt`EKYapNWuF**zrGyEjm{_^RsT_41P=v`{{94aXX{bC9|{$fgf|>b1hqBo+IiI zgl%IiQrlF9qwzFQa^*R*Q==Xt;}m{Uu}l{_tzEU{Ux7wh73`LjO28}%4^Xk zL{1LadQUKoO`m2W;+#wwB1ZyD^gJ!fp7L;_oo1?7JPl4!cs)yq@v{IG7kyq@n)Gx>GLy?r(C2HXq zUNodpVJEF@4Ff;tH5TO1=niCCuFhrF%@asHYg#5%nn;z}2gv z`cf{F7cCayDvqe6yauOnZP+w>wVT&&wrI~8JV3~5u@2eqfC9% z!?i%`_^M*dtZdmVzufGS?@OocVyv)LS5>=ZOQeKy3y@jDw;YP*NuLy(qco4wpEboq7$%M*_!+2bpB{-`U5B3ad}nVAwo3 z=8cH5=Z#W*kBGxr59RdhqYZY7=8cIYSp3YV1LRy6yjh9mFVhq>IA8DOhI_oIH-?sc zgHAI^&?xK`oxCj)i6sjJxF{EVQ;%o}gzFjIM1Ve*^Dt#pMd>C7Gt|ASds@;@) zaGjo8;hwP5qYE(FAq`z34o zV+GS4`!X{EPKzCVMA^~sXk!v(9s@w4~#NKR1dvog6i zE@y`~Oc#aVswMNnu>SNxNDL}47TLhVkIYeiNsD>nrb{pE^JPVKP}-=h70dOa2`C#~OBgW$kvUg$rS0htA-C=EQOAK3tdJXkTDlTw}?fC>uD!$J(ju0 zV)T3^#w1xgZioDEh@`yg(flZdfom0|=l2!lvS=BfnPGkKMwpPWt88TLGr;JeIJlVR zHSp1Ok;1m(F&`}_#ROvYl3wMk_Yuyu56i45&^HQ?qHJn2QCdhZ@C85k)1od%QSvp*Hi2GLkY^` zT^If9UeD|FN{otN!`#ni1Ag!^tc0KWRV$z|Jr!f{km^q$dK0loUEs9QJaUv?0$BWM z?krIAbNH8MAWY-1(-IlyYl_t(ZIlozm#pZuYd@?w=vYHY!NVET&@%;Q?})`HqzDMO z4nQP^SEgr&n@>%O;qs;R>13N;fI%K>VGPW=z)dzS#QK8!z75&{2iF$Hs7*;P3gfU^605-FR zW>67}QA_4ihOvw}4K&enjlh`G;F;o3_r9}~&lYK>Lner~KDaO%DkRq;dWPp`-pjdC z8}}Y!j06sD!BmGK)Szz{$$oW|%-#tuQi_DygC-#Q^8q}eD_$^FIVPf@Ucyq7%c?ON zsZ2&#YH}?yRy;8WOWU)Q>aBz{6T#*G+ej4Td>XbZ0zP5nbVIarIH$mhgwi*h?X%Pz zT)vET@v9LB20wF4-m0_2YnCUM@WNjp3gFCLFfYu53W6)h(M|1ubuX*yS?sUxErKda z-waGILULI%t|fyC>{4=0`UggFfqY7}(tM64@4({7rEfQWv_+M}p)Tu*`jG2FmaXU4 zk0i^i#V1#77c1QCH7?0~7m_-(F6&cWtvJK6*UPp&8hjk?O3@n=E{e_&1u`oTK0u=t zp?MPtkA1EU5C;JGF9A!`YhCkJQYV)DAsomF;A2W^4?x8sqW(S%Dq+>p%(ud*gpjxz zBYvgUL+U<(;B=^*)f>!FOj2~ZY;`K}HFPzYMk=QPX;E|Mvo0D&S4!?@bK>|CH!JN_xR zM93Q%uIoAUvnC#1r?)I27a6=)xVd6zvO&N3(VE_V4^-++f|q?l05|Pfie(bzW{7c`GR&y8)rZ>jT0m2PePxAtq6k0R@;k>H?yW2 zprNz-CoDNq*YvRpEi(kDJVUhpV9TZU14$>RKHmon{L3FCw;q)VD_f|3MZi+K1nBdh zOEujc*q%Q5<@#XhA(X}}@y(9IMNO~oR27T5zSpWs>sKS)C~ozpbfNf|l6lU*jYXG| zYaqZD2MJ5sgDVe%m15{?j~U0r5|rP&RMPm4U(mpE(QWn0R-U}GQJgrBxew2x>63`y zcVx+h(?PW}+^UQmM}LEvzptAoLqH;vUjhT$VpaBib*-ZAw(YyLTEvmZ+VgXZJ(Dq% zafv>j1qWQv+?0S=^BD%w7n=US4kQOI_K=cdUH#;OW;}T&$+h9V-44r9qAamA48q1Q zX2-2Gu5Gp$!`e@HL!!Nz7bf6=EgpOrRol_ z<1|z3<4@uwz0o+yov9Hl&A{dQt}FMU?&kX|TnG=ru3mxHdH!6sDv=1kXsS$vGXgXy zq!7#b_llkA>n1ecTNae1_W1O{&Mwzk$fSFtDV~&*i%_zSq`e9J7SVWtb z83{q;V|S*KRUDrysogBL(L}TGzm|7H=GtGfmLZSM?vhSq(c!R37G5e?zf{RfF57YI zF6Z(Gm0sPKMRUDsqaosHZXC(u zU}?T-qoxQZnPet^l2h(zksaAph9 zpGSF>B#Q@=()QV&`O-^gySW&jpR+r>o8g3w^6{jdHNsDq(l{vUEz#mlPF1D^R9H-r zh5*YfJkO^MP5X}YGT}}1mRadJ3xA(2eFZdm{fZ|hFC<42hVBdGvhj~`WsU+zNN{ar zXX{8<5v9H3>iwQX1eskgaRa06*nv3%@6g45(F9T}@o4zvYAp|~vW;#NtW_Ypm&W58 zK0<81LWh!C70a$=Q{5(`1NVmHyT0~`X9$RYsAgI1?+(m(u_H3%Bt?e#?I9(1*NYKh z&@&3e1rkc;9WVSD2VxhOTYrn3=fMd--o1LM@|o*i*ujvnuS;D9M4>~(i+$>OPxyO| z`RdjZB-esBpY_RTLwth>kDlQ7QL-FJE zca+dyooy(e)87gGYCpE>J6k|;-!9UsC7kBZQrFZRBBlV)z4x@)k`eI(cN*m`_e6y| zVflk6>_l?wT(qX4jxBa?z+$v>iS?KHewQC*8ngLsDXYP|w?;vbK2p&nbI>u#KP;s3 zM|E3xI;^xM{NbE+GfD|nN+K*TYJyP4+_2~rxtl~NkfYooI+x5K&Wv&@KQa@x?Pkw0 zv48u1I2MZ@AkMJlTX$Da`gXc1BoX9@ltO_A_b3LDZF%liQ#d#lA{vX*`}rmTR3gE z?fW_>U!dlXCo~C@cRB55plRdW_g_rxx+sklY`@j!A;DtOs^XV+i+( zeWGA+&W)`NM%CxCQ3&*(JJv^0$i?RfqDUJE{9v$Z-9Y9y@;-*tcG$!+=w*<3rL^G# zt9zkVgeS&8!Dg6^mR;%>_=RCgc4saK`Uw$r1Ia-)8j>_fl*02MF~?cA{6^`HgH~mt z+tc2zYfvvt%8CB52>xKj&T)W!Cp5WWydNrS^113xLGiaMWv#;wMNYfDVX+n)CE#A8 z-lhzfc=KH(+p3-xNBqu}nTU$H;G1v`aDrHEFoJ;c6fT0xrlB{_10X7gV@>)I1#4qc zN&z)C;Lc(qLiO(RjAj2e1UVYWLQ0eQ3_sfSHozh~IgU?Gt$fy1CXr)N(Hot*J$liu z_r&jVXn|Ao0eQnL-(&7z1k`d(#zd`(78T&r+0Qi&V@x|c1m?+isWVdl4^>|o*5n)Z zJz&Bp88DF^0|XS18r>ZdB8r5PDj^L5!bnHQD5a#!00C*~7K2uhE(N4EKsw%w|MNT_ z-f!D+aIoF?uKT*q^ZZq@G?qiD*GuH7A2d&du*w9{Y`j1>0UhE4JT1uaMv`ea{THQdCXw?XyuN7=(k{1mXVnLZ9_QNc;+sddvtD(vz9SDkS8i<%2jqAxZ=T)v`J3QB zZ6Cz67EH}sKRqUc+xjJamivDCc`#E z7O5L<6U?;%C?5@=aM0EOMU@f@pU#mK%{8xYCxAT^?C4B4h*%iv+8BEDDYnFqQLp9q z3@Z0cJP$R%qe#^AxL(=7l-v6KA{vuYV$BXV#3c9V!cNn7m7p$WUnQ)#5uuChoB3pIxdWu%)nP1XQWF~~pz z{X`N%ISzGz?S~2v>#IP(6UgXLqCHed6#FhKH%j(T;{=p@Lm=bEVZ20ciWfoUu9rtY@xz#>vuU5?le3C>BL6 z5(RQTabpLcg_ovee0^WGIOt(C6Q-Y-ba@naNkozR&73ELuvAH)E+c{Vm)E()Y( zQ1Mtc1)!4(2CD)W!k|ozw-tF|8^eUrALM*PyRP;bU)fHjz^g?&`gx7^<}X`fa-`9s z-F1s46N|cDOUvhPl%5pj?MgcYQum%cqmF+%PGm#M+!nzie9^1;vJ$*X^q{K4A|$5u zh<{V^TMaBYzwU?ngAMjuz0of-!S>XSKzSNSn=slnf|tP zBFTZhCuq=s{?dDL zSu(f_gjHGJb2q>t9iPGp8$Kfk$DC>|Xm;BQvh>nm&#Bz~1rGap7hwJXuSd2gpy#zF zt**ye@y)$u?n!cux6+c~0WU-K>;d|Y23SP}> zf6kNl5h-#1`unC5?}#?@O-~13I<)Zm%F$dFZd(3o>r(&rV0*KSrt`Dr#)VO`DOp#& zjC0B6m7lx~IfjgKAgeYQ6{k+?bBoFWhNg5~6;Y#}OA+Cw2j4Vq&!8sRiWu?Ymbo?v z#9~c{{JQl3^Zct9U9d)D4&2Mh%r=r&6U#29JxqRQ-H%b#KB(cTg>H1k@`ngs?J1B( zB64M7PHX>tUdged`pB4-$-d%V=rQ@}3r_}>&QfTa>6rXCwRrca7?#1jfG*(Y&)8A@ zW`eZ?=g_9XtE~+a&66hcBtef;dg~-=!>wL4Z(uH`@C;hfjN31BC385a#7HOsfiO8A zC-9X5gANC(@QQtEe04_xO`FjMT{ybFtD73)P68Yl!RZ6U2YpL?sWQI8M53s+afrkO zoi0XnUK`#{N6Wq(ZP2$$^6Ewb3gD9|R;y(`$pO-c#?FCHedpIRT1dZ6Y*!GVSue=Z5ubjIDSrE2 zJ7b-9EB#sXd@&Jcw6{cr$3TZ3$2(H3VF|!Tt|E{8=)0|SL*r(SNcOIWIpogGP#y;> zzS_Ar%ncYGL1CRE$&a|W2zkf4zO!Q6Kzo_*fezq!-ZD>kROLD>dA{m?&a1%?PhjWp z`YFDT7ukEd6_DY7u$nrJjQ@DFGs+A3F!LzyuQO6}7B*q>%_sKS&N&p0r~TTIdNJ!qnyeS?}HNsZet zNbODh>{!^?F8!6_uMgHC`#+Bp|@f<8j6@~i;{2~8HX}V))$7cR?Vu~F0qnU1tEW$&ik1TxuQP=e=lnfCRrlc6=)))JE)~A*TReKgCpCWRe|Jo3~ zQz6C`!Ywh!N&V)ozXn>F8{KT|+}>|Q#en(K_Ta+ndW^KAryF8R8mO0*SmXI zt_jbpKx5|A7747;yX#0Ys!Q0`1;SZMrFkvL|sG~sjNhrho zgJJ$&%O3jn2Nt9j?Lv3^wp6iwF16n`H+G^9z}6MT6B>fiZKreKES9mxthE{ zr&w`Xa1Zc^ekUEvw8oab}>F8yLsENH(rs{?99-O9%2-2 z#S@e1bXim|c)s?H_As4f>kpvFn(SH(Z=-WtL>YDHL8uKP_iW$D{acuw`gHudCz+i( zo**;R3!+^H$3iZ%l1SOn8wVpfG=yAQ-C5aBwzY{_Uv!7@aEYvtJqMmL7o5rpibxp-qT?=>#|k!{s58cd<` z?ti^xnk2$KeG{8E$fI4s=e5Et(GMr-q^YJdGLwwe~E$NS4B*5QH5EpVP?4i&qv3OIxH z-A?E6deslKzL#n!+lwj-<)ay8cWHW$k^V#fZTgc(BLxGEzkbTJeOEr0{;ph+?%ByT z%?cg$xNMLKXn2#qK3kGlbyx`hPQ2@UxgrJh8N>U-E!PE}-K%?`q+&U3z1GBW9 zUJcP|yyeUMh=k9*#C{m)BURxP&UaLeV1W1%k?75%nIklA>N-2JI^G!-YTFbaH6V@6 zQk*%LvL!E9RH<)AX!0rrll6C|^xouHd9&l<78H2$Je2NcW)V?1)Ue)FYdfNVTy}Q{ zV1^1OhgIZqiYA^&1=82S8PE3ifK%cFPLd4#5i*{6KuRSjXRc~*ro=Zm&JH#&?v**$ z!r`0^BT^3&&Pe*8`Zk5x`_)-zdH|Ub+eXn@f_{L#61l)999OGU63daxD-m1(`(k6iMz05oLD0HV=XFachwaxUv*xTaW>Iys z^Iu@4%+CD`=@RV-Epy_fyRzK|6Bk+W3bDuy2uC;WBG7(+OXE4TPhNFcqL&WvP?%PK zPVMOaw||sA{WopErOT>vTROIa1V6W*iuy=qRbltp{;FzPC8}+7qH94@R+~YY_%-K6 z_UNyl^m8c$5Tj)ReF@w`Ln%qfvY`9$ZiuLM`L*M5vM<@@97Y>xkF5kRBx)tsN9GUb ze#cW+H*@H(u`9CC9PRz;E<7?C{N7N#lI~U7OXXtTCzVr5ajUe}5rI6m%aXK8vNyc# z2gdVSYn37^RNZXW*FE1g#`G(jL#KK60x62@J!8)0~0}9X+9XlkxQ(=L7w74<}irhXl|3r`)o> zUT1}9Wvb4RXDuypN9X@}o$^Rz1SqF~Xvq{E<}2q;neZ+v9ORAXgS~s*mP8#)*&xw? z)J|?s!DRctYQb_Tv$S0LMs^^F{qGsbEhJ*^=s#hJb0f zUr#!|KQk*@l4Ie`9%{p$E_3bxgtqQOD`5lJw3$^5$|&<%U03J-lYFgW@Pg=Im>@?+ zR%rh+e1sUaVOnF36?%(;BzcqSWdxTv26J6-WYHd-;sxaXv%!Y!24wYMsY5%ToSya& zM3{Sh+4ulm*S|9`0GEZr<|6662ZPCu%6w++80Vj5!L2=@>nAI9$3H^%-C73$X*h`VeUYh^5We6({RCgL zyD%P&i6nqUd^2&*wU0ySND%3@fTPp9w`xi>NXk=*`i&a^R;BIz${Tv!Nd#kGX9vja zCrvHZr)~%IA<4G9mKQRS9=Du$-vC9a8@&}nxde)DuP>Bi7DA=K;+N@|)3xjfAo2s< zvO0yt45dYu5jG41K%oDTkERi8+xi(@z_ki9)wx9zp{yH~#YBv&>bgRXnM!mS7Hd<` z)IltJkKS;B9;F8u`r9j!=BO`IQI!l&fERGDF`L}k!*giL`#u|9tTl41R7XNX_u3)m9}_ZLtrRA9$AM zMk;%XsQyt8?NTmz*uB!$MHVE8u6S{bjh8+zUb@3jk)ND}Jbj{gW}3EXPomlub2FW> z?~xr3F}VUs*Gk7Rgi^tOPn>Xnc&;4B0_tvv<~jQk>F?I(>+5>L#8x--E^Mn5A5E=q zBvxI`85spyXk~Tt#N?;BJgYzUmU8m4y8D+XfGie_VK<%R!gW)*7(XqR4-kUjFC3=N zQkSRbCUb58MZ-<#oHp}FPT?hG2l{Yb-V3Tb@W8MJEhzB#KLB&WwqzV=IW-cvzmFi% z7cLkVVI{N|IIzr*SFmsh(@eoJxiT3wzAzaDAYl2>YYq)QTA=Mj==y4icr#2sDLpp= z&)8ng;Gf?5h85(xC%sL=a|!nLiu8!ko4o~}gBaS{vt?NT%HE*%3ado_=@v|37&Nx& zC!i@~OnUVe=MB*4Rn=*yiCFF|;$N`vLK9z8TO`_nkXXfW+|;F{iZns2A@y3Ded-Hxc%DXPF3^JfvZ4cCx$}LvU8@ZI z1I$h*HgiN5CX}ZaoZ;yCXq!tf0f5X9F2Q7^LmQ8`0rjcE?UQ24S#DFT|aceluD~?k6?Wt z>?p{a{xqj>^=U=9bA0{aclGn!tjq)vz`kSc(2r#WZEeY5Ur}(5Kqyp^K{@VV{uMdS zE9N4ZRCJu**pN7L@lVm;y0q5g2CN0a&5%mAb%=TZ9c2T1b% z31>q%9`xh~@x?c+Tt4T0dc?fGmf$|t*szL>-J#R?bM4JH&HD7Z$B^9TOlp<4(*139 z<6$ZjN`^IJHKFin_&A%G8_o$t+Yr6-OQ(8R%Re8aiZb>Zp5=^>Z)xXYen z)5!`?0*{!R)=J-RJ@Xt=^!<|;G)^M0<188~D#`*O+YDD(}J>Xec`k*b2&MZo$cDu=)W zmWKOUz{cPT;Db>t32go*SNb}lu&M&#*_gm;O>*mEGl==z>9N(aP>2m+xp_P`b4v!Qp0~VF!9XO9!kymN*9>u_2B!K{ z5FqncqR$MKc)MUPLTs?^2jSe1utp!AF-hLOt2r`IOX{c57$&I*9%6#^X2X5b^PPfX zAydiO^TJI3X_6@nHuz9ddRVaHmzLytG1pt%!c9B1VXA8ryjf}@*W`sHm9BfJWBR9#PxjoqR@SAn<1%;u|o&qdTsRf167vyYW5v$y5iv*$;y(f|nsX}1X zjK2v>U^FQ9UV=zlHm0~3o-*81F8r1Zm=dT|So8h5_|{K|4X#5HYag|Ok-lT_ z`qSs!4w<8sVpw6(DB?8xx;_upeyZ=NU~K=RUs?UadXTrId_#Y{vew}`)#ks^BTxjf zRw_hbYSO{JpE4YKxle&~C83`5BGYDeHIP9)c=?Oq?~tHQv@Q@QYG zSc=HvB-Cx_0|-T#Yxkc8-Z=xw?ET}qy(domBPlt~;^F%j!rjYtS?f-LugxRRLh8OD z^|#L%v-ZXsk+PDThXzxmG?;}~ty}c_BaMpg{3C%oy$bHU&FfQZt2@KRegAfE1^IZE zRkdcOo}pxsL@457cF3hIF_VvJ+O{H{dWwn>jMO)szpn|o1FB&H_77`6(e3IOl-oCu zy#Dz0-H#!wHZTz$2<86K$7OvLUvlcwu6{D#A%w zO&CmvYdJpDq85jyFgxl(7&juBUS!mOS#JhiW&)i|@~n<+$BR=OIfvZFyvt?4O2b9O zZ2bAQJK20aZ97*?lCQjeM><&^3|i`9a-h~nU`lf@lYR&r&}JmAMDN4)pMDZ<=FJ;o zBwdmTCK+QDDKy1$6R+8HdEYKxX9Bnf$@_eFG>s`U>vN?SqOpemkJLUK^G4&`YR)2DB z$xgxDb9OiCcqlHX-t_DsDs!jSV5-Rn=F5OOI5`Pi4kXwu#~+jVYVFEl*>t@bIC8mb*Dzq+0@6D(WDPr)YX#f68bRIwhNlI_^9O*gq zaN6+PLbk!etcB}HKyFkfT!ADcnastYU}~UoWlxDxECHzv)qn4!PvNY16;Juw*5ZvdV4eK_UU> z$G~APPY=Sn;lV=`ZdMR!Wh-)bgF7(vkqmhV&xTR*T_OJ;7iJ~+-JS#qYr96j64Y+m z1>Ht9l6;yIP+xce6qi8{e4Nk{MDnQKObOKITq2frFm?h8v@~MtPgTOFB#xP9kBO3SlwK?2Fx+Vn zqJNc&z)cRCeby&t#oAN5TOxbfp5dACZ!Pw0cHNN7lhBHx{wJr^BG@U))8CEaARQxLIZ_%3$5SV|sK7*<^XW_I0kzR2!RE_pkbqMFkA^g=Klw;;tKR0Cw zF(Lv<*h`vtovhbu#a#Fub)c1lXuK8Zni1-7yXHST4bZMJ=)F8q0o!9GG+ShI**xAO z#>u;Ia)0URsiI2B_nLnXp;@;Syu@^O=NgXa_nV(8qVSl7K#vh#ms;~jU&IF3a_XOx z%kRuyJN!=4A0T`XRPO3sR<)JxauydsZ>3S6;}VGYZQr*g`tWmTYr#PH|F2J=-(%1K z4AEiDix&NEKW#Bl{Z0 zEgn@{S>Jdu_Gc=%!gHXY2`S+h>VN$3P;cSrY;Y)*ryS5zN;*4F@Q{u?Xr4K_!Y5$@ zQ8fIdhTV4|3@^>P7*M)X-YA5LSM=mij;_FtJ)1xMMXn~1COVHn_jjj|*>_lK7VBcU zS%~SFZ|ht*jZD9W6`txz+CAB**fHpD3w_lOwyVthrbzmLOT z-D^9I=-bSZagB$yFVXG#T`mJ2crhIpJ^z! zIk9C+pK_LW2~5vKIv-s=dadsZKVhx5=;>JAZEi&Rg$I4;rh-43?^r=qTr3d5Cji#I z3T}E2n#{lLF@r*U!qC`;h>J(h8Sm4ruLl6Xe3`ebUs)=*%ewlIT(f#vqG3Pr>h$~a z)P-!HUFSjyzI&PR6gCS;D!;uB%^xh|jHLMfX1hLLxHJitKg^@+K=!}^^4_r*sv8DN z0^Q4SHRuOsW~%$>iepfWK*fmXcJ6p{=YhJtNCmK+vz@lVW~occcd&V$m7N)MRM*Vp zos-Cnsc+Sn=N#XBvAhNu=tkBv@nF>EP|$~{)EeR6w7Xzq!W8KGKWQ-)<^P>ncS`d* z{HFr%L-ld#u2ZiOu4xr)S{S(mrK>xY;zOp{3e~!=LrJsgH=!J6umsVEm*JP(x&bpp zhsB;a*5<0}`O(#JDz~KUoKLr)_t;H6^U@3;ktT8TY&f;h?b85`?qvsHE^`GjrGfmfZ>Y3T~xvJG1F?vRZaT4Rj^7G`z zm;IgW<%=e8jW_u@B;3wA%L~oc1wz#07hGOOEhQt2!CVon6I^LAS(bJ$S)(-heF2Tk{P=0h?BQI08y zzz==m>btVQ`rVu}8M%rUB`|f4o2H%3E|1^ZTvA*cnUFb{*`Jo|X_`4Va(Er|n|4%+mKb6zeUHB=>dwN3sg~8-IOoZC7?7IwJe6 zl1aplr473!NGj=b4KbifI1PBoXu!o$s3W>-Baay2TXEN8U zR@Y@76;fF!Q+NLX%UM?%#7w}=&w3dnLu&sA>dh$LrcaTfvF=+9^M;}egqqSzZbvgW z71Q%5Q^#KtOJkjXpc~60?~;)S1RXxWB&(I#Zw5gFDRlOfwI+MM`>Qo<%vj9#cQKYHcct_xyA{X0_(RBNQ|L7`k6JKkvD*D9lu1Vi7M9Ez!zYlA$a>ktvpl17 z5IvHyuW<0W`7r*${qBxKr6HY0h=v1xrWuTQ3Hyc1#A;Kj{oE^ZJyEGsPB6XL{Bi9A zj||t#)_s6vem%4(8@M#=awsKwi@8bJKeuHxIs6Z35$MTZqBhT9hRD zjgsbhP$g$>W-iWn%u4Mz?^6daH~CDD^{%BXt4ekjc?i*fUP5W5{dbw`!+%l7dq1!_ z?~7XXrMl)7b3t1dM~A`VRgiyr;NE9@e`Hg4e${_DT)ldDCDc;gi;IvvQfQ4PfetVqB z^Ewi@Ki(dwk4%RXX=1aeua9>2e181F8p|G-MeJpLN#GudKzgn3M=<;-=-XePBGpNs z8#Wn+zW((yM(dsR@>pj-<>8fin>*~~DvU#8LE^D^mENZPx9lXWk~90&{_{0;P_f3> z8y~p8O=*_T?ytneUc!)a5IY7ZjLin(2p=g7Li-oSLJ-yLYtm9ZmL&K#5#d6-^7;VC zX$tkcqAbJS+WZEm{ROTm_YP}o~?aPgWL2~{EjejU5RP`a6s=l0S)7Q_{~se7i;kPd%8c~;vk zlHA1<|2>(nq-nmz{U~#j#jfdh%LgNNl>w^7(`LD=YlX|I`{Loaf#1l8Z=R>U zn*oRC4Cii?=f@sHdNlP}ntEQXQ{L6)SZmc^cjjyeMv4m26FD>|a3$Y?P6n%{ zZ40i@JI)kvovrt)dD{A%e0x8X6vm?tp}{9lap>i=A1ftjlz|)} z?w%Z5%Tse4@vL9jiL{oU$?TTu+7v%K-iXhqdumt{S|iC>*(5xLU% zQxf$3=|d?p|E9AQ&md1b%N-7+rFJ=q-a*{L5p#!0{@9Q&n-RzQeI`GB@K;M9D{oPI zXtUR{H;#O8)3)4JjYuW<#}_CYbcN`Smkf5FaO7fpNjB}MwCTN)-QySR)WOg;U^g#6 z60rSUvhs!*w6WVTE-mwi z?>171zFr*+vZ*;S9}mxe9n-k=y?bYQ^=iQ8x%7Ot=YWqv%j}_oy0qqPVH5`+>`i1O zTA4^$37WzYnI9a?QKscWbWMD4iImwsv8Kh`7V$gIxEgI4O_^e}pA)1#_>GY-ns>3P-w>fs%%Wq` zv~8BVSZrpB#-ljHU$PC)HNjZaZX2zw`8=VMUY^Fg(Mgv6;n0Cg~P*tS;xi@JI#a{Nf6iMvwlQO?WU4xSTcA|oeW%gvag zQ$DShD&F_Xc0H#m)fHJ7sux$kZag*QI<|?-Rp~--mcV)gtsN98lB<#O@9)mWcNDT&S9kF9XRJpJS)&w1PE5BD6|(h_a(&RI%|Y!pXWO}xbJG@+bq${YT<-nG zXf=0WKAvw+I_Lo%=SR_$F8zl57qlN5g1j0mBU5ZzrLt$wJts8ZRK!_2^U{ihmA%_9 z;IKx9bVy|Ta#{=%rUDTHPFxSh$3jU7BU5&lqE3t7pt2dnS4Gn4B)djb!hFqg;ReRO zaL(>Pl+JMAbGg>@UXP1=Y8=l=7Sge&o%&6nTi@t2N9cMBgZM|Gd{U9ZOVsns`5JpK z>%o6QUw_aL=VslCa;%jX=)RTD?Xq}r^S*8&%}fxS{BWV8oP)87>bvmcresLheSs*-7H_TiiG_RQm21S!`#4k#~-{7J^uui>V0G z&c6{BmrpwXV%$2%+4PFd%g6vV1baxQ1iP)cR?EYmh&#(XAz>WmiqSVrnQU0B)zgaY z>G->D&%eBuSQvl`H48wcbuE{{Rl{%#T8B+nZ1~7|Yj5FlS9{=c3u9MiO~~miZMD(! zlYo?wE6YB9%PX3(low%$CCWk z*=l#il88_kj_s=RHh=dG1B4t>zUaYkX|9P;KHvU$iLwW)(n1vM#{R_vLM_c#!VErA zUPYh0vy(&;;;&i+o^A*q=F4`Nwa&S!#Z$lE!aO)|tX?W;vz9$9Wy_T7;ElTW6n2eJ zWbb&SUkXkI7TPct1N0K#jBg@6Q)KD({G(j@w z{oFcxiigGcX1)i}o`&mP8?v;rhFzcCL-4C2uOhPoD2NI>ITTEOD4*b6XevIw7^Ds1 z(lRlQA8u47uuj5Q$Rl7np}nkR!;0HY3x;EXMlM>beeTbp;cc|zGge!Cck-{{f-75C zzDDP&%z1GKf(t=6nO$Rcgs~I!R6m2uw<#*Y>zUt|>rltUs1FTCp1mQ&Hd@D_Iuh-i<4@2!Iic8JU!t~0A#;5z%-r-|ZX zH?$4tsfIaL@>ww}aD|4ORjQ2Q4F|!GK__|dNtXfQhW5!^f%yH{E)x{pEE*eoV9amq zM=@J{rA%|wWH#{%zbe0ma&m2r0cXjoEUls$^cnaV)z65tggem64kKsPu6~}@W~)&r zTLO%WAigJ0YtWa<*>}Xi&yKsIU~34gIocVP;8$^4d@2~7S*$2Yp63#KkAt8sFmLXZ zvE6+m;h+hX)TQa3Oc1QSkC0zTR_Yl0Wm={{fvTldbGpj;wz={~iX5@_34DmV#eur= z?gv;=uai?9Sb_;%lHE!Fvc?^>PcS|?Rl|~RU&FoY_sj5E{xjsa*zu1{w&zMZk|N~k zU&$>rRB(qbuRI4&kYDvb9lz>s9b9B~kF31mZlSAd z7H6-Ds=UM90@wP-uW2TyPLu+!s?$(!Hj(WurkW3nhjG?YCXUX)H5TqOm4RTp1)TfJ*?8OL`g5IiEgbz&Vn zhDx#6St$w{g7(tfV#5s_#NkM#8o|lC)!MlA{EOxg-RXWcuA^|?_VtGV1h+4g!Ui_b z;Hao~s8a33tq{)icfha(F1R4srKz0MrQew|y+F&+)y?Z(_4%x{LsNMePheG1m$S|c zbbOBs#iD;2wZNqp2EO@X_2y}BtP)H*a}pP7{h;6-&%y}B&?Xb^^L6?6(hIbTundNC z{*zVfEX!=>TG^$J+*WDH?1qi4t#HBYb4`4@6=@M>e)-i*bHm+~j%7>VZ_jw%EBuyK=&4n#JKUjLOgyBVq14Rw zzhxp%5g|@1YWSu!sy>Ps8?Zr{n7j{TSff>@Myl&|_R6&|?{K;FDo`Z-@VRO1$H$-T z`QvQh%hmkH;slXzx6gThQx0(|lu>QmZsNcD+jP2;oiMU{!dG~pvNU?kMTxxBci%gf zlMFe4y4yuxyNbK5K#{?xg@;`sgngzx*ZfV3E@RL8`0-!S=f3CQ;o0?dYSjLsnfL;? z+*Osql`X}uK{UK;xK#Zw;yNx^M1g`%PNfJRQCuIU*|v0gwcFKG%S0JNC+%w-M4_m* zjtM$vvTeJm6*$5dED<*;*wOcao_-|GePK3=TOo9Ktqkn)RhaUL%0-N!}wGVz{6gKO3HZEl|slGhY}1qDyMhD zB5zhPBz%Euq_ zb!Zv~lx7JFHQ|pI&i&P5zC5l|%uxG27U+#RnD~%fP{)AdZ+)`e%bO!WQHWA7MP7PLtz$IaSE0Vag9%FRi-R{dBYM443oziT#K%r+WSv?Dhh|5Ar=w$Q6~ zMIvvQO)zy_J4A76l$y{E+wkx^?lD-F!hUz@8jo_^E-e>Vi}@EOyxN>bJ6r81V&wO@ zbT3k<)PzWf(++3fDkIM7^+)gb-Nm*_nr4RDjN`!ZzYRgy$AQSOexWT2x8+&U@_1^rkDtj#IxF@33xeQHnU8#T z@p^8nZ>tAq@${u z9)eF*Elv~~dr+Kam``f>5oQyvIMB^2()rhr?)r3OM(42idsj1!^#@XVItOQ`Z&v%BhH?4g;)#I zOgJcYU;*nvC2YCUbVTBA%g=mx2Uq0B{I}MI5C>Jb>8#C<{OgB&zDY`s2XDK*xAjzE zQLZ%$?xypZ;ee8h8|io~h7>AcB%84~z*YRF-wJmI8`1caO~sC+#%Xqiy_j@E{1nrx zshyUJB?X%BYeB~*2fhfo9I2I6JV6y~Oi1=i1IQeq`+oUREAx})h6iY4%mKp~c{%!i z;DJW!o+0DI^Kt&i+C7p;3|{$wkhgp-War<*%D$pL@A=kOa_^OjP|>CLf5P?dh1=@{ zuISv}h#tJzt#g~s0Gx{(jK3*S+zPJUi&Y((M1>epP}MR&ErpoIsJsEIIsvR|geJ8m ztSEe7!tjgaM!#mx&2nE@Q0B1*of@y@Q7WIWrPgs9?ko$l%0`$FUhGbo(jXjSlP$>!}D#s&kR$b(gynOb}>rAo$os`b6d1 z8@9|uU&#wsClc$jqsrrI>E5eUh~{|wQRS}lay27yi3L?w83rL}IA}8KXxKH%#Hopi zb1)pWF&sxXi9&G))qkscSLcOra+#!LC4J>jnh}9?Vf_Z#$C~2{1fLE~pN8ugr?JWW zxdtxsY}`hmfr-afL`Uy_Oz5&tRcG%xUiaXjJ;*gW+oMPmJJ5TE2s2PUsrWnc;81(( z=<}`q-m8JDssYb5cbaEkXLo&*42;i$x18?$ZAf%kQytRH>rWm5mM*C7VC~NEt9gNU36eM*GBFY(uzzoT2Rg zN8N5;9tUZMr!_47j2L#8Q~6`3sc*0l?%ehLrlzjJ^;KP?+j?q^tN0+q+s7 z=npWX``6Q`!4%U$hJ)BNg0STlRJ2+50KBs5aO)d;KC^;x5}xy0G%=hvFBS07;gmkMpfb9~Ou&Yk z^K*B|+M&+ z@=EjTY8NfLKOi9y#3(!C4cAY0!-BA7$mjeRujRE)%^+{jgYf}ZV4J@oWZh>u&8E=O z8!*4Q6 zs$5bqTPNi1Q$vCI0=Nx}@?D|q{1t}-6$mv!u!nMLp#btxfr7o(9Mc0zE^~qCJaE{7 zt$)@rl51^k-9Ydxc;o|x>wx8Liw*eAhK)S8zrRb@n;5$hp(}6j$42E8JNa+gV>lM1 zcsO~<3-@n@AaH9xxSZvppZ@EP8KXvCGMwn)e;UoJmiX^W{+z=B!*Rj(4+%Byn#w#I z-e_#%$M5-V72v?|joj*zm{yEV9&coQ7NayIR1&B}x*`sW#nt*Oiul@vlGF{8EB}eG zTW>t~lRC>c{XMu~AL!NFRB<}B-)TTAJ8;V7^ly-5-qPoj1VuIrcy_LlXJ7Nlyz*-5 zG#gKlN5XPuwkj)*kU11AIVYI$z=@`c{m124ZOIn)z1E`|{7#G|xuV?GZ~TT)L1f|; zWS4;|0;Wy3Bv4yU~+fz z3z5iA`JjGjWPh%FaNIP;vhW*hd)hV;r`+BPB3Me!h%2mu-o|mE&`M65l5s`RvJ*Vx znor4t^gT-27q_MJSH-|VH){h!tW|}Z(3Y?BmMN6sxibqfHI*4g2c09{^O+KA>nC$Q zSL2v$#d)81(Y}{0(t0Oq?46-NQ6RB*8fAzU#~?I*!f$~ooFQbMR%LceOZO$ea$jo4 zXVBiL8O;~)-BEBgcmQ z*Hg}q`72R2b_>@fQ;Z@Dq|XWWJ8BK*@G#2CDx+#aq@UQyTKxU6pwrc7^97Alj0(-m z-zrY88(_s;a;|1SFFJInrvKAI2&{MCJE@qhDUbM}?<*p|eRNRB=bK-2CD(o;Xn%kv zMTAYt@5tG@j8EUB`|yvDzSFo_tJOKS*siAch~eo6NXNGro%0>pns`$ba*9b(~#}vvC-#7aVQ3f9oVXJRJ)6rL#0aXoG>}u!IE@ zaoV~ELdw{OVh^KoUwR=#_IcK0!%k}(kfrza zKm{C9HGFP(7#pGN)m2p+ZG82?o{bg;6`o&TsX(43))Ak4^RiIWwy|`8R7TuZz_kcc7fSHRnvNez9-tOG5K}-tyIOJ%e<5g`2pRSi$FWukoK} zPt6?m|VlupU$suhfDvo(~Zez7|G{5l(6}1hPXkE6y)_a+o(5==_s17 z@-E#DtDv2YauDGTOzaxGsY6v6Clsb{LG_YfyDybr>kHR|x#s;@8qeis_M3v;mnU6Q z6~jVcDpa&&s7}X(U?~+TZ5fUZ7~tt$6#-LST5jX(;YmVJ+#c+;u?Rx_R;L|Rh;0B_ z&$~O@k*owm#N)31Zree)>VjKXrOAet+3H-4Jo`88wmN-!n%He> z&_Z|Ciz_Dwh1Qm;Q&H6Zt2|a;5q-Z&q=Y<1j3T+lM^d)H$$UYi!$BGuF)2tNg~mrO!TOu1koZQI?+23orK^KEuxP$NQ5!!BzmGuLJ-~Pq9tPx1kptw zC3+dX+qdWa_CCJ-H|*c$ShLo>?zXOSp69g|TzP&TPRrsKM(jaIFWg^bkS9ZR-%-Pa zq81Cz{5u(Jd5-wh;%k4jml?D5aWkv8MRx}0}IC&z`S|NIcD6Cz= z85xE%vn(TEibhL7i6R6h>kvdMk>g;jE}P|$9n|wAGbtnArlqlmB;iahLr|otj-%+{ z=QzH;7pSJ|W!omY>~HOh;W>O-JsWd)8v$?G9HYb&_1^95eiXwxL@YFqZiGBp3POGN0i1B(7a!gJOei>o z@0G==DE}*bG#%S&(9iXEd$B8CJgRUMKyE&c;&t;v?cs^;-9uYEm_NHv`+zb1JW-&~E zWA8arCuCm+SRR!->Km>tv>5=(Zi75xD+j5?_GWO` z#{^l>uigUsst@}5=CafJ;UJb&qCl@nE~F*nOqT&9&_3Ku6s+PQ+3*WS@0SN`6v)|bO%u1rF&6l8C=6ze?&@AVdybB4?tO8e^ zsEnf8d~sZ~pFM@BU2$x!6Y{pGimt?L?meQ;GMp~0@a(D(S@K;2;1tG?X^5{7g~ zALzwrEpI}&nyBw3&E`U#aWzrQgm6s1m&xeXNM5+1aC2Vz9hPn(FDr5vxjGK`YW@LM zT3;w;Kll(vD>EGzJh{|Nb5`uOXT5fsSIW*R-_ZY~kCKetitv5wy)h-lh3l#d_Q{D{ z(#r#}OhIL7_Yu3^+@TC^mH1Kq@EGLBBB%w|-3RTMxKUt3f2@TlN_>W~W8r>HQa% zpkCv%#M9)?8pco!_=PcxX|Mz5Xy%iGjHUHW?ZU?c^r-sEX?xRruJaymRY-0F;A zI2TY4ySQg#afow!5s|YWz}c`p9B6-&I4%_g`6lV7Bav7CjvLIwPfQK91gasAUNQ*C z%ax_-Yw|q7vPz zo;-*|UFCC4X;S6mk-0OM2A-q~al$0XQ~+^6^rTRo)?8tbS|j|zkUzcBls=rA4G^Hw zj|;?945LNZO2Nnh`aDc*bw3K`0Y13}j0Z2`o#y%LC-aWzD!$+>x2SX&q80+?_&aT| z+BT9IV6TP_4BV)9HkK#SE=YC)3Cn5(PjHVZo6W$kzf9?t!S_pKT$0t|GMmy1Uf>f6 zzHJiqY2NasMKttPk-qJsgkg*CfwWw@PxslvE>H-bc2(HK{@GNuWHdolw6T} zid73l(+@{t|AEAZ^=xqZRYp?xH}&WlWg2Jaf<*KF7}rbbTM9YqqYqRbFI(zHqiH_Q zs>@|GrSDMXUb*41hjdyM!c5Ge(wT*rWWk-qdm z!bXKn5Q(Zk23ACL0H;#ToR#Nbg3QG-U^PzZX8|y$8;-iFar7@Ti(a8|R8KxCEyhih z=-pwQPIT_lfru)N{Kul3;>CXWZ$k`9d?J}W-G{lZcM;ULN{eY_nK#A6Uxtjf;ul7y z`SXa?XMPM8R9HoEE;g1~RF=+OSiCGf{3EDI0_Q zt@RdbIr-zcmIzZci+p*TCcecbljVFpj0q&7a*&OW>(;6x>9E#k_;HU=Yu|$etnYs6 zt@Zh`SKEdl;OF=+Lj-UrfCOiYC7m6VTMZkbQT%8}00n|*gQ*XMQhaoo?Af$n-vSCfI*SA)Xo)@{wD6sLPj(ZFv8;PeC7Fn47*E!#4DSM#QQgBd2|&9*_M3N$`UdpE4ZA6zUv z3y}+d$6qvxo|=USQ+UwqI34ookWJGHd@=C*!vHY^*I41Rx2RE2qhRWm8PdW=v#|?T zy!j+V1aWv2Ov^VM{r<+)8+`-217rp?jcdFRqW}}1hkp)=%KEJGA`*lf>(l93x?v;d z;$$Df!&Cij6%RdW9~8=h(1YbHg$;Ec8IIQ`9BSzc-xQE7%Zs2=_o%?Fgnu`;?KZ?lG{Y>+W>+1;c!s3~PSYqvC z#5PYXFxJ5?LjG}FR%8ih^VyFeB5G_T46Cg_uR#;wv>acOaJmn|$edqef!uZAK45Jz+xm``jU_^Dsqm+dO(R=`zvtrJ2ps~_B-^<6xMVz7Jg;33hFtam^FZpMhVruD4p3e!m9-7VYq^#mY zKO5^9+r^09T?Z$J6oqLf`P03D7WF2NfLjm46}aI47K^n+WPd;UDbY*He*U)(&owQr zAc*OS*R5aVOVLqMi~-D)k+-v%7DkO}fLRziq0ujuk1D*zuU zN(Cbe0Nn{isF?9w31`Hr4*;91v$E5rndC~WyFaGB;mRfpN4DrtC__M9U z*CYYu4legGGur!pL=@wIZnZQ2kzH&CS$RrCC!i26LKJ)0fVs*oAC(BqURcatl}Qvj zo#bv%A)SCcU^AHr2Hzh{F=;iK5uEmNFe@!5;0w)6)pCc}vfmfhP9zFJTS>Nbi-hY2 zqk=aDRGa&0$gxoC3!{zh7))9FnLlO@p|R8tXI&`zXo7&hauWw> zLQE3p*JYHDY08!|g(6o|nQdzx_yzbW7lRo`)C>e-Hfv&H}22+dzo`4J*>8Z`E%Bc&0psH5upXYRnLt`{Pz$KbgUBRQn4c z!B9I2h@RzjKynhqlZgy_sC7CRZ1ZIZv_fQQ+{s&-YeweK0EA1LCF;>F_SWAA{xNi| zJ&?sID?Q@4?{0s~;#M)g&M?zFZ~YhQKnSJ87q2UeB^E$+j77MHYN zMDPqN{z_*6tyc9?vA+mh-@!(VL~=T2FyUKPt!`cKvA2obD?!5STh9F=OGiodY{r1Ziie?|M84~dG+%A@)ax0N(bM_L7# z!P3gimm{Ee+py==5wyW+e2+%|N+$1jtq-4poRRFaVN^PPquqM|I3lOCxjrtV(K{?{ zO)qQKQrO;LVbW}|LDj8m@`Vpu34fdD6_pPhRIEv$MQ7*N`_ye{D4OjjMu3E+pIX%^ zBp`|l@f;dA`tFR+tRJRBjC$Q?iwqJ%P;A z(E3BP->bTAt>1M9Yw2_kr%ndlTjW9n+;r7Pmp3=nZ7MiO)9Ki(-x2j}qml$9`xs^s zN$KJEioTGC$Gx)m6^=yOyh?YsqRlS?)A*j6)$xbxZWqlIdD#FqxGX*a*KKSQN!q7% z@fp|g%R_U3DqdI9% z8s`j-I;-jmA|e|PU$VIv^|Zw4dxfCvMD+GP$EUfsqJ?FWE=Ox;n^lYQl#tS`BaMjRBT7$x&$u*=xa%P$8;1?x9cw{2FI2S+mb} zjwHyYI5V~S65#;vg2)Z?(ij*aKWS;tcKC&X^h&_$`!JStKq>!HLYZcQEX2A2R+>LP z9%RWf3P|ut)*ujoygeJ=+&>T)h-MyX-cvjhrc}x^>o9M6+QE<0^Wq`)*!iPAxSze* zdUk*n$u?WL&ij;5!{^&ICPq##FiWRfYObKZ zCBTF8sX|mV#euZ=m{Z4olk<~XA_~nxDfj0eXND}+Z4E^?vrsl){H|>7DwfHSJh2M; zck~|+dKR(pgm_|D&)oDHIAt%knepi^o3Toy_#tQ0-T>K!E1J~0_57rHycg$B{O0o+ zI>n&jbCQ`}Vb@KN)G9Rl>G3K_?wd4T10HKrydOhEuqwhH=CRLPoi;mC!c(k5WLW1W zzIeUT;9OpF*?3i?=8@SzQoq55%%f?+i>B+X7BL2k^am7ckpHwK=U>~ZD5avhSU=*1 zAzQlUS2u!{YFFaa2QW%T&u;g8JKk__SN4j3WXldA;x8@S)Usg@UODoPG3JD5Ulq8I z%x>xVR$`#nQ}JYX)$ySqR-<%SBkeU#fXEn{n~6Nqk6k!4p;b-i+K?KVN?56Opw&g@ zG3Pv;CW*z7QVyK&J9t! z{JumjWHv(&26RT zopli;i$|FLM`^G{eL%eKLpVavm}!2rmt=J=V5WPhSi(Z#FQT zkLNN(P^n^eKKtaV*K@#^#u*S)#eoKuey1`iYW0F}U@WMLeN_*s3#AMuXko?MBM1kp zkJh=;P5$0J(KeHkHbv~bu3_yr47Q%9J*zXnB|LI=Hg^AC0k7%vK(pXu2g6h!VQT@_ z`jrm?{pThlr)AI=hgXz8Ac^kS2sn?buW+1nw(EbOwKdnr+G3P!yx?Kt-ceJLR^IeMH)$8UJ+?QC5_et!y7!rp4=rRLul`C%@ z6e5!uQHLaniF&l6t*LPY7$r6$<}zLaM~Hef?#Y@=G~eiLF?w1#u{ z7`M13WAN)I8FlEt+p0C{iaSq7=SHLBk&3BhS8)$Po{WQztX z(!1B6WT+|*?CKgAxwhI>U>TIYGP@KJMM4uT;Lwkrv;3FLdImC2ffm($Tb_)i8lv>l z(!>wbX_G^@u%XYxse_n%P`#O=wwJXB`F(oiXxT*?&DsXpiv`*j6)qB_ zE>9br{WjL?gp?dw$(!C;ncV2{c=^XGMXykWGrfSq!?Q|pUZ$^XGbDW zNO*|4lMKqrX5apNBbtWc@X^Pj1H+UZe)c3E zbKU6V{p-1pToX`N^DcMAR!bSTH_pNJDvp^-UU-jSiJYk(;sIe1Nm3K;!fV zYAj+IL88zhqcSETB;cKeS*bWWUkuX?@d~J2ZjxFMn)_aQejZHwU_pygK%!_ycKek@ zo%ud~Y2Z9`_E4D|TizEUy&-bqUP(+Jrmw(wK%f%5iT>uMI2y3Ob^Z;%wZl%%emv|S zE^gxULPfyTXSnf;*`N2u8GEH<>>u5I4u9VmQL7h*JGL-qH8}5hopN-&x7RDTKI|lGV(q8uMRM<1H+%0@UWD(YkfRks{!}*hU+{Q<9(XE&kX2aK2KaFNxxHvKSZV# ze4;vou~))0SrXN;5^v>W%Z_>b&n$+@c2OqqCY{X7MIwXu2icm3Kke>;mu75;VjVq| z88KO5U*CDL)JsHV&b%k8;%UUA*w7{P2hx$rWkYKVp-a| z&b>q$tz@O6IgwsSsJTDqO@e5(RI*6|Oa}IK^v`*j0KIa(tiM290jL}aH>JP+n;N~= zKW|Q9%M4&hc%?c?q~nT;EHq5zfe&{kWhAEtbCw2tSXiq%7RWgyZ=o^ViJrrNJTL>S z8#MGAhCC4fX>eMl+40+<5$aEA^1^lJc*lreNT4rdpztHoy>ngK`>lbJms(bKUJK~! zDQ)0bcosj`vbz2u&PG+Qo%KyKwDvWIvp%e;Z#NI|Ut5^9H0|h2%J4a|kSdghSDnt5 z;R0H@ig@mn6?oZO4B;_Dx0tOM){o0@Y7*g8uHJUr+KK0pi>D0bAeSg5p_!epv`Ifa zVvgM0@Cq2+7(;X8IZ+tu`_}2_b>27aEXi5lwVNq4ZSac54#Yd&LRY1l;>q9mgwR4s zGSBqB-Dg$iBgpquu5OT*Hp?ljb7hen{30(^74^}&B}0-&aUjpL#@tF}ODtlWN39b+ z3T0`BSgWT88cGYdd2CNfknu>VF%n&Gzel8{{Ky8=NYav>Ve8|hbxSAgq&qT&_eUa* z2J2+OpDxL!3K>6;J36S0U4q6|WV_#j*oP;OaGR?-r)%3TW^Sc`dJ`=c6Y!m_M>krf}yFCBx2@yJyb0b`ogolwR|y~1A^|4 z4b7$&JyiOHgy?PZMu%QQZE>7F7VUpPnzHr@yK0=io2s+UfZ*eYLxR6PhY0jon{CWx z-|MT^``Px-KlxWQRTPcnquAi(0QghLroAurL^h0gd@LH$WY!m%8|0)(lz)cJa^w&4 z$UIZ}f@I)oWIwkFs4ES!L82?MG&O1Gr)9>p(w65N6I*Z3dMVS^#Ca&QN>h|;cE$qP zRiG^=4;vCHILK0uT2G{wS=0HRW?k&I6io>t$H`mrvK)984G&u94%*iPvzsN31GAcW z*_vH~4+kgvHl9+KtZeBkv1jfC9QHC>Q_JrbJK>dG)GZ?pe6oTp8%uXss|sjZ^#~<# z=0lpc>f_z`f`Jy^WM=Ba>d)J@MSOV3{i_LPwh6=>5`yXJ zhJK-z=}yX^$m00%0t(CGut}R!x+QObe972KPE-H5=$uwSzWkP|WTO_34YlOe&@f3( z=l;6}yV61`6t=2)s<$=MIlSZDO4c|WHL}g#@MD*~NRqf=Fa;=^NK*+Vf2m)brb6Tg zKQ_DT8jG=yH941#UYvE1+k~cKY^37M`fQ19R3uG8skuR{45t+hr#oVp4G)5dlF+_k z_)2=PZcWFTV@4`1OqQlp`_7b*S~QxH#QJ9#Rc_X5?oeZ^irilFUsH9u9_bnv$Ff-;kS0t#n`JR(^-ZCI7^6LwKthKouPX4qNq%h zg=8A;py=Nv*((g7LIV@mC}S43XF)g6CZ6;NeTA@pqU6ca7uftn1W*2vkNR|y-JwOv zxwygSw_)*4r6=!&&`s?No?Nd*th+Arj}~jCQ&e}>r=wvh8&X`4^ddc~tf^Z@Ml9=h zG0om_enE&9@gfnE(sDQ(^?{$0=1)cn_EH*nDoB=YhvbBV~0g}*s3MM zHzo2StkLcshv>YE6mF|m!6j$fC!qdSlkB9|;q+i@bxwqAdVF!0v)J)4K%n*UcG32O zpknBkEcKFGsByhNouhq6J#3J_qhQ`+9f#=E2;)S*lbP0OxSB9 zdtc7?9C3KNiyWNa`nZwLw)HEmavztwbL($K1Ds>@)fdQ8QK8Uy5z|<+NgI2Idb1mO z9VhHzyWNGm=M?)hr4yq}J}wh+56{9+nY*ZD_bd(frIiv60Y@o1yi83;f zs8E;>)yb1(cpCFYW>|uyVJO}`kY5O)Bx9J^eNHQ*9zhWjWJ}ANhlo9p6Kbr4FYV>s zxzd6no4R*!e1G?`-yo031NPvvWlh1VONb8$+6V7~@%QC-00N9gxmC-+Letjrg!1N< zMA^{xW1Gm&{GAf6L4d8k-b0P9vR(MPrK`MUW-WjyLWLsMbGM|RE+kBZ=odL8x1vMU zqdAEl7xLY0MOE=RZjq!(izY&3OoiJJB;`##!ur9)3zj$Ea|7v}CcGF3U|J3Ft84vO zb(^>9|6nq32E)RjHj|@TmA0y4y-1y->X0wsHjsD4s$MZVjQ%Kp8@TN$VWTD|O-3Ie z6`&w=_^p`)nD|mkD!i<_Ft<6dE4>@xrhfQ0p;fD=99|#g>%kV+RxepJtMVpct;uoW zF6I7mefH#@)!|?UdG=3p#^kuGiwVf|aR!yo0CCDdO_$#j^f#H`Im!M{Om zw`V&n0G|uLrD{B@8GVP~1AEdYL2-pUIEWzL<{W=$YtJ9Wxtc@)(GOHJ0NOc8C+21n z1W<*|{ydI>e#`;@5A4_udaJDxrIdxA!@$^VI5QuNopi-d%LjnM74<9kaqW^wTG>Kz zTq}(OAV9xtr923d9m!wpOWxC*ze!-=Ma^)O?1z8FoO3Qf1OZYVk3e~}av9+g{yq+| z!Dr8K6wl8|5s}y+j+r_cIIs6Q$NAxO2CP4w#(V||8)4L>IgP#=dF|v%p790ux!=Of z;xrXH_>qurpLfxA6NwXn+#r>w08?|DAQf9r_dqF@i#E<`DjfqJn*IbHp9s5}|PI)oe7$}pQdwd2?Y zCURgWIDXGy!ss|bj1Awvi_Aozu4d!yZikDgMEPM&j;#eywfVce{Gh6487OWvE0&Kw zTp^I8V)d!n!%1d&j~Mehxy&q1*$f7`LzD*Ez1Gj>vFecfR|wfbH{VJ^^wT%jf*ZDx zDGd%j#6TVtfy_X&c`Vqv$V8%)Kw*c=r4R*h{CX{*tS~EHosmh~w&T!IQzfZs>QZz9 ziW5!4QA&4#oM1fK4Wq;j){$!=LG_0isEq+N0M6ll&U--Jl84aGB6}0&cNflEU3|#* z4iM3xq@+^B1lAL4yBJe8ow$;7Oz7;|3@#X*QnRcmn2tg213OWaM%r;YYz0b@@9DYGuF9xkW< z?cU4dak1=2fOaQ{~$U|^Kv3YVb2{(hf? zyE?7uKbg=i)7HDx!5DfOQ2*3&OM)czw#VD&PRCEaJ4S<2vm~e)ZiE@gd3hfiP0Xvt zni0?Dwowbt?jRmxntCd~@(1x7eFL@GwLq%yc{aC|64caFg-8g!WFxKuxOWlDIcqmT zMCG%W$n1+?e$T%Q0#XgpG^#zk<{kK;^zpxW>c-*U`At3IzkgsqAK5dQc`BxGN=4LT zyotE*RE4^qqqP?!F5C$~#wlV!ecl~&gr8PB(dWI8gCEKmOmKjO&|AnB6oPfCn+w_I z!4;**K#khIk+~RgNy8kb?1xB16f4oM1BmD>7jtrJPAw15e+eD;ouLE-~2 zq4)B|!lL(zAL@XS=hKPXs!gasIkR%1ufCP3(o2veAVi3?Oc6+fCaZ~mRpKBLMf+vX z4u5s_^r$}-{|9Ejtq_a7L&~*Y0aM*3VXJ1gbu^&3M549(xMEZu*taH#hIPj!kbSPO zQ{LL`*Xp~JU?$=O`hX__HC+{a2o9j$fAWBb{rbDhR{+%9M&ZoQG#TtI%P=7HRo}lA@=`yN?^!2rxrl7j>fybODu^;pzeqCipq3&B)+;1( zUq3|zD1a1iNnLDUk2L4aPMYTkA<~2oTOqEHa2<=u4%yD~&2=+Of{Cw1YY)RgLvzu4 zt}SL!=C-D0k959f_Ey{rgP$*}F9u^e2-pw>P}+l|Rvi`?0O;3$!llDF;4#P*K@rfn znJiWV9$gics}-%3ztuWdjg`3Ea;;gPoB)Kv0r=`mc{P}mHfoJoudEI;n7sx(cA?c! zqRsB1J*fCWaoE;FlY@hlia`if&*DF1Ye#aMAQN3GN~AxKqLgMV6Q)V&ChmO6+-i~6ra>OZg#3m*Z6EU0j8 zURMLvJf=(jp{+sg~V(nmYT8ZTNua5T* z)1BU9^y(@ZgV(1WsqTm#G_T8~=a;&=BQ%2Pu zrK+fw?1JlH)-KXaJpO_wxg&IIvs2x;rRu`($2cAx7joxRp*fJ_G>z4*gjzHd2+ zFYCL%@WlSt3r-lX?7@T=zPM(JY_sve>Tu>QRcCgbSZ(d7M;qPEHF5^wn{EvRHNX8o z4qf1QlRIWEM&jw3?Q3t~1E=)V|fPAg349K)*r&unEkC6Gkm8A2R`W@;owdaP*geN)?#;B%AJ4OnY_(@{L7O- zr)%=?EC_TSZ`;n4vSj^aU){XN?=_uH@T)g;x*^u>Om3Gm$#ZN#PxD%#)APoMz|BU9 z;^*b@%c!z+0`hVI@qvl0VKb6%e=1YS(PsMp{jfFWQhLNC=y;*f<9U7l?Rw7OUA8*k;D(+lvG9*hj;IcS$Dc&=X z?3w))bTFA>)vyQ=y12erDBa`N2L9i8Kg4>6=+2FEk=65)O)B3B4|OK22ffHf)5*pz z>ikscaJ95~>hMM~xJkq15DtE>P|{qbxz=32gQL;^QkvD9E>&@JK{A@SNNan8Ng?^D zQ=s&4b45}Q*BUpcayiyR32!zBLhtWWr>y4YIYGU$+Z_d8WSeH6JqVVi5#5xWV`7kr zGvq{79CH8SopnG5Jv=Mle&#!AjBroKkQcryQY*jPvGPTs$us?qFpNe02aY3jaUsQ; z((CUpO%%~-xV?iQmr}%#h6#^(#=lAZ?AB6xZ=zY-MLGP;j#Jo~6B&{(wo{tJEZrKb zKu_)7rvFwfI;kmT$&0)^>z?8$L-NrXD~PpaYbIfqO#L2e3=Gn715Ds%yw_;L8_Ir# zI6(c(@c8%in_CmXC+qea?M(i!>K2lB?|UZwCNRXa=Fwe_;Yw&kWtJ5G`TskK9-Vt+)Sc%dZ!e?Q{22``JNog+ zgz+dqN+3?ynJ@`?m?bvvxN$LfHCs{A$Ufs|C zPA!xL#obCKyFcfI?%Zq7S0bY1{BZDnqhY6KSC6p}VO%J6IRr0oP0zjO@$cI$fT`3^ zc&xX3&qmZk^o{6yLUx$W%TZm4Nu%7qF}$@K{lrUD7Bd|2pqTc@Zma^^`|bM;!4mDJ zUMvoN;PFdW{iJnyGx;Pja5)ry7|X_{d#{cljF8>vzxva)OsAx{Xu^H6?tJ&!@wGG1 zpR@1~fyJOQ|DC@%(|)#lzb{+r1LjIHnj`^5C#UmR$4JLa=c&$f_>)C}RUPM|<1Jlb zD_J_i+{4i}pT7ZK|EDc-7Tk84ThoWBF2(uZc~9phd$NG3@CXP4t^9v&h&1j#3Ha6e zrEM-UFEik7P|(?XbvDfecJ#*Nje**xrw%0&BN?mu3ZE2yi&TDB6x^xpH1%Z3^SvCI zJV#apsdgCE=F_s-mM?8GjHi#F39KUM`$vS)F4udpt6l$BZ%o`Pzk9r&lWc4O585u| zL#4{08KFf+{?f#MJoQ^!c$nI@w;=7+SX}GzW=`@9n1i_(>iZv@2rXglT;wsNzg_R? zmUz6{yWz!>*9QCPM5zx2cBh zwZpcP&QXNalfT-3doZ0}qce_n79-ZH$A!fQ?{^8(ylUJV-qsN)ZQQpQbdhYA}zdTDxgqSOge@XlWl5ewqR4$o~5c|EGf**@NP$-w87JFyMwn&Y!Yvq zCwDwR&l>Orr#BRPT^M%!wo)n~R`vxRgC%B%KSnTi+M(p=O)Q*p+N!XXqaI}5=(Dkr zCi={f^P_DYnlr`H@rQ#4UAxNz19GCkDeblQNwlxdf|>2o}utyQ*zx0x!A zr6)y{hMcWB)jQkL$H{L0q>VdyPsR4Kev~O{qr&*WpcEI^Xl*7s26}mWvF=6BbFp|^ z;-%8YUoHlWG$5ivdJbT)Em|mqV$zSKo$?2nfo_Xn^2n_Zu?+qG$#N0V(HZ--qf81* z4;Mwr4%o1ZVDkzqS7uF@jsti6bZzj{$;+XjK@rTgjG_XWw{N2}4CrOPpNRKAH+jzC z%=nz?fk^Y|cH4~8^;p@JPEx2zgmB|-|E{K?)yLCL)23ULQuFV&{-(Jle{Q+U7HRA5OGFi788K!5h7G%&a zzOR@Hzf24KI*>#4e@2nobNOMUo zYyr=7>V{&c>IW~Hszwtj8!egNdM?FPCfd_~obobmH z!>{$|etf_`85qwtk`idR!Arh3M?kGNSN;I8qY>in(qF5Qg&rnX`)R|_0J z_FtuPS7+Y*f}Q=3+Z&JrdG<$6#K+gKnvY>tuJN}^>9cd{@dkyTB%BzHWvuoF6}2;3 zxxA~h191)W{rx5Q`YF`w@kV-UHPy&j_4q57U1*FtlBMwWg+_K-lXE-E-`gY63#@#V+K1NsVb#U#!v$End7H@|Uh|J2fN=qGi$C;i47 zex@0w$5p8Ol(rGqL+)C?R<13bA|?%$$bBvoham6Hvs`{X?41W)QzT|JVxpfjKRP>@ zwr=D5ow4{^nTmCL<60XgaHEbl$g_H}45Tmt8jH5>R(7%C<#>Lsy>iw+S#I;`%f}-N z5k4PzmmXqFcwl;RdxHqaKDBWS*;gmuV$YF$vdNIzVE8kWJRY^l;_qvJZ;NiZ%S!yS zx?g@Rw&-;{+jOdP1nVzu>#_H~UJnM(bwBSz1t(Ip zlh;0pOYfuC`4zAYUEd7a4E(c|$~IcxI3iPrQd3%UG!UFC5l&l|dF*3lZ5URf<83?N zJF+}t?vPR0yMjJ@oNIc0!7^n1SZlIsXe3FK|z|eOhAa*@{cCcsc3G$y#Ivhn` z;Nmu39!uQW^*G|@m~|L3Hr0)y+ttl#y_HECI;R6~XZ3xml@RR%47+%irawUD-yOD+C)>gG&O5Npr ztf9}wC^3rWFULipU3)ifP|ZGvb0J{(QwoWR-;M)%Zf27qj)wBBqWO{5<+h*4 zUB2)t->_3GJ$?>H{uWv7BIBd!7weTZWGil?e1U@spX|#~9sO34Ix;Hh8qFX5EYk73 zdvC_V1|QR>9Xf|N!oql`=rI**O7$*lGH;Ijxgui&ohgxpo! zKhQ<*KlU@ZLSJ03pE-4v6d3otdNfFLo#u@&*Ai)WaA!gGMqB?|&KIRMuVl{hpI8^7 z&(<7--im3YtpuA#Y$%ZU2Cef`p}x*Hoco8pDt%9X7~r1EK7d~KZFu}k{2d+3HUoZe zxvJV#kHx$ZGom-9C71{l@Bf05Phv;We5R+2vJ{b8V}01EEN)de!>Idcn>&;nc~_9) zQm;>pqN1uLG(TnDkzHLw=yk$S-$QTijB%!El$~aBete4kJ zyZ6eAE#aYAVpBnT`cq4i^%9}qRGuRgS48}mU|*RNo~;>uatq}*%>825Pg=#;CnBiL zo9u3aNzmJ<5@3&Ud|#x~h%bz9Uh^#eOdR4}%3Ix^dr_wW*@&NDG{Q z4~}S==srl)l{eRJE>b=~PsoVYor_Pna5wj5ZBiYHDr`_li7foyTpevPRxRmXXk>|T zeKf)0Ny59gVzTyFWTo8$qT{m^{4)%P`_i{;+-UcO-EHZ?E^)+W@IgJkM`rU^REuie zh>y(ZiN;dWX#V~F;pU2gS4u_FrK?YT^;d(l=3EFRrjNb983(D>&Ct^oT3KIxbp#n4wDp5HuUh$$ zCVTt*Ib!0FqspV8l-`!-&PX9PCvx<|!{j~OfB0Iu6b=5eW z7VbRJenw1PAZ_(*qJY`@Cq;}j8kVdrraq}_=&LuN$!t!a<66+O`e2;NW*h*sVH5t7 zFV=NZp53sOlk^h#*#swfx5{yroggnbKlW7L?7nE^KmF*=!aFMkE(UZ>WRtJznueVM z>H^cGU)8TyFV`|A9QLWRPi~iclmrPHFAT1~6HxFTzjOQ9Ll+&ZL6o}dN0{rF=CfV# zZfIfZw?=!qOwVQCj)MN7_5L1jsr9GOt0Y{mA1vpm5+DAmQjLSH6W85~?l&Eel~SrN zhsO6v&c(E4!$eCWWu<<2vwcJTITu-6AsW>X&Bevhi+alricCEe-pWs$gJ&(&74!Mw z-oG*eA81W|`n4b~VfA0*L7#s<7t9T{^4zqM%5#H5eOs2`W9Gu$EItytlTy08uK$`R zR_9BX4!m>-b5%FKfOszYq*aMMgVlHPqvPzEtmG9t^PbeXt&~LP6m;7!ybXM3?{)M% zOCiaWV#atRYv79Y@Ac$D!@OnV$??Ir##AP-U0%zneA|gP1^azQNrpAbL*mQTx(~j+ z+>T32h5J=jx(w*8WR*HmHum!r+Hk&JbJj5a_U+l&2jRRTc&D9{IYmmH@&-iy`HnDo z=GjDJdiJxEH+f5F!$Yy! zd4n3nIRm%!l8M&EjLp?5-kPx*GZ<&`?kpQ8ZxsISl_*TE-g|OKM1$NXBX9C`e7()C z=c}Ra5g{Lm*q%~nCWd($dNkvF_y9~$YupG}@6KE)mV#r{I~j!umoEw&_arAlKC(Q3 zx%ugd!$v}3$+rTi#yr7|*Qly4v&_#a)!t{j4{V$pTLmuAO=gbkhDcaIU`y}?0Enj_*mBgnKFFjmuw^{U%>`CCB;sVEfTAr?nloumrh;s06)&+0ZgsG=18a zE{ZNUsh<*5htdmo7dF4R&-K&Sm1cVBl@e7do1EXf(XFi-ZtHH_2DY8dRA{?HNLitEG6qc1<_|K;WLFO8^l+I)56)z?*2Vr1n) z!u_#kzPZU76GLMFo6gP1R*q~LuhBR*53E* z`{&+!p7T8S{Mr1TbB6iOuZ(xR?-*Yb3ifaqyGH^jEqCnrsiIsCNbLol?MijdPKvuLO&*ZhPm{j9X3+gTnMXGGy)?IV!tWd zbC=3?U}9W$_@n_{JDDyz8cX&w$q(2J(g-7+;RHX45v~{;o6U!y=nTdvw{@T8 zCh)88|Hu~;vN_t8YlsuZ{?hTcL)`KTl)Xe51{9_R< zH&lZccl>V9o+`m?h{7vBo%_vCLVC9eHMDmDBF<&y9 zNF(2)sAm2fz?BH8O6wn0qtGTWATi>f z4;IojJ?#ZCgT)Ph5JGsnhyXjD^6Ky+omm#c1j{wE{3oOe)qCspNWcud*S^w zI#%V}2eN88cN9{7x6`p1X+FIQyBo+159s4%J*gbzt;n6bsF79Ul7X6UXbzqBH-1yGK!~>$R_WA(&x^NtceL;AW)0v@+aYt6O z?_PjNHuDE82=ArmSCfy`ZNmorS}!b9vrj#mlsNz(_#`WG4x~v7JFg`!9C)WjaHR|? zSi^mIZymcD$xd%o_7w>&E-SiQ&U__zlWm%Dh2VH*-u?1I5bZH~uiw@L)?@2);a*;w zak{^-?x1wzj>Teb01izewuM20+;+GXI;kaLop6WOueMA1>z$eQN*IlfvOio0Lj6nf zAL{dFu4Sd^)hAhr-T#uKo9DSz9XS7`MMp%fmt&0oB}7f)Jt}W1{s*V3-qAfkIw^|) zROx@c;s0+Qb;P@}dVjU4Fes?Dr>$fCcSSM?Vq(W-A>{Kjqyk_D3;ifRh28h&tqyL_PW*c-^s&zs8#y8N5J`=%B;~}?G70I%m?19^S z@z3Eak9D(hi&T}q@lf}{#DP4yIt17mMV8GxB2bZ`ZXI#Rg&;F8V(zs4bM|-DxhZm1 zN<}xf_?MFZE*q(DD)LH}on~+pSpW#Ud*^^E;rpTgxC=gelq>%XI3FnfwyUna?ZBA2 zePZtu0#-lv54NN?KUFd#MLz-l7+YG{awx)F??5g-t}>q!`(Z5-M$i> z$mz^3%q&NmmtTA7ixQmAs8yUp+ith)i;WBLWZA9v%#EL{BQWcFhl)P}HYxz#sn(i~ zu~RMslbI}U;6LF(DaXLP<~S(01;rX-=H^_cx~#L|F&V&<4=2S+Q=&br`TYf4_in-C zj#8psHVR#Ftzn{SXtVWtqIriNEo^KhoQQmH#I>Hf0gm}tznU{7QwdFidut-LRAn~vZVLt?Mch$m9`T@0|S zE?wOsz#fgU4#~)nwu@ib7TJQB=W*k+1R3O3H3_%ilG{J3&#y=BtvyZ1lS(F zi_X)T%m!!3RX=2cB+6S?!%`1i(ZL%JpR1Jjn+W%7^VJDZN=BYFjWlaVV9>ofMAM%K z9(XQim#B=+9*nX8!@3;@gH@ZgZ z!%+ZLt%b%M;qTN}mb6NMAHsNz)lo_3}`13fm#`VX=ghjF6*49uEc?#*tSdPDK zwfemhw=D`=4@P-D3tL%FeS|TT6^%CdF^RhbP7nWTYn<&qE&jj1M4fhO)W~E_=E*QmoA~v{o~X zbrZm6d`&@%;-0Fpg{tZc8!E+wvy)seS#wH+6F~ULL0^gZxc<79xb#fS_Ei}h^T|K* zPV)&qd>tImr<#4o*B4R!V=CT8i)H;XE2T@$y;-8@IAl^ArDQ3$-!`??#1u1Gm)cY3 zSO!D-PRxBp74DQj*%;lcHI%gwGM3R4(QHg>Z#A*)OO7rln;R8gt?9QSn(Fw>unV7; zg=zZ)lrh_LeEXH9`ixwjfl6pF+Y#_EDg+g5d`awQ!>)uCufJqrLQdbpp|3JK7B5Cu zKl@tj8j4zx@ufB>vSy>>m`08JUJcH*D9Z!gab#q2@?Be}kQ&ERP8cpb$4kM{5X%{l zFDSQ9D6Wpmx4Eh*(wG&a#u}vRc}3X}1=l8ySNxH)SzZ0%Mb|T)EahJooIID?IlsuT zY}okcWt`z#Ym9ZP2-42^Q6J>-a`Gz}gSIWV_I!p58#K*2Yo*e<1&IS|0wZHIHDF>c zr{4-cuZ(^L3)yHKyPf;Ju7#eQ)>u_7z4NrG8A%do#F6C}X!Ss7Y+_9e6CB{uTgbCe zA*(5CKgCup>&E(UlrNnxb^q0F7^m##N`XeyfS_n=O^&o7R8Qec)HXnJq#ej_K13f_RPO}vw>$yGII zs)-!@`P%Yy$1vmG3tuzcnyhg2#m2H^X-wJ8dCG`bLR_G@^vWstmjdZzdNPL%-kqDx zRb8td%1Rj8BIspv9ZT!Z=kcEYCi9LXbskeTN;B2v{9TyKP|pa0n|8_;!p}om#ny{H4}mD`IWtKjGC_GoFU4>*q)K zFs;ERVZ5$~ON5dp)-%paH{fVJ;;*aw4}tJ}Z-ucLL#L{2i54Mh$_4$5uE|RC(sh{$ zs`vP?E*8%xYU%W>JE~y6d%vryauI}0$oe?5xwBa)(Dd0p8{~1t$9^oehDCV*nT&89 zZ?97V#*NE0?%8}S3)a-Er#nPW76=sLUZu6}%kSMHrL9kp&ic@XTKn-ur4@ZP|Kdr|KD zBh%FkWVJ^k}r0CR&QSO~yTh*5_+P)Fckj0?LlesAEuu z*tkK(g7W;#JR55zePQ@q>YqAWORNmX)GrorkQ9c?6TUU-_({yDNke>LyTl~|<>_dP z2}f5P>JPBTt0CTUtz(qyRu=o1u>GDfD<~jl`Q>k5-cWI)!UtpL9&*JEbFK7{to;pJ z6*Y@;wDu{qp_z`zC_y~$l85O0xuP}ZP{B~qP>SBox4yD&6yO}DzYg!2&u2|*YZC04 z2T2XeKcY{XF}k`4iuLz=BddFc zTNQ18AJpJRZo_aA-&cH?^QauLS}fC*-T&f~F{WGS{uG# zL_?ypG=R!!t}UHzz0?a8uKXX3BwmBbtp&#%-dM(Go=^U{4JB$F<~Flgb?kgE?<+TE z4=%>TUfC&99yDPs(_nPwz_jGR|Knky8KbD@UT8gvd+--1IYzxqwFdE5-<9JlhAJvD zjw71AGSm7uEl{eTrpM=%6Y5gvl0C9&81JK^O8WDc(xX8Oes(nRQRgR(s4LJG=>@+< zdHc-%?n>CZ{tiXzLd~WxA#o{OU-boi?iBePPEh)x+oYzePeyi1b+POT(2K3WxjTIj z-dhY%E)YJ8A_TsaHe}5bvfJZ+u3ruHd#F?tok^s68WoD#EjOAhx)n(_NoTBb(;8Ah z-X?|d`V(f3V|ax1q&L<&CDp6ZMaOco-u2Cg=(6|}!y#Wo8^stADph%z$!xCM&_@to zS15!*2yF-UK_mKQno29gkf1nsxH20WPWni_S*oAe&Wzu|Dv(7nYE4kY^9+pfn zUz2n!Sf*vhIpBTB&sKi*7o#p9pcLAL2sLoa(MuS2-;46(uWgu^NYb=D)kHj2oco?P zobL|b?SZ9pKbu?H`LZ-Fxc&O_hT0JKd?f82rkPRK$I6`FW)Af7Y65%t$1dp#s$>qyIJ>SLo8dSB(~ER`b=#fOP4t>o`8mG zNMrzh454fq>2=bL@PznLCQ{i8Sw`9UtM2+EX&LCELTOMon7Ur^apx>QHv&p>BL;#e zt^N4O=N_8J=`?Nr;jkUhx7Lz^TN4s*fQ|i4Fk`>Ur!y%mb;~$cKmLVdSHo-$2E?0^ ziN`b4s)r`}__SDbQACOU>Naf&{<0?8jdR;kXpuqm3Q9r2d`#>VPIL*TjjyK=I1zb&(aw+%SEU6b zV2!(t@Pz}|BZLhX6vEH8>DvOUM2bm|*30B+Sr$bXWT5(LLp~O|-5m0SBhL!rdx)M- z$!SUv#`rW&_!j%b*e#5ZuRZQd0+S&Q3(?>bv?+8PxrBhiT1sZL##CmKS!)d01~u?o zb$1EuBMWK>KC`*dVlS+yW4+@DT~ltSQ!#<)I7VKfsQ@6Zysw%SDw`#{a8TU$an{P! zFSkEk(p^TK-z1_pwPZxGsL4WvyIzJBzuA&i(pE6p@^;DM3HbvwV;mk5tE0?2>owPx z{~(+-!_e?^t$P#h?^>p{io_>(x>#8v7Ij$c-=A`(=L>yx0U*BW z5kCCf%H~^NT8oFZy%j-tkj^_b6G5@8N%rlDUCW-9fG3%ZQT(RT!%y(P1d$m}4DDetunivUuq)tg&EMdx7La z72ucD=mj@gcf|++s9*^ejSU^Yp~zOJBA(WnMn_5SD!R@FlXWmKOSh)Aw@Q}?Bv*8O zT(r2KTA0vpH9`Le#|#dTDHAApVVEJbApffm$Qkb2@+xUXOp`pwVamuI0~s0oom|rH z_Eg#*3>E{Y2bo<_Ec_!>^oZZp+6u%|hQI3}Zqxck4c z$j&3cx&7bEj491=wp#-xm$2`0w3n(XC!JO21`^w_XY0zq8Vk5k?B%WcwX2W;&NRRC zilyQftn1Sa?R7FuJ!$-irg69n;>~HKahvKIErd6eK(>**Yq%D@h)t~Z%0zdEr}{aP-><&@N}MO%wTP+bO~q4naYIy9)yzVvhc*(? z)~Z&4R;cySl{aKejg;BpU#^Gb+BdOmT}6Ev4s~BYo6f&0a$%5&F00Rej!<*5z*skZ zd3&n_4y-!>o$}Dx4R9rC42H)U{3SpXd?b_GRXFU*P%+fbVPku0J#jXD^&Yu#Y2t`{K-|oCzGDOF)3u`_zDG+_C)$K z;#||QE@Y{Q0n8?&tnW`GZ+;7695LnU&?tWfPtCwy_C%11*WuP3WMz?^2HheR?0`x&!ST8dJtloeJZyd?)%%Y-6IS;Jz=3At2JkaKNj-6Yz6QJ{MTI1MN zH)YdW_FKBF@J>-#mG^i4=?1^>zuQX*bgor@Xj>9#!@mo9<$vLw+dNh?I%biy;RbB9LfG%&ow6QiNLuib?Yr3h82b*Dv-}XPWu#qP*qq>V? zTVEzK%$%8b_*h=}d;0~M>K^4V@|*0(ij6{CJ#}ems}}Gte+`BaV2ojo*)3%N97pTl(*MWnlRI(4;i@39b$4_q(P^SE_DMISXJuMLD^H z*y1ty^~G_Qr>|y8S&(P1QF(7Z6O+YbM=sdNmM;OAB_ha0T!y^y>#LzqxYXLU_<@n@ z-hG*dKi+rRJ#^Q%ns?r)*vkEa4CQw=v@~-2tG6T>pvp?z&8@if$ycbSJg>X2~Ej!K)a|_Zri{x>3QX2{n~h`L zRwnpm?c|)57R>x1Z{)A?D>C>#X;h>%nCKD!yfKPFh)Ju``%_(`;Q+;7ZT6Sht(w7@R)tA;SRm(E2Dz2yH&Fv?)z7^=_4sogvh#K%kBIm8}$< zUK8o)3f2ChCiw_#TsP+fZHl886-OcFJD27|6e6uJ#tpA&%`EmLM_(pIUtw|Qw+2UI zCH6(|6ni~B+!snozg{+cdY5vA%tvtilMn!(8xjoOoNG?`G<5^q9NtV3SQ9Jlf_bwb zbW@e9%E?(?0mWamd7ME-p`-eQ(UlMVT0U-mj36Y@`Sxlv<+K11Y4;=TUGd~xbJy8{ zrMha5>_1>(piuU7dwHDNkV1SV+FB+I(;CMLaj<>X#Xu)4JMo)2c!-B4fl|$kM$x@ zsfeiZrT4?sam7=8*H!?#bF@g@s#T-HVy-oZ#r)Z%oK5~-!+PE|bkW)91 zL~TN1RqtN0Vl7Mr`7~$gc7R~dFVOx&H#M}$JRW6s)UGnK&`P(mKGWdF6z7%g(Y{uE zblbAgyxo%q-lu^Ve8B1--hy;rvvaBvc+PMe$^6y2I5Xh|7Fy^z>wj7sKy@JRm;gj8 z7)lsUMieeY=k%NA436pKxa&57L*4qn-x_kPSa}d`qKnb4a9(tgAgxbSQ8%(ijpyGm zm6LA~dm8c=9U-%v)Sb);UibMaY`j}Yd16`4EF-qd=8Xj9=w4qA%A*5Qb|0A6`UKkD_e2( zg^h3SSqo|T6lGBK)iM+>SWK8jTq<6_fUtRJE{OkCwDEZkL;`q>is{d`wxAeTukFy* zIVfAj$`ossjm%&%{Ji4vbwq>7gjG&8EWdKTxG%${-lnErJx6D~>KXZK!AG*z(AL+~ zH@l6^dQE~WGv;%J{iXd39J+;to#gHQxzk|lCRDF>_GqXwDj)@{*QjTRu`nVG&fR^Z zEWY(2bXUHxrr)p+_#SYZa-Kz0Z*8L1ckApVHc#*yknYO|z{rr(vZY50Y^qeuuY`X_ z3ZXB1&Gib3vSmSJpdvvnF@=?$pKaZ$tg~qWGMaH_X!&oRr)5`?`k9K$LJ}nDE+~2n zAiy~0mnI`NhM&@iX~sGAcG_|J6W~E>AM$EltcvXp<6UB?4_4E2rt97t7*KrxyGOG! zG*;2=s)Q$GJ-wCLODVZ6^zj$v`vTx+d0@iK`K# zp&ErF&oU556@-ln+?R@a5g`)<43(UgY>o)shu|_3j6-AH**GLYSFij0FtnUmu2Dp1UeFU0lXV zZj>K~FQMy@jZ!p0Iekb32m&>4iGKjm&PlFO2EcprA#PjTSk+?*{;gICUpx`JVpFGN zmoNP5b1EC+up;wD{T^q;cG@OI&G$UVJz-Axba=7ff^y?-ig7)|JT?Fq2SDmSHTkUt zXPif&3>h*D0bY81sM?nbyJ@*)OP-W2G zDZJP3WhdolOWhitUWa)0ZA7X1Hm-(EpBquc;B~43 zqNU*++}hiZ$&=#8-ebc*8CNAswO^i}xHk_`UmU28)!##AH`Xjo2qvS5TSE)Y!5%gF zqr<<7`sv^{>&aeZ`FB9UR4cmae$~Db-sQ=lU~%(=%9ZyU-!^p3ge&p+lM)c9;C?qiLppmrr%)+; ze@~t_@x19GN7>}26*0#ECFAnMo7O%Dpxe%3o|QLQfr@fKvBpOgppG2PCWGoZErSB< zP8g)w$hmU^dY$f!*8kAyWDfsFv03^5vveo3J3%!kK;vNg`y0EqqWV`qAQ`+53-uHWM4(oa!>}!TymRiGKkKQOhut5?t zE7ne9!s@4>mO`G3>4@p9X;am#?-vwQDyxZ9rHG)7NzsmoZ>ps+b0^QEHjxsK7l+=z zjC!NV&hNa*HjiA_@qY;@S!V1DRgadqbR+ObM+S{bDSJ#m*j$dcoBymtjX+OiM|Xhq zvWFlRGn9Dj1q28M@Rx$fGp{aXo9(En8Yw@y=kxn8=pS8D)FyP9VvbU{BDM=!D$beL z&Hb!mL?4~?6J~S8Ne1Xyr(6Y`iUA4b*cFsmY1r`b8JBL>x$1f3L`n&#YYSEiYuK`D zVZTST%o5gvUX@v~xQc>P6YEVn3*5;%M8kpJwhxA6l5*D3*V|bn-|4aX&g*T;ss|gt zl9L6|Yb|qcu4DuFf;9Cj-Xb5NxixFr`9(L!kX#7e@DNpx`=R7-!<%<${qUQ{h^bG9 zJ`JblvwgM?BJ@xwt2I;AXQC8gz34K#?Dw5TB0x|$+ry`E?63GrbK2aSX@+DOmSX_@ zBEFn77z~_`6nv8O^kEI>^~n1}XI@pvuX$PHlNsM`$Tu2T>Klqb>VVtKeEYbZAZve$ zk{NcDd0zm;GM?sz3jn(cX6j1mDX%B_Jk%Y>lfG>wDV_q#r|&AM<4c#<9Qu(e^L<+w5k|I5?AF(OciUpl9 z+^)48c1+p;w-qa3Tg?KV9yXJF*J`~xPLDi$^>AJcl|isk1BNv-7+~4x#WnV$G(oI) zQvNnh&rDVzr7?2F2a`PUf~M9p)MhcLlM?Te8a4(CH8T(KqR5trWZm|8^yU-koAUyS zKz)*(?WmxBt`xXy?FNSA7cZF5q{9n>x=kvmKP4q6LDPIXx zP*j&R(wa{+G@KuIKFV~j$IX`90zx?{_uigi`A$Yg!(ASNw@6TP}T=&t<;Nn@2WE_!HY2i}U@&mUHOwlv;5&HM1!cV`scGr?3?j~-g5>HH4&PJ;ba|E8S zDh`z1)~o;|&adMenU-mEgo~+D%PisG1!spN#Lz=jd!&8DEUiUc!re^eWYTmo02RZa zp{$J&inSz-+h^X1CAUb6;*lz@dty>} z7%x3ph5{;)u*@QzW>@R#7QNc3=OGjH1&e6K77} z-@3+7ndtxb)!W(;#F?kqZdQ_f)X?xeBH*Xmv>5BNPRpbHH2mn%K%B?1=|;!#PUmc& z`pH)^1Q-UNa7LlE1Ww_&>T3eNYf!uKEQs^LOL!_89wBk$%?=DMfI^6?=8<2D`W56b zx7@z5dVXgB^=?Huj_&_iS-F`C$V-dA!!ytP<}{K06G%aXMhg~}?*>yWn<2_A?fZ!% zEP!gfb%rj1kEcp%h^TP=_e1_)Vj|TS zym?}GAYDhgB2_#3uvcTR7xKy-y<|20TC(i?$;rRGeZxaCg_&>z5{eA#1iC{X3&G|9 zUD$ceLn@>bXct$%zCwcKq^tSDEd%%FI_cQd?h8qL0B4I5Wj4!y93So2jXPpkT*?}s zH5?!9cLL42yfV#yIuNZ^*BIvBS(_a5>Q|0LYbYlz1LD0RNZamA^jzYq<>;;hFp5lU zso^B;pI_4DM2&C%I9&A}p&r>vn!uNu51Qf@gCTD;D(qiQD!1wrY=R`Zn{|(S8 z{rT=SnD1Z#MVgVGgtBx1%CnSh6`;J$9*E^-sZ4gkR1bh985i`E#Q_&^KM6HpgPAt8 zr9D)pVv`AbfMdbUss>U~PxrumprVP+=eB2X;Liq387dZwOI`tj)PlolLVt#DDI2o` zOiKuOVjgkjHW;gmGdcFGG>whUdUrA?4a&P&bNVc7(Oa)b(*;kDD>_-3P81{~KR2fQ ze}|u_&H}bdY>ngFlmpvOGhh|OjC~beC7%0|t*+_{r~|1Z8lJ3xdNhTrdGA*SHIV@y zRShVXUNw5nn-}E!0y?OXS$0BqAkh2w3Xszl>Plj);re-*yZmkqm%Hr}>?+0qLFve> zxOsK!pK#f*lV;zw1?q`L5@0|vX$FxV{AK~W( zL|dX|TN~N zVE_{vB9vjbzfx~Y@|lgbqA5AM0XjXZ8WoQI-7p(BYO6eO1jtmAI{M@YxpAY>0Piv~ zh+QR^r+9W>vT!YuJ$weJ!(NQ)Ebgv0{Vwo-lAmgButhv9Pd@5>!H3qHh~EI3Obq51 zS8GjpqwRHRBtVXvWzJqCj1HrnK|Y;JsQW2!xB=4K)6cUtXoAPoLG8jXJ)GE?@^{ZG zx2wr2y$-p6?_ht`iL)UzjkUANvEye?i(++Y>H@+7w_s8YOEw1KoDF=9;#?Sruxt zu-|=)7w|Gl2Wp*)(y>N*%mRRs352iV!V7F~lkP(k`tzY*u9uW@2n8Li_2lC3c$_pZ z`I?yb_Z4HO{?Qw6N%z zCO|4XpR|masOGzP4rw#wquJrel@1MRf)MpKbP_Pp+%K=};hP3bER2$s)blmRPs5RVD znc>>!c^nt(KJeT%jK2HvY<1Z3j{-1 z!EInZru5V}k37r*KARg)iG2hcTMYN;rD@~+zFP%xHH<`?cw>TWK2+t^5ZAOG|8U@W zfjX5oypTV3V};;KRGR1(zW5(=F+%%sOm7GzX_+3Cc+*R6cT!) zt3Kxz4&E#xoFm%!!=g#=VvF)diD`J&&q<2Y!H|7|Vv@|tSQ#)Aa_n_&bsn8f@vC#; zR@)Z{0^C<#EDbC&aMGW-^91fd5N`!kkL-f{u$l)BSHva<(W_q5z$iAE55e6BnQNR_ zr~EBk7orbYH1ti+rRbazdE9#vPPAnhhaS4|n|#rg87~;irYbckYkLsr*sSy{{|mXp zw=yN+V79z~J57wf#HX=*U-wZI9jyZpF@0aa5Xxws5qEp;G7nG6e8shD=e*z!x(`5# z%~YF6L0|1RkZgew5@QS`fmsUG(aT~07TUk^p(gPdz?>E;r-P0A?S;KXvY#TaVnB{p zr3aGhazXq**Um}a5a<*wXivj`n=Fv#ye=Djla~-^)WBhaG5%8LuC!^ed_&IEyiA4U zNB%b&xWkggfiPGZr1xsLZ0`Z?;)P` zJ21S+P)z2_8FIcUwAEXPd^Gvt`m6`F4kFU=K`GvaUZPqJe%i|2Y7n*Z9(0UCKED*& zd;Hd=Oy4sEGEka*;m4H{qxFT;3nh_%Q-2^ORg=VhZ!~73x5w=O%LJEz$MYkqB?bW- zCYV&n(Un)rPd_e6E_kf7avWw?ty@B9!p=)|XD2nicHZ6hF4rd`I`m#=xzTcMw9_gh zXoP|cSly$3A8}{BwlB3Mr3-6b>;WE0-e=_|8li8I=umw9$_(3ICwNJoU?1`6?o{kg zD3dtT)U=&#_5-?{_q?BZyLgx{FdJPDc>K$h@AsuYGG|Kk*8|VVqU1@5;yDY-*@lKX zjS>;qz3QApDHdzyC(R@6B3(D(1MI&NbXfK2c(y7-v$Kp?)i;L}cGrB)zB9dwO1DlA z+son=*F9&Sq3HOWBj43et6cKmpk2IhHsHPEURKq*3H_Orb;i1>I+hh*$y3V|TMO?u z!RbTnoun{E&gKx*mneGu^d47ON^;0%ecK_d*u`yV zB$?6I^qhpGOe

cRuD+3o$^}>2X;M0nD-S_@IK4CYb*F$vu7WDXd;3g#kyG$ z6AXT^&#{ffWt{8VLF zvs#&jKQ~aWR7Q7$6!G#l`}DH=>*rrW#?=aDD$o30_~Z16n%(_i`Hx;?Du+<`Mmopk zPXTIPOz-+=xYh7F=oylxg$x@G})?!8fs8JKbC9ljGqR zvLjk};sA#3W)Q>ApgX8%r{XhDvboJm!U_M&56S1I;|Ln70CeXCIkUen9>)JP)BN!} zhBZ%Jf9?05b&Ip>vYXK(?vtc8-=AzkdpC6hOFh)>|@Y+lH1E{uzok%z6j9Y(aPM zL3M~Tnx6)q_8foxBWiO%X}pQz`KrGNASL6V_l-b%e!iyJ!Q}5iCCYJo57>O!!`36n zBPRv~yv)DpQ=XiN+=Uw=H*P39#1Cg;cdL6(K#8^QT&lD1U|@aFZI!o_qjoPfz&z{U zm{7ZepE7tiPRlm@e7QN;sTTJ$na1zlJbb=?RuVXLWNq-%!5hJ8l>tplVUPCHu|XAe ze+GZjgyVe03N%#)vs9H1Z{C>i%?VO`b~Z{r33RO20tliDs@5YZKqjJhtYBn0bHU=A z)RA#|(5(U^O6>{g(&aG2-x_@rr1kCCAm+I(KzT3TKBDCiy*LX;L%g&EEe{i_q!z_g z-zHyNsXW{!N5m>lTswrYmjvxES3~+WE#`eTzABAq>h#zCw52?{`obG_*T>7~sPS!} zXD5r2*sL7i8us|*=5HYF!Ohu@%}tO2RXul*s>iQ4&lPDZdx_}E8hR)Sjp zO~vjf=Nw?~E{{SvsoZ{2Ne%#_f*e1E;12j{UW4kG8D{yDRh%GO*=dXeKwkKXft&zh zNZUC_^YPPQA4;Mw;S^vh(i8^RL4}7ialiUc^lAs_L8y@36Zop2ybO5Lj34LQT{#%Z zIZB!0p2>MZQ1m=76&396mUzq8RLEcOx%glefQMva2$7b z;LuG;qiC+0No z5T_!3VzLJ-{}?GKE_#BNnu)sD>g(xNbnjdb?)=TydZiJZy^w!6jn$Vi333m2R z5^%uy>#sJxCdzp!nNK8`C&3auob&R{u3o6Vel(wX#5Ml8Qn1@QK_@l>eP1w7-jr#9 zku!6}%dq($7#R5sS>E>y^7mX`_V8P*ljcMuq%o3nBA799spDx^tF;mfzJax><1zvc z%a>hDRhobf(7mVgd_2|`q8xU)wB^~hpEIt}d%+i0`zNUz+Hl+9 z!F!>V*HApB6pcyW`7Em*?uiTUJXdOob%Mz!naO3eAtA-{!{n{$w@a1hfsQL*AWJ0l zuUx@002X&ZhK?a6@(YzVRPLkX*-7PZ#e9sqK~IGs0c+8=MmY&$5OZb35no0D^NWXE zA*bUN)|ll3_#A$AoY?0m$e9b)-#9PtB>%2zqP_iUD4_Mgp@FgTF%j}vovu&k#V3Ugu9X>(E%pA6XeI_~mr#MRqaOnUv&vRn^O57P-<6&Z83 z(sV~+(ZzQEvCq-o{D@o#SwjwNJ0BW zSw4Wvrjz-S`Qsm08epo%J}%!k=S4hHx!`jrum2g@{{inueSB7X`=Pr^1 z16~f)qCv!O+jlF_cRCi1K3dRY%lj7j)*@x6k$x$Ov`l!Pg!9;|F;T&9HippFV%jNK z`-_XVUZ6Ohna8U|iO)Q_R9AY$rUt7dWdeq#>0+_tt8W(qFOvX^41q#j;7vM3u1Jcl z2V~CAEzeJ>B!on2=k(sqZZpi5k}I$3yG}iON1VG)cRXDRP8Xx*kJ$lJ1etA898akN z8ER)f#^x>ISK_6)E0e{uDwL&dqexm}REpWu__R8+P1zjJyqM5$VNaVj7ZGH|O3R0s zZ(`lWEG0@cXRib^&P9sGIW;4!x8BPqGr+oLWy6>cb*ILiyp&4@_^g~S>n|wDg3@r`Y!)mB5SLgtkZ9V&Kjo`l8x9a%qdr94o zmJ#yeYcfKIKTi;w-|(AM=+st{0vXCVDNFBvQX<%l1d@l~sEAKtQIVg72U{c0u+YT@ zgueXrN>^KTwZXwKyZL*+(o^NZQ{9H)G_s{%u-(hs*adg!jodXB;R_*`=j_8n^y?RW zE-}Z2Io|&EPu9WDopQ+`!{JQM1)#pCNgIwQcm+Wj$WzgMP9_g&I6GIsE%K%SFjbtB z3L%zjOwG&Dr+z->bO#m|mh!eEKe9{4QgmIs9?xVOyW@$CO&;471m&u!zvjYb`X9<; zQ*pwO-AZlET%JaxWD(n8T;Tag&}6(%SHDvIy=dUAwVLD@*Dk+|3~WD)_Zf5k_J4a{ z1rZi`qoIJ?rGCGkN=>8R3#saZeg6v&x+N@hw>OXV(HY@>pPUc)Zj>=nA7Z(~sANDgiIi!gA)9B$Yi%@<`CNSW0|zFFn4^!n@BY#Y-6= z^zb&iM}tczMBiLnRlG${9w|}tn9{bpD}1x?#LE%wc%f^+>EQi}hj|Vc#&!x>X*xIq z7u3yIyN1e~{s$a7*lEq=gv{lX?RmQ&30gBn0d9BooVSDsfgSy)_Iils**UGzq z9olF1$Ll>^`=hHZFCM+oj}DUjB`a8Ad$f*mR^bCUf!2yu+)_b+3O>hoz5Fv6()W7T zmqsn@1kgC9!!r}&6R=o*9kdX1_m^;^g!iOoVLW~Gtk_ja7(ut;)j_{H@!%g|q$o{H zaFGUT9D1d^~OQ8%y+>$n^tkW`j@;NSQ?)MvZ# zoHeND%&K$3?mzqAm_A6Y7;71Zrk>

k=>ey~o(ossCW)SS59|$JZzWygSCH4Rbn9k*g#A>et7OEzWWPo}! z1uISYIK0hGzvGUh7AX9wfCMtj0}fm+yC?8R+(tj5cMWjl>Pt)Za4By=T^FXBDxI4F ze4Ntq`31R@Dm%Bdp2~Xy%#}J73<0EvQJi-eU^u|uwg83Ed^+j3^l@a*t&5fO{wlZ+ z3p%WYW^-g8$)RbRHvlqq^mxGq3(8HGic$5ab4&D|PsAKcr1!?r0`$Pd&?k5nju9{J6r? z(Dw6$H-SYD?E>C*6Y=-$cU+r`3>>LoawL5%jJU+V@yPn(!p?H*cv7KR^ zg^FpuC0(q(9s_T&-oToSg}f5zy!qy(wCEQg84&<9wB2WUCIx2;CHfs_4A{|NKE?01FqPKX-VZZ3g#0N_@( z6H`lG_?n#AP?zSEGf@!9q0{vmFrYr zCHniI;&B(H^PxQ5X}ZX8h*Q8!D^Rp}7$BEcG&iDQ&T zn2whRZk43L$Kh8tcT@2D^kDayK2Y!Q6VHpPXAZ;j(KO~OjW1HeUGTTCEn8uoAU}=q z4Mt%f=G%|`ZdVZ>?1bY|1$%EQ=~qe5pS{Bt-)^a&3z2pE_X`8d*$653w7+M8!nm5tllL;Ho72DSQ(6G*_E zp8ZENqOS|zpSLNfetCS!3Dkn}t>aYP1a+~a9|(N{cAZydH#90LUUY61e)XMB-?x~8 zO~1YTq;2o3d%@1(rmCtn|5Vl$p`G{5Low|?B`IOr2)H_rXdGY}IXVycN`8>cU}1W^ zEb`dLJK?ASsA3d0tPc$Q&!Nu5nW1)lrr_5D`s7IFE6fJXO~LJ-ST%Nkid_SY%X@4A zzs83F8sU|)@!8)1Hw=&EO1$}N!J!{7+I^Uj07A*fK=%F?$200!=2|m97MQPO{L%5# z>f-uB$fwljE032+@H5Ey#%7B4A-iE-?~FKVH{~n#&T%e_Gi2gYdc|h_BOm5I`gOnu zvtR?&q5XN?je+VR?W;m6TPFQq;W+DZ05;;M+|jN9((pYP-KK5*s)x0g*TX211?kjJcn* zyU9dji0Q6$c<>M3-3_z%qQ#$ZH!)j*DV&l63xJU^PztX6w-gLq^B?u(u3!JwlYu<$ z-+D4<#(&q7|Ceg)L*A7-5eTn;|CYLF+9!7TtyBvXn{F7?+J- zYsUQ?TmSqMNC%W+B3d6t?Buh1Z=f zbth_iHu*8M`QTTRtn1bEPPAE6JxrN9sS_IREAvO3Vp-@2Y! z9wv*X8rsFHZ=XLoNCK>M-aex0#Nu~4ghA+9{OGLxa}OWiqkgJOb^z0R{%pUEqJPeZ z{qfdkF}5vL7tc29nY7+Y@aNk3ALV^{IF#?-wo)WpD9TGT-^oXoCG_7 ziM7}*0cv}5t;Dq2u%16BSgZsDXoU&ts0w%OL=gTFuK(CUw0k`!-W7e zjR!0PmveF~vfRRPMY{K_vfq*qF+lRx7vxfmoFnK#2TxJyl}0(j+)cSdYU`mEhT z9j2rR7hpDRyBO=7RkrU3>IXk1Td({aKxCddui~6=ckCRCb+DIN!8p)_Nq)d!tIj%C z2Ws3=0BRND2s+-ywC8K3w6Oq&g6D{?WPx`Rz|Qd`9j5p3N2@^1SIa_6Mi@##P4TH< z(Datj&FUJ9Xc2i9kN}cTn*{c8@9?ZM@pQ+$tYZfXpJCM zI7zl2&Y>s24z(cM_bxEvT&s1lAb=gYMI|6bssu9%#-xxq69sWMs(_>1W*1u@Pvm2j zhzs=QflCD`LkvHGqlR(l*L8qyd*pk8@>kl`^HNs(m*Zx$(q&NCD{?YdDuQ#LiCJ~h z`CBh>grmV!ji&*Y9W(hUdLWXkP^kyH*ybH@nBa9jFRK08a+r`DkOjvRzyA)Y2bIBg z5D2Fkhxt!NimGs%dcT+h+C;j}vkaztO+tRDA1k{V)PZ)Z8lzKFQbO)EE=vt?el@1T z=E;o&W=&VafJC^c=J8kJz28?ZRkqvna2l1?j+qG+bH>nd8cl)JPKzd{vZ%fBjvVVX zxndQ?gD>>x*?d4`i2{ZccU=LeBLO1Fj#(#?t<(41*PZHxH<3S4ORz~yp-61ilb(M~ zBGlaN6?E{ayi-3%A;|SHN^F|+T}>errCb3yiz0c~pkxdiAd@U}7!5D?*uD&KYGV)o zh53Wo#6RSK1qMkHD$Xbz!#-nq`Al+5K70P)d1@~P-jW-eAp>1(9$67A>-3vziA~k2 z({e2;HIv?bLJ8vDc9hSfoKz+^GUB(YLc6Xw=BJl3*tJyM2^k_ED`ENlgWL#UGH0hv zm=ly&HKzHGx^T-5OuMQ-0Ou~RS%!gI-c8mhbXyaC#Irq#g2@5AiY*U zi>}MpOi$(Qc>Ou9_Z-t1x`mtVZgo=8|9+VBkI@63cGjkD zt4vw-!GC;G|8F9R|J~0If$3jyfT6Zfs_Wr=Iz2#elmd|1V6C`a(t2`qQx5lsG6>e8 zzUp1g7DSX^7jyd+^F{t05gg`doP|$6I}6R1=*~S2YH3z$Lace?7-#D>gSA0Yd%y?@ zGiILR_dXr@#S5rI%v;Hutv+5JP!{1Mx3}%p`*Ph^Kr5F&hqeA5 zqsf4aGH(iZnyg1pDwj-;YWFBpd12`yq;Yg&=p3nwCWsm=9$k zxj3s{i_vT}r=iHurjIXq0|lssWGGNdgd)mHb83Q&G8d8Eu8kF}d;zs9jVXM(-j%a7 z3M53Ez$CWulLB^SX7}>|a+OJeAG+GW&S*tHc5rv>abD$MZaM!g*;AE5Oi}&c(-2#p zoP*Mq)_c5MaIdl=PBDh1;ME8oPaS=6dW8d>6uN^9zdTU=z+#kBVj1u$2evYvWv{c z87=b*h#Bqv^{y|=g&(G10(W1Y)c2SUH^zr1ar_ieUWN&4xX(~* zb;S&JgprMWP_)HqY4&Pc4D@HqH(s^FE;P-#jC4xr2R8VKZF*TD-xYBJ{jaC!B+;p# zr}BB)Xr*%E1l+js5k(t&GQQ}wp?<82)sc*;x7%YQD{hN29Yzg|b)AM0ZZ63sNq{Y> zJSJvx7rpr;vud<9oO_pv$tztzyU}}bI}f-({Y`)%97S-7`lN(&%H4i*gP>G0IRBM) zQfd12^X+Soijpc`0OsN%iPLJIm41m+E6!iS`uQxhZ3s(MP{hgH%a^m<*iRnAgL&bD znwDvz}hxwEOjdt%!vv?zpq+RJPeiz@6dZ$f0M8=~{>$_X@z(^XUrgn#8S%|B) zY*l}N>3F5Hv#S~EuVi=)6A*0k_SES>JCT?Jf4CNFOf;{z+|PWqxfOn!oHs|%!LxQ@ z_ntE)7|Q4fOn5a%Mvq2L-5lRlxNe5%I|I5cM{7R5ibE$UzW3KD50_#wW9IF*rOVoV zlcTL_hwyG8RU!_c)3h3j*TPv9LJ4$J@j}UkZa!Q2zn8?20svxbe6VL){j|1e;XO{t z16N~{|9!kCa&$5HIm}rS0ato+Z?!^KdcG;5j-bH$&nftx7(vq%*keK8CT75WajuCo zCf1r48dek2?ls_YT`uJ!xj25+o{C$s2lrDXyb-Q(66l#OGtr~g%lD!0#!{~|LSYkf z#e0|86*M6dwsQNmBw5m%AaZT@-^{&T+AE``M>7MV@5Xk|F6JJMl4pz_CW?qCAj~m} z$=OC(C8tN!y74|Rwsg!aZ{g%V7EA}%y9Lo=T7qL)*skjXc|PxgLrzU>oCf>yb{=TE zLXeE_*uB4A#S2&;-hURMAF`EV3#ijHBtySEuhq_#vx5pm*WQITY7xOi!H^;0nnap= zaZJq@WuZeCoYE%^y$eNivCkm}x$O4%pPa>z5&ojGh7s%4d$P=%^oDwpK$1t`1cQ#0Q*u2&>CA+7Ry$$m#l_`>=g1En^Ka+9%_MDN4qX3iy?WApO4}5v- zaJ>V5>4w+?`+^p%J%Em{uXFHn6}~HP!a%}U zBI-6#BR*c;AJGChv)A9Xod8#*6wdHXsYQ?$>n0Wz!ErU^z%uDIiS3nc{Fa2lc=qt7 z=lih6?$3*aN@sbtQ8|ys3? zUnoVK?JoV8R1>yse6YBY&l?b%JGA8D$}xvA=_yBGuj(So$}}3c4TXgsdlR^ib-t#$ z7;I|w{>`nroMNZJ6JDcp!R#A1`vvlIaYeH-Zg3uN384FZopm|MANW#*-lzT-SHF30 zLLm0FNAN5genIhfKriJv4gavD50P^#8fZBKWthu8+6_9M~7v5zrj!(mW%KWy{ zhV$_jg8b&C>E37%W2n2&jjcM@AmuxM+7by}@L9s4#-ZUT6b(yG{@&@6tg%X*ek;rfPux6r79YYH&2UKwA_==i-? z2MQVHwo0izzu!1!QvqUA;K7o9=-cTAl0y({K0&EpBGDtwDsagYz#r)v(VQ6P*6jgV z+u~B>ebBDqtJ%~}uh=BVh|arZRr535V8s~PvR7LkxsVg8F#m~PTsfU;VpKYvE?_eQ zE(S5o8MgCck?puz<{qS5ro-M>I{jGlVT)LzseyrsFt`2|Un^-u$(MY9@sqMqliC;l zn}0L!-mTkF`fEh?yuB0$>Jj|SJngf5dsOC4#0%Xna$$Y7cf*> zj;Y5pV8G4B#M}`SFmJGAbX_Ac0f8tSx!eb3LDAUih{O$2Ge$efck(j! zife#rx`z=1oh;})8F?ZcF41=8lnSf=A@mWLAQBbleMlxZEy`+GnacKC1BoF!c{~05 zR>tZX+)u)~pPXYyh!BCO>vdW*`hhTKwbt8`p>Lz6g{nbrAe9&TKB00DZxkp5b#ip8 zVK`lBVn>Nhui*uKf-MrTGWzaK-`2~|R=9sq>_~5^-_uqwdel2xSQ-b z!~Mwy{7lO0zuT!q?d%-ARQW{t$Q%zqVUX?KUolG6HL{9n8w$g+MQ5JTDbx$m9p^oy zDB$X`;NfzLrshi9p%f>1M_$sTgj7~L9dwKVnq)jZsu_-m;b;@3s#=yaJ}LajLZhOX zJZjwBCTjuQxMuANL1^9lg&#RRW9Jw=L|;iRmQ9O(B6aTgWBPt+93t>f)J5Wf-hin@ zP*_ceSGB3OMmr4l&2Yl#_9uKf6Fv*Ei7ehZJJKSy_YS@) zIQKmHdRu*dk9%Ng#lmkuH&$0%zWUCyj_5CntWrnJURJ>5kPJZoaVS+-+p6U6 z^wmsEi#>vp(&Ih!Pm)tKSOV|%q&*jxE;o5ik*a)A*88}`>-aF1_E_qnPFd|gM+U^B zSDsYn@v{%a-eAahJtvtX!ytPNa!z0o;^RQ}qp#eD{uVd_$nOfzcpoFow|_qb!vZ&S zERJBT!Hs^Lckm_j{C=FT)8Seo9+V_#81F)@lSG+}#tAP9m50%u$2N(n*8Z2qD!AGR+hNHYALkv=s9NQg9O-Hh}E;Gj0BhUZ1_L)Od&I2%7g5 zQQ2OpNVg6-?6MiS%|_?Fd6gx*Nh`(v02GSF+bRYF5?*t8>}%yTooz1fYX$C8sd$zspvm%~E=or%q1eHSMMLGu>3p{n|_{C5H&Pi7Sv;ZPt9Xx9sh8jo<4zWpu~WkCvgy zF!PWmy>QV80_M0Y;1km!*8AtgD~Z2Shmmgx#6X=6Z2Hb-2PG`QmG$VP*5T`X@k-(L z5EkNFUnD_h$=?vd2oLt1&Psuf66WKrK_Sa~XlahGki3uV`9fE_Ha~_Vl`u&>6EP}D zLuBN7QZaP+tf(!#*#I&w_&Uy8^AIBA|A~JQhAjBiATA1PD$+rg?#xnYb*sn)W$o;c zshgqKT>Hq*ccfQjgbV`V4;V*cFp#eiSaj)>Mqj17pkHUQHg#T$3u4BaS*AyA4hYDs zUOUpUg*e?ZWx6)4$IX^!msVU#acm-oGY*+DjQl1PmZ8AfV@69q9U+R2hFHBQZJZMz zDzWeR%8LUz)8$~u$pcK;QP%5ldsK_J-k#f`+ZAc|J}VWPi6l2me)G@- zVQot($6un$b{aAcYnK<{W`5gW6SSrF=G9Ll9V%wBT81Yg>m*+`zq=d3?{)}z=b>Y% zK14JEMq`jSQv3mnO#n*3fN8I#P?ntue4+fyoNeTkxq|u?E4};#R9}lUxm*yTJiDWrmF^P`T9{} z=Z;XC8I!k%miht`N@cBph$m}A=bYShnt9<(FWz7yM3@iSDx;>jEOQDIK$Wj=hH{n3 z>ZhEwsN2shjT1`mxFjX)_DaCsr~%^tWly$Q->jkK*+>#hr_D)IKV7Y`pmOQHys7T2 zMWe)p9qG>xLwn38+M;~A`16FJPcomYC|p{~{8Uy=eN-PYOTmmyd#=6L(BSa7h}y&B zqNPL}+_BODL)^=nd$)~tUYTXS((!nWSJ3SizJN|;lv^p-k~3)wE0xRzmZykQu{?8S z1*I&wWT-IBA`H=L(`OK=%W_?Qt9Gfk!9uR>q18Jk>2Ca9}PKsX9sG&kuK}gw_+c0 z%OClfVMT}047d{f9AauUNUJiZ`gV`q3nH7sNB(}U6c=94XkB;n0p*mjtM=nh)nzOT z*X4+4b(#1q7Ywt+I=c-0c>442ABqQ;ew{@p{W`}(IExZQHH&AZ&&qh{)YVO6yyndA zE3gJx#*FkFciqm+1{X;2N`4>jqQ8V?TW?Egxo~E|8hdvEP5w=Sb058-$&|WG7Tg1W zc~hq0`?+G`SzFnF__GaSKZ<+R9-~<_H424@NS%)MC+3A$iAIOs!jcN+5YEpM4$c^g z-D&R%-aK3yWf1$M|_=_~rm(vbHZEc`w{vhVdC-^}F&SE(Qi_xD8` zHrs_IlS5*f&Qcnall{V*nq2x)H>-sd7c(!pPDG?{*&&6KIq|#PHpBC6*R$OnEise3 zLjfx*_nSqvG|FyjB7B=6rVzFzQJZ~V^9zZyXu7?6b@VVk|0H*0biwuHvqXTV`FNoA zly8u8jH*SOPqSu@J+gVXWloFzhZufYf_c^VDkuKB?lSKt_q=0kb+5)|MjEx`w>?80~L^X3Q*nsf8MN`S$9>iwdtRjOKrj_i`DvuKabtPE;3>0;i+aG-`3Wvc5?G1O@Lmqn2w&qCOX{w%S-q`yU>6~eA*KO@(eWl$?J^J>Pi7eP! zkJ3xTl;3xGQYbdb_Pq(nAlL$M{BK<3$*--kM(Xx1N(;u5fbAaqV%)k=qVaZHu}8EA z;g0+y5ZDRGZ?yp8M30b0Azo0a{SVy_O>b^%+O0ILcu8JoqeD-BbMdl8NBTwS6CmF9 z$zOH3gAgG;2a@0AuLV0bxA#8gq23qU7vD#!?R!;1k7I&t#gEMBj<}Akdj}-Cv)=7g zmn#sX!`pE53Xj%kQ|NZSX#TKsq%n|;@jbu$;Y0;!9gxp@^0y9uz*YJ2K$(p$j~|?i z0AzgTNYJ163nK)lOFTYK_4c^2&C8*_i|=q7JX#`M!y!APEP7dt*^_(x_{bDJy6u5%W=e2^E|!6?pD%lI{@3_5bRTQAv`ysF&e>W(C440I+g#q@aMnPP7;)`i+1U~y<~2m z3WZGr@%!Ut&_yd(e}qX{JnY8B4LJ^-wX+WcUNG?bT>otU-qA!lX-W3wjse`}4>!;? zW&5ch?LHFtkRxeWU47zx`nm%_^HA;W3e8C%Em7d(>Z8;B1u`w6D0EMp)LG6GPvG3b0^uWnBY$eb z4O`KPak^hfR}>xefunhMY34mw6mlTHfYM=#a=EvAFRt>$e~CY-xR@_p!C_eC0;C~7 z1ovyR=%W7CNPv;0PhT`YyOn!wTi)~3kbtKLU-Grv6+yL>W98{-e0DOCdUiSjKbaG+ zI2FS&71DrAw(ls=^|d}N{j|KYnZ*Y-^B(6YiDv#f*mbto*#rvIoH12Jaz^;)O+MYR z7(#vipq78qFD>nXl_m&R_l*>JcbuR`E6^6jSms2~Nvs-i#2h!++J}LD(S^x_dsw`_ zq{LpRNrzFn zROVo>H!*8=)P}!{YJ&LR%y~Wj!PMl0JuvxH1Aaa#Rauo@{irK-!#m!S=8Ra9Ci@jB zsd9c4@wY^IW$7yjFK0#R_5khNi++}K9+dYj2a5uM-H8w~J0hh@dmPf}V>KbjVw|2S zGrv5gg^=b4V*6nlG&1@KI`ZaAvi=BUf=OzN8(YOZI)$P_h`>XXA>2}^3JE#=FNG-Y zHO*Ctf&lsDnQYbEndd=|*1Fx-^`))vQUIG-WG-T&Hnk?fjely-)yGnK>y?Y+{_~10 zyn31R17;3Ap7{}n3$9J5tuR{s2_x7G`>Yfgx{NIyz>i;BzCCPPZn_Z%Of+~fXIvY# zznAB6!BSJRq=SC*#j~fA=HI%R*X6gl3vp$~vk4 z7=GPS9_?W2XDL*3PrzC6IRjCV%@E|Gpc6y&jG348XTneQ#i2;3|Qv+4IqM@ z&yyRSh;0>0HabEF-GYPGWhO71$kU6@dHKa-@Qz z1M_T;&%v6$#4e&|YNz1~yh0|vKfEHi_nIY#p8afCf6jJ9pYml{e&A4Rh$Av}k!-Q^aVD(iU1X;iGpYAM`Y+B1s#;L#p7FfyjP zg(e6;-L88CGaJ~9ODPkn1Dx^Grf-(!PDLMr~or z&H&J6zh+!i5&n2IS3Lwp!zwFxx*~SivDR%qJq31KKw2D#8GC+Xr z3sSl4q+>AlHbUWP->1IRz8s%q4@t<8^P5XcdhN?Z+8x+b&#|c_pQ&r6xwo4`V$WT? z!OIqjy`$PjiWkBU>o96S1-V>+ey+`AUiUkCUj(}$1N)>+XKDRq&(_?S)>hWEe@(-h zaI>!t0~YO%F$i~8Dbaw14m$EEW`Qb^6nSzw5vqx8k|@UFib1j zKA&g)M}5n{=i5^X2(d}3d*2^22kBRd?0Ys6tEV!aypl*oRy_ijN>m}2t+$&is!D`3 zAvE81=w7mU7h%KqCrPbH$!RY=9 zaE>;UjNXaIdf=A8w6KWfm{I976bnBmAY!Zo%AX$g$G>rn+g!!HAox0A(VfV5LyIF5 zrf~Nff7y(j41Lhj#nm|1OrT~BmCe~o#|qqe(`-tqH6N>WFkHCzN|)K|GKDfU%7Nl3 z*3rf$s{ho^(y`q1y8q9=n(sJnWJTX`oGzcs#AhF81ue*NWiMD%uq9Tq8A9Y61Dxey z6|UL0T0&mK)%viv#}(YBP89NokDV0*r!f7Gj$}@xh`c6##m8div-Xw^W4T601zd}| zye)*qegWY?*INYHK>JY%%BmK3rD6L~l!ShtGjW(O9*pw{?bC4P8qR!Irm=HCFjKE{ z?0eat$fY0LP=9^Fbv+W^llHLlJ7y7D1Lt@MX*iI0-;KlU44y0(mD6{o>3Gf=@l9I3j+^84fbEC~)C4S~4?w zYrIs=1f$=P{WN2@{`}Dq&E-rMSnKSM)|H~g0Bmq$>yDq?=6u0~qe{1A5-}OOm)D)^ zoH|Xen|KnUQJ$I>mmR0OGI$tbynA?U_2Tu_{F@=Oryf}7H@9?IdJ{X=LQ|1umU6Da z`-)%6gTha|lLKaN#~7VwI)Dr;RI@&M5q!b$r>&#tZ;f1_pm55B$i^1-!?bxe<+sO2 zL-~{CTXkizHg_&8GsNz_FSL{BReI%CA3clsWeBM>iG$jH9%f{|i? zp0^?+JChDJbq{;f{}kB;3ozo0wuLkQ^M4k1Y9D~57&kB#4yNs+aU~NUUarvA_8KmH z65e0zE1ukU&skRRn}582sMsYDYKWNkzFlvI!W_7Q69_0FoZ>{`fg zESvk!mmKpq!xPJZ&rcZ>S@12=VTMbrS{%>WN!qLBWi~#mGavQ*iXd+A)UDVQhL#4} z+=q4UMwvONB@hSK-r!qy7B<}vwzXlO4OA8F{xXzw#{b+hB$r%owp?4-@Aqc&;}F)@ z(oeJ1=q8q$f2hCh;eJEEVZ+Q!7DmRlKi0MNx`hEsmd^*q&v_^c;gkULsh0IwQ{@W0 z)z8(N8aZO=I8~eXv(bYt^T+h}akK2Va6z_7!FD}P+MQr3Su(>EFoch=6(jz+?TBA9 zu1j4o?EcYWVPJ@i9<(8d|J$KM2n3^3=Q}veIa1=9p|eslJ-w_T=%z}1jI_wF&dujEvZoZO&?de{x}h1 z`iOZN7cvB!KZcr@7jJSPV%}eYR=vqV#7ELXsk8D{t+rBS$ks2!A^icRV4s$hI;}0!g zS~D=r4GIo~?JJ11Hg@G`*Dh_ktzeB^rxylI7D{1FRl%7#EDkHjj$N#Z*FVlfnwGE1 zm>)I8hAf-m4xPT!x74Gp*(%*8Wo;vgyX`)c^lQQ6qk`Yp(rc?OR6`f8`gN*SPqCD7 zE+nqhB{r??aY^IrRI#U$-kv$+&R2=%FvuNBO8?MrKDDZ<-7hP9>_Y4N>C5BB>e3*2 z0czQ2QY&>FTSTczuL+pv&nz~1mu7l7Us}rJU;Avh$&qTw1A-F~x5w$r<1)REf4Xo& z*IE+EW&Rt!U{cS6;Hvjchz=si_V>PsD*nb@?y}lwqM>Seo}4w!tg5AxlJ3}4UL`f^ z(?uDLv64NU6)Hr3=_m`z!H=5c;tXxKl(2gnRC>|o+XZu_H?2?o0{XKrUi_Bv{Vwzk zu7+3<uy5DFg?~wA z^>GEzt#396FPdgQn}m6m`Ah8lEo6LZB;r^@4;oz{?c4ZEdI|67wsP?4PRqi=%jlnn zhhq;RMLTuB4enqL6$OTFU>C7wW{E_y{9^@4zm)I$I}WmetCED?7py%_SOcjCniW=O zsA=rA->J$gEmMg-D;d3^c)PhpuAtCAoVbT#=CZg5iDz}+ZM$*t@p`m@($SK9Ich~i zWby8x%JZ|yQoDkmOy-7$Q{+_=ruidJMUFlj$-|97BD1U~75ljKtzDamd@U<=yvtrk zC)OWOtt}OkIV*|lZ`a&mKM8Bw!`^0AeNLvhuHzJ!nygEO3xVQ!jsN( zKrb3!G<)Ayw6FGDV`OxNk@n7TRYe{FD;~){tRIl<#;ROShPwxQ{XBQuYR&f=uM}X?(^X>bW-b?8g2~{LQ=>$O z18(qr)zFw%uVUQ$tG8(9FC+ZKBfv+PJTi2fz7UEXyQ8e%-`b7HaGL#Ydj4%|peK?z zuV}sfTt!~gPp&TCL~10!>GF*bn$4wQx0Nfxw9U@M3DTKy(oeVK+5JY^dpo+4(@AmI z{=32EQhzC8tqMOfnV>Hu2s?ovR)A>Y2Zobuz#J?*=p<@clLU)7k1f_`4+ii5`tqds zqz$g}l2d)`j?CU)@N974x|rZdZdyy{3{`pAi8{EEtv0coxdvTQvS|MJSyJn5*D7%N zmu5B=^~i4-B0L03Hz$ps)wKHH;-&^y7XujOm5QC;n#7(?4oukbbuJx2k1d6#%2(&v zyvGad7760&>zc;+FP{0f{rH8*`_<>u?>3+sM)RC;6(*es7eq!4)Y+V2O(n4D6<4cBGt2<1E7 z7(yNGhwZGsf@`a~2M%<%!6Ug!%X9V!AD@lPK36^Ew~RAyY*j9BAfA_9?rhllzWwWP z$<{$$)NP?~+u(ETno0Rx%c4jQj`XN;NXW#`4^wU@nNLvgB8|e*E!)Hja&BMJ(jIwE zmb~<=i&?PL+X@?(&O^0ZbLO?Vr^&+2{!D`NvPb)_I|;XTu}+Uap~HLB1m@VlReO~b zvCw|1$h&%zmR7uu)9-f%Hpss?CNh|3mFz}7X{ES&2^wYhzZ}JY=&1p65dShkG!?cq zLH>8}Lkc%LGW-N2Iv(v6xX}M2W_lBi5b7uFtXYJi?_z2x$++uDyZfsh{&Cnyg!~;p z5q)>8mT!@aOc*H9alhs!1&lOT|I@J~np*avngMuj_MU2^`}5nl5#0sojhF9lyzDLW zo*9V*v1(Wr7yz;`mH*7ol}mqb^!<4=meDT02Y+^ZDPQ>6k>Zh88&2i*(t9%S&{EU8 KSEgd~;(q|1NBnsJ literal 0 HcmV?d00001 From c942deaa6e31f2bfb09c617d83c0e29310f82367 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Wed, 13 Nov 2024 11:04:27 -0700 Subject: [PATCH 03/19] renamed Purview lab with .md --- ..._Purview_Audit => LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename Instructions/Labs/{LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit => LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md} (100%) diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md similarity index 100% rename from Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit rename to Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md From 755c2f695da399d92210e13968b2d6559f569ef5 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Fri, 15 Nov 2024 10:13:11 -0700 Subject: [PATCH 04/19] Revised and replaced lab content and additonal cleanup. --- ...AB_AK_01_Lab1_Ex1_Explore_M365_Defender.md | 2 +- ...AB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md | 2 +- ...AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md | 9 +- .../LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md | 2 - Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md | 15 +-- .../LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md | 8 +- .../LAB_AK_08_Lab1_Ex1_Connect_Services.md | 5 +- .../Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md | 4 +- .../LAB_AK_09_Lab1_Ex11_Content_Management.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md | 2 +- .../Labs/LAB_AK_09_Lab1_Ex2_Playbook.md | 114 +++++++++--------- .../LAB_AK_09_Lab1_Ex3_Scheduled_Query.md | 4 +- .../LAB_AK_09_Lab1_Ex4_Entity_Behavior.md | 6 +- .../Labs/LAB_AK_09_Lab1_Ex5_Attacks.md | 5 +- .../LAB_AK_09_Lab1_Ex6_Perform_Attacks.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex7_Detections.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex8_Investigate.md | 4 +- Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md | 4 +- .../Labs/LAB_AK_10_Lab1_Ex1_Hunting.md | 4 +- .../Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md | 4 +- 20 files changed, 95 insertions(+), 111 deletions(-) diff --git a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md index b3637c1d..bda688ee 100644 --- a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md +++ b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md @@ -44,7 +44,7 @@ In this task, you'll assign preset security policies for Exchange Online Protect 1. If shown, close the Microsoft Defender XDR quick tour pop-up window. **Hint:** Later in this lab, you'll need to wait until the Defender workspace is provisioned, you can take this time to navigate through the guided tours to learn more about Microsoft Defender XDR. -1. From the navigation menu, under *Email & Collaboration* area, select **Policies & rules**. +1. From the navigation menu, expand the *Email & Collaboration* section, and select **Policies & rules**. 1. On the *Policy & rules* dashboard, select **Threat policies**. diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md index 74d23859..9cd97c29 100644 --- a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md +++ b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md @@ -43,4 +43,4 @@ In this task, you'll assign preset security policies for Exchange Online Protect >**Note:** > It might take 60 minutes to start recording activities. -## You have completed the lab. \ No newline at end of file +## You have completed the lab diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md index b66533f5..b50cfe96 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md @@ -16,10 +16,7 @@ You start by initializing the Defender for Endpoint environment. Next, you onboa >**Important:** The lab Virtual Machines are used through different modules. SAVE your virtual machines. If you exit the lab without saving, you will be required to re-run some configurations again. ->**Note:** Make sure you have completed successfully Task 3 of the previous module. - ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Deploy%20Microsoft%20Defender%20for%20Endpoint)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +>**Note:** Make sure you have completed successfully Task 3 of the first module. ### Task 1: Initialize Microsoft Defender for Endpoint @@ -29,7 +26,7 @@ In this task, you'll perform the initialization of the Microsoft Defender for En 1. If you aren't already at the Microsoft Defender XDR portal, start the Microsoft Edge browser. -1. In the Microsoft Edge browser, go to the Defender XDR portal at (https://security.microsoft.com). +1. In the Microsoft Edge browser, go to the Defender XDR portal at (). 1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. @@ -98,7 +95,7 @@ In this task, you'll configure roles for use with device groups. 1. Select **Next**. -1. Select the **Assigned user groups** tab on the top. Select **sg-IT** and then select **Add selected groups**. Make sure it appears under *Azure AD user groups with this role*. +1. On the **Assigned user groups** page, type **sg-IT** in the *Filter user groups* form, and then select **Add selected groups**. Make sure it appears under *Azure AD user groups with this role*. 1. Select **Submit** and then **Done** when finished. diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md index 365df167..e228c42b 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md @@ -14,8 +14,6 @@ You are a Security Operations Analyst working at a company that is implementing To explore the Defender for Endpoint attack mitigation capabilities, you will verify successful device onboarding and investigate alerts and incidents created during that process. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Mitigate%20attacks%20with%20Microsoft%20Defender%20for%20Endpoint)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - ### Task 1: Verify Device onboarding In this task, you will confirm that the device is onboarded successfully and create a test alert. diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md b/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md index e3639760..ae04dc9c 100644 --- a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md +++ b/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md @@ -12,8 +12,6 @@ lab: You are a Security Operations Analyst working at a company that is implementing Microsoft Sentinel. You are responsible for performing log data analysis to search for malicious activity, display visualizations, and perform threat hunting. To query log data, you use the Kusto Query Language (KQL). ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20queries%20for%20Microsoft%20Sentinel%20using%20Kusto%20Query%20Language)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - >**Important:** This lab involves entering many KQL scripts into Microsoft Sentinel. The scripts were provided in a file at the beginning of this lab. An alternate location to download them is: https://github.com/MicrosoftLearning/SC-200T00A-Microsoft-Security-Operations-Analyst/tree/master/Allfiles @@ -23,11 +21,11 @@ In this task, you will access a Log Analytics environment where you can practice 1. Login to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. -1. Go to https://aka.ms/lademo in your browser. Login with the MOD Administrator credentials. +1. In the Microsoft Edge browser, go to and login with the Administrator credentials. 1. Close the Log Analytics video pop-up window that appears. -1. Explore the available tables listed in the tab on the left side of the screen. +1. Explore the available tables and other tools listed in the *schema and filter pane* on the left side of the screen. 1. In the query editor, enter the following query and select the **Run** button. You should see the query results in the bottom window. @@ -48,7 +46,7 @@ In this task, you will build basic KQL statements. >**Important:** For each query, clear the previous statement from the Query Window or open a new Query Window by selecting **+** after the last opened tab (up to 25). -1. The following statement demonstrates the **search** operator, which searches all columns in the table for the value. +1. The following statement demonstrates the **search** operator, which searches all columns in the table for the value. 1. Change the *Time range* to **Last 30 minutes** in the Query Window. @@ -347,7 +345,8 @@ In this task, you will build multi-table KQL statements. ) on Account ``` - >**Important:** The first table specified in the join is considered the Left table. The table after the **join** operator is the right table. When working with columns from the tables, the $left.Column name and $right.Column name is to distinguish which tables column are referenced. The **join** operator supports a full range of types: flouter, inner, innerunique, leftanti, leftantisemi, leftouter, leftsemi, rightanti, rightantisemi, rightouter, rightsemi. + >**Important:** + The first table specified in the join is considered the Left table. The table after the **join** operator is the right table. When working with columns from the tables, the $left.Column name and $right.Column name is to distinguish which tables column are referenced. The **join** operator supports a full range of types: flouter, inner, innerunique, leftanti, leftantisemi, leftouter, leftsemi, rightanti, rightantisemi, rightouter, rightsemi. 1. Change back the **Time range** to **Last 24 hours** in the Query Window. @@ -389,6 +388,8 @@ In this task, you will work with structured and unstructured string fields with | project resourceName, totalSlices, sliceNumber, lockTime, releaseTime, previousLockTime ``` +>**Important:** The following queries do not currently produce results in the lademo environment used for this lab. Entries in the *SigninLogs* table have been removed. However, the KQL queries demonstrate important concepts and use cases, so please take time to review them. + 1. The following statement demonstrates working with **dynamic** fields, which are special since they can take on any value of other data types. In this example, The DeviceDetail field from the SigninLogs table is of type **dynamic**. In the Query Window enter the following statement and select **Run**: ```KQL @@ -396,7 +397,7 @@ In this task, you will work with structured and unstructured string fields with | extend OS = DeviceDetail.operatingSystem ``` -1. The following example shows how to break out packed fields for SigninLogs. In the Query Window enter the following statement and select **Run**: +1. The following example shows how to break out packed fields for SigninLogs. In the Query Window enter the following statement and select **Run**: ```KQL SigninLogs diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md b/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md index 5ffc689a..2fa506c7 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md +++ b/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md @@ -12,9 +12,6 @@ lab: You are a Security Operations Analyst working at a company that is implementing Microsoft Sentinel. You are responsible for setting up the Microsoft Sentinel environment to meet the company requirement to minimize cost, meet compliance regulations, and provide the most manageable environment for your security team to perform their daily job responsibilities. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Configure%20your%20Microsoft%20Sentinel%20environment)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - - ### Task 1: Initialize the Microsoft Sentinel Workspace In this task, you will create a Microsoft Sentinel workspace. @@ -23,7 +20,7 @@ In this task, you will create a Microsoft Sentinel workspace. 1. Open the Edge browser. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. @@ -154,5 +151,4 @@ In this task, you will change the retention period for the SecurityEvent table. 1. Select **Save** to apply the changes. - -## You have completed the lab. +## You have completed the lab diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md index b9479f52..8f6a8b41 100644 --- a/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md @@ -12,9 +12,6 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to connect log data from the many data sources in your organization. The organization has data from Microsoft 365, Microsoft 365 Defender, Azure resources, non-azure virtual machines, etc. You start connecting the Microsoft sources first. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Connect%20data%20to%20Microsoft%20Sentinel%20using%20data%20connectors)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - - ### Task 1: Access the Microsoft Sentinel Workspace In this task, you will access your Microsoft Sentinel workspace. @@ -23,7 +20,7 @@ In this task, you will access your Microsoft Sentinel workspace. 1. Open the Microsoft Edge browser. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md index 1d20e160..d4857a02 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 10 - Create workbooks' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 10 - Create workbooks +# Learning Path 9 - Lab 1 - Exercise 10 - Create workbooks ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md index e4008c83..386616ba 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 11 - Use Repositories in Microsoft Sentinel' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 11 - Use Repositories in Microsoft Sentinel +# Learning Path 9 - Lab 1 - Exercise 11 - Use Repositories in Microsoft Sentinel ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md index 2fffeaf9..46a05d92 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md @@ -1,7 +1,7 @@ --- lab: title: 'Exercise 1 - Modify a Microsoft Security rule' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- # Learning Path 9 - Lab 1 - Exercise 1 - Modify a Microsoft Security rule diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md index 8eedb560..d1ceb9d4 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md @@ -1,124 +1,120 @@ --- lab: title: 'Exercise 2 - Create a Playbook' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- # Learning Path 9 - Lab 1 - Exercise 2 - Create a Playbook in Microsoft Sentinel ## Lab scenario -![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod7_L1_Ex2.png) - You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to detect and mitigate threats using Microsoft Sentinel. Now, you want to respond and reMediate actions that can be run from Microsoft Sentinel as a routine. -With a playbook, you can help automate and orchestrate your threat response, integrate with other systems both internal and external, and can be set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively. +With a playbook, you can help automate and orchestrate your threat response, integrate with other systems both internal and external, and can be set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively. -### Task 1: Create a Security Operations Center Team in Microsoft Teams +### Task 1: Create a Playbook in Microsoft Sentinel -In this task, you'll create a Microsoft Teams team for use in the lab. +In this task, you'll create a Logic App that is used as a Playbook in Microsoft Sentinel. 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Microsoft Edge browser, open a new tab and navigate to the Microsoft Teams portal at (https://teams.microsoft.com). - 1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. 1. In the **Enter password** dialog box, copy and paste in the **Tenant Password** provided by your lab hosting provider and then select **Sign in**. -1. Close any Teams pop-ups that may appear. - - >**Note:** If prompted to use **New Teams** accept and proceed with the exercise. - -1. If not already selected, select **Teams** on the left menu, then at the top, select the ![plus sign icon](../Media/plus-sign-icon-lab.png) icon. - -1. Select the **Create Team** option. - -1. Select the **From scratch** button. +1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Select the **Private** button. +1. Select your Microsoft Sentinel Workspace. -1. Give the team the name: type **SOC** and select the **Create** button. +1. In *Microsoft Sentinel*, navigate to **Content Hub**. -1. In the Add members to SOC screen, select the **Skip** button. +1. Within the search bar, look for **Sentinel SOAR Essentials**. -1. Scroll down the Teams blade to locate the newly created SOC team, select the ellipsis **(...)** on the right side of the name and select **Add channel**. +1. Select the solution that appears in the results. -1. Enter a channel name of *New Alerts* then select the **Add** button. +1. Within the solution details, select **Install**. +1. Once installed, select Manage. -### Task 2: Create a Playbook in Microsoft Sentinel +1. Find the **Defender_XDR_Ransomware_Playbook_for_SecOps_Tasks** playbook and select it. -In this task, you'll create a Logic App that is used as a Playbook in Microsoft Sentinel. +1. Select the **Incident tasks - Microsoft Defender XDR Ransomware Playbook for SecOps** template. -1. In the Microsoft Edge browser, navigate to [Microsoft Sentinel on GitHub](https://github.com/Azure/Azure-Sentinel). +1. On the details pane, select **Create playbook**. - +### Task 2: Update a Playbook in Microsoft Sentinel -1. Scroll down and select the **Solutions** folder. +In this task, you’ll update the new playbook you created with the proper connection information. -1. Next select the **SentinelSOARessentials** folder, then the **Playbooks** folder. +1. In the Search bar of the Azure portal, type Sentinel, then select Microsoft Sentinel. -1. Select the **Post-Message-Teams** folder. +1. Select your Microsoft Sentinel Workspace. -1. In the readme.md box, scroll down to the *Quick Deployment* section, **Deploy with incident trigger (recommended)** and select the **Deploy to Azure** button. +1. Select Automation under the Configuration area and then select the Active Playbooks tab. -1. Make sure your Azure Subscription is selected. +1. Select Refresh from the command bar in case you don’t see any playbooks. You should see the playbook created from the previous step. -1. For Resource Group, select **Create New**, enter *RG-Playbooks* and select **OK**. +1. Select the **Defender_XDR_Ransomware_Playbook_SecOps_Tasks** playbook name. -1. Leave **(US) East US** as the default value for *Region*. +1. On the Logic App page for **Defender_XDR_Ransomware_Playbook_SecOps_Tasks**, in the command menu, select Edit. -1. Rename the *Playbook Name* to "PostMessageTeams-OnIncident" and select **Review + create**. + >**Note:** You may need to refresh the page. -1. Now select **Create**. +1. Select the first block, Microsoft Sentinel incident. - >**Note:** Wait for the deployment to finish before proceeding to the next task. +1. Select the Change connection link. -### Task 3: Update a Playbook in Microsoft Sentinel +1. Select Add new and select Sign in. In the new window, select your Azure subscription admin credentials when prompted. The last line of the block should now read “Connected to your-admin-username”. -In this task, you'll update the new playbook you created with the proper connection information. +1. Below within the logic split, select Add task to incident. -1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. +1. Select Save on the command bar. The Logic App will be used in a future lab. -1. Select your Microsoft Sentinel Workspace. +### Task 3: Create an Automation Rule -1. Select **Automation** under the *Configuration* area and then select the **Active Playbooks** tab. +1. Within Microsoft Sentinel, go to Automation under Configuration. -1. Select **Refresh** from the command bar in case you don't see any playbooks. You should see the playbook created from the previous step. +1. Select Create and choose Automation Rule. -1. Select the **PostMessageTeams** playbook name. +1. Give the rule a name -1. On the Logic App page for *PostMessageTeams*, in the command menu, select **Edit**. +1. Leave the incident provider as All. - >**Note:** You may need to refresh the page. +1. Leave the Analytic rule name as All. -1. Select the *first* block, **Microsoft Sentinel incident**. +1. Click Add and choose And. -1. Select the **Change connection** link. +1. From the drop down, select Tactics. -1. Select **Add new** and select **Sign in**. In the new window, select your Azure subscription admin credentials when prompted. The last line of the block should now read "Connected to your-admin-username". +1. Select the following: + - Reconnaissance + - Execution + - Persistence + - Command and Control + - Exfiltration + - PreAttack -1. Now select the *second* block, **Post a message (V3)**. +1. Under Actions, select Run Playbook. -1. In the Prameters tab, scroll down and select the **Change connection** link and then select **Add new** and **Sign in**. Chose your Azure admin credentials when prompted. The Prameters tab should now read "Connected to your-admin-username". +1. Select Manage playbook permissions. -1. At the end of the *Team* field, select the **X** to clear the contents. The field is changed to a drop-down with a listing of the available Teams from Microsoft Teams. Select **SOC**. +1. Find the resource group, select it, and select apply. -1. Do the same for the *Channel* field, select the **X** at the end of the field to clear the contents. The field is changed to a drop-down with a listing of the Channels of the SOC Teams. Select **New Alerts**. +1. From the drop down list, select the **Defender_XDR_Ransomware_Playbook_SecOps_Tasks** playbook. -1. Select **Save** on the command bar. The Logic App will be used in a future lab. +1. Select Apply at the bottom. +From here, depending on your role, you will either continue doing more architect exercises or you will pivot to the analyst exercises. ## Proceed to Exercise 3 diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md index 499c859a..19a83ee0 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 3 - Create a Scheduled Query from a template' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 3 - Create a Scheduled Query from a template +# Learning Path 9 - Lab 1 - Exercise 3 - Create a Scheduled Query from a template ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md index 41ef7be8..8b578a87 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 4 - Explore Entity Behavior Analytics' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 4 - Explore Entity Behavior Analytics +# Learning Path 9 - Lab 1 - Exercise 4 - Explore Entity Behavior Analytics ## Lab scenario @@ -15,7 +15,7 @@ You need to configure Microsoft Sentinel to perform Entity Behavior Analytics to >**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Explore%20entity%20behavior%20analytics)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. -### Task 1: Explore Entity Behavior +### Task 1: Explore Entity Behavior In this task, you will explore Entity behavior analytics in Microsoft Sentinel. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md index 146d637b..075c6327 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 5 - Understand Detection Modeling' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 5 - Understand Detection Modeling +# Learning Path 9 - Lab 1 - Exercise 5 - Understand Detection Modeling ![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod7_L1_Ex5.png) ### Task 1: Understand the Attacks @@ -78,7 +78,6 @@ Do { Until ($TimeNow -ge $RunEnd) ``` - ### Task 2: Understand Detection Modeling The attack-detect configuration cycle used in this lab represents all data sources even though you are only focused on two specific data sources. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md index e1845456..bbf92d4b 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 6 - Conduct attacks' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 6 - Conduct attacks +# Learning Path 9 - Lab 1 - Exercise 6 - Conduct attacks ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md index 5bad6cfa..28c82339 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 7 - Create Detections' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 7 - Create Detections +# Learning Path 9 - Lab 1 - Exercise 7 - Create Detections ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md index 435ed1c4..54c2374e 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 8 - Investigate Incidents' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 8 - Investigate Incidents +# Learning Path 9 - Lab 1 - Exercise 8 - Investigate Incidents ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md index c1967efa..4c53a566 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 9 - Create ASIM parsers' - module: 'Learning Path 7 - Create detections and perform investigations using Microsoft Sentinel' + module: 'Learning Path 9 - Create detections and perform investigations using Microsoft Sentinel' --- -# Learning Path 7 - Lab 1 - Exercise 9 - Deploy ASIM parsers +# Learning Path 9 - Lab 1 - Exercise 9 - Deploy ASIM parsers ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md index 2a98b211..50eee683 100644 --- a/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md +++ b/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 1 - Perform Threat Hunting in Microsoft Sentinel' - module: 'Learning Path 8 - Perform threat hunting in Microsoft Sentinel' + module: 'Learning Path 10 - Perform threat hunting in Microsoft Sentinel' --- -# Learning Path 8 - Lab 1 - Exercise 1 - Perform Threat Hunting in Microsoft Sentinel +# Learning Path 10 - Lab 1 - Exercise 1 - Perform Threat Hunting in Microsoft Sentinel ## Lab scenario diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md index d096145f..51d54ad2 100644 --- a/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md +++ b/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md @@ -1,10 +1,10 @@ --- lab: title: 'Exercise 2 - Threat Hunting using Notebooks with Microsoft Sentinel' - module: 'Learning Path 8 - Perform threat hunting in Microsoft Sentinel' + module: 'Learning Path 10 - Perform threat hunting in Microsoft Sentinel' --- -# Learning Path 8 - Lab 1 - Exercise 2 - Threat Hunting using Notebooks with Microsoft Sentinel +# Learning Path 10 - Lab 1 - Exercise 2 - Threat Hunting using Notebooks with Microsoft Sentinel ## Lab scenario From 6beb5552ac7aaaa6823f6eddb97c6d3049dcd278 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Fri, 15 Nov 2024 10:32:53 -0700 Subject: [PATCH 05/19] Updated instructions --- Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md index d1ceb9d4..903047a3 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md @@ -44,7 +44,7 @@ In this task, you'll create a Logic App that is used as a Playbook in Microsoft 1. For Resource Group, select **Create New**, enter **RG-Playbooks** and select OK. -1. Remove *for* from the name (limit of 64 exceeded). +1. Remove **for** from the playbook name (would exceed limit of 64 characters). 1. Select **Connections**. From 55ebfc14ec6fc8598dc5f82238233773f58891c3 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Fri, 15 Nov 2024 11:39:49 -0700 Subject: [PATCH 06/19] Made revsions per feedback --- .../Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md | 2 +- .../Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md | 5 ++--- Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md | 8 ++++---- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md index bda688ee..345de041 100644 --- a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md +++ b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md @@ -70,7 +70,7 @@ In this task, you'll assign preset security policies for Exchange Online Protect 1. Read the content under *Review and confirm your changes* and select **Confirm** to apply the changes and then select **Done** to finish. - >**Note:** If you receive the message *"The URI 'https://outlook.office365.com/psws/service.svc/AntiPhishPolicy' is not valid for PUT operation. The URI must point to a single resource for PUT operations."* just select **OK** and then select **Cancel** to return to the main page. You will see that *Standard protection is on* option enabled. + >**Note:** If you receive the message *"The URI '' is not valid for PUT operation. The URI must point to a single resource for PUT operations."* just select **OK** and then select **Cancel** to return to the main page. You will see that *Standard protection is on* option enabled. 1. Under *Strict protection*, select **Manage protection settings**. **Hint:** *Strict protection* is found under "Email & Collaboration - Policies & rules - Threat policies - Preset security policies". diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md index b50cfe96..32c3acde 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md @@ -36,6 +36,8 @@ In this task, you'll perform the initialization of the Microsoft Defender for En 1. On the **Defender XDR** portal, from the navigation menu on the left, scroll down and expand the **System** section and select **Settings**. + >**Note:** Some versions of the portal may not have the **Settings** option under the **System** section. **Settings** may be grouped with *Reports* and *Audit*. + 1. On the Settings page, select **Device discovery**. >**Note:** If you do not see the **Device discovery** option under **Settings**, logout by selecting the top-right circle with your account initials and select **Sign out**. Other options that you might want to try is to refresh the page with Ctrl+F5 or open the page InPrivate. Login again with the **Tenant Email** credentials. @@ -44,7 +46,6 @@ In this task, you'll perform the initialization of the Microsoft Defender for En >**Hint:** If you do not see the option, refresh the page. - ### Task 2: Onboard a Device In this task, you'll onboard a device to Microsoft Defender for Endpoint using an onboarding script. @@ -62,7 +63,6 @@ In this task, you'll onboard a device to Microsoft Defender for Endpoint using a >**Tip:** > If your browser blocks the download, take action in the browser to allow it. In the Microsoft Edge Browser, you may see the message, "*WindowsDefenderATPOnboardingPackage.zip isn't commonly downloaded. Make sure you trust...*, select the ellipsis button (...) if needed and then select **Keep**. In Microsoft Edge a second pop-up appears with the message,"*Make sure you trust WindowsDefenderATPOnboardingPackage.zip before you open it*", select **Show more** to expand the selections and select **Keep anyway**. - 1. Right-click the downloaded zip file and select **Extract All...**, make sure that *Show extracted files when complete* is checked and select **Extract**. 1. Right-click on the extracted file "WindowsDefenderATPLocalOnboardingScript.cmd" and select **Properties**. Select the **Unblock** checkbox in the bottom right of the Properties windows and select **OK**. @@ -73,7 +73,6 @@ In this task, you'll onboard a device to Microsoft Defender for Endpoint using a 1. Press any key to continue. This closes the Command Prompt window. - ### Task 3: Configure Roles In this task, you'll configure roles for use with device groups. diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md index e228c42b..410c96bd 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md @@ -1,7 +1,7 @@ --- lab: - title: 'Exercise 2 - Mitigate Attacks with Microsoft Defender for Endpoint' - module: 'Learning Path 2 - Mitigate threats using Microsoft Defender for Endpoint' + title: 'Exercise 4 - Mitigate Attacks with Microsoft Defender for Endpoint' + module: 'Learning Path 4 - Mitigate threats using Microsoft Defender for Endpoint' --- # Learning Path 4 - Lab 1 - Exercise 2 - Mitigate Attacks with Microsoft Defender for Endpoint @@ -68,7 +68,7 @@ In this task, you will investigate the alerts and incidents generated by the onb 1. Under **Informational, expected activity**, select **Security testing**. -1. Add any comments if desired and select **Save** to update the incident and finish. +1. Select **Save** to update the incident and finish. 1. Review the contents of the *Attack story, Alerts, Assets, Investigations, Evidence and Response*, and *Summary* tabs. Devices and Users are under the *Assets* tab. In a real incident the *Attack story* tab displays the *Incident graph*. **Hint:** Some tabs might be hidden due the size of your display. Select the ellipsis tab (...) to make them appear. @@ -110,7 +110,7 @@ In this task, you will simulate an attack on the WIN1 virtual machine and verify 1. Mouse over and select the **Incident graph nodes** to review the *entities*. -1. Re expand the **Alerts** pane (left-side) and select the **Play attack story** *Run* icon. This shows the attack timeline alert by alert and dynamically populates the *Incident graph*. +1. Re-expand the **Alerts** pane (left-side) and select the **Play attack story** *Run* icon. This shows the attack timeline alert by alert and dynamically populates the *Incident graph*. 1. Review the contents of the *Attack story, Alerts, Assets, Investigations, Evidence and Response*, and *Summary* tabs. Devices and Users are under the *Assets* tab. **Hint:** Some tabs might be hidden due the size of your display. Select the ellipsis tab (...) to make them appear. From 2cdc38dcf5421dbd5401b2de7894a34bfd723fe1 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Wed, 20 Nov 2024 10:46:32 -0700 Subject: [PATCH 07/19] many revisions and renames --- ...AB_AK_01_Lab1_Ex1_Explore_M365_Defender.md | 2 + ...AK_02_Lab1_Ex1_Explore_Copilot_Security.md | 215 +++++++++++++++++- ...AB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md | 2 + ...AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md | 2 + .../LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md | 2 + .../LAB_AK_05_Lab1_Ex1_Enable_Defender.md | 212 ----------------- .../Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md | 97 ++++++++ ...r.md => LAB_AK_05_Lab1_Ex2_Explore_MDC.md} | 2 + Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md | 7 +- .../LAB_AK_08_Lab1_Ex2_Connect_Windows.md | 67 +++++- .../Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md | 3 +- .../LAB_AK_09_Lab1_Ex11_Content_Management.md | 13 +- .../Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md | 7 +- .../LAB_AK_09_Lab1_Ex3_Scheduled_Query.md | 2 +- .../LAB_AK_09_Lab1_Ex4_Entity_Behavior.md | 7 +- .../Labs/LAB_AK_09_Lab1_Ex5_Attacks.md | 11 +- .../LAB_AK_09_Lab1_Ex6_Perform_Attacks.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex7_Detections.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex8_Investigate.md | 3 +- Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md | 4 +- .../Labs/LAB_AK_10_Lab1_Ex1_Hunting.md | 3 +- .../Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md | 12 +- Instructions/Media/add-plugin-button.png | Bin 0 -> 1930 bytes Instructions/Media/box-icon.png | Bin 0 -> 431 bytes Instructions/Media/check-mark-icon.png | Bin 0 -> 439 bytes Instructions/Media/create-promptbook-icon.png | Bin 0 -> 1087 bytes Instructions/Media/edit-icon.png | Bin 0 -> 575 bytes Instructions/Media/home-menu-icon.png | Bin 0 -> 411 bytes Instructions/Media/information-icon.png | Bin 0 -> 727 bytes Instructions/Media/launch-copilot-button.png | Bin 0 -> 12321 bytes .../Media/launch-purview-portal-button.png | Bin 0 -> 11382 bytes Instructions/Media/maximize-icon.png | Bin 0 -> 1112 bytes Instructions/Media/pin-icon.png | Bin 0 -> 639 bytes Instructions/Media/pinboard-icon.png | Bin 0 -> 575 bytes Instructions/Media/prompt-icon.png | Bin 0 -> 724 bytes .../Media/raw-file-download-icon-v2.png | Bin 0 -> 826 bytes Instructions/Media/run-icon.png | Bin 0 -> 785 bytes ...rity-copilot-launch-exercise-button-v2.png | Bin 0 -> 3858 bytes .../Media/simulation-pop-up-error copy.png | Bin 0 -> 4994 bytes Instructions/Media/sources-icon.png | Bin 0 -> 728 bytes 41 files changed, 418 insertions(+), 267 deletions(-) delete mode 100644 Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md create mode 100644 Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md rename Instructions/Labs/{LAB_AK_05_Lab1_Ex2_Azure_Defender.md => LAB_AK_05_Lab1_Ex2_Explore_MDC.md} (99%) create mode 100644 Instructions/Media/add-plugin-button.png create mode 100644 Instructions/Media/box-icon.png create mode 100644 Instructions/Media/check-mark-icon.png create mode 100644 Instructions/Media/create-promptbook-icon.png create mode 100644 Instructions/Media/edit-icon.png create mode 100644 Instructions/Media/home-menu-icon.png create mode 100644 Instructions/Media/information-icon.png create mode 100644 Instructions/Media/launch-copilot-button.png create mode 100644 Instructions/Media/launch-purview-portal-button.png create mode 100644 Instructions/Media/maximize-icon.png create mode 100644 Instructions/Media/pin-icon.png create mode 100644 Instructions/Media/pinboard-icon.png create mode 100644 Instructions/Media/prompt-icon.png create mode 100644 Instructions/Media/raw-file-download-icon-v2.png create mode 100644 Instructions/Media/run-icon.png create mode 100644 Instructions/Media/security-copilot-launch-exercise-button-v2.png create mode 100644 Instructions/Media/simulation-pop-up-error copy.png create mode 100644 Instructions/Media/sources-icon.png diff --git a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md index 345de041..2cc28ca2 100644 --- a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md +++ b/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md @@ -17,6 +17,8 @@ If you are being provided with a tenant as a part of an instructor-led training Tenants should not be shared or used for purposes outside of hands-on labs. The tenant used in this course is a trial tenant and cannot be used or accessed after the class is over and are not eligible for extension. Tenants must not be converted to a paid subscription. Tenants obtained as a part of this course remain the property of Microsoft Corporation and we reserve the right to obtain access and repossess at any time. +### Estimated time to complete this lab: 30 minutes + ### Task 1: Obtain Your Microsoft 365 Credentials Once you launch the lab, a Microsoft 365 E5 tenant is made available to you to access in the Microsoft virtual Lab environment. This tenant is automatically assigned a unique username and password. You must retrieve this username and password so that you can sign into and Microsoft 365 within the Microsoft Virtual Lab environment. diff --git a/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md b/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md index 57f9f30f..5ceb8813 100644 --- a/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md +++ b/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md @@ -4,7 +4,7 @@ lab: module: 'Learning Path 2 - Mitigate threats using Microsoft Copilot for Security' --- -# Learning Path 2 - Lab 1 - Exercise 1 - Explore Microsoft Copilot for Security +# Learning Path 2 - Lab 1 - Exercise 1 - Explore Microsoft Security Copilot ## Lab scenario @@ -16,7 +16,9 @@ In this exercise, you go through the *first run experience* of Microsoft Copilot > The environment for this exercise is a simulation generated from the product. As a limited simulation, links on a page may not be enabled and text-based inputs that fall outside of the specified script may not be supported. A pop-up message will display stating, "This feature is not available within the simulation." When this occurs, select OK and continue the exercise steps. >:::image type="content" source="../media/simulation-pop-up-error.png" alt-text="Screenshot of pop-up screen indicating that this feature is not available within the simulation."::: -### Task 1: Provision Microsoft Copilot for Security +### Estimated time to complete this lab: 45 minutes + +### Task 1: Provision Microsoft Security Copilot For this exercise, you're logged in as Avery Howard and you have the global administrator role in Microsoft Entra. You'll work in both the Azure portal and Microsoft Copilot for Security. @@ -56,7 +58,7 @@ Once you're assigned the User Access Administrator role in Azure, you can assign As an owner to the Azure subscription, you'll now be able to provision capacity within Copilot. -#### Task: Provision capacity +#### Sub-task 1: Provision capacity In this task, you go through the steps of provisioning capacity for your organization. There are two options for provisioning capacity: @@ -87,6 +89,209 @@ For this exercise, you provision capacity through Copilot for Security. When you 1. You're all set! Select **Finish**. 1. Close the browser tab, as the next exercise will use a separate link to the lab-like environment. -#### Review +### Task 2: Explore the Microsoft Security Copilot standalone experience + +The security administrator for your organization provisioned Copilot. Since you're the senior analyst on the team, the administrator added you as a Copilot owner and asked you to familiarize yourself with the solution. + +In this exercise, you explore all the key landmarks in the landing page of the standalone experience of Microsoft Copilot for Security. + +You're logged in as Avery Howard and have the Copilot owner role. You'll work in the standalone experience of Microsoft Copilot for Security. + +This exercise should take approximately **15** minutes to complete. + +#### Sub-task 1: Explore the menu options + +In this task, you start your exploration in the home menu. + +1. Open the simulated environment by selecting this link: **[Microsoft Copilot for Security](https://app.highlights.guide/start/2cac767e-42c4-4058-afbb-a9413aac461d?link=0&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. + +1. Select the **Menu** icon ![home menu icon](../media/home-menu-icon.png), which is sometimes referred to as the hamburger icon. + +1. Select **My sessions** and note the available options. + 1. Select recent to view the most recent sessions + 1. Select filter and note the available options, then close the filer. + 1. Select the home menu icon to open the home menu. + +1. Select **Promptbook library**. + 1. Select My promptbooks. A subsequent task dives deeper into promptbooks. + 1. Select Woodgrove. + 1. Select Microsoft. + 1. Select filter to view the available options, then select the X to close. + 1. Select the home menu icon to open the home menu. + +1. Select **Owner settings**. These settings are available to you as a Copilot owner. A Copilot contributor does have not access to these menu options. + 1. For plugins for Copilot for Security, select the drop-down for Who can add and manage their own custom plugins to view the available options. + 1. Select drop-down for Who can add and manage custom plugins for everyone in the organization to view the available options. Note, this option is greyed out if Who can add and manage their own custom plugins is set to owners only. + 1. Select the information icon next to "Allow Copilot for Security to access data from your Microsoft 365 Services." This setting must be enabled if you want to use the Microsoft Purview plugin. You'll work with this setting in a later exercise. + 1. Select the drop-down for who can upload files to view the available options. + 1. Select the home menu icon to open the home menu. + +1. Select **Role assignment**. + 1. Select Add members, then close. + 1. Expand owner. + 1. Expand contributor. + 1. Select the home menu icon to open the home menu. + +1. Select **Usage monitoring**. + 1. Select the date filter to view available options. + 1. Select the home menu icon to open the home menu. + +1. Select **Settings**. + 1. Select preferences. Scroll down to view available options. + 1. Select data and privacy. + 1. Select About. + 1. Select the X to close the preferences window. + +1. Select where it says **Woodgrove** at the bottom left of the home menu. + 1. When you select this option, you see your tenants. This is referred to as the tenant switcher. In this case, Woodgrove is the only available tenant. + 1. Select the **Home** to return to the landing page. + +#### Sub-task 2: Explore access to recent sessions + +In the center of the landing page, there are cards representing your most recent sessions. + +1. The largest card is your last session. Selecting the title of any session card takes you to that session. +1. Select **View all sessions** to go to the My sessions page. +1. Select **Microsoft Copilot for Security**, next to the home menu icon, to return to the landing page. + +#### Sub-task 3: Explore access to promptbooks + +The next section of the Copilot landing page revolves around promptbooks. The landing page shows tiles for some Microsoft security promptbooks. Here you explore access to promptbooks and the promptbook library. In a subsequent exercise, you explore creating and running a promptbook. + +1. To the right of where it says "Get started with these promptbooks" are a left and right arrow key that allows you to scroll through the tiles for Microsoft security promptbooks. Select the **right arrow >** + +1. Each tile shows the title of the promptbook, a brief description, the number of prompts, and a run icon. Select the title of any of the promptbook tiles to open that promptbook. Select **Vulnerability impact assessment**, as an example. + 1. The window for the selected promptbook provides information, including who created the promptbook, tags, a brief description, inputs required to run the promptbook, and a listing of the prompts. + 2. Note the information about the promptbook and the available options. For this simulation you can't start a new session, you'll do that in a subsequent exercise. + 1. Select **X** to close the window. + +1. Select **View the promptbook library**. + 1. To view promptbooks that you own, select My promptbooks. + 1. Select Woodgrove for a listing of promptbooks owned by Woodgrove, the name of a fictitious organization. + 1. To view built-in, Microsoft owned/developed promptbooks, select Microsoft. + 1. Select the filter icon. Here you can filter based on tags assigned to the workbook. Close the filter window by selecting the X in the New filter tab. + 1. Select **Microsoft Copilot for Security**, next to the home menu icon, to return to the landing page. + +#### Sub-task 4: Explore the prompts and sources icon in the prompt bar + +At the bottom center of the page is the prompt bar. The prompt bar includes the prompts and sources icon, which you explore in this task. In subsequent exercises you'll enter inputs directly in the prompt bar. + +1. From the prompt bar, you can select the prompts icon to select a built-in prompt or a promptbook. Select the **prompts icon** ![prompts icon](../media/prompt-icon.png). + 1. Select **See all promptbooks** + 1. Scroll to view all the available promptbooks. + 1. Select the **back-arrow** next to the search bar to go back. + 1. Select **See all system capabilities**. The list shows all available system capabilities (these capabilities are in effect prompts that you can run). Many system capabilities are associated with specific plugins and as such will only be listed if the corresponding plugin is enabled. + 1. Scroll to view all the available promptbooks. + 1. Select the **back-arrow** next to the search bar to go back. + +1. Select the **sources icon** ![sources icon](../media/sources-icon.png). + 1. The sources icon opens the manage sources window. From here, you can access Plugins or Files. The **Plugins** tab is selected by default. + 1. Select whether you want to view all plugins, those that are enabled (on), or those that are disabled (off). + 1. Expand/collapse list of Microsoft, non-Microsoft, and custom plugins. + 1. Some plugins require configuring parameters. Select the **Set up** button for the Microsoft Sentinel plugin, to view the settings window. Select **cancel** to close the settings window. In a separate exercise, you configure the plugin. + 1. You should still be in the Manage sources window. Select **Files**. + 1. Review the description. + 1. Files can be uploaded and used as a knowledge base by Copilot. In a subsequent exercise, you'll work with file uploads. + 1. Select **X** to close the manage sources window. + +#### Sub-task 5: Explore the help feature + +At the bottom right corner of the window is the help icon where you can easily access documentation and find solutions to common problems. From the help icon, you also submit a support case to the Microsoft support team if you have the appropriate role permissions. + +1. Select the **Help (?)** icon. + 1. Select **Documentation**. This selection opens a new browser tab to the Microsoft Copilot for Security documentation. Return to the Microsoft Copilot for Security browser tab. + 1. Select **Help**. + 1. Anyone with access to Copilot for Security can access the self help widget by selecting the help icon then selecting the Help tab. Here you can find solutions to common problems by entering something about the problem. + 1. Users with a minimum role of Service Support Administrator or Helpdesk Administrator role can submit a support case to the Microsoft support team. If you have this role, a headset icon is displayed. Close the contact support page. + +### Task 3: Explore the Microsoft Security Copilot embedded experience + +In this exercise, you investigate an incident in Microsoft Defender XDR. As part of the investigation, you explore the key features of Microsoft Copilot in Microsoft Defender XDR, including incident summary, device summary, script analysis, and more. You also pivot your investigation to the standalone experience and use the pin board as a way to share details of your investigation with your colleagues. + +You're logged in as Avery Howard and have the Copilot owner role. You'll work in Microsoft Defender, using the new unified security operations platform, to access the embedded Copilot capabilities in Microsoft Defender XDR. Towards the end of the exercise, you pivot to the standalone experience of Microsoft Copilot for Security. + +This exercise should take approximately **30** minutes to complete. + +#### Sub-task 1: Explore Incident summary and guided responses + +1. Open the simulated environment by selecting this link: **[Microsoft Defender portal](https://app.highlights.guide/start/f4f590f6-8937-40f9-91ec-632de546ab98?token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. + +1. From the Microsoft Defender portal: + 1. Expand **Investigation & response**. + 1. Expand **Incidents & alerts**. + 1. Select **Incidents**. + +1. Select the first incident in the list, **Incident Id: 30342** named Human-operated ransomware attack was launched from a compromised asset (attack disruption). + +1. This is a complex incident. Defender XDR provides a great deal of information, but with 72 alerts it can be a challenge to know where to focus. On the right side of the incident page, Copilot automatically generates an **Incident summary** that helps guide your focus and response. Select **See more**. + 1. Copilot's summary describes how this incident has evolved, including initial access, lateral movement, collection, credential access and exfiltration. It identifies specific devices, indicates that the PsExec tool was used to launch executable files, and more. + 1. These are all items you can leverage for further investigation. You explore some of these in subsequent tasks. + +1. Scroll down on the Copilot panel and just beneath the summary are **Guided responses**. Guided responses recommend actions in support of triage, containment, investigation, and remediation. + 1. The first item in the triage category it to Classify this incident. Select **Classify** to view the options. Review the guided responses in the other categories. + 1. Select the **Status** button at the top of the guided responses section and filter on **Completed**. Two completed activities show labeled as Attack Disruption. Automatic attack disruption is designed to contain attacks in progress, limit the impact on an organization's assets, and provide more time for security teams to remediate the attack fully. +1. Keep the incident page open, you'll use it in the next task. + +#### Sub-task 2: Explore device and identity summary + +1. From the incident page, select the first alert **Suspicious URL clicked**. + +1. Copilot automatically generates an **Alert summary**, which provides a wealth of information for further analysis. For example, the summary identifies suspicious activity, it identifies data collection activities, credential access, malware, discovery activities, and more. + +1. There's a lot of information on the page, so to get a better view of this alert, select **Open alert page**. It's on the third panel on the alert page, next to the incident graph and below the alert title. + +1. On the top of the page, is card for the device parkcity-win10v. Select the ellipses and note the options. Select **Summarize**. Copilot generates a **Device summary**. It's worth nothing that there are many ways you can access device summary and this is just one convenient method. The summary shows the device is a VM, identifies the owner of the device, it shows its compliance status against Intune policies, and more. + +1. Next to the device card is a card for the owner of the device. Select **parkcity\jonaw**. The third panel on the page updates from showing details of the alert to providing information about the user Jonathan Wolcott, an account executive, whose Microsoft Entra ID risk and Insider risk severity are classified as high. These aren't surprising given what you've learned from the Copilot incident and alert summaries. Select the ellipses then select **Summarize** to obtain an identity summary generated by Copilot. + +1. Keep the alert page open, you'll use it in the next task. + +#### Sub-task 3: Explore script analysis + +1. Let's Focus on the alert story. Select **Maximize ![maximize icon](../media/maximize-icon.png)**, located on the main panel of the alert, just beneath the card labeled 'partycity\jonaw' to get a better view of the process tree. From maximized view, you begin to get a clearer view of how this incident came to be. Many line items indicate that powershell.exe executed a script. Since the user Jonathan Wolcott is an account executive, it's reasonable to assume that executing PowerShell scripts isn't something this user is likely to be doing regularly. + +1. Expand the first instance of **powershell.exe execute a script**, it's the one showing the timestamp of 4:57:11 AM. Copilot has the capability to analyze scripts. Select **Analyze**. + 1. Copilot generates an analysis of the script and suggests it could be a phishing attempt or used to deliver a web-based exploit. + 1. Select **Show code**. The code shows a defanged URL. + +1. There are several other items that indicate powershell.exe executed a script. Expand the one labeled **powershell.exe -EncodedCommand...** with the timestamp 5:00:47 AM. The original script was base 64 encoded, but Defender has decoded that for you. For the decoded version, select **Analyze**. The analysis highlights the sophistication of the script used in this attack. + +1. Close the alert story page by selecting the **X** (the X that is to the left of Copilot panel). Now use the breadcrumb to return to the incident. Select **Human-operated ransomware attack was launched from a compromised asset (attack disruption)**. + +#### Sub-task 4: Explore file analysis + +1. You're back at the incident page. In the alert summary, Copilot identified the file Rubeus.exe, which is associated with the 'Kekeo' malware. You can use the file analysis capability in Defender XDR to see what other insights you can get. There are several ways to access files. From the top of the page, select the **Evidence and Response** tab. + +1. From the left side of the screen select **Files**. +1. Select the first item from the list with the entity named **Rubeus.exe**. +1. From the window that opens, select **Analyze**. Copilot generates a summary. +1. Review the detailed file analysis that Copilot generates. +1. Close the file analysis window. + +#### Sub-task 5: Pivot to the standalone experience + +This task is complex and requires the involvement of more senior analysts. In this task, you pivot your investigation and run the Defender incident promptbook so the other analysts have a running start on the investigation. You pin responses to the pin board and generate a link to this investigation that you can share with more advanced members of the team to help investigate. + +1. Return to the incident page by selecting the **Attack story** tab from the top of the page. + +1. Select the ellipses next to Copilot's Incident summary and select **Open in Copilot for Security**. + +1. Copilot opens in the standalone experience and shows the incident summary. You can also run more prompts. In this case, you'll run the promptbook for an incident. Select the **prompt icon** ![prompt icon](../media/prompt-icon.png). + 1. Select **See all promptbooks**. + 1. Select **Microsoft 365 Defender incident investigation**. + 1. The promptbook page opens and asks for the Defender Incident ID. Enter **30342** then select **Run**. + 1. Review the information provided. By pivoting to the standalone experience and running the promptbook, the investigation is able to invoke capabilities from a broader set security solution, beyond just Defender XDR, based on the plugins enabled. + +1. Select the **box icon ![box icon](../media/box-icon.png)** next to the pin icon to select all the prompts and and the corresponding responses, then select the **Pin icon ![pin icon](../media/pin-icon.png)** to save those responses to the pin board. + +1. The pin board opens automatically. The pin board holds your saved prompts and responses, along with a summary of each one. You can open and close the pin board by selecting the **pin board icon ![pin board icon](../media/pinboard-icon.png)**. + +1. From the top of the page, select **Share** to view your options. By sharing the incident via a link or email, people in your organization with Copilot access can view this session. Close the window by selecting the **X**. + +1. You can now close the browser tab to exit the simulation. + +## Summary and additional resources + +In this exercise, you explored the first run experience of Microsoft Copilot for Security, provisioned capacity, and explored the standalone and embedded experiences of Copilot. You investigated an incident in Microsoft Defender XDR, explored the incident summary, device summary, script analysis, and more. You also pivoted your investigation to the standalone experience and used the pin board as a way to share details of your investigation with your colleagues. -In this exercise, you successfully provisioned Copilot for Security. You're now ready to move to the next exercise where you'll explore the core functionality of Microsoft Copilot for Security. \ No newline at end of file +To run additional Microsoft Security Copilot use case simulations, browse to [Explore Microsoft Security Copilot use case simulations](/training/modules/security-copilot-exercises/) diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md index 9cd97c29..cbfa3aed 100644 --- a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md +++ b/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md @@ -10,6 +10,8 @@ lab: You're a Security Operations Analyst working at a company that is implementing Microsoft Defender XDR and Microsoft Purview. You're assisting colleagues on the the IT compliance team with configuring both Purview Audit (Standard) and Audit (Premium). Their objective is to ensure that all access and modifications to patient data in our network of healthcare facilitie sare accurately logged to meet health data protection regulations. +### Estimated time to complete this lab: 15 minutes + ### Task 1: Enable Purview Audit logs In this task, you'll assign preset security policies for Exchange Online Protection (EOP) and Microsoft Defender for Office 365 in the Microsoft 365 security portal. diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md index 32c3acde..6a3b6f98 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md @@ -18,6 +18,8 @@ You start by initializing the Defender for Endpoint environment. Next, you onboa >**Note:** Make sure you have completed successfully Task 3 of the first module. +### Estimated time to complete this lab: 30 minutes + ### Task 1: Initialize Microsoft Defender for Endpoint In this task, you'll perform the initialization of the Microsoft Defender for Endpoint. diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md index 410c96bd..f5344e9a 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md @@ -14,6 +14,8 @@ You are a Security Operations Analyst working at a company that is implementing To explore the Defender for Endpoint attack mitigation capabilities, you will verify successful device onboarding and investigate alerts and incidents created during that process. +### Estimated time to complete this lab: 30 minutes + ### Task 1: Verify Device onboarding In this task, you will confirm that the device is onboarded successfully and create a test alert. diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md deleted file mode 100644 index 33ea6238..00000000 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_Defender.md +++ /dev/null @@ -1,212 +0,0 @@ ---- -lab: - title: 'Exercise 1 - Enable Microsoft Defender for Cloud' - module: 'Learning Path 5 - Mitigate threats using Microsoft Defender for Cloud' ---- - -# Learning Path 5 - Lab 1 - Exercise 1 - Enable Microsoft Defender for Cloud - -## Lab scenario - -![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod3_L1_Ex1.png) - -You're a Security Operations Analyst working at a company that is implementing cloud workload protection with Microsoft Defender for Cloud. In this lab, you enable Microsoft Defender for Cloud. - -### Task 1: Access the Azure portal and set up a Subscription - -In this task, you'll set up an Azure Subscription required to complete this lab and future labs. - -1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. - -1. Open the Microsoft Edge browser or open a new tab if already open. - -1. In the Microsoft Edge browser, navigate to the Azure portal at . - -1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. - -1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. - -1. In the Search bar of the Azure portal, type *Subscription*, then select **Subscriptions**. - -1. Select the *"Azure Pass - Sponsorship"* subscription shown (or equivalent name in your selected language). - - >**Note:** If the subscription is not shown, ask your instructor on how to create the Azure subscription with your tenant admin user credentials. **Note:** The subscription creation process could take up to 10 minutes. - -1. Select **Access control (IAM)** and then select **View my access** from the *Check access* tab. - -1. Verify that the **Current role assignments** tab has a *Role assignments Role* for **LOD Owner**. Select the **X** in the top right of the *assignments - MOC Subscription-lodxxxxxxxx* window to close it. - -### Task 2: Create a Log Analytics Workspace - -In this task, you create a Log Analytics workspace for use with Azure Monitoring, Microsoft Sentinel and Microsoft Defender for Cloud. - -1. In the Search bar of the Azure portal, type *Log Analytics workspaces*, then select the same service name. - -1. Select **+Create** from the command bar. - -1. Select **Create new** for the Resource group. - -1. Enter *RG-Defender* and select **Ok**. - -1. For the Name, enter something unique like: *uniquenameDefender*. - -1. Select **Review + Create**. - -1. Once the workspace validation has passed, select **Create**. Wait for the new workspace to be provisioned, this may take a few minutes. - - -### Task 3: Enable Microsoft Defender for Cloud - -In this task, you'll enable and configure Microsoft Defender for Cloud. - -1. In the Search bar of the Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. - -1. In the left menu for Microsoft Defender for Cloud, under the Management, select **Environment settings**. - -1. Select the **"Azure Pass - Sponsorship"** subscription (or equivalent name in your Language). - -1. Review the Azure resources that are now protected with the Defender for Cloud plans. - - >**Important:** If all Defender plans are *Off*, select **Enable all plans**. Select the *$200/month Microsoft Defender for APIs Plan 1* and then select **Save**. Select **Save** at the top of the page and wait for the *"Defender plans (for your) subscription were saved successfully!"* notifications to appear. - -1. Select the **Settings & monitoring** tab from the Settings area (next to Save). - -1. Review the monitoring extensions. It includes configurations for Virtual Machines, Containers, and Storage Accounts. Close the "Settings & monitoring" page by selecting the 'X' on the upper right of the page. - -1. Close the settings page by selecting the 'X' on the upper right of the page to go back to the **Environment settings** and select the '>' to the left of your subscription. - -1. Select the Log analytics workspace you created earlier *uniquenameDefender* to review the available options and pricing. - -1. Select **Enable all plans** (to the right of Select Defender plan) and then select **Save**. Wait for the *"Microsoft Defender plan for workspace uniquenameDefender were saved successfully!"* notification to appear. - - >**Note:** If the page is not being displayed, refresh your Edge browser and try again. - -1. Close the Defender plans page by selecting the 'X' on the upper right of the page to go back to the **Environment settings** - - -### Task 4: Install Azure Arc on an On-Premises Server - -In this task, you install Azure Arc on an on-premises server to make onboarding easier. - ->**Important:** The next steps are done in a different machine than the one you were previously working. Look for the Virtual Machine name references. - -1. Log in to **WINServer** virtual machine as Administrator with the password: **Passw0rd!** if necessary. - -1. Open the Microsoft Edge browser and navigate to the Azure portal at . - -1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. - -1. In the **Enter password** dialog box, copy, and paste in the **Tenant Password** provided by your lab hosting provider and then select **Sign in**. - -1. In the Search bar of the Azure portal, type *Arc*, then select **Azure Arc**. - -1. In the navigation pane under **Azure Arc resources** select **Machines** - -1. Select **+ Add/Create**, then select **Add a machine**. - -1. Select **Generate script** from the "Add a single server" section. - - - -1. In the *Add a server with Azure Arc* page, select the Resource group you created earlier under *Project details*. **Hint:** *RG-Defender* - - >**Note:** If you haven't already created a resource group, open another tab and create the resource group and start over. - -1. For *Region*, select **(US) East Us** from the drop-down list. - -1. Review the *Server details* and *Connectivity method* options. Keep the default values and select **Next** to get to the Tags tab. - -1. Review the default available tags. Select **Next** to get to the Download and run script tab. - -1. Scroll down and select the **Download** button. **Hint:** if your browser blocks the download, take action in the browser to allow it. In Microsoft Edge Browser, select the ellipsis button (...) if needed and then select **Keep**. - -1. Right-click the Windows Start button and select **Windows PowerShell (Admin)**. - -1. Enter *Administrator* for "Username" and *Passw0rd!* for "Password" if you get a UAC prompt. - -1. Enter: cd C:\Users\Administrator\Downloads - - >**Important:** If you do not have this directory, most likely means that you are in the wrong machine. Go back to the beginning of Task 4 and change to WINServer and start over. - -1. Type *Set-ExecutionPolicy -ExecutionPolicy Unrestricted* and press enter. - -1. Enter **A** for Yes to All and press enter. - -1. Type *.\OnboardingScript.ps1* and press enter. - - >**Important:** If you get the error *"The term .\OnboardingScript.ps1 is not recognized..."*, make sure you are doing the steps for Task 4 in the WINServer virtual machine. Other issue might be that the name of the file changed due to multiple downloads, search for *".\OnboardingScript (1).ps1"* or other file numbers in the running directory. - -1. Enter **R** to Run once and press enter (this may take a couple minutes). - -1. The setup process opens a new Microsoft Edge browser tab to authenticate the Azure Arc agent. Select your admin account, wait for the message "Authentication complete" and then go back to the Windows PowerShell window. - -1. When the installation finishes, go back to the Azure portal page where you downloaded the script and select **Close**. Close the **Add servers with Azure Arc** to go back to the Azure Arc **Machines** page. - -1. Select **Refresh** until WINServer server name appears and the Status is *Connected*. - - >**Note:** This could take a couple of minutes. - - -### Task 5: Protect an On-Premises Server - -In this task, you manually install the *Azure Monitor Agent* by adding a *Data Collection Rule (DCR)* on the **WINServer** virtual machine. - -1. Go to **Microsoft Defender for Cloud** and select the **Getting Started** page from the left menu. - -1. Select the **Get Started** tab. - -1. Scroll down and select **Configure** under the *Add non-Azure servers* section. - -1. Select **Upgrade** next to the workspace you created earlier. This might take a few minutes. Wait until you see the notification *"Microsoft Defender plan for workspace uniquenameDefender were saved successfully!"*. - -1. Select **+ Add Servers** next to the workspace you created earlier. - -1. Select **Data Collection Rules** - -1. Select **+ Create**. - -1. Enter **WINServer** for Rule Name. - -1. Select your *Azure Pass - Sponsorship* subscription and select a Resource Group. **Hint:** *RG-Defender* - -1. You can keep the default *East US* region or select another preferable location. - -1. Select the **Windows** radio button for *Platform Type* and select **Next: Resources**. - -1. In the **Resources** tab, **+ Add resources**. - -1. In the **Select a scope** page, expand the *Scope* column for **RG-Defender** (or the Resource Group your created), then select **WINServer** and select **Apply**. - - >**Note:** You may need to set the column filter for *Resource type* to *Server-Azure Arc* if **WINServer** is not displayed. - -1. Select **Next: Collect and deliver** - -1. In the **Collect and deliver** tab, select **+ Add data source** - -1. In the **Add a data source** page, select **Performance Counters** from *Data source type*. - - >**Note:** For the purposes of this lab you could select *Windows Event Logs*. These selections can be revised later. - -1. Select the **Destination** tab - -1. Select **Azure Monitor Logs** in the **Destination Type** dropdown - -1. Select your *Azure Pass - Sponsorship* subscription from the **Subscription** dropdown - -1. Select your workspace name **Hint:** *RG-Defender* from the **Account or namespace** dropdown - -1. Select **Add data source** and select **Review + create** - -1. Select **Create** after *Validation passed* is displayed. - -1. The **Data Collection Rule** creation initiates the installation of the *AzureMonitorWindowsAgent* extension on **WINServer**. - -1. When the *Data Collection Rule* creation completes, enter **WINServer** in the *Search resources, services and docs* search bar, and select **WINServer** from *Resources*. - -1. On **WINServer** scroll down through the left menu to *Settings* and *Extensions*. - -1. The **AzureMonitorWindowsAgent** should be listed with a *Status* of **Succeeded**. - -1. You can move on to the next lab and return later to review the **Inventory** section of **Microsoft Defender for Cloud** to verify that **WINServer** is included. - -## Proceed to Exercise 2 diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md new file mode 100644 index 00000000..8012eae0 --- /dev/null +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md @@ -0,0 +1,97 @@ +--- +lab: + title: 'Exercise 1 - Enable Microsoft Defender for Cloud' + module: 'Learning Path 5 - Mitigate threats using Microsoft Defender for Cloud' +--- + +# Learning Path 5 - Lab 1 - Exercise 1 - Enable Microsoft Defender for Cloud + +## Lab scenario + +You're a Security Operations Analyst working at a company that is implementing cloud workload protections with Microsoft Defender for Cloud. In this lab, you enable Microsoft Defender for Cloud. + +### Estimated time to complete this lab: 20 minutes + +### Task 1: Create a Log Analytics Workspace + +In this task, you create a Log Analytics workspace for use with Azure Monitoring, Microsoft Sentinel and Microsoft Defender for Cloud. + +1. In the Search bar of the Azure portal, type *Log Analytics workspaces*, then select the same service name. + +1. Select **+Create** from the command bar. + +1. Select **Create new** for the Resource group. + +1. Enter *RG-Defender* and select **Ok**. + +1. For the Name, enter something unique like: *uniquenameDefender*. + +1. Select **Review + Create**. + +1. Once the workspace validation has passed, select **Create**. Wait for the new workspace to be provisioned, this may take a few minutes. + +### Task 2: Enable Microsoft Defender for Cloud + +In this task, you'll enable and configure Microsoft Defender for Cloud. + +1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. + +1. Open the Microsoft Edge browser or open a new tab if already open. + +1. In the Microsoft Edge browser, navigate to the Azure portal at . + + >**Note:** Select the **Resourses** tab for the *Username* and *Password* for the lab. Use the **** account for this lab. + +1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. + +1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. + +1. In the Search bar of the Microsoft Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. + +1. In the left navigation menu for Microsoft Defender for Cloud, expand the Management section , and select **Environment settings**. + +1. Select the **MOC Subscription-lodxxxxxxxx** subscription (or equivalent name in your Language). + +1. Review the Azure resources that are now protected with the Defender for Cloud plans. + + >**Important:** If all Defender plans are *Off*, select **Enable all plans**. Select the *$200/month Microsoft Defender for APIs Plan 1* and then select **Save**. Select **Save** at the top of the page and wait for the *"Defender plans (for your) subscription were saved successfully!"* notifications to appear. + +1. Select the **Settings & monitoring** tab from the Settings area (next to Save). + +1. Review the monitoring extensions. It includes configurations for Virtual Machines, Containers, and Storage Accounts. Close the "Settings & monitoring" page by selecting the 'X' on the upper right of the page. + +1. Close the settings page by selecting the 'X' on the upper right of the page to go back to the **Environment settings** and select the '>' to the left of your subscription. + +1. Select the Log analytics workspace you created earlier *uniquenameDefender* to review the available options and pricing. + +1. Select **Enable all plans** (to the right of Select Defender plan) and then select **Save**. Wait for the *"Microsoft Defender plan for workspace uniquenameDefender were saved successfully!"* notification to appear. + + >**Note:** If the page is not being displayed, refresh your Edge browser and try again. + +1. Close the Defender plans page by selecting the 'X' on the upper right of the page to go back to the **Environment settings** + +### Task 3: Understanding the Microsoft Defender for Cloud Dashboard + +1. In the Search bar of the Microsoft Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. + +1. In the left navigation menu for Microsoft Defender for Cloud, under the *General* section, select **Overview**. + +1. The Overview blade provides a unified view into the security posture and includes multiple independent cloud security pillars such as Security posture, Regulatory compliance, Workload protections, Firewall Manager, Inventory, and Information Protection (preview). Each of these pillars also has its dedicated dashboard allowing deeper insights and actions around that vertical, providing easy access and better visibility for security professionals. + + >**Note:** The top menu bar allows you to view and filter subscriptions by selecting the Subscriptions button. In this lab, we will use only one but selecting different/additional subscriptions will adjust the interface to reflect the security posture of the selected subscriptions + +1. Click on the **What’s new** icon link – a new tab opens with the latest release notes where you can stay current on the new features, bug fixes, and more. + + >**Note:** The high-level numbers at the top menu; This view allows you to see a summary of your subscriptions, active recommendations, and security alerts alongside connected cloud accounts. + +1. From the top menu bar, select **Azure subscriptions**. This will bring you into the environment settings where you can select from the available subscriptions. + +1. Return to the **Overview** page, and review the **Security posture** tile. You can see your current *Secure score* along with the number of completed controls and recommendations. Selecting this tile will redirect you to a drill-down view across subscriptions + +1. On the **Regulatory compliance** tile, you can get insights into your compliance posture based on continuous assessment of both Azure and hybrid cloud environments. This tile shows the following standards which are Microsoft Cloud Security benchmark, and Lowest compliance regulatory standard. To view the data we first need to add Security policies. + +1. Selecting this tile will redirect you to the **Regulatory compliance** dashboard – where you can add additional standards and explore the current ones + +1. We will continue exploring *Microsoft Defender for Cloud* **Security posture** and **Regulatory compliance** in the next exercise. + +## Proceed to Exercise 2 diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Azure_Defender.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Explore_MDC.md similarity index 99% rename from Instructions/Labs/LAB_AK_05_Lab1_Ex2_Azure_Defender.md rename to Instructions/Labs/LAB_AK_05_Lab1_Ex2_Explore_MDC.md index 1ad0abc7..315f6c0e 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Azure_Defender.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Explore_MDC.md @@ -12,6 +12,8 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Defender for Cloud. You need to respond to recommendations and security alerts generated by Microsoft Defender for Cloud. +### Estimated time to complete this lab: 20 minutes + ### Task 1: Explore Regulatory Compliance In this task, you'll review Regulatory compliance configuration in Microsoft Defender for Cloud. diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md b/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md index ae04dc9c..1d99d15c 100644 --- a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md +++ b/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md @@ -12,8 +12,9 @@ lab: You are a Security Operations Analyst working at a company that is implementing Microsoft Sentinel. You are responsible for performing log data analysis to search for malicious activity, display visualizations, and perform threat hunting. To query log data, you use the Kusto Query Language (KQL). ->**Important:** This lab involves entering many KQL scripts into Microsoft Sentinel. The scripts were provided in a file at the beginning of this lab. An alternate location to download them is: https://github.com/MicrosoftLearning/SC-200T00A-Microsoft-Security-Operations-Analyst/tree/master/Allfiles +>**Important:** This lab involves entering many KQL scripts into Microsoft Sentinel. The scripts were provided in a file at the beginning of this lab. An alternate location to download them is: +### Estimated time to complete this lab: 60 minutes ### Task 1: Access the KQL testing area @@ -172,7 +173,6 @@ In this task, you will build basic KQL statements. | project-away ProcessName ``` - ### Task 3: Analyze Results in KQL with the Summarize Operator In this task, you will build KQL statements to aggregate data. **Summarize** groups the rows according to the **by** group columns, and calculates aggregations over each group. @@ -346,11 +346,10 @@ In this task, you will build multi-table KQL statements. ``` >**Important:** - The first table specified in the join is considered the Left table. The table after the **join** operator is the right table. When working with columns from the tables, the $left.Column name and $right.Column name is to distinguish which tables column are referenced. The **join** operator supports a full range of types: flouter, inner, innerunique, leftanti, leftantisemi, leftouter, leftsemi, rightanti, rightantisemi, rightouter, rightsemi. + The first table specified in the join is considered the Left table. The table after the **join** operator is the right table. When working with columns from the tables, the $left.Column name and $right.Column name is to distinguish which tables column are referenced. The **join** operator supports a full range of types: flouter, inner, innerunique, leftanti, leftantisemi, leftouter, leftsemi, rightanti, rightantisemi, rightouter, rightsemi. 1. Change back the **Time range** to **Last 24 hours** in the Query Window. - ### Task 6: Work with string data in KQL In this task, you will work with structured and unstructured string fields with KQL statements. diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md index ecb0fe04..5a5a1059 100644 --- a/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md @@ -12,8 +12,7 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to connect log data from the many data sources in your organization. The next source of data is Windows virtual machines inside and outside of Azure, like On-Premises environments or other Public Clouds. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Connect%20Windows%20devices%20to%20Microsoft%20Sentinel%20using%20data%20connectors)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Create a Windows Virtual Machine in Azure @@ -65,7 +64,67 @@ In this task, you'll create a Windows virtual machine in Azure. 1. Select **Create**. Wait for the Resource to be created, this may take a few minutes. -### Task 2: Connect an Azure Windows virtual machine +### Task 2: Install Azure Arc on an On-Premises Server + +In this task, you install Azure Arc on an on-premises server to make onboarding easier. + +>**Important:** The next steps are done in a different machine than the one you were previously working. Look for the Virtual Machine name references. + +1. Log in to **WINServer** virtual machine as Administrator with the password: **Passw0rd!** if necessary. + +1. Open the Microsoft Edge browser and navigate to the Azure portal at . + +1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. + +1. In the **Enter password** dialog box, copy, and paste in the **Tenant Password** provided by your lab hosting provider and then select **Sign in**. + +1. In the Search bar of the Azure portal, type *Arc*, then select **Azure Arc**. + +1. In the navigation pane under **Azure Arc resources** select **Machines** + +1. Select **+ Add/Create**, then select **Add a machine**. + +1. Select **Generate script** from the "Add a single server" section. + +1. In the *Add a server with Azure Arc* page, select the Resource group you created earlier under *Project details*. **Hint:** *RG-Defender* + + >**Note:** If you haven't already created a resource group, open another tab and create the resource group and start over. + +1. For *Region*, select **(US) East Us** from the drop-down list. + +1. Review the *Server details* and *Connectivity method* options. Keep the default values and select **Next** to get to the Tags tab. + +1. Review the default available tags. Select **Next** to get to the Download and run script tab. + +1. Scroll down and select the **Download** button. **Hint:** if your browser blocks the download, take action in the browser to allow it. In Microsoft Edge Browser, select the ellipsis button (...) if needed and then select **Keep**. + +1. Right-click the Windows Start button and select **Windows PowerShell (Admin)**. + +1. Enter *Administrator* for "Username" and *Passw0rd!* for "Password" if you get a UAC prompt. + +1. Enter: cd C:\Users\Administrator\Downloads + + >**Important:** If you do not have this directory, most likely means that you are in the wrong machine. Go back to the beginning of Task 4 and change to WINServer and start over. + +1. Type *Set-ExecutionPolicy -ExecutionPolicy Unrestricted* and press enter. + +1. Enter **A** for Yes to All and press enter. + +1. Type *.\OnboardingScript.ps1* and press enter. + + >**Important:** If you get the error *"The term .\OnboardingScript.ps1 is not recognized..."*, make sure you are doing the steps for Task 4 in the WINServer virtual machine. Other issue might be that the name of the file changed due to multiple downloads, search for *".\OnboardingScript (1).ps1"* or other file numbers in the running directory. + +1. Enter **R** to Run once and press enter (this may take a couple minutes). + +1. The setup process opens a new Microsoft Edge browser tab to authenticate the Azure Arc agent. Select your admin account, wait for the message "Authentication complete" and then go back to the Windows PowerShell window. + +1. When the installation finishes, go back to the Azure portal page where you downloaded the script and select **Close**. Close the **Add servers with Azure Arc** to go back to the Azure Arc **Machines** page. + +1. Select **Refresh** until WINServer server name appears and the Status is *Connected*. + + >**Note:** This could take a couple of minutes. + +### Task 3: Connect an Azure Windows virtual machine In this task, you'll connect an Azure Windows virtual machine to Microsoft Sentinel. @@ -101,7 +160,7 @@ In this task, you'll connect an Azure Windows virtual machine to Microsoft Senti 1. Wait a minute and then select **Refresh** to see the new data collection rule listed. -### Task 3: Connect a non-Azure Windows Machine +### Task 4: Connect a non-Azure Windows Machine In this task, you'll add an Azure Arc connected, non-Azure Windows virtual machine to Microsoft Sentinel. diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md index c434e791..08f7892f 100644 --- a/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md @@ -12,7 +12,7 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to connect log data from the many data sources in your organization. The next source of data are Linux virtual machines using the Common Event Formatting (CEF) via Legacy Agent and Syslog connectors. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Connect%20Linux%20hosts%20to%20Microsoft%20Sentinel%20using%20data%20connectors)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. +### Estimated time to complete this lab: 30 minutes >**Important:** There are steps within the next Tasks that are done in different virtual machines. Look for the Virtual Machine name references. @@ -24,7 +24,7 @@ In this task, you will access your Microsoft Sentinel workspace. 1. Start the Microsoft Edge browser. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md index d4857a02..f50392dc 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md @@ -14,8 +14,7 @@ You are a Security Operations Analyst working at a company that implemented Micr Microsoft Sentinel allows you to create custom workbooks across your data, and also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20workbooks)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Explore workbook templates diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md index 386616ba..46f3177f 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex11_Content_Management.md @@ -10,8 +10,7 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You already created Scheduled and Microsoft Security Analytics rules. You need to centralize analytical rules in an Azure DevOps repository. Then connect Sentinel to the Azure DevOps repository and import the content. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Use%20repositories%20in%20Microsoft%20Sentinel)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Create and export an analytical rule @@ -41,7 +40,6 @@ In this task, you will enable Entity behavior analytics in Microsoft Sentinel. 1. Review the Azure Resource Manager template and the close it when done. - ### Task 2: Create our Azure DevOps environment In this task, you will create an Azure DevOps repository. @@ -52,7 +50,11 @@ In this task, you will create an Azure DevOps repository. 1. On the *Get started with Azure DevOps* page, select **Create new organization** and then select **Continue**. -1. On the *Almost done...* page, enter a name for your DevOps organization that you would not want to use in the future, like for example, your tenant prefix. **Hint:** It can be found in the Resources tab of your lab (WWLx...). + >**Note:** If this operation doesn't complete after a minute or more, **Refresh (Ctrl-R)** the browser page. + +1. On the *Almost done...* page, enter a name for your DevOps organization that you would not want to use in the future, like for example, your tenant prefix. + + >**Hint:** It can be found in the Resources tab of your lab (WWLx...). 1. *Enter characters you see*, then **Continue**. @@ -68,7 +70,7 @@ In this task, you will create an Azure DevOps repository. 1. Select **Upload Files**. -1. Select **Browse** and select the file **Azure_Sentinel_analytic_rule.json** from your *Downloads* directory. +1. Select **Browse** and select the file **Azure_Sentinel_analytic_rule.json** from your *Downloads* directory, and select **Open**. 1. Select **Commit**. @@ -113,5 +115,4 @@ In this task, you will create an Azure DevOps repository. >**Note:** The *Failed* status is due to limitations in the hosted lab environment. You would normally see *Succeeded*. Then you can see in the *Analytics* the imported rule *Rule from Azure DevOps*. - ## You have completed the lab. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md index 46a05d92..86ce4a95 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md @@ -12,10 +12,7 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to detect and mitigate threats using Microsoft Sentinel. First, you need to filter the alerts coming from Defender for Cloud into Microsoft Sentinel, by Severity. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Modify%20a%20Microsoft%20Security%20rule)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - ->**Important:** If you completed the previous lab *Learning Path 6 - Lab 1 - Exercise 4 - Connect Defender XDR to Microsoft Sentinel using data connectors*, you can skip this lab and proceed to the next exercise. - +### Estimated time to complete this lab: 10 minutes ### Task 1: Activate a Microsoft Security Rule @@ -23,7 +20,7 @@ In this task, you will activate a Microsoft Security rule. 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Microsoft Edge browser, navigate to the Azure portal at (https://portal.azure.com). +1. In the Microsoft Edge browser, navigate to the Azure portal at (). 1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md index 19a83ee0..f73713ab 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md @@ -14,7 +14,7 @@ You're a Security Operations Analyst working at a company that implemented Micro Analytics rules search for specific events or sets of events across your environment, alert you when certain event thresholds or conditions are reached, generate incidents for your SOC to triage and investigate, and respond to threats with automated tracking and reMediation processes. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20a%20scheduled%20query)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. +### Estimated time to complete this lab: 30 minutes ### Task 1: Create a Scheduled Query diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md index 8b578a87..64632ddb 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md @@ -8,12 +8,11 @@ lab: ## Lab scenario -You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You already created Scheduled and Microsoft Security Analytics rules. - +You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You already created Scheduled and Microsoft Security Analytics rules. You need to configure Microsoft Sentinel to perform Entity Behavior Analytics to discover anomalies and provide entity analytic pages. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Explore%20entity%20behavior%20analytics)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. +### Estimated time to complete this lab: 15 minutes ### Task 1: Explore Entity Behavior @@ -21,7 +20,7 @@ In this task, you will explore Entity behavior analytics in Microsoft Sentinel. 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md index 075c6327..9ca48ee1 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md @@ -6,13 +6,17 @@ lab: # Learning Path 9 - Lab 1 - Exercise 5 - Understand Detection Modeling +## Lab scenario + ![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod7_L1_Ex5.png) + +### Estimated time to complete this lab: 30 minutes + ### Task 1: Understand the Attacks >**Important: You will perform no actions in this exercise.** These instructions are only an explanation of the attacks you will perform in the next exercise. Please carefully read this page. -The attack patterns are based on an open-source project: https://github.com/redcanaryco/atomic-red-team - +The attack patterns are based on an open-source project: #### Attack 1 - Persistence with Registry Key Add @@ -32,7 +36,7 @@ net user theusernametoadd ThePassword1! net localgroup administrators theusernametoadd /add ``` -#### Attack 3 - DNS / C2 +#### Attack 3 - DNS / C2 Attacker will send a large volume of DNS queries to a command and control (C2) server. The intent is to trigger threshold-based detection on the number of DNS queries either from a single source system or to a single target domain. @@ -84,7 +88,6 @@ The attack-detect configuration cycle used in this lab represents all data sourc To build a detection, you first start with building a KQL statement. Since you will attack a host, you will have representative data to start building the KQL statement. - After you have the KQL statement, you create the Analytical Rule. Once the rule triggers and creates the alerts and incidents, you then investigate to decide if you are providing fields that help Security Operations Analysts in their investigation. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md index bbf92d4b..9940261a 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md @@ -12,9 +12,7 @@ lab: You are going to simulate the attacks that you will later use to detect and investigate in Microsoft Sentinel. - ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Perform%20simulated%20attacks)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Persistence Attack with Registry Key Add diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md index 28c82339..c043349a 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md @@ -14,9 +14,7 @@ You are a Security Operations Analyst working at a company that implemented Micr Analytics rules search for specific events or sets of events across your environment, alert you when certain event thresholds or conditions are reached, generate incidents for your SOC to triage and investigate, and respond to threats with automated tracking and reMediation processes. - ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20detections)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Persistence Attack Detection diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md index 54c2374e..f5fcaaa0 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md @@ -14,8 +14,7 @@ You are a Security Operations Analyst working at a company that implemented Micr An incident can include multiple alerts. It is an aggregation of all the relevant evidence for a specific investigation. The properties related to the alerts, such as severity and status, are set at the incident level. After you let Microsoft Sentinel know what kinds of threats you are looking for and how to find them, you can monitor detected threats by investigating incidents. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Investigate%20incidents)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Investigate an incident diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md index 4c53a566..9d6e746b 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md @@ -12,7 +12,7 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You need to model ASIM parsers for a specific Windows registry event. These parsers will be finalized at a later time following the [Advanced Security Information Model (ASIM) Registry Event normalization schema reference](https://docs.microsoft.com/en-us/azure/sentinel/registry-event-normalization-schema). ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Create%20Advanced%20Security%20Information%20Model%20Parsers)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. +### Estimated time to complete this lab: 30 minutes ### Task 1: Deploy the Registry Schema ASIM parsers @@ -70,4 +70,4 @@ In this task, you'll review the Registry Schema parsers that are included with t 1. **Run** the ASIM function query. If you've completed the previous lab exercises you should see results and noerror messages. -## Proceed to Exercise 10 \ No newline at end of file +## Proceed to Exercise 10 diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md index 50eee683..055ec778 100644 --- a/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md +++ b/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md @@ -16,8 +16,7 @@ You are a Security Operations Analyst working at a company that implemented Micr >**Note:** Because you already experienced the process of exploring data in a previous module, this lab provides a KQL statement to start with. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Perform%20threat%20hunting%20in%20Microsoft%20Sentinel)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. - +### Estimated time to complete this lab: 30 minutes ### Task 1: Create a hunting query diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md index 51d54ad2..4cf1e067 100644 --- a/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md +++ b/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md @@ -14,7 +14,7 @@ You're a Security Operations Analyst working at a company that implemented Micro - Create data visualizations that aren't provided out-of-the-box in Microsoft Sentinel, such as custom timelines and process trees. - Integrate data sources outside of Microsoft Sentinel, such as an on-premises data set. ->**Note:** An **[interactive lab simulation](https://mslabs.cloudguides.com/guides/SC-200%20Lab%20Simulation%20-%20Hunt%20for%20threats%20using%20notebooks%20in%20Microsoft%20Sentinel)** is available that allows you to click through this lab at your own pace. You may find slight differences between the interactive simulation and the hosted lab, but the core concepts and ideas being demonstrated are the same. +### Estimated time to complete this lab: 30 minutes ### Task 1: Explore Notebooks @@ -22,7 +22,7 @@ In this task, you'll explore using notebooks in Microsoft Sentinel. 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Microsoft Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Microsoft Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. @@ -55,7 +55,7 @@ In this task, you'll explore using notebooks in Microsoft Sentinel. 1. Select **Notebooks** again and then select the **Templates** tab from the middle command bar. -1. Select **A Getting Started Guide for Microsoft Sentinel ML Notebooks**. +1. Select **A Getting Started Guide for Microsoft Sentinel ML Notebooks**. 1. On the right pane, scroll down and select **Create from template** button. Review the default options and then select **Save**. @@ -63,7 +63,7 @@ In this task, you'll explore using notebooks in Microsoft Sentinel. 1. Select **Close** if an informational window appears in the Microsoft Azure Machine Learning studio. -1. In the command bar, to the right of the **Compute:** selector, select the **+** symbol to create a new compute instance. **Hint:** It might be hidden inside the ellipsis icon **(...)**. +1. In the command bar, to the right of the **Compute:** selector, select the **+** symbol to *Create Azure ML compute* instance. **Hint:** It might be hidden inside the ellipsis icon **(...)**. >**Note:** You can have more screen space by hiding the Azure ML Studio left blade by selecting the *Hamburger menu* (3 horizontal lines on the top left), as well as by collapsing the Notebooks Files by selecting the **<<** icon. @@ -85,9 +85,9 @@ In this task, you'll explore using notebooks in Microsoft Sentinel. 1. Run the *Python code* to initialize the cell by selecting the **Run cell** button (Play icon) to the left of the code. -1. It should take approximately 15 seconds to run. Once it's done, review the output messages and disregard any warnings about the Python kernel version. The code ran successfully if *msticpyconfig.yaml* was created in the *utils* folder in the *file explorer* pane on the left. +1. It should take approximately 15 seconds to run. Once it's done, review the output messages and disregard any warnings about the Python kernel version. The code ran successfully if *msticpyconfig.yaml* was created in the *utils* folder in the *file explorer* pane on the left. It may take another 30 seconds for the file to appear. - >**Hint:** You can clear the output messages by using *square with an x* icon above the code cell. + >**Hint:** You can clear the output messages by selecting the ellipsis (...) on the left of the code window for the *Output menu* and selecting the *Clear output* (square with an x*) icon. 1. Select the **msticpyconfig.yaml** file in the *file explorer* pane on the left to review the contents of the file and then close it. diff --git a/Instructions/Media/add-plugin-button.png b/Instructions/Media/add-plugin-button.png new file mode 100644 index 0000000000000000000000000000000000000000..a77a87007ba8eb08e839827a8176d2fcacb09081 GIT binary patch literal 1930 zcmV;52X**~P)000^Y1^@s6|D2(?00001b5ch_0Itp) z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TL-_iY#v*U$k0Uq_ep_$_=F`A75WI3ooq} zi_NpxX%VtiDay0E*&55xYPCXVw_3};wrEir!gF|0uuy9NnPb-tIplzzF@yy%X$4BKuKi7x#iu}~z>8U)cGcb@O zEM2q!fdK&s2?@pv1Nx&!kM1bEd+9>Wbn!w=pZX>a96TgrG@`ot9%j5XT{dSS@{b%rLxWB6jHi-#GI5u=aho@+ht8nK ziIb;9nL0%r=hFz}Gfy%8%QdWBy$YUQ2An?qr{pGTkqV)WFdxSabc7>W276zZXpuoZ zJtbVmq!LUfGrrxn9d)&}Dw+Mi9zs}HPc^UxCd}O*J#r)(gosh2MqqDVo+7qizrF~O z1;ob0h+0EbY9}e=uz0R^*dx{ zWS~I2F4kzoy0vSNn3yQUB%rjc3>B4?`0|T2NKZ>eN^%lvYwNIY{{c~BjSv-wuQzSL zpn(I$0@5*g(ga+%coAt5d$+0zbF*g4LUky+bqm|R*`f%TF>NYdAOD)f55Sz+vrurU z5L2g2MrCCcMvWMOWlI(#UPzlYa|Q|vFQcfqSj6CI&%7Ou%5wQM> zgK0D0!JgcG5B$Xj50&)yKm3S=OW%W^Y+6ckvMNc&a4tTxRG9+_Pkk;0@2~g-Yrk5r z-cgnGL4#C>UP||J(G{%BUZvs_M9D12uHX_`G~7GlQ#*2YVdpPT;#~l z$Bv&sHz}nyYkLWD^02Tl4A0CInU|;%zH##=UK%zG-9x*p#N%RP5iX~!PW*`qal+>27FAj_M#_?Yz((U$JIsvipw}>Ymhid_8?pSu zkFak2MtReQbLY>gq*rIJ6ymy}q@)Z#@7SppxjOrE#6%mFFIm;^s%o9elg5o3i;q`) zfRm?w$MF*<<+@|W&5}~=&CSD*!2>aWZWd~4Ymk5Rn5Z)s^RnisZ( zRi~rm6fCME=$pKbWM&LeY8*anDEgYa+$1XSR40}q^bz2D=1bC9f+UIgX&d7zo|vqs4JQ6L zi?#7-BlU4f(%?*%gA^XUTTdI0yI_X%nPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!T<{AF-b&0R5(w~l1om6KoEw19s*(@F~*e>F5s*ouY%;`OekvMh1E zTw=R@#mD;_RL$siexNq1BFDqy6RsAE_OgIQ#O002ovPDHLkV1g`Xs`CH< literal 0 HcmV?d00001 diff --git a/Instructions/Media/check-mark-icon.png b/Instructions/Media/check-mark-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..a6f977670e5e971f8d6f9e4a33ac718237429373 GIT binary patch literal 439 zcmV;o0Z9IdP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TJf^h(IY4x!b^yF z012^r9Bm~#i^Z;M5@Np0j04)n))czZ9}F{Z-tc4Ky;oY_&{8Z2j_nKK56QwXq^rc@ z@609heIKf-;_zS}@0oCt!ZO$MplKS8S}nW`2JCj6oGgxGBuT=ePrOW2->kzl40P`A z@bK7$D2gomMNXzD3V5EUQiAKc&~+UrrUAQii*D};a=A=%lZ?rNAi#FB0kdr&iXx0g zZ)i5QaBQ|=**1EaXjzuo>pZ-&x^}_N;5ZJ?{XX_~c2TWWAqoN&-B=bC$umTR+&Gc4 z3z_8n>=d<3czJaV$8mlY5q_LaBCM=bAW2Jj9S*ZyVwu@Y9duHFG)?I*i!!y(NJZxn h5eheL5&ne?_yBZ|WJ{W{7cc+-002ovPDHLkV1j)gu(kjI literal 0 HcmV?d00001 diff --git a/Instructions/Media/create-promptbook-icon.png b/Instructions/Media/create-promptbook-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..f0e6eb56889d6b7e70f1215ac778e108d9ce7f07 GIT binary patch literal 1087 zcmV-F1i<@=P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TNny3g9jq+4Gv=P-XM0Dm!lxR0AIg+U63CbimHQ^=ZP(!Er^U2L13fLEy+uQN<*;6z&HVN0y1`<#UB8Q1IHZ@`B;gHBx3PmJ9KATT2tJMmXD>CWa z+Rg?sm}@E~P+U}m=B7r($FK6<_2A0Y4xBh~5)Ox5RuyGR%mIhPfyBf_G&Ecg1e`7j ztrstmcb<#!gOwGisyZZEzSvG5P+T1n?Kd|d4xZR9&y#tM?YAnOSx;G{R%zi%({@^VEb`1@<93R*BRF(Gnt^YRcK9gPMm;hdaoY$_~7 zL_~xzCLd~Y-jpTbCizw5OdCyR8W@0|pC6I%huLh#^5x4!&W6nOA_i{V#^#a|iehp9 z(eM+Defl(SZ}|zeE-3i4_xEpLFF5Esg1ey6Sctf|I2dRP_y8-R#Z0CFK`1>f4Q}#Y z79Dg62?+?KL+=}%sz;9<$Lm+GWlvMt?+M-xHe(tsv_`N0)h}3);o--aocxUXx;m7V z?Lbga5G2~V_oPyN{TWiuBwj$SSIClJFcB_Er_<@Z;{h+gW4y#lG9mkbzrgrxu~;mE zl#*tph=d%tT{A%@#Nd;3A#Hn6Nc=7SxMMCR{*&+k_yJ03pJfN-Yf=CJ002ovPDHLk FV1mN$;dTH3 literal 0 HcmV?d00001 diff --git a/Instructions/Media/edit-icon.png b/Instructions/Media/edit-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..bf90bdbd17472d18620f52e596f5ff4a25192357 GIT binary patch literal 575 zcmV-F0>J%=P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!Tn+b!AV3xR7gwhl*vlNP#A?z+ay&AR;YI6(7h|ComdbQpFnUUB1NrjEg~*N zDGm$YLD4z{MR(FteG;b!P+GBC?3hm8{~82IqAlo3zfBTu^5xunZer@{?yuq(FssKO z=MRXhtdUBkqFxzOm$+OmLs1I+Tu~H$G@@p4u~>xJY{t~&1hzKU(bwC9LgD=-dekIV znABpiU_G=7r_+h;-93zs48!H>WXX%_U7z_@Oi3kCL@?mPQ!26l)3 zXYi$%(uhpDFdsl7@rcmc2BH_22(2vR>iQNpw|9J84?{5}6-5C-{~Ycg9X%C;p$>|xFQkh2Rj?h*b z9~(pR`I!|JewWU8kj`XrAj^;>iI@2m8Zo7HI2>qhvg1fT=F8#t&LWq~VgFF(YxYkb+oskrPYDKfdMQnF5oqtMwm$@sWvI05!1S5S-O{0il>c4V~~$eAhI>BRZ3|7 z$JBDER6;(V|7e}2Z`8gKn#5K1m!V`fn~j%7Mb#@Mba%y1@Gn*Y-T;rsnIYz91fBo@ N002ovPDHLkV1gY*_IdyS literal 0 HcmV?d00001 diff --git a/Instructions/Media/home-menu-icon.png b/Instructions/Media/home-menu-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..14936c3cc34a1af3d659bf85c8cb32ee3474b44d GIT binary patch literal 411 zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`jKx9jP7LeL$-D$|SkfJR9T^xl z_H+M9WCij$3p^r=85sBufiR<}hF1enkiEpy*OmPRtGI}yF^`bIZlD>mo-U3d7XC+r zz4Mw41Zs~pELb{UR9bJsCQp4qz6;-~Vp_fkt(;=U?qU8WNU`z2gDRN~9!|SF#A>HK zJ%46Tj4-{F>;$$-8?7RsoopmRYCoOEzIlbX#jpo*K|LPPJ z+BfMa?hcba*BB|Y@BM5RWmcv@k;H#C*NPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TV?Me%`}CR+Uq!78{C677?{p5cCI>k`^@)i@0iaV;7PpSZQVgm3C(G^xiK?HKql@1H+x~n|sfkd+wFu zM^7~IpYXL~7aENQJg)-Bb+O|(B6^jIxZevsN-C7x7YHDkIE#2JhW`Eou+Mge1!<56d{8N+C`Ya2yxw)Y`MzIf@0iL@+*nM3|q=<;3K; zj^Q5|9Gd1AX3bNwO1)mbloq~}EDIJr!Qeq$yfBHYSEew(kU?f~Nqp}p=~}irna9$T zi3BFkrG(j1YnEc|m)^Xkt*RBU0+=~~dxD8(1DK0JU4DRku(ZSul6ff@XZpGc9zyQVl^!xt*oU3yY z*=y~U?2BY4dGkc7D9NCs5TgJ90Q4`il4<||O!2=y6B6RTns?&`@~?q$QIin|R8Ntf z{4?M!#1zEi$oG@oo;h0|3~XzDSCF^)xuo0UBu>v<`2D zo?#)uz{0~CD~qXMDR^P-Xa_jq+OBXH%IkGl|r_lQo_vqu4*KmE_k>8dCBzhZCA*{skr-7TJBrjRmNmJ2G|Nl7{VXrX^4Gy&Y`O{ZH{BiC# z$)*o4cjra&>R94P%74ee-tD3K)Rgq1T3J!XoIQ6O|6?-ySxkGud1c1Y`eQ+RE!?#fBdj0F&M?e@&2cW{C~Yj zagaX#Psn^USf7jkCw5s1S6M^KOO)8KOCeH2?VjiOcS>KB@PXn#e@OIRt81!@ zIXx^LDF{2{W13RBZren>1z!vdw2$O&%PMRfW1e5TgD=feF>f}=Be2C@-7BpB=$pB9 z`a|owF?p&^wjK<>9gPhHfFrM9117?Q-=I;)*nfT40g4n7is!6*y z8jGu>m?dRyBa|H2TSkiu(N3EOHF)XQL7CmNn#94ui@&{w>87R2gdR`(o6s}dIz49-x+L78eorACQc^GW%%7(yvzWjsKI_>M zHb*{TL&rsUyU{PT)gID?rz~WjXa|T5#~DwBhVfeO$I-w}DjMbOMmkL-0xcC4i(BC+ z#3yTuA+_wK#hCceW=1%%Vi485a!J}qT3VB#wB%+B5eyDF{_9Q60MY+(jyqWW_?e2nqk3k$S! zP(VKfZ4RIxa6E*}+NECkyiuul|64apuYBm`o#n3$#zei2s&VGwOALeG`p6mAQkgm= ztKGBx`T1FQ;_@rK&H#n@mZ#qmG0~xaE(tS&$iYtqUgq|CernhJa__XYUyXg8oks0h z_m4_@%5rm?9Rl%2n}oj;h?nx-+=8R$JKnC@n7EE$(+CMpr7;y;j&j$h?HDSZF*`eY zEq|}J%D|~oVfD2RjKP4G79$951WdFvJ<88yn;YO`3N~M_E>71E&%gbU2d<_XjT2ta z*m^F@OSeUzF7g{RL^}z9m+-4uoof6V7OFPCLKAUJ745rZ!&^nf;^j1M90<@{wgj8v zbep;+^j+@7UDS{h!!vc*`YmD^6qhsLg0_2?hsc16T`zq~PLUGs3k#Cf4GRYg?c}vF0?fZuT=vIhal!$#KV(x&Q%QX?MF-7TVf4O zLgeeXzCXB;Hn-NP4Kf&q^gZsd?)8bbVG1#ayfzMvyKT%`7IQ=>5=SmjyPxMZ ztFaWTtno-SQxK>tC2B|$UfxA<*I4Vk>389aRI1Glu|{nnFAD4BGx2QGr=B$EDwwFM zm9?8bE@|nQQcRiC^M3-6&^;KPDBn1%zdugd75NX98U<~v5FAr_IdHT?5 zp&Z_)KC7Sl_M0d!UZ36PeI1CUL!R^bhw_zf7B&>eLNSwyM$$Qc-P96v4xWk=HN$i! z9{d8XaB^Pg@A^M4={1{}wsK_SEV><`xzmwt_D|w&q*k&xIa!ByWf8N!8jW;S8SOk> zpd|zklf1tll`TLcdH=3&9pblW3a{?sAL3_S3)mVFcr53$+Hcm0YijA(%vxgkOu)6y zHvZU8>fXk!gJB^er)@SGjXo67sm_&h1`!QdTXF+dR0DQ$^fVCsJ#SA^$9S z%4YXuT46`JX5Y4qsn5(<4`KW8;78Gh>OlVrzmX{IFIUci##6raOQA7TZJ)Hie((H3Y5SE~IZI z*1z2rF>T;FM1^12yF2)|O&;?2YqgQE>Fd$>t+q7I-E4$Q_Kq2hgs?St*>eH+!ymIM zPwDQ$t`Hs(T~}76g$s|yYxGJ#Lic>ytI6NodiZA0!SE_DTD1l1otJOs_bYP294k0N z_4UO=`|nZnF0RViKK4poDR(7^i)7A3MNKdMg}wJ(A2-utWvGwi?|w(IA<+ZT2!GQp zAh9c=h|!D=yy~$0%6rN`lQdxXQhT>fHX}GUzpMYFkT?_`Xq4vGshj4xq)#4-Ykrfs zoiO`Rq`Dodd`W8T>H`~$VEinvtvvIfH1nElY#Dx$S=2~pbdzLx{n<$mbBRf46tA$% zUk9#s(LYtriNR3sb5ZwcCb7fVNgN#Qq*@+9P9}@7W3}W|8Mb>I1k!c9Njtm9>nPnj zdzQFfhZsyrTm~?0dvN+aV$aILJ#`%B^7mOh!IMnq6Rm3-;1oqkIpE?H^h6CsH&rl5(R=TZ*II`0Db zIDPge0W8>)?<8`)e|{%~hkkgY)W~5qT%>t!!^o`lh(W;g zYnLEl6&I#I#z`8Z&MlV?$RGRC&U9GP)V*DPZWR{07`uAa^~ddJGKR zgb2;}$*E_E2uHA!+`a4m0t!$=r+s8Vw2Z|Ajr_R5v90rAlq-mE%EF$@j?> z$IlbLRY2)8#6Y?x2c&VF%OcZOU%a?+eWr6i8zqi<+2XPCq~`HlsmB|joe<-(swy-| zpCwps=vpN19F0LL1nM7)g(rjL-Tp+%BI)In7C2$%L3nmf6ov!a9LHVwUebSFk#I(0 zK~@PCC8$N7hurFV%Ue~!T(A`gI6_z#|N79My zE`voQoF$W^l}{Yt#WPw7h7zfSpLBAc9aoep3_)M;(m>%Zm?-Qq@;RUzoGy2U?GOpLAQhm1Yr{Qzi%|v&&)nlybpj%AGtamWv9~) zD*WO>{T)YOchKI_q7?Jm01w|Rn{bw5vERbfox8WGu`f*nHwpD}kEzn+AW*3sx$zl; zu*Xg_mKR{e?R6ftazksEc!*;-@I=}@L)EUp_t(I*){;|s1+4-$X-uFu^vi4UP1&bx z$-%XMJHy8F&$;4Zz7>#Gz)p>gguq5eHyQiw)JsA?75*xYtW*LpqIz-q9p0=axR`lFdfV$LOtJRcU&|S`Oz#DdoxbTfgym$ zvH5ajX7499NOtN@2wRtsG4^xnb3x7Md7}p#=qRvoo|W@2I<2caMyT_bL~z0#vZ%qgq08k{FZ@<2hl!fPwyB&d;n{Y&t#vT1%!3j> zVh)F;3r#8Ji)oIhy4f|YkukKp#Ws|v*^mKFD_$3Tz5@twTcB_L+`ay)vVuH?O-+ZB zp)O=C*>>x;+*6%!if&%HGrTvqfHO<-y)Wo}_<%ZvlC~Z1p&U`G9rhxiYyS1{>f0v* zf7h5IQS)g*;qjXc<|&V!<6FghHf|z>uSQydrNk2a*&O*KY*uKO8O+gMPdBZ{$+l+I z+G83^5#+Vda0?6`p!;~p_y&`A7y$kaaPw4*EVN$J#XDxlQtqz#cF395U9Z+g`#K17 zJmlQyb(RioGU(Fl$gNVq0Ya4WnQZa+)nAR{IhIG3>d;G|y=grEE_nDvhVcl(C58G; zpxbEWk49#FU-|jzVXL$)d=+?Dd2819vd&POj!Vb*tgcJn+kZ2%U-qufbs*nVi&#W} za@9O4EERr*+bW5G=3lqh>VS1=kOP?`j7HE~o}s}7G(MzLg{$r1_Zzgo{Du;6X{{T?>5lXTH6+os1AXZZ~eTIKesVhk2=1 za!;q6#$GC}S*krL07nZwg{iL|BE&{)1~H6Z-o<Fz5%PosB+^P*~2#8ncpdTC#+N3c1Y;TL%9_M80N^iF5 zd?Fj2s_iQMn3u5oa8nQfVVkA6XVcO@;~8tc5}XRFW!1cio@Jd0N3em=EEiLl3=XN? zKepi{#T?@xxc2;v!B&Q`aZVOX;)t>~d?z}N#w2=ccgE@V@-1mM6qF3&0MiRjA!TF= zewO&FZ5uRX$Q=NA^Een_mzJyr3j&^!TEzp9&NuR1n1vEtq|zH@-BCT ztm7=F3!_YM>-SRJv}%bR#7&c%?@19{H)|4agcy<9;!&kjkmQfeFi~qiY1k-Xe(e91 zNV#z*S?yz$3tJ?sBH81b;=1>Yg5;PO@BtJ0x<<@&9g||aogar4;HMjAy9@DWZ51+g zW{W8u6QX+V3kMKoJZF> zo@>Tsv_~NOD(2Z!DuKv$ zwPRTOkP;>Sd%Eu< zlm+=y8Q%fMpSx@Bw@^>-oqC5JTQmYw%JJofD!EvvkmPBmI9j@)wq^obPU4B=Ub50- zV(Pcl>K*!HkFIQZ*P(pzI4fsCNhdac6(bwOOL)55=yB=Q+qJw2HxJ=Xof~@B3+8ou z#JvY6q4gc>tj8izh)t-a=m65B;geCtVaK|Axs!-A5iu13VQkiil&*KLg2OKLsJ4x< zd~mMqPYS95NIt11)40+Sq5n%bEj}%)p`rN-o=xB|1L&OL=%r{`;&@XKh`#VYiwVSa-qCuqoPaq+vXs&)q{7fdZa{6aB)#3> zfxYF{l=)fY*Mvr|!X?t#yi=LDKjs)%D|FF4k3FZ<;U1j1lQ=N}k0U6&n%9RCM!a6G zyu8+;1kKg?>nz%uKi;y<`v2wi5;=?!`)yi6`cCnHcx7D)wP#37{@xI3nD*D#o@lZd zA~;hYk6HJmprV6c=}Q)^gP-L8i5rTDmFqbiWzGCvo{tdF-3L(c40}s;&z4?*_FqnC zQH!;bhvN#b!d~YjR30u@O%0E|@BMZ~NGtbMaaI4adlp#lGV?EJDlz73-s<7UIN@V7 z7}OG}ucFn-4u{(3;SSjQR?mqa*tr4*VtBN3{B;N;6jQr~T|%-?Ya7Ao0q^r_d)L51 zh7J;@97_7iax3=M5^`6_9}F9x2E)QiB-3e+pNVAMU2bIfJ@RXwaeBt`uQ$EnvbQ-10%r#J z(j2ygYq33XV5paUBS)@mI1b6cAU^;v@ibWptFK7fm2;T?G)Gac#>NgE#R85xFROkf z_v5m_0&UcGB0n5r-qwY`dknHpFkZ+lkn|2@CJ&GX1-xf8!44MSJvIzAYGfQ(;rfgp zyK^20e8cenW{`o*Y?gogefBU=l)Qw8@U)P7(EO*0^`ZQ}yb550z9jxTrSHtV0~wv$ z@O*2ks$*fyW30+ySib3Yu0P$@Q(#y!#Btx2B`oass#TJd5#)2C8UlxW~hWWQ`$+apBaFEUEIj@Sq>j!wDDso8G4` z5JJ6uhC^PcPzQ5--&o|6q1tqdV>1hf5qv(oP>Ad@>{+#}wY&M?ndK*Re2a!Q!mVi`$6^!v4WEaD`7@%cs95-&a$|QIV_iQMZ5d|v zCzqaMoGZOjg}bDb@1H`&RH(pJfX@ZLxyA|^rt1bXZbVq>e!%9ln6*zv(eD6zVM1s> z`zTLg62CrsNo-8Bk?eHwl%+{Q;8~V7I!87h6{_h73i(m*1Ce}WoT?bu^hHgwiD;=n zqIfx?fK3z6mpPKx{6OE9&{|N@iQhR9gZj+KcR#=*C}ay!)KF9snf}Uzi^wNlBg?Ef zpAtsm2bGLqbB#kMV6v@+t(S1np;2-EuV4{uON^ct26< zn{>43s;gu_?;mvKn98}CKb+=WZ!WGl>GCjN_Bpxwj%ZO*J8t=vd0MlK0B|k(AX%bB zMT*&LNnxuvh48$|APR_uMQ4t~HxiK2q6zZfeDV*(W97*~^-}7K} zfQP3+v=Q=IG%^C=aS(*WmuLw$c@MUmKqnTj=>lN{Dx&hW82v_wp$|&==4FHU`)oAy z^U0HGjh&-%SIQCNC=y;w-IV82qv?j-7Wuh3>Bbr))8fG_kUDDO&X6t>UdHUc3=@Rv zuPlFy-+s?a7=48Hc}4K9u|l?=-Mc<8)_4~k8$2tvs=4F|I_|eLoAx}#TnvA0A~9zl zNE)iX#mxYp!_9<~hc==R(8Q2;`f~?pC%2B7AQfV&GwzDx|P~ z(qUcqDA|Z}$nLNbZvYx(c!;74Xa++arRrd1$>$9w2de6*I%wb9DOWl#ZFVjP*II0@ zfPM3mZzWb(ZUVV8?Q=RmT5r9Z$3E{(^iRebPeYUS+n-mRpqG@JPUvTtH(xYV`@xK`BvgPB4e(;{ygLe&D+)Iu~M1O&f>Um7+N3T0r9JDPRfElJKADA)Ji-zdE_AU`kCGPzqNxbyNW*fh&}Rki-*muYth?a737L^=CwQOi0D3xWxSs66B@nW3+2lTS7|ZXeROY@ zjQk;#kC3;8Px`03Q^&+M!AD1=NrOr*l~AI%LI|rPoP*0v*+x_)C}GfZZ{Q)PCoZZV zDDS@fL?kfo=vk?Fmr%5C8-H<@t7bmjJ@jfozUUlKGtEY3aA@ysRQBv@R(rb> zH@(k8tY^BJ87ERIf$T5(5C&`b(5s}Y3wx4k8JngkUOD)@5OueU>LS~eI>SAy&n2{$ zoV2v0=domRf5~*Z!E}wfE`N=(-nUNG&a3nADhgx%czGdKt7!EZK!u%|4-cRh!(!F@Zg5*-il)P%@2GA3y3(s1C0fjwQ8mWo(O+DXOvQf~40oh8Hia|ES(tP# zHJpnPh%B1@Lzvk!(coz0C;D-c^~FyUc{W&h+~wn*J|b?7ZWbfR4EX{G0*KR7KmGVy z@=;sm@E4uiN^GFNBfA%9D*3Ax(AWdp%?3g&9&K!DF&4nYa`cS}f*Qm}C~D3gbwmp=S*MwJ(%>A$+K;4TUV?`1I=l6W4P^&h)V1ZtjV-5aDe~!q%8gB03dWy=Zc#Mpf-D!RfktGMi-PayxPxs142Z{kvsH79VKC zGh{;osI>$>C(Q&A2xo7B!>|4wC8kH8U%k|nz@($L8aRqp;oZoeoK|g<0d0OFM$J{< zv%X;qoUZX7e$~?1J7m7$;r-QqaXhqK=kl%?rLg5-K_?YNc zNs7#A|E|PCuYY88Z9@=Wzl|19&}C~`*f2|T1X->Y7aD_kx_>*9|v(&!ryR=>b zL+4&TzTczEh>S+!fy4~;`Mn+jr%y`^4qJm_FtvihA6YVu`7 zv^qBV4*i`(qLoi^XBcL1a0g9IfmbFr{HsA%!wLQU%tavtMoE*-WT%Y!be4zT^d{2u z3*In(6UkT*v*nA7V}VO-DMh|4ZL88h6Z6Yb*8yTaMb#v@W3v^@yg0n(q{^Dpt zDrElX%`@p82^RO=2sDr08-Mq}XqF$g`rnaj0y-u`5mbjBu7l;!u>3yK9=r{4bZ!iC zK4npgsdyQ#k>uGoOX$&~Abyw7gPfLNc5>27vRWe2EnyQ*^*iQtS%w_b@pezBnK!As zkOftu7rk_HI!{=t)A?yZLL65MauuPg2-*t z+Ua{XuooVvYnVDGAu{GU6Yhg;;7$h8fd3$&5Fg}-!_4jgJ?NOhGt=t$@UgA#%Wk#B z5~1N}C?T9G`F)Zd)?=OSN$5YBs08HuyUdHJmxSD*(JTH-rD`gdYF!VH&QuX(M2Yh| ztQ4!E z%gI)9{0bSH4oG-a&j@`@7L`q#Jbk&Q9-l5V+h8UR5mV_H39pGn^lruLhduh*2`q=yftR2{s zRk8CCF^*5X_q(z4}StzF+q4{d=2r-H_ z?>jsIxgd5id@+m{G7*{$PsPSvUj+7JnXV!6??~D`U0Tv5tq_eSZmDw@-#`z-sEHW& z5W6GztcJ+WU7s$hq_D%wSVlP4@O#L|obO#T(Q~xdqy;_bL{H;qG4?ywi*Y*Lwpasi zUajT1GDs2m^eigsW^;rmmht}1iFt{H&o86)DuPPJ>WqbzPQ#q7?$rprN5wqA{+~Zh z;rUynpOi)s#hnb0isFnr_f8fL@mk_!fl|Sj^i)8orv;ugZdeBAj3>K4J-RkAki85O zF83d00md>JQ=+HA=9Io1#6(^11QkopA<i&F;n1+JM$EJEg72&JM*RiRe^WZk?dUsyGs1 zwf*rkZ0&x0r&s$~UW=gnq(~fD$M^&!?;y*;^cQ|7%qb5s`^ekT0v(VpJR$#fAk|Uh z&+a5M&*{N*Y?`c{S6zB~x@(TVj{=MvxHS%S5>13`c(4Yh%mn3_unCcEX+06b5f3Z0 zw?GDN2Y{$CVDGRJ!#SMPS(JD$wvrv*znbZ116+m%Su!rz)^<<|CPR}eo-R2LL<))y zGK=Q%Q%N1jzy)_Q%6KnvR|rRSra#3 z13%&%X?W6p2!q=TwKp>2V;*NR@dS{ud(@FVC`-oWVufO%Q7nyo8cIR|#(tkbfm4h` zCX+CI5X*za9Ot-*F>m5-)W0F56Zky>jbH0kCFiecqUjOtAB=?2(K&eR>x^zp%?w&+ z5oQp*FUT7PcKR(yc{6ab^7+CMrgu2cXGIQv32!8^^zY_rvUhH6oReKbTp^w3aN!|J z>bVl7vp)YM{?|4L&k@nme!YHHK-1v7DTY8j{upcb9!tNn=3T1!XMF4rN--u0-7T{txG1XNfFS2=I1n&*UCR`sapAo}W`33WqR z1^3pM?F6UnlF3h=k&L&R$pl5iFhX7X`@-UyMJh8}1${4<$0Hb=pz|EaABlFbc?KDz%aN&NZqT(@|1Hxv)o)BbFD{`wX;KD*+#e439YIG2e$FB|c z>yP-d;DU{BRBpn8y@5hfnEGk5Z8}nG(s3h3mMI=+Ahtq5G+d0-0J#wLKQmbheYvy4 z*|4T_p6QzEJ(nCF2H!%Hj7fE)%5ASQ+}YWMx4+rhh2+?XV#lLn7!`K#k@nVPQ&`*A|0kHtKdNG6t=AV2^^I%-|t8asX5Z0=RE5_LmVSd9MP zF?^5B`Y=f1tg#AvrsU7$Hb;#S9%_`Spe8STe{7oDWSCOrrpcnSh6{mjP_vC7g0sJE z#IWCW$qmicia6LuP=?Sfrink;)C*4&iUiDyoM+`86VDe09E*zv+t=~*a`NzSa&0a< z{`-I9W{2(0XMM;QszdZojOhjLH}UhsjL=@ou)i2d1d+4Y z@%xn{ISM{H;ZSM^l`f_soCxTWv;&5&W%uY6a;xxl-s3F+ z3%V0xk5ifCRofcf40+#wE4eGD0gaBF+YR}<$^L`4A4~%K(#9ySQqP!_r=6y|(=O}- zoEyzBS@=7!C|6Nm&`JcG2J3~T`SWbOpot%$sUmD?*MAN0*9}M;n*G9&unSEo(o5iF zS1NxM-&$0PhaMv(tE_}^E&duAT3+!SRZ%RHWBB{3y(;g|LE+lVv5gZ^6W>6%jW}`$`M#VV({+S z2$&OLuI*hj>e{P8fV)70_LH7zb>2omKIaV=l`MU zTkIER{Kb1V)?=Q?U;dYY@4>dgU>N$AcFtEaOPS;RDuC-TNPFY%cDpIEOa5OFU7Xa2 m>+{8O literal 0 HcmV?d00001 diff --git a/Instructions/Media/launch-purview-portal-button.png b/Instructions/Media/launch-purview-portal-button.png new file mode 100644 index 0000000000000000000000000000000000000000..19bea31847b466d4a4b1fdc5674cce69c555ebf2 GIT binary patch literal 11382 zcmaiaRZtwj(lzexuEBy!aM$1t!53W!&cfpE4#C|mxCaZC#aSQ_+}+(RU+%rHf7Smm zGpDPj`(dWKs{8bb)=*QxL?c6kfq}tP{4A>l0|T4!4>O}6{o8rs+e!Z&upli3X_z`F z#nC?l0Vt&^1q0KVi2iDh_|Hal`D_6CceVFF3)ZJS=pF`!4P8-IO2^CeEDzZ)ZEx*? za|8OFyHv`M+UoUBjUNi`XJ4eSo)}WI2^Tl7VCPl?J(p`SoBsC~v%O&DYrD%t_y< zUBqo~9Fd?@-tqv{5YNb0hgwpSZk7VYxUBlfCQ0F=8P^~)F@*)s;V_HRQe5@7}%aatPwPC3m|xu z6RG+dDL(UL){LwFTexmKuF*m2@ zv=`x)@kKyEQ1(>!CylaZCa z`z?im9(mMhL4RS@Gj=8e4fQNbVXq6F$-~p0U;l@1f$_c)>#@p6F9wa_X?D)}`Rg(a zFHWzQMV3)d)j+N!2v!UhqksCdUkEzfjGUfL)62Vc=;_6qI=g2q+PI1!7C)DJ)oAVN z88Ma%d{?_iEV^f>@833+g}lerk1lSSk{U(hgxWrxqmiC&D@tEiIT?t<WD@%!4)bLbbx z`Cn7j zwe`Qtd>ZBA!Y#@k{+(8xuxl${c7uZitPg);4D8XbMcB@N$%{T8HpO0!eYJ&ox#xU* z@91==my7Upsb>?ArOvdB2=>+7`HDeM{k;yPfO)Zb-sAe?<@jnXtsg;~VLI#{^%&`H z#7)K**wHdqO0$fUy$t=iW7plSz?H8zWGPPaOMA$JCzQkp(=nC)$Cw&N&g$SDbgE^9 zPj?0viudH@F;DdH;5py**Wa0<&JgB^-y7ykOA({LZ}jwZGu4dstEYQn zz^8jZfA44NB2Ag7+9`=hV|S>cr>BY7uQ#h>jf`1-hz%@WFz~gx(L);h6r2-hwa{y1 zw9uY&+QuP2p%}XzWK2kT2LhLN-qzFF$d^b()N(}%u( zWvcnCGyYNg7uxDsbr*BUm#5I@dv}wKXc~Nv4E|d6kLqt_dmj90xF-2+0Hw0A;ue)y zxpwV3*FWtkg|u~`z-qeJdq=I+k$^Lk#BO)}?&kS3<`of}p}~ibq)f}f=W&zI73$N_ zpSQ5@KyNG2Y2ict+CRyaW{s74T~x%XXcWj;LlRRPU;ilV`Y(-&O$5OZz)Kwj_$YmQ z@#+UZ3@Q+H=}WNi>~yHVJY&TtquWA%sL0QGTDoHtx<;RqJ9??@RM)I`1xWoN0Un02 zaXF=+is7@fHuk~xIggP$RtZ?7T1rt~PPI!FRQ9U0^rJj6G7m3q9&JVq`hOh~7Pun@ zttM8mgTr|mL~}|pyi#+aoB3xB4iM{4LpNR~cW)2EpTRtL8KAZJ2jU+&RLm|5hcA=8 z&vWc%W;Skj@u25r9n!rbR_ZBoYzeAcR4OkQ%Iq}BjL(2z6>dG-M6As2V_$dwpn?|o z_(E2x#d1g8bEet!9}@4N_?aA<$A63P_#bA_>ACrq2-2^sg`&xtka{p>Ot zf2o>TZbjO9X*vTQ;Z!(E1#UwF(vF1Pqx^F>j0MQ0dvz18gspz;$a}amC7$gLVV`Vv?v}4ew#V3dY0(*yAY>+x&UfYE zVuw84p`>QC=9~L3XA#Sf;J{$u!u`uB-)hgveWjcf@vpLVBL03q$;AqLlyysWT1w=H zfDhs`yt2T?4p1bY=fsGy=NN9@>XyaVbWyR1NCTqi6Wr%nQ_Wv?J0eDu>b*Vdano01 z#Ak7&ne1iBbdL4>^pV{0h#tFb*tuu}ygz{HD~x0`w{HZxr%P)}Nage8eNfTwu}$go z=hPQYI6Wt;jq_^2aRRP=Imn;w(RGKQKs#cehr`^X1QE8Wa?2sCiDdlGZPzHY{wfIS zJ1KIJ-KRS3=Ju^8btoj3m;JyM$H}mJE@#2ISoPC$sBmYj5tF52PnXAzHL2KcsMFOc zZfLWK(P5Q+>ErEes;0jk6S8mVuH9I29^3KxqWB*#HG}2ogrXW@Onwz=(Ut8NfJbced z)u(y(i<5qspwM_^!#y9xO2VulUqyK2NbU_CqYwU*F3A{-+C%?x8~-i`Eml+?aOokJy;cP-NmuVJ?d!5dt7OC<)*FE zgp8)sK)Y+0-N4AEMRMVqVfG>x$nY)CRi??Ly;}v8n|h<8&DZ&L zHt*rZ>mw<$K+F2aF;(S3k1HtjVNot4y4zMfFDR84ZtQaBsYH$tH0m3Hb&Psuy3M;6 zi#X8mibP(6D;#;gO)PnnZwEU7D&!xg(%*FYJ_yMmtC40n-$^^?S8$HZcCzd0iDSQ4 zin~w2;pn1@scHE##X&(bKCOgihU7gn?DpDgr5huJZ_?PNFZ#(dm1Pwb*j1q5BW8N6 z@Vn4@l?j0oVQJ|gS_!=v)KCc{gYUgk-eFNJVdLs&Ec7OOHk@m;!^u`G#K{0X`Iwh_ zR-}%b#FOLq*3!j!QQ1Jtk;HnkQ#HZvl(34SH8)cUBXa2ubG%=}eODNJlak-1=-e^x zJvk|DZwBHLk7Dt4r?z6qxU%i%kRo`OJ80rgtaqJ6yXw0>Bc=1(+J9Rf{hG47uXLsP z+m_ZUPL_8#?(i_cXHr8Op{}T=MxW+GPMdC*I+3#gL_WErx2|%`Bv6m~p*5v5XL?2g z1Lzy?-8R&$989!R6sS_4=jovTkXMh%R~9rcJCriCyF@U7Cf91TYlSaFa$(HX@~<*k zqn};KY!s6gHESxLs9hwf;oj=wBB+rtr+B{{_*epa_w#m!5#NQbvN@rg6Mh2l^X7=Z z1le*Rn1c4;Ig}Nt3tjEdW=h&O?voVktb7eG?vf>i3r~wj-Q!Os{~#*j=-z+Dl&dpz zX&cQNgG;*#!zkio_)R25kY$tN`z?b;p6Z4zI1yCryM zUi{q9Q@R}YDHz?~X2Sbyc9oJC(`CW0terv&x#R)?QTdW`rv;!}H3Kiswe}RqL1mj@ znrL+ClI=CXM>>?uom&VK)Y-gJo*icav$?lYO!&5&uTTRrXz;1XVR#E_J1k`1lrc-o z@knn!dQ~A9t1A@`KEyAUOy>a;hAN+L-FrR zxE9RRH2!p6mFbK4Q9<} znXXnnySm3csfoq*EYa-*wuQ7dGbBzUBXhfcsYCRIC(xijf%rrK9&-*JKnwXx!_WN2 zEk*e$RthdWhfqC45d`hXv5sHu%*e3rqzUov1M_ z^MTXep=Z0T{=QiSRVJ1PFPaXUNzsO=j>E%KyrplgQvC00V;N7nN3nvZ=S|1kgv-nV z_JOm2_>N0o4Mb!$^xJ6fXDCrE2WYmOxRZDul@-(6KQ}B0#fu3k-gGv z*d5#)a7vmGSjP!xf}Nu+9x*_`D0{h4UWY_HNpsbE6vnz;h|DwD>%Qu0i)xfZG+aU< z{tys6yWJ|X)>)fI6t|^ljR)h*a?U8Sx0wNWRzyDhu?a17h(- zE3B8u4D2?^$e@pf_S3>|w1C}EUMsQV$t9!Jo!=F`irC-j)!yr!36^_$C%*vCxN}@5 z^?eNXp#+DXbHi0lRqa)(yKWRGPQZKq;Q{x;gT4MCS`bI+F$%(rU=_0g6kfgF1!N^k zT(^8g<>T5K)dtPIkA8)Abw89tQa0$64tO@5@)op1;^e&lp3V`1c}4pc3mk8o7eS3+VP zN1#S}@GvuQcCOA@uLo{e8siFAAdRCoAT)p(@O{8nt`#-dQi7 zbI;P6IErx>*XvSI$OowqkNaV1D@{F=xy7lEFD97`RZrbadzHLQP0i9$;9T-zdvo+dM* zj}(c%tRsz66=a0$Af(rGCaR?EEiJ=(aNotuzH2y^bPL`KDaWqKaMpmSqY5a~%2Y_Q z?a|`Dsf%|vlS{A-A3whr5E~!}>Q9N@-TOTBNI=_Ja#_Z{ChE-(dJz+*cS^)gT@p_i z{TzJL9Ev=eBmBPO%sbz;po_d%$>x>4dzh?0|3f_^<1-Q&5K9!O8gxW2ZWVjV@c|!5 z=DyRW)b5wZ!wIVNZ5JJei-hSm_3q<2PZksBR0!DdM7BJ(vU z?~>(fzvMbf+lX|M$Dw!P?Op+z2Fke&Grbit zU6adWki$ySY${DtnafBnx&hLRMiEB;i`LwM#3BGe^_w*@wMqkyUlJ=)<0PTX+z%xN zq-5e>eky9#z6SBugdGMfJU+E^dL3z_8JqMpr8_EB4dBq}pX>@V@-tKkNho1QO~5h@ zu6XfAK}u#tocP(m^0>CKLU#>v!H)<|Z}T5nXNw%0NR9r+A@_3Ek-+v^Mxd0`1~fxM zHLs=sUvL|k2p|sY`zwl#u60`3nAf0L2hrR1#IS_h%+I7!&4})4MP_lh@UUNQiqF1S z;$h1wqCC=b5*rQ$-w4ZV9zmGEyzk%a8uT`Yf0Jl<5d=;YI%ucr+c@!CLy3Aa^(&GM(TNRzj>ZZD62OL9A5+wQjoHZv1Pj?q37v7fB?7Y~J`Rx;MFAR|^DM z6YJ@N(I=YNI3}_~`aPacrt|tRNbb$cMfDo79_-~Sg5=@!=9oy{km=Bw&IqTB(GIXf zh7DE>08T-jvWELi&rM1M-UGXnLrZ6Bz+202!=g{I!RCcHUf)dhpaJ#rK-F4rk+|H2 z)Xc!TmVA|dyu3P7IItejb(QpqHebdxi_Ru5jAavc>|gIY9fwU*>9e<^ntsSM|=->Q?4yRn*`k zE=ou?cDp&FCIJfv%g3RNuv0N zBNE3{n4%$6*^!wGDZ0B(I10TIu1+BYm$D z-N)6;m^iYM)HzDAqPuylT#>(M0e_;or4>b3KECf^4zBrckZje7l_WZH0F=U5K0+-^ ztJu^^?T0a{Lm{RFSznV;YdM>EC=Gqdb33nTqj)&{ zFV{~9`M_h0j^J=nWtd-1jd^3=P(RF2+W<$f`o72SwasDx9o&l4vne>RI=q1K@u7CD zU$Ow9xZp^u7$6zk1MhF6l?hk_LS7!hHEjYC6E`hv&sJOTSys=UgZ5-qv3ew)=Kj?t zT={dV$FW_{>YG5kOYcvQ)R+CIH^=@gh`*LD480Lr6eiOA!r|ZF)RNkz#mvg4;7$`6 z=EG_;nA=Os%dVv2ez7odB5qv@uFAx#UjyyU8ScJ(`2;WX?e^rJe^O1)W3+vh4B$&b zryEBmp?u{4uY`};zfH24o^1>PSxu@~aK(I9PHf%0iSOQM3`n?QfCC)|rb=Y-%~JM5 z6po8f+s@`{RA8_)tQTtWFkVE1Dw^@J*Anmx+dK5%YnEVJID@D zCnrL3_+43b8&`LhiN^;Vw_Zkb;kiMv7vS~>2Q&g4DbMHXEV0G!HrUay;ToB~ z%;xp!I)R>AqWS-w9bdzIm;woib4{tfL5y>L!d=Ay=_H%r%gDFoC`;#Hf_Z}*&0r64 z^Qrp*R8O&3|A=^%6d2C=XkVlkTry zhPddnHCbD>QHMFKBc|&wVWydH;>= zX7VIVJQ8ajhj{`bW+U_L@HL6y_%Ys+0g{u@xJ+^1N1D-hRgH3nMy)Ko6K&3^)m_t> z$X*p)?z^1|^qk-EHceAOH&*efYZ;q|$sIOHOGr?u6F5>g@ZAy?3o9=C)g(n69T+Z} zTB38&1iZlJxz^*mcW3C|YY5)X_TBGH%Nb*j>iZJd#Fa@#z9=@{gu-vqr!e36g*vD8 z$0CKO0mYJ^xX6iK+A@bwuBv6!f|=KNs`v?Gsw9|YINhUf(K1vUJCM|y(RiT$l+$I? zL1{aQjg&r1z->JH^sacJJ+QaWF%@LZzp1g4)cU!!|2+^2$2IlY3Ig{s@F#{N#(p)T zR<~`Ck!s=)g@hKNpun91Nnam1G6)L+;olslTtKp3jg%vnQin$?|AIt-2%k72CL#Ix??+=Uq!i<;9U~k$TW4-juBcjax-7NiNdA>`vy;1KQ#XN6U=Cl_{Z z-kmvB9#F2ch=dU_65ODT?9;imvz+#0!Y*ewz_14>t##$>|JdftX^m|`|mjgXz_NaVHs zg7Va+B{XLRt5UQOqHmNh#D)g@mz~2%&S?#Cq+J6llx~rW%sCphBl(P0Ev8RD(m||q z7zb9lMOp(e`$W)Df*O1)218g@t|}8}yGldxBMuggS>slm4>dE@tRO{=rcaIzGYzFR zL%DS5i);fky{xIlDPYiBpRpuc2#6(!pn#vdlY)a+Hms-$fN6eLuB5FpG*HKQ3`C1L zLM8$j*zSAa3FQ7Uvh#09DHkeKmX$>jGe|@Ybg3Q?z9t6tqkO4$i)ufu~s$izL(dL(Cg2^0EboPBT z^3bm5K%=;#3B~(OgkvC#gs8d(>+`6T=D5uVpdd{g*9qDw#~_Vc0KC`mEP=*12O{94 zl-f@-!Kxe)70pjZiCK8)MAs5iLbsF^@Xj_IY;AbC*rQq-UXheMA(Q~Lo30EDcZr{F zQF$p+@*^rsc$4@3SXE8)LGPOy)0FeudgD>NZ{y3@kvy(|%P?S$#bVb%*~*+-<0($t zn3ZcTMfn|gCWg@U4(Lof@zPLPjXj3-y_H_2#SeQ71 zt-$b`&OUZJ#vXydLv^0z5EWgvcPMg?U~@ zi`AUQc^f$tr2(_ipVi*tKia{SX1i9pCib>MBfQ?Sde-Fr7556Eew!Lz>ZAZ=#(t%N zsx%Z5)(%u)HUW%AKuu!`-0RUT zAue@!Jov%l+nWpLrl_nz+nPxlCfSSJd>eLLnE{a&!4IEJFlVBSRM@W!3F1VDqT>-L z#;jyu`i+!fmH{Y2kHZiDs8uJoev!=t@+|v)B;?OhyneB;r1Cl&xh7Ufu`(lv!YkKy zDK&iNlI1|xeFt3|GUS!3J8j?P1gY|>rR@nuM6CR89);Dn1->=Ggf+~KUn5w2%{^1k zj&&lF2yMso08OY4$Of3*Q%RzH{PH1K6kL%%8=VDlc!;2Nu3yNyU#}R)(?#q|l zJ<3i5U$6qYVNU`!k#+xmpF}4L+_*h?>?848c0_hTW4KRx9x2)NR zT-iHnC~l!&0UHMxl#xzSvc8|-2N)yZ zP8zy#`zcT=h+-&8A4=!2Wa_x`Wt2})c`(|KAl(0YY3$Lfg4o}8FJ+QH{*X8|x_D@W zHu+lnJ>GyUk<46_}O@vvDfSC4D~xn%+o|DIxYT? z?FVHJ6>Z3-AecFLn=uP(0cr62i?8^Fh#n#5jL>5)d2mHCCP1Y`2*LUA!9c;I6-0fC z=4&QDHwH=O?(^9F1_()6?LNR@a(PBr|DEgX;r5k!jSggi87Uca(S05s4*u6ynWiB8 zE$(-=Asb>*mPG0+sjuN)_CZ#DA@RA*yie-?9b-bI;*j?G&Glv<%hu<55o)9F!nOk; zZZfu2B7Icl`CJ~8EC=K&RhC@mZxq5`&YpQjS| zY>XD8!e(Xayn|Wq)Kku1WtyTf1|{Nn6WA*pr`M10Z_a3VSNesJk$R~DLA8zr2c!X( ziGqhCaU;v@gy-xDn3WqN2!Ik8VB^SogVCbVDfO%$1)sHJ^x66%FP0Wn3Al*34LN6! zfUBPjnWu=l4J~KPEW{m7HG#fiHl=1|{d5{`(fPn)XC66(=V1bh-e%XNA+JO5w)Kg8 z0>blW(0!4oEE$CaD_Tmr5V^nrmxKhB#|R}_#TH)9yffGi6`b1_^{vU!NOqqF7qn$8 zv=GMM@$UFdS zWknYo6vUeW92%Si6UG`gL%LL=Q6m{C5tXV*(>9q9dA-aEVi7P$1`0P&SjLaGDCxHAXE#knx)#P;&pedYSdn9 zBuYTQJ|=dKd;Nl{cEG&Za)(V=xM7v-u#?we8(BNk(5D`l<+P1Kz}ad1aqR;Qmk-)> zxSd$}gJ4QXa%p$oyFRJc7fsUc@L-i|c2a})7w)UWBXek(y%C5}u<7EjT~V!3(*r&LGTh!MOz769$I+~moA z`1T>6Kr-8s1yc=$8lT`Ku+*v=B=K-qY%So^+bc33GC7v|FJy9f7_4#ONqC36Y? zrn1zDaqTF64Y&gFYXPr2_%o)JVn=roL1hXSGz&W~7gi42oW^NRGaQ+SZ(LX_&YVSs z*fVf_0z;wj*10n+C2ANbG1iuUnr}&wL%-o1L0&GJe!)>mAs?6LBMlc}BPG87{&}Zw z_Ty&;)vLmM@pDz8SP5A4uQ!qPW@l?Pu=r(3qo6WzBTghK-pV)s6DD;~60K|~@arGF zw7VRc_*)Sdx9(XqdRPeyJ2?prJu6&DnS*uO5Oe5GbCqpU(H1lJ=SET*Oa3QqQY6U& z(OQe_+Q16!6zh~alUjK5^oQjB^Zy? ztMGo1ECk2Xz1H4g!H!{J*eqcv@zT&zCY7eR78E|e&wf6dYq_ygJ_!;yA425yvuG1# zvyze3{&{qcHvO&HK0d?m8rp7!nWutkV(lZ=#3uqa8Km7V_g>aiB$4WW!fygxJ=D>@eyx9 zIIdo%K7c#?Qqt8rhc?7OhBHP-Z366zBZZH-+BH0-d5Ye|G5O7ma2xiU{%)aoi@4EZ z1!=WuP0)4u`qIDDgMhs)AQ9e?iRhga=goLLo{1#3!c2S9PNj5tu44PHz2l8<>GSl| zb0^sm{$Ay5dn_HK#GKEz02ow3sE(k2kGPPm3ch;eukj0EJXE*jgOQhb>uq#Xt>vV; zPj+46Q_qlXva$B4;(mS-|D@Aa)cNB#MK;`q4V|!;597BATUim}rmz(%HZFK*bBk1g z|Iivv_IFVHofugF1wmY0!ni54WCbl7`DiMEYEH>w>6iC-AFLB+p=IxA+$gaHbq+jED z{#0bFeG(h#ZzcL2&R#?ZJJ(*8LVsJhs7LQ$j=Se~ zK1gFw`LVI3e_{l+f`iA)E$1<#8U9RGHRjcpq)Xrbf^I@CsA^!)*{~$vE literal 0 HcmV?d00001 diff --git a/Instructions/Media/maximize-icon.png b/Instructions/Media/maximize-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..ad968a1a3633dcca53e30affa0ad122ce3af88c6 GIT binary patch literal 1112 zcmV-e1gHCnP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!Td7i~s-w+DSw~R9Hvtmt9O-Wf;eQrSy|h+QIt8fWZdC7Phe|4w*oJIA`?E3r&m{ z-sqKCjPb(6#CTz%7bYgtWQkM9;&dj?AyeWQ*@E_dNge=6T*6*@_68hz#kvX?SG#VQ0fN>>gjBE09D;uHYy&&}7Y& zA`ccD-eF6g3PUQ&XXj@)?TJgXtGVMF#x>!W)W0nHCvXn?B$bBv0z)o03kgZzlQ^F1 zE@sl-l$H$}UR($>mQe8FVH0JFWodRbqx~%$dG{!DF=>Jbr#^a{_gcCnod!iFYPE{Y zv>C}zYBVV1a!LPxJt3vkpK=ao7Obru!ctW2!BwJ)9ZdiY~#9F5I^qtHlj zyr1@7FZp}+Qop;HfuB$D{ZH-q1Ovso7#%%MN_P}-_17~@#jWOirc*}QO9iGKzFDHAQZ*t!q zcDnr>a|^uQY@5Y+L$`&rc5U)C+ZtUOCTbD1y7E zlOdmgy|#%4hm}ASa#K@$dEzYF57e_Qb(7Y%K2lOn|7DHgWIV}V!Q|cXpmUbvo)m8$ zvf&WT-j7r=hM}m6>Jm9WocJ2AtdJTv60W4NH+IYOMyPN>5InoDol$*WNn9c13^* zpBInIi7%8OOSyg@UgIKiE6R_~+x+618aqa3KN5EBv`+|&)uwDt1rt1sg}cbdtWMN)!5YB@!8X^Du~2a-ZU z)PlHjj7T`jvgkudB*}=)^X(@e&^N!r(%A1z3R|cww_`5ZNmbqRJlFUn>s9%h8kR+q zeBAD%Gpyi^+O0g6Bj0dmQ)#m?TTGbDCD_Y$VRzV2$rR{wE!ZpUC~kSV8I0kmZlJ^{ zCa<+|_)ru2Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TQU=LbJjVEO-FVIF04efF$K0u8OT(5(<~v;bV+o5&!Y7%`?#|3N-}(Jn z&vfuU!Gz$Pc_NG@W?2^c{l4=y%&o9;}96QA#_{1DK`>zu%8!GKr<7=P(QdUkU}tQ&TuQ`-$^k=Xkcb zh|cH^|~Dfkc(1v6=Q2G zK9VHi{Z1A~pFhFp<88O`cnq1$2BJ{~JJ~F1wHjUXT^wW`;5K-_Na9+8eAwM1(T9%+ zxH}}GJRtiAI*F+ZL6Pwbefv$HgVDvV+gMWYB&6z!V( zAJ^Vw*9p&s@#^&&^qh`AG=?viU(oDY*vMp1sZ_x8ytDfX*KD$qh{fjd)?0|8F7}vJbxJ*zC Z_y=|_#$Lf^^FaUr002ovPDHLkV1k%h7ES;F literal 0 HcmV?d00001 diff --git a/Instructions/Media/pinboard-icon.png b/Instructions/Media/pinboard-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..bb2207f464fbf609386b6df3e0b0c835aeb10d75 GIT binary patch literal 575 zcmV-F0>J%=P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TqOrbMI}XbPa%RHH=rJQfcJ#+ah7cN%Xly zqbo=z6UgPZSWu0rA7yjy&rf42dLWC#9Zkdf`Wlz|K^A)?5`k%&P(-=S<}+^Z?znH{ z(DM&)oCJd|<2*@<&xd4l*}l#ke4UaX91#b;(nD80{(=RH0dFjv(02*x1ZMyM N002ovPDHLkV1lff?`i-5 literal 0 HcmV?d00001 diff --git a/Instructions/Media/prompt-icon.png b/Instructions/Media/prompt-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..9b38a5b16ffa2cd3c428194a9f41dcff562c67dd GIT binary patch literal 724 zcmV;_0xSKAP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TQ!lgfdF*hKvU z>H*>(P*Sx=V%o;2C-tCS>b)GGt;K{ig*L6$q=Y7TARs(o+}%7(sqiRG8snEtcHi#I zw==Ud`*aqojc`KHtK*5_-;xuNkmEp;yxnf2(P*IAY^p26p)Yy6)q>4tLp&Zw!0$(` zR#SJ5j=tpe`Y(7q9)!bTM59s2l78q2{vvNNkGYp4Bc~Az1~HvTKw+eJ?%spasIx=s zs^(xw27~d5Iu|*%+wBO2LbyLUiM?VG&z{bpw7-u?Bm#%yJSvq6N~IEXI-P2z0p3I% zVHR}l`VHFo_MN5^Gi0(@S()f~snEF3PaF9Hefao^j3%>?gSNe-%X7V6k8-(;d_E7S z(+QW$g>*WDai0&dSPa>07Rh81h5QC2Sr+%l3N7xokOkAb4>{ojG?mfw}L9DqhjM2*K8r{5gTYQ_$ zmY()py3%qGdPzpHxCfKTjK#&zSYOY<9|&M->M>f)7Tj((WP^;&%`MSrJtOFKVn?`F z>=2R-Msb0!UcaH`)h~3}?WTo=mz2(AXzb!8V#Gb|2R^yHJo#Pl_hoeS3?4ju1n(6O z3R?xtKA%M{mlJxuN>lr~8F;wdkdHrhcSYTA?`&g!ejY2!8KKj!=7;`S@D8?EEPpz+ zA2G*3&ksYABvh+aG1nsI7@C|zW(_omnB!RFN5%h24*UisWfNVdX|V$U0000X1^@s6+90*i00001b5ch_0Itp) z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TK!s z@;|uhMmOR@7rwv;Vv$-yQ5RxSk=jlhFt6iOsW!xVdzkVK!fJuXFBH! znv|<1f`$QARsMcidn;-aurHzZO!12Z=rxe<#AR=&gEmnxAvKu&CO;hEk zLBUu}C+oYC>qPKnZXVwj5(rZ7G9d?e|M4?Y>5Tl|4;{&wgv*giXEApDCf-edfI%uA zKYM{&x9_29nzV;hKh4O@jvd;M(CsP@GU-;3sG;Pb`kzX6Tfx&15dq+o_eM{>KN#;Ih zYK_bspP0n<;jK7(>IBT1B}u)q_|}}eVrF(8lO);pxitJlM0 zGq}GU$EMN#o#%brJrtRU?bd1+Lp@j)%M?;YyP;{Ce5jTaOHgi{aMw%3(mM@Lr3Zx` zEwgTU{?Ik1AtSZ^?sxF{y5%63FCx4y1d&=S$k4@71>sPThw$)7$W~f zBDL7m<;f!jeSwa1V!@z+0R0v-mj1P1@_va|py>nf7nTZCdZJ$CYybcN07*qoM6N<$ Ef;h^3>i_@% literal 0 HcmV?d00001 diff --git a/Instructions/Media/run-icon.png b/Instructions/Media/run-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..16ffa5bd16e30f42709aeaed76d0e61df04ad08c GIT binary patch literal 785 zcmV+s1Md8ZP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGqB>(^xB>_oNB=7(L00(qQO+^Rj1`+`m z3{GVGaR2}UlSxEDR7gvumEB8IVI0T5=VhDi#d6u&8dNZ73Q@MLf53|VgQANFvb4fv zm^oF7z2&Sa zQ>)E^gFYXst9L@Ua4oEV8;N6TVjQ9%vKsP{n}yX);y!;pe23~FYPlTJN(z!B@iHW7 zi;I0LiXzf!g>9gLrMNOUBi0V25(-*exEK_WW7TMyhD;`d<>lr4o60a0&ZsKf?!Aac zZsKZ7Gn~#EEG;eZ%__lAIIW}+32!#S@54WMt?>9VD zC4~tsU$WV3hTUev=;&A6y>}n)KYT>EtraeptLR|M3a>Sy$_AQcEeHmV;qzJoV!-|;wE-Y7~K3X>zIXJ&9b6vV^c9_(g5?&*DiXU|_Cl}f>G zw-;?e0pWbhbv+*YjQP1gEO2#q%9z^F&~TL7Di#~&4xu3$LHEwS{RdEg_=s`FBue5# zL!S_jkHE^>QA%_@C5K1iRaF*PEEfK}8CHbpF4Zc(!Hl5mvVbU?WH@VUxn**>EI+DS zTFjCra}{>g)bgRSU(*d;&8YZ2I}0V1WPg#(m0W;MsNLbf9+#V4`Xc@T#)K+F(GA!! P00000NkvXXu0mjfzy@O< literal 0 HcmV?d00001 diff --git a/Instructions/Media/security-copilot-launch-exercise-button-v2.png b/Instructions/Media/security-copilot-launch-exercise-button-v2.png new file mode 100644 index 0000000000000000000000000000000000000000..b3a2334baef753fa2f7727662fb44a72a9243f95 GIT binary patch literal 3858 zcmb7{S5y&8cSTK zxUxdG!!@ruk^nQ1F5u%=?)57{?yB=Z2LPyur#XXPyV6v?hBg5J0DafrMuPV#a=LQb zBP^@~&Ak!651a$xPVhkZl@9|pyg#CI?6=>Pbf!ESK3Y&W_#BhtBAvpgvO|Ap9 zh-=F6doJmQX(`ZFqh`vMnNiaWZE-{Tz|G@>W&TG>@gN=3q!^t@hMTv9uwip-n`f)D z_qLiEdXW5iO8k`Iz}`~` z7wneB7hu>Tezto-cpf%DfeAOhNqft4__lh|M>FnS|p5mWAZ0ra>`vpz8jv<2~yK> zO3!MR*)Med&VJU>SAud$oi&$t=IrPa(@l&wRyb)-K1=PRqYr!leSQ(n>|!_|s<+~- za&z>#D`T9-nxDaK6Mqt?dG$;}p40k3Q9K!xpL_Q}+a7#ZI#ij!zgG}XIcZ=M=W9R_ zzQntS-hQ+ToIEU{8}4^1mEM&+$j&saJXq`UTxb2G&Azqprt!`)FlRZfMpdC@V@VGO z)|26D92%&wgv}#(O6xDCT*#J7>$m2|vWS|Y0rZ2J4EKM|i5EP`;vLteOw44^t&{1^ z$0W(VMps*pMy2rn@wK|sauCjOn89us@-xx3zu{8Gip7neEOmAod1(Pg-^hVHVjF^5 zIS)@9Trb9q#oZ0L8~{%p>u?-yj4?)0g~b}u<`lfOSuOn75PflaXD>kiqE_TLq0=_R zAgQ5nyrQ2}9|)Bb0e+m01yd)(4|6xw+sX^uyzlBmHAS2zqE-^c1XVHNr!z2dl_Alt z_B*S%k;VH8h}Dabkol7^`7btU+Q~~JEb7aPJ{N1E;+jN*`&koG+Y&bWkrJ8AJVrXX z80f4>QAtH&N?FBcxzbhbVT5`@ z{gBgraLAw7n;f_uCe2?3EasxOHL%`cXIv%Tn;YXx*9Ptq98|}o_QJZZ3A(v>)5aQA zkDAvNaV?XWujSq03Dg}wf_e>{@AAoDS2)xK>}t0c_mphLN}{Agc5u784^@DXC+6v6 z!Q)=yJo*3ltRXvW`f}%7`%t}X{Uv4@ZD#?$()TBn%6T8}I&&y`*(q9%|1%QTa=1s$ zlyW@PupaoZ)ioHy+bSIGAV6B2U2h7T5RW>$=8AKZlg$52L2$gk@Ae1z^KAaKH=jXj z4B+A~la^sLj_z5dEjotC^kI45fJF7yO(W{0da=pWLpC2( z)MMY-qVz%H$?$fYv=D~7atdZjN-H1ud3tR_5fs3ew*A*_jz9aLBq1sW8*J+(8rnyq z8T9;@ucr6c78Tx<1=39#60DV7>IKOnh7R`)Ol&NhFzByQ^k*WbZ{NAEM`T!<%{{SU zOabr=nY-J?D5}Vs#C)c%;{KQ{} zZ|?^6NlBT6&tQ&5Liskm@&Kyj7v~D{K3c<1)s{Cxs(_|?EfB_;9dEcOyq}&k`}RYvIv3BHuX`XXz^*$`$&R87*s>zUU+yJ zipX0Vhz{LWm#@#X;A&ibH;hxDaGkEq&CgBd4IN%|CbJw<$%#Hy-c07b@ktn;uGVwS zn7c}BjX=ZtWb@Y~mc$QNuxu2cs=FUZ+Z-{P^wJr=M&B`EVf z{2Vg2`(=4*5r;MaD|1pzT^DEk{dkkv!(JxATuPDpy-tLjF37Br^kct8b5-65m|n%T zvKwt_PG;54c@LW^&Z(1Uk*&~<x3S;aE{$aQ^y$(x&%jT@Uu0ezDmC>-Z~$G?rpT)>*RDUc5T=qy&IdO6F`1;^;7A!e0c}QChJOFboM88 z0%^ET%e2>4wJA1zBs&713Se%cc?zMB5g|4Qdpo)0l$iBq-7NhOyCQZ!G6bRDCSp%b zOaeUC9f|26NNH~Mx-kFELtS*hf*7)y1 zy=r$})LR}x<+ojzd#p)=>Zg8S5Zo&6a%MbGk+K7TYLFC^nGNp6-csynyl5#{d;W}Jw$`A891@2{ ztZw;5IK_wh@Uq}>T@!59nq5o8-Ybu{vZTEdW3!tJakP%BB;rPVOq7Z@tZD|VU^n%f z$l2hxm=Zp@tVsT?Fac)+dq%Ci^@G%E`n?<-s)wZxtE@>Jtq|FLmtc#8aX#Q>5>}rc zETvf^2BF+)QekE1b%$~NecDoMlf`=Rx#Awlz9(ML?Qpo}gH-i9&#xZ9<%eI^MtvIs za`8NAwd`O=_w9|mLYS5zdYpOalG@#g=ADArSN8?pJxCVuW}fLDgZ4=^#J8 z5zIC?<6t$3npiY2=HZgkY8kAsMS~)0gp(#WH<$@@z~)pJJ7s04^c$bh%j-bUF=1qY z5@*(KnRfIHpUll9NeH6Ew5ovjW~QUpx3t*I>J0x0-f9maUmkFzBMHZye0H9pR$ipy zI67X9UKtg4T6P8XDX}tfXwUJvbG$K{H>^uF1=Pd^i0{_MX}%oCB&qcl++}I|RPi#t zN>HUxP60n93JvpqcQhDAoHZ3zd&KvEoki8KRT;S&fCec%eN_2=|7S<=ue~f+k2cB2 zP0FfDF|f;`7qwd@IePeMApTWVNXFmo9<#zCi`beY*2P24a~Q`JgH2t_Yy7H3_?$<| zohLh)Tv`S3~N8H;!HwIdp1;H+_CuKaa@LgBu#> zb-a@rb5IW$u=?&_M};1v8rIp9h4|Ys6!fH_%u+95sv^l-)>vV?Z3>R4V|Pu2Xtqvk zWdVj2s_}ZOA*9-FT!)g(&*5{a$42mm^^2-`49$$w*8HlK5Uip67W)HC6#?gcU5s|M=k2ccI4tcxn9NjLCze+G%L_Q$a(z~$n%~xv z9qjTZ?r(GBl!l*?&@ymdH<+E4{+0y)+8-Fz_`}=w;2&zeWTE%Wy+DW`WgQIN;l>5WzdVIOJR>MyY8iFCvZCeA zm<<~l?CzWPmIJnn*=WYZTS?dzKCQvYivr|3`X*aiybF%tkCn(TH8lh=c)W$kfA>XN=w< zjdw5S0)XUMzAk?krO8vr@Uvo{m#p?jeGEU(CUK4i0&D-#o OPVWI9>VMRI{Ni7YG*00F literal 0 HcmV?d00001 diff --git a/Instructions/Media/simulation-pop-up-error copy.png b/Instructions/Media/simulation-pop-up-error copy.png new file mode 100644 index 0000000000000000000000000000000000000000..97a9b261109ce2d1fcef135cdf86391e09f190c2 GIT binary patch literal 4994 zcmcI|XEYpM(EjSt2}0CFjS@A9wZalTT0~hPS_nb()vdB3I!V}&ELN}4yNwHUM&y()tQC4EF$rEoA2}43Y>9#8T(o z5386fHdGX7#xoT7jy}n-(7{Z(;9CY-6m|TjmMXOojSfH8(>20pfD-DGNbD)uyAlW&;_iN%S#>iD3twb2bZ8 z@+BKcD3_hHHsh!avPR^&b#DCTY>aZ?Jj8}Wa`VDw2JV|uoG`naultBCup}VYxb#u^ z=P+?V$XO1BBVxhfZ9(gLA)itGp6WvPuCQ-GeJcM9Yc$-Q!hFb!lBaQCV{cZtaJ%QW zL$^HrZq?7%N+QbNv~a8LZFo}8-c$S6cJ&8g_`DlaSi5==B@y@KPxz<$w$3S9vJ`HOGXYY1cGJ&7;uaYSqEG%*pebWIggy;&%0zF=H+IP0w(M(@}7g)CLbs z)>-=0Jx1kIo5_bwkjpFR%hUDK%y&o!jnuE~s|C%#QpZ9LniQlfND&!^>_FVxca!FY*eul@* zw^fJOqqbgH7RyxiN-`!pOV);3KS&CFuOh1NvqQHdot_jL#xEW(M9HC-{@yj7Mq!oBqWdkBKKgw z5dVo=y>QL-P~fl{RdP)SDbB697yUY}($U;qWF!uLEFZt?$uE!~0rgFRv6%$L-J9IS z$bSj?sNthq$36b`<=`sqUj9%voUj;DrIPrSB%NdIHSgP#SCz0p8bP2aGWo4Xe&>A8 z3$01Loju4?lGjj?&Gy*6VzL{L{~TlZzugRUVFHXqzv5kjf!~iT8XpV#7@S0c|4mTst0G%gfTB7D@lq zlrZ6MD-IrxiyFho4e|BX$R2i9z*CVtO&@^Y!QDD%h(m4~fSs*|%M3wySoXP_NKk1b zANMol%)bAxf;XqA?h=#woM;wSXd8pE+0kHr9X*`jC@GM@q~73?z+_PI90dP3H`UAD z@Ii8kGS#PJrnF9gk3&=M#qY?A273-R_K{%~Z$l%Ve&Qcr068;(!1aVNn6n-$3Cx9X zE`{hXY{kbg*@pVdA2PGYH{P7xC;c--Tlz5*Ib&#_hu6@VJ}@-J>M~|Cz@TH(n_c#w z_2pi{9;4kwK5KmbrTbk)Sa%?l*{ty+fvY^Nk%l%}(l?*C(2gwiiuc{y;oog;g}B#& z8~5ykj2A`+?tH1In?2Jt(i=*K3cM?Gc&-DluTS(72MqPMKd~Fx`cmf9{bZ`?SbR6P zbSuknxTd*pwwt|SMRJMEV1-Hdk}dNd?#mXlVDxP+&8Y?U4(2313vY>n6zb!ysyEXI zPT?h0lER$AoA(**!QCpll4MbVqB-HrnQ7sp*sztePZv*3EIwfr zI0j40YBLFg^zT;ug+D`edrFqMsvbLi9)_qPG>dp2GL6<>$|D>eW)Bz`7wu4twmjP< zvMxuX@)-YQ6ua1A3u1tLkXB>H;_r;fB~QnNeyDg^fNa0Xmmq1*twFM#AX_Hk3s7No zo7O-TdWU5~ce#QZy_8nvVAX;2f=tMx0%a0cG)k88lxye3xaz0PkAA)FW(b_wGY>2* zQ5YLZ$8pP@LrhAyU#P~e2zF@h%)p}7989MVBN}|`#L-Iq_fQ}LK>PfNeq@yl8Id4% z@<=gdTX1gt1A)IC!=YqP{@RSmZYxdtRz`s%w}*NC3D);lHP0jy(8dJ8`tl(#etImT zeDeC5Z{_ALZw}h@S+&u`*>#gLV37Vz?pH%e& zbh^9x(?k2ycSb7A95$e!jdxEji-qefnu^V${hXh1%GwQv*y21FTGF#Jpq1b2D`Fem z@(ZtbJIiwMGrO=*>w;Eu=^vG$ig}@_knnfm<1}71wvluzcc`@CCp4F}yVCd|LMo@Nd!uHE1kmxlHpas#H zBP3@m&6U}piAQS7T-1>Eo#eRXZwWwpUh)>8M_I<>;tfi7SNa+g6F$d|-xPm^@9Ts6187L+ z$W@D65f5yCzg1vlC^2ri1&J>y0Q3Xqx^ES^KCV{)lf&(LZGtF?4zB<-H+j&~1~70m ze66Fw#_xKsZ8XNkal@K^+%s$_+Z1_6Gbqnt6}c-Gb6nOOFloZIJ}xw`Hf+uzRSwS~ z?93GD*tQfJn`&cez!F{1eUxtfCgvn9Ej~&B)VI7(vGp?JuPkRLKSud@FLvnRPTijX zV*oyrp-ldR1gcX&$D2IgxJ_ly!j8cbDsrmq3-(p)fcxF$>=bxQWb#DbU82$;m*=iy zJ)V-~re3?TJ3Yz!-p}Lm^Ov}g-Mm_!ls3LGuwkZa>LqAAM&^QuOnWWu20Y62!257{ zDqT0y>pg92e+&2XdEqXW0?x0_UToBAVSA7RE2IaDm%Hnx5|McwLq|%hmV9uz6_$u} z$H#6F);{t;O9;qW0QAQ9$UQKj1$whR-FPu<(NEr4hEW%g#*Y&6+fj3+4N4$$w%HrO zkFuM*bCcQHG299$zEiVA>t7ZHBDq_#LLzFcrTUbGj6b-WoZdK3ZXO(F-s2x}&F+_= zhGdK!(yKOZxG-zRe2Vg9GU$!$9SK+MFn;`PASXv1J3-I5Y@I4I2IVXmxA(cvoS1+| zJ2$NfirZ~k7k?{r8m?0Uhmo8UIwIxyrvIb``K2ptGc~(3P^OFJu_M2o<{YU9iKgCK zftqj~ni+uCtY)=)uyKvR-(QFAjAQvXN{)H$bDRB4E(%`_4GL2ccC0)y@ZRAwWMfU% zu(?m-F-KzvWrzEpk zKTZGr*YV%;*(#R$#E%{hS-w>~f3Xo)AT@&%dGt*`aA&Y)TR$_G=1dliAs3}z0kY;w zjAFXA?l-<>pkSv0@y9I<+%YZLsrW+Xwgd@P8(qvHm?a{4=Ia}qW0?N-96=(umV zFg|ED?FNHg<1UjI9mEmiz_%3jT(u7UtS7TQx}#L<2h*kSuU@6qa;aPgn}@}|FK?h<7! zs}?bPZz{$Ph|2f#|NSETZsf>D5IfK@oS>tA1GHKg-LUujv@KxL&kc{Tv_zWiKVbEn zCtf3N^|>LZ6`{v)`*EZvvacX^O|Mn{Cy@xv*K0NB<3*p!*}$PqR6{IYGA*hsL>uBa5Z4lUaO<39eI|D zQ4Q=fERr{E1tpEVKNcPuO?VHpEI)Cnh5q?P*ytubAMacBh4aM=%W2ikk>m@ltCG04 zVvQ@q;iPMa9-ARF9F;0!8pWHMM-C7#&jmdz4($X+I~Tpn;IKDsh|>hv@Du&D!F|ke z8!l#1U3V#;-88qpYY`3}n5T1!*s z%3Gs1N;<*mXTIUM{{aZ)i-?Fg*`&yph`iC!t#J_%Ch`Bra&Ij|SV392uW>CfVgv_n zMednl7CY9%OZv^{>S08uY4x!Q%uP`)_7>9)7B?U#^%`#qZG8XyCEdbR*EIG3fAggqmxw{h)Q4(1@f4wqj2uyaG>A(4{L$xm#1h7qN zkhe26Qvab)9|SS0Dl2D*wfUXDqC(fYu1f&UsIEf8f#>Vq5<#~B-Us8tx=T}J*P#N< zr&5^yk+Y;`KMFN27y!R_#a7By^A}N9!NbiBh;O~A86T046?&G88S1x!!jQus+e-pKr#C@iPy! zUMGkxqX(KpCl=J71RcnFOZb>zt{h#KSFfLHAtqW89Q5>y=is_9y94rFS+1P_UorJ_*@Ej^&|E~dF8q-# zvfe>N6oKUHR|ESeIpgjgR9?!;AH0K(W%kdskK9qSot5!KwBV+Q1>Z9akq8*?N!5g} zhWq|GQXDLls_l74Z1>}U91{; z^87PR{PTd*b}xu#H9nBdrSa&|)eWE6pxOcF<5~Va^EKFb z=K*?pGpPlii}8#iSMiye)SD#Q_Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!T6LmT#k2TAT0NCg zl^$x;RL<%}P5lDWlf4MNsW*G57oye>^%Gbt2y|iD9p@Prfo>ZQk{Ex9$7n%*l_|lDpvGH+)Lm?E_*HNid z;BYztW^PH3C<%Iwc#upcG3+0PrfHC68TmpUEmgzfVg}{%cQl(SQgd_MFT?I|7`Hq0 zh*D~oE?+?`7Q@q(6$%|5j|b^=8dj?nnM?++U%kZr2M^)(dNH3$L1{E#u~-ZR0}^c; z-?HmBZnE2V?h2pG;dHUh&9`i3_L|sBvPG=C1Z+BfUijS_WTr;xy3Wf)XMaKdk7^b1 z_%!_f0GO`fLgFHHO-Hdu*$5MKBn|*+_(^Y{TH;LDXtB_SJfgNy z)NShZx)`^E9)L-dMn~h#B6O{VDsK`skLucn=9$hNgz3-L)<-PeTEg+6As#V<)8WLK zi3w!0S$y5z7QuzWVXQr0qg2G>*h|mwQ$(_C!PL1aoH}^|DvyZi3{@WGfXgMKllh?U z?0iGvMIJR?hChlDR6k|6ZtM=m&NDE*Bm Date: Wed, 20 Nov 2024 14:13:33 -0700 Subject: [PATCH 08/19] Renumbered labs again --- ...B_AK_01_Lab1_Ex01_Explore_Defender_XDR.md} | 0 ..._02_Lab1_Ex01_Explore_Copilot_Security.md} | 0 ..._AK_03_Lab1_Ex01_Explore_Purview_Audit.md} | 0 ..._04_Lab1_Ex01_Deploy_Defender_Endpoint.md} | 0 ...> LAB_AK_04_Lab1_Ex02_Mitigate_Attacks.md} | 0 ...C.md => LAB_AK_05_Lab1_Ex01_Enable_MDC.md} | 24 +++++++++---------- ....md => LAB_AK_05_Lab1_Ex02_Explore_MDC.md} | 0 ..._Ex1_KQL.md => LAB_AK_06_Lab1_Ex01_KQL.md} | 0 ...=> LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md} | 0 ...> LAB_AK_08_Lab1_Ex01_Connect_Services.md} | 0 ...=> LAB_AK_08_Lab1_Ex02_Connect_Windows.md} | 0 ...d => LAB_AK_08_Lab1_Ex03_Connect_Linux.md} | 0 ...d => LAB_AK_09_Lab1_Ex01_Security_Rule.md} | 0 ...ook.md => LAB_AK_09_Lab1_Ex02_Playbook.md} | 0 ...=> LAB_AK_09_Lab1_Ex03_Scheduled_Query.md} | 0 ...=> LAB_AK_09_Lab1_Ex04_Entity_Behavior.md} | 0 ...acks.md => LAB_AK_09_Lab1_Ex05_Attacks.md} | 0 ...=> LAB_AK_09_Lab1_Ex06_Perform_Attacks.md} | 0 ...s.md => LAB_AK_09_Lab1_Ex07_Detections.md} | 0 ....md => LAB_AK_09_Lab1_Ex08_Investigate.md} | 0 ...x9_ASIM.md => LAB_AK_09_Lab1_Ex09_ASIM.md} | 0 ...ting.md => LAB_AK_10_Lab1_Ex01_Hunting.md} | 0 ...ks.md => LAB_AK_10_Lab1_Ex02_Notebooks.md} | 0 23 files changed, 12 insertions(+), 12 deletions(-) rename Instructions/Labs/{LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md => LAB_AK_01_Lab1_Ex01_Explore_Defender_XDR.md} (100%) rename Instructions/Labs/{LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md => LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md} (100%) rename Instructions/Labs/{LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md => LAB_AK_03_Lab1_Ex01_Explore_Purview_Audit.md} (100%) rename Instructions/Labs/{LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md => LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md} (100%) rename Instructions/Labs/{LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md => LAB_AK_04_Lab1_Ex02_Mitigate_Attacks.md} (100%) rename Instructions/Labs/{LAB_AK_05_Lab1_Ex1_Enable_MDC.md => LAB_AK_05_Lab1_Ex01_Enable_MDC.md} (100%) rename Instructions/Labs/{LAB_AK_05_Lab1_Ex2_Explore_MDC.md => LAB_AK_05_Lab1_Ex02_Explore_MDC.md} (100%) rename Instructions/Labs/{LAB_AK_06_Lab1_Ex1_KQL.md => LAB_AK_06_Lab1_Ex01_KQL.md} (100%) rename Instructions/Labs/{LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md => LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md} (100%) rename Instructions/Labs/{LAB_AK_08_Lab1_Ex1_Connect_Services.md => LAB_AK_08_Lab1_Ex01_Connect_Services.md} (100%) rename Instructions/Labs/{LAB_AK_08_Lab1_Ex2_Connect_Windows.md => LAB_AK_08_Lab1_Ex02_Connect_Windows.md} (100%) rename Instructions/Labs/{LAB_AK_08_Lab1_Ex3_Connect_Linux.md => LAB_AK_08_Lab1_Ex03_Connect_Linux.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex1_Security_Rule.md => LAB_AK_09_Lab1_Ex01_Security_Rule.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex2_Playbook.md => LAB_AK_09_Lab1_Ex02_Playbook.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex3_Scheduled_Query.md => LAB_AK_09_Lab1_Ex03_Scheduled_Query.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex4_Entity_Behavior.md => LAB_AK_09_Lab1_Ex04_Entity_Behavior.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex5_Attacks.md => LAB_AK_09_Lab1_Ex05_Attacks.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex6_Perform_Attacks.md => LAB_AK_09_Lab1_Ex06_Perform_Attacks.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex7_Detections.md => LAB_AK_09_Lab1_Ex07_Detections.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex8_Investigate.md => LAB_AK_09_Lab1_Ex08_Investigate.md} (100%) rename Instructions/Labs/{LAB_AK_09_Lab1_Ex9_ASIM.md => LAB_AK_09_Lab1_Ex09_ASIM.md} (100%) rename Instructions/Labs/{LAB_AK_10_Lab1_Ex1_Hunting.md => LAB_AK_10_Lab1_Ex01_Hunting.md} (100%) rename Instructions/Labs/{LAB_AK_10_Lab1_Ex2_Notebooks.md => LAB_AK_10_Lab1_Ex02_Notebooks.md} (100%) diff --git a/Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md b/Instructions/Labs/LAB_AK_01_Lab1_Ex01_Explore_Defender_XDR.md similarity index 100% rename from Instructions/Labs/LAB_AK_01_Lab1_Ex1_Explore_M365_Defender.md rename to Instructions/Labs/LAB_AK_01_Lab1_Ex01_Explore_Defender_XDR.md diff --git a/Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md b/Instructions/Labs/LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md similarity index 100% rename from Instructions/Labs/LAB_AK_02_Lab1_Ex1_Explore_Copilot_Security.md rename to Instructions/Labs/LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md diff --git a/Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md b/Instructions/Labs/LAB_AK_03_Lab1_Ex01_Explore_Purview_Audit.md similarity index 100% rename from Instructions/Labs/LAB_AK_03_Lab1_Ex1_Explore_Purview_Audit.md rename to Instructions/Labs/LAB_AK_03_Lab1_Ex01_Explore_Purview_Audit.md diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md similarity index 100% rename from Instructions/Labs/LAB_AK_04_Lab1_Ex1_Deploy_Defender_Endpoint.md rename to Instructions/Labs/LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex02_Mitigate_Attacks.md similarity index 100% rename from Instructions/Labs/LAB_AK_04_Lab1_Ex2_Mitigate_Attacks.md rename to Instructions/Labs/LAB_AK_04_Lab1_Ex02_Mitigate_Attacks.md diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md similarity index 100% rename from Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md rename to Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md index 8012eae0..71c65142 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex1_Enable_MDC.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md @@ -16,6 +16,18 @@ You're a Security Operations Analyst working at a company that is implementing c In this task, you create a Log Analytics workspace for use with Azure Monitoring, Microsoft Sentinel and Microsoft Defender for Cloud. +1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. + +1. Open the Microsoft Edge browser or open a new tab if already open. + +1. In the Microsoft Edge browser, navigate to the Azure portal at . + + >**Note:** Select the **Resourses** tab for the *Username* and *Password* for the lab. Use the **** account for this lab. + +1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. + +1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. + 1. In the Search bar of the Azure portal, type *Log Analytics workspaces*, then select the same service name. 1. Select **+Create** from the command bar. @@ -34,18 +46,6 @@ In this task, you create a Log Analytics workspace for use with Azure Monitoring In this task, you'll enable and configure Microsoft Defender for Cloud. -1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. - -1. Open the Microsoft Edge browser or open a new tab if already open. - -1. In the Microsoft Edge browser, navigate to the Azure portal at . - - >**Note:** Select the **Resourses** tab for the *Username* and *Password* for the lab. Use the **** account for this lab. - -1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. - -1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. - 1. In the Search bar of the Microsoft Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. 1. In the left navigation menu for Microsoft Defender for Cloud, expand the Management section , and select **Environment settings**. diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex2_Explore_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md similarity index 100% rename from Instructions/Labs/LAB_AK_05_Lab1_Ex2_Explore_MDC.md rename to Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md diff --git a/Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md b/Instructions/Labs/LAB_AK_06_Lab1_Ex01_KQL.md similarity index 100% rename from Instructions/Labs/LAB_AK_06_Lab1_Ex1_KQL.md rename to Instructions/Labs/LAB_AK_06_Lab1_Ex01_KQL.md diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md b/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md similarity index 100% rename from Instructions/Labs/LAB_AK_07_Lab1_Ex1_Deploy_Sentinel.md rename to Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex01_Connect_Services.md similarity index 100% rename from Instructions/Labs/LAB_AK_08_Lab1_Ex1_Connect_Services.md rename to Instructions/Labs/LAB_AK_08_Lab1_Ex01_Connect_Services.md diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex02_Connect_Windows.md similarity index 100% rename from Instructions/Labs/LAB_AK_08_Lab1_Ex2_Connect_Windows.md rename to Instructions/Labs/LAB_AK_08_Lab1_Ex02_Connect_Windows.md diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md similarity index 100% rename from Instructions/Labs/LAB_AK_08_Lab1_Ex3_Connect_Linux.md rename to Instructions/Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex1_Security_Rule.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex2_Playbook.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex3_Scheduled_Query.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex4_Entity_Behavior.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex05_Attacks.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex5_Attacks.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex05_Attacks.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex06_Perform_Attacks.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex6_Perform_Attacks.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex06_Perform_Attacks.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex7_Detections.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex8_Investigate.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md similarity index 100% rename from Instructions/Labs/LAB_AK_09_Lab1_Ex9_ASIM.md rename to Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex01_Hunting.md similarity index 100% rename from Instructions/Labs/LAB_AK_10_Lab1_Ex1_Hunting.md rename to Instructions/Labs/LAB_AK_10_Lab1_Ex01_Hunting.md diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md similarity index 100% rename from Instructions/Labs/LAB_AK_10_Lab1_Ex2_Notebooks.md rename to Instructions/Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md From 5e8bc5ee0497db8c19dfa0a2e3502c479892d062 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Thu, 5 Dec 2024 10:22:07 -0700 Subject: [PATCH 09/19] Moved content around and added Ignite lab content --- ...K_02_Lab1_Ex01_Explore_Copilot_Security.md | 34 +++++----- .../Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md | 32 ++------- .../Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md | 2 +- .../LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md | 68 +++++++++++++------ .../Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md | 8 +-- .../Labs/LAB_AK_09_Lab1_Ex02_Playbook.md | 13 ++-- .../LAB_AK_09_Lab1_Ex03_Scheduled_Query.md | 40 ++++++----- .../LAB_AK_09_Lab1_Ex04_Entity_Behavior.md | 11 +-- .../Labs/LAB_AK_09_Lab1_Ex07_Detections.md | 2 +- .../Labs/LAB_AK_09_Lab1_Ex08_Investigate.md | 2 +- Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md | 21 +++--- 12 files changed, 123 insertions(+), 114 deletions(-) diff --git a/Instructions/Labs/LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md b/Instructions/Labs/LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md index 5ceb8813..15d04293 100644 --- a/Instructions/Labs/LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md +++ b/Instructions/Labs/LAB_AK_02_Lab1_Ex01_Explore_Copilot_Security.md @@ -1,16 +1,16 @@ --- lab: - title: 'Exercise 1 - Explore use cases in Microsoft Copilot for Security' - module: 'Learning Path 2 - Mitigate threats using Microsoft Copilot for Security' + title: 'Exercise 1 - Explore use cases in Microsoft Security Copilot' + module: 'Learning Path 2 - Mitigate threats using Microsoft Security Copilot' --- # Learning Path 2 - Lab 1 - Exercise 1 - Explore Microsoft Security Copilot ## Lab scenario -The organization you work for wants to increase the efficiency and capabilities for its security operations analysts, and to improve security outcomes. In support of that objective, the office of the CISO determined that deploying Microsoft Copilot for Security is a key step towards that objective. As a Security administrator for your organization, you're tasked with setting up Copilot. +The organization you work for wants to increase the efficiency and capabilities for its security operations analysts, and to improve security outcomes. In support of that objective, the office of the CISO determined that deploying Microsoft Security Copilot is a key step towards that objective. As a Security administrator for your organization, you're tasked with setting up Copilot. -In this exercise, you go through the *first run experience* of Microsoft Copilot for Security to provision Copilot with one security compute unit (SCU). +In this exercise, you go through the *first run experience* of Microsoft Security Copilot to provision Copilot with one security compute unit (SCU). >**Note:** > The environment for this exercise is a simulation generated from the product. As a limited simulation, links on a page may not be enabled and text-based inputs that fall outside of the specified script may not be supported. A pop-up message will display stating, "This feature is not available within the simulation." When this occurs, select OK and continue the exercise steps. @@ -20,7 +20,7 @@ In this exercise, you go through the *first run experience* of Microsoft Copilot ### Task 1: Provision Microsoft Security Copilot -For this exercise, you're logged in as Avery Howard and you have the global administrator role in Microsoft Entra. You'll work in both the Azure portal and Microsoft Copilot for Security. +For this exercise, you're logged in as Avery Howard and you have the global administrator role in Microsoft Entra. You'll work in both the Azure portal and Microsoft Security Copilot. This exercise should take approximately **15** minutes to complete. @@ -62,12 +62,12 @@ As an owner to the Azure subscription, you'll now be able to provision capacity In this task, you go through the steps of provisioning capacity for your organization. There are two options for provisioning capacity: -- Provision capacity within Copilot for Security (recommended) +- Provision capacity within Security Copilot (recommended) - Provision capacity through Azure -For this exercise, you provision capacity through Copilot for Security. When you first open Copilot for Security, a wizard guides you through the steps in setting up capacity for your organization. +For this exercise, you provision capacity through Security Copilot. When you first open Security Copilot, a wizard guides you through the steps in setting up capacity for your organization. -1. Open the simulated environment by selecting this link: **[Microsoft Copilot for Security](https://app.highlights.guide/start/6373500f-1f10-4584-a14e-ca0b4aa7399f?link=0&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. +1. Open the simulated environment by selecting this link: **[Microsoft Security Copilot](https://app.highlights.guide/start/6373500f-1f10-4584-a14e-ca0b4aa7399f?link=0&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. 1. Follow the steps in the Wizard, select **Get started**. 1. On this page, you set up your security capacity. For any of the fields listed below, you can select the information icon for more information. @@ -93,9 +93,9 @@ For this exercise, you provision capacity through Copilot for Security. When you The security administrator for your organization provisioned Copilot. Since you're the senior analyst on the team, the administrator added you as a Copilot owner and asked you to familiarize yourself with the solution. -In this exercise, you explore all the key landmarks in the landing page of the standalone experience of Microsoft Copilot for Security. +In this exercise, you explore all the key landmarks in the landing page of the standalone experience of Microsoft Security Copilot. -You're logged in as Avery Howard and have the Copilot owner role. You'll work in the standalone experience of Microsoft Copilot for Security. +You're logged in as Avery Howard and have the Copilot owner role. You'll work in the standalone experience of Microsoft Security Copilot. This exercise should take approximately **15** minutes to complete. @@ -103,7 +103,7 @@ This exercise should take approximately **15** minutes to complete. In this task, you start your exploration in the home menu. -1. Open the simulated environment by selecting this link: **[Microsoft Copilot for Security](https://app.highlights.guide/start/2cac767e-42c4-4058-afbb-a9413aac461d?link=0&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. +1. Open the simulated environment by selecting this link: **[Microsoft Security Copilot](https://app.highlights.guide/start/2cac767e-42c4-4058-afbb-a9413aac461d?link=0&token=40f793d4-2956-40a4-b11a-6b3d4f92557f&azure-portal=true)**. 1. Select the **Menu** icon ![home menu icon](../media/home-menu-icon.png), which is sometimes referred to as the hamburger icon. @@ -120,9 +120,9 @@ In this task, you start your exploration in the home menu. 1. Select the home menu icon to open the home menu. 1. Select **Owner settings**. These settings are available to you as a Copilot owner. A Copilot contributor does have not access to these menu options. - 1. For plugins for Copilot for Security, select the drop-down for Who can add and manage their own custom plugins to view the available options. + 1. For plugins for Security Copilot, select the drop-down for Who can add and manage their own custom plugins to view the available options. 1. Select drop-down for Who can add and manage custom plugins for everyone in the organization to view the available options. Note, this option is greyed out if Who can add and manage their own custom plugins is set to owners only. - 1. Select the information icon next to "Allow Copilot for Security to access data from your Microsoft 365 Services." This setting must be enabled if you want to use the Microsoft Purview plugin. You'll work with this setting in a later exercise. + 1. Select the information icon next to "Allow Security Copilot to access data from your Microsoft 365 Services." This setting must be enabled if you want to use the Microsoft Purview plugin. You'll work with this setting in a later exercise. 1. Select the drop-down for who can upload files to view the available options. 1. Select the home menu icon to open the home menu. @@ -199,16 +199,16 @@ At the bottom center of the page is the prompt bar. The prompt bar includes the At the bottom right corner of the window is the help icon where you can easily access documentation and find solutions to common problems. From the help icon, you also submit a support case to the Microsoft support team if you have the appropriate role permissions. 1. Select the **Help (?)** icon. - 1. Select **Documentation**. This selection opens a new browser tab to the Microsoft Copilot for Security documentation. Return to the Microsoft Copilot for Security browser tab. + 1. Select **Documentation**. This selection opens a new browser tab to the Microsoft Security Copilot documentation. Return to the Microsoft Security Copilot browser tab. 1. Select **Help**. - 1. Anyone with access to Copilot for Security can access the self help widget by selecting the help icon then selecting the Help tab. Here you can find solutions to common problems by entering something about the problem. + 1. Anyone with access to Security Copilot can access the self help widget by selecting the help icon then selecting the Help tab. Here you can find solutions to common problems by entering something about the problem. 1. Users with a minimum role of Service Support Administrator or Helpdesk Administrator role can submit a support case to the Microsoft support team. If you have this role, a headset icon is displayed. Close the contact support page. ### Task 3: Explore the Microsoft Security Copilot embedded experience In this exercise, you investigate an incident in Microsoft Defender XDR. As part of the investigation, you explore the key features of Microsoft Copilot in Microsoft Defender XDR, including incident summary, device summary, script analysis, and more. You also pivot your investigation to the standalone experience and use the pin board as a way to share details of your investigation with your colleagues. -You're logged in as Avery Howard and have the Copilot owner role. You'll work in Microsoft Defender, using the new unified security operations platform, to access the embedded Copilot capabilities in Microsoft Defender XDR. Towards the end of the exercise, you pivot to the standalone experience of Microsoft Copilot for Security. +You're logged in as Avery Howard and have the Copilot owner role. You'll work in Microsoft Defender, using the new unified security operations platform, to access the embedded Copilot capabilities in Microsoft Defender XDR. Towards the end of the exercise, you pivot to the standalone experience of Microsoft Security Copilot. This exercise should take approximately **30** minutes to complete. @@ -292,6 +292,6 @@ This task is complex and requires the involvement of more senior analysts. In th ## Summary and additional resources -In this exercise, you explored the first run experience of Microsoft Copilot for Security, provisioned capacity, and explored the standalone and embedded experiences of Copilot. You investigated an incident in Microsoft Defender XDR, explored the incident summary, device summary, script analysis, and more. You also pivoted your investigation to the standalone experience and used the pin board as a way to share details of your investigation with your colleagues. +In this exercise, you explored the first run experience of Microsoft Security Copilot, provisioned capacity, and explored the standalone and embedded experiences of Copilot. You investigated an incident in Microsoft Defender XDR, explored the incident summary, device summary, script analysis, and more. You also pivoted your investigation to the standalone experience and used the pin board as a way to share details of your investigation with your colleagues. To run additional Microsoft Security Copilot use case simulations, browse to [Explore Microsoft Security Copilot use case simulations](/training/modules/security-copilot-exercises/) diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md index 71c65142..cb7993a0 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md @@ -10,42 +10,22 @@ lab: You're a Security Operations Analyst working at a company that is implementing cloud workload protections with Microsoft Defender for Cloud. In this lab, you enable Microsoft Defender for Cloud. -### Estimated time to complete this lab: 20 minutes +### Estimated time to complete this lab: 15 minutes -### Task 1: Create a Log Analytics Workspace +### Task 1: Enable Microsoft Defender for Cloud -In this task, you create a Log Analytics workspace for use with Azure Monitoring, Microsoft Sentinel and Microsoft Defender for Cloud. - -1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. +In this task, you'll enable and configure Microsoft Defender for Cloud. -1. Open the Microsoft Edge browser or open a new tab if already open. +1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. 1. In the Microsoft Edge browser, navigate to the Azure portal at . - - >**Note:** Select the **Resourses** tab for the *Username* and *Password* for the lab. Use the **** account for this lab. + + >**Note:** Select the **Resources** tab for the *Username* and *Password* for the lab. Use the **** account for this lab. 1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. 1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. -1. In the Search bar of the Azure portal, type *Log Analytics workspaces*, then select the same service name. - -1. Select **+Create** from the command bar. - -1. Select **Create new** for the Resource group. - -1. Enter *RG-Defender* and select **Ok**. - -1. For the Name, enter something unique like: *uniquenameDefender*. - -1. Select **Review + Create**. - -1. Once the workspace validation has passed, select **Create**. Wait for the new workspace to be provisioned, this may take a few minutes. - -### Task 2: Enable Microsoft Defender for Cloud - -In this task, you'll enable and configure Microsoft Defender for Cloud. - 1. In the Search bar of the Microsoft Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. 1. In the left navigation menu for Microsoft Defender for Cloud, expand the Management section , and select **Environment settings**. diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md index 315f6c0e..827d333f 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md @@ -12,7 +12,7 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Defender for Cloud. You need to respond to recommendations and security alerts generated by Microsoft Defender for Cloud. -### Estimated time to complete this lab: 20 minutes +### Estimated time to complete this lab: 15 minutes ### Task 1: Explore Regulatory Compliance diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md b/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md index 2fa506c7..cde21384 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md +++ b/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md @@ -8,37 +8,65 @@ lab: ## Lab scenario -![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod5_L1_Ex1.png) - You are a Security Operations Analyst working at a company that is implementing Microsoft Sentinel. You are responsible for setting up the Microsoft Sentinel environment to meet the company requirement to minimize cost, meet compliance regulations, and provide the most manageable environment for your security team to perform their daily job responsibilities. -### Task 1: Initialize the Microsoft Sentinel Workspace - -In this task, you will create a Microsoft Sentinel workspace. +### Task 1 - Create a Log Analytics workspace -1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. +Create a Log Analytics workspace, including region option. Learn more about [onboarding Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/quickstart-onboard). -1. Open the Edge browser. +1. Log in to **WIN1** virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Edge browser, navigate to the Azure portal at . +1. In the Microsoft Edge browser, navigate to the Azure portal at . + + >**Note:** Select the **Resourses** tab for the *Username* and *Password* for the lab. Use the **** account for this lab. -1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. +1. In the **Sign in** dialog box, copy, and paste in the tenant Email account for the admin username provided by your lab hosting provider and then select **Next**. -1. In the **Enter password** dialog box, copy and paste in the **Tenant Password** provided by your lab hosting provider and then select **Sign in**. +1. In the **Enter password** dialog box, copy, and paste in the admin's tenant password provided by your lab hosting provider and then select **Sign in**. -1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. +1. In the Search bar of the Azure portal, type "Microsoft Sentinel", then select 1. Select **+ Create**. -1. Next, select the Log Analytics workspace you created earlier, for example *uniquenameDefender* and select **Add**. The activation could take a few minutes. +1. Select **Create a new workspace**. + +1. Select **Create new** for the Resource group. + +1. Enter *RG-Defender* and select **Ok**. + +1. For the Name, enter something unique like: *uniquenameDefender*. + +1. You can leave the default region for the workspace. + +1. Select **Review + create** to validate the new workspace. + +1. Select **Create** to deploy the workspace. + +### Task 2 - Deploy Microsoft Sentinel to a workspace + +Deploy Microsoft Sentinel to the workspace. - >**Note:** If you do not see a Log Analytics workspace here, please refer to Module 3, Exercise 1, Task 2 to create one. +1. When the workspace deployment completes, select **Refresh** to display the new workspace. -1. In **Microsoft Sentinel** you should be in the **General** section *News & Guides* and see a notice stating *Microsoft Sentinel free trial activated*. Press the **OK** button. +1. Select the workspace you want to add Sentinel to (created in Task 1). -1. Navigate around the newly created Microsoft Sentinel workspace to become familiar with the user interface options. +1. Select **Add**. -### Task 2: Create a Watchlist +### Task 3 - Configure data retention + +1. In the Microsoft Azure "breadcrumb" menu, select **Home**. + +1. In the Search bar of the Azure portal, type "Log Analytics" and select the workspace created in Task 1. + +1. Expand the *Settings* section in the navigation menu and select **Usage and estimated costs**. + +1. Select **Data retention**. + +1. Change data retention period to **180 days**. + +1. Select **OK**. + +### Task 4: Create a Watchlist In this task, you will create a watchlist in Microsoft Sentinel. @@ -87,13 +115,12 @@ In this task, you will create a watchlist in Microsoft Sentinel. 1. Select the *HighValueHosts* watchlist and on the right pane, select **View in logs**. >**Important:** It could take up to ten minutes for the watchlist to appear. **Please continue to with the following task and run this command on the next lab**. - + >**Note:** You can now use the _GetWatchlist('HighValueHosts') in your own KQL statements to access the list. The column to reference would be *Hostname*. 1. Close the *Logs* window by selecting the 'x' in the top-right and select **OK** to discard the unsaved edits. - -### Task 3: Create a Threat Indicator +### Task 5: Create a Threat Indicator In this task, you will create an indicator in Microsoft Sentinel. @@ -132,8 +159,7 @@ In this task, you will create an indicator in Microsoft Sentinel. | project DomainName ``` - -### Task 4: Configure log retention +### Task 6: Configure log retention In this task, you will change the retention period for the SecurityEvent table. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md index 86ce4a95..edb73c35 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md @@ -34,16 +34,16 @@ In this task, you will activate a Microsoft Security rule. 1. Select the **+ Create** button from the command bar and select **Microsoft incident creation rule**. -1. Under *Name*, enter **Create incidents based on Defender for Endpoint**. +1. Under *Name*, enter **Create incidents based on Defender for Cloud**. -1. Scroll down and under *Microsoft security service* select **Microsoft Defender for Endpoint**. +1. Scroll down and under *Microsoft security service* select **Microsoft Defender for Cloud**. 1. Under *Filter by Severity*, select the *Custom* option and select **Low**, **Medium** and **High** for the severity level and go back to the rule. 1. Select the **Next: Automated response** button and then select the **Next: Review and create** button. -1. Review the changes made and select the **Save** button. The Analytics rule will be saved and incidents will be created if there is an Alert in Defender for Endpoint. +1. Review the changes made and select the **Save** button. The Analytics rule will be saved and incidents will be created if there is an Alert in Defender for Cloud. -1. You will now have the one *Fusion* and two *Microsoft Security* alert types. +1. You will now have the one *Fusion* and one *Microsoft Security* alert types. ## Proceed to Exercise 2 diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md index 903047a3..5f41cda3 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md @@ -36,7 +36,7 @@ In this task, you'll create a Logic App that is used as a Playbook in Microsoft 1. Once installed, select Manage. -1. Find the **Defender_XDR_Ransomware_Playbook_for_SecOps_Tasks** playbook and select it. +1. Find the **Defender_XDR_Ransomware_Playbook_for_SecOps-Tasks** playbook and select the name. 1. Select the **Incident tasks - Microsoft Defender XDR Ransomware Playbook for SecOps** template. @@ -98,7 +98,9 @@ In this task, you’ll update the new playbook you created with the proper conne 1. From the drop down, select Tactics. -1. Select the following: +1. Select the **Contains** operator from the dropdown. + +1. Select the following tactics: - Reconnaissance - Execution - Persistence @@ -108,13 +110,14 @@ In this task, you’ll update the new playbook you created with the proper conne 1. Under Actions, select Run Playbook. -1. Select Manage playbook permissions. +1. Select the link to **Manage playbook permissions**. -1. Find the resource group, select it, and select apply. +1. On the *Manage Permissions* page, select the **RG-Playbooks** resource group you created in the previous lab, and select **Apply**. 1. From the drop down list, select the **Defender_XDR_Ransomware_Playbook_SecOps_Tasks** playbook. -1. Select Apply at the bottom. +1. Select **Apply** at the bottom. + From here, depending on your role, you will either continue doing more architect exercises or you will pivot to the analyst exercises. ## Proceed to Exercise 3 diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md index f73713ab..6e613e59 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md @@ -8,8 +8,6 @@ lab: ## Lab scenario -![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod7_L1_Ex3.png) - You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to detect and mitigate threats using Microsoft Sentinel. After connecting your data sources to Microsoft Sentinel, you create custom analytics rules to help discover threats and anomalous behaviors in your environment. Analytics rules search for specific events or sets of events across your environment, alert you when certain event thresholds or conditions are reached, generate incidents for your SOC to triage and investigate, and respond to threats with automated tracking and reMediation processes. @@ -61,31 +59,41 @@ In this task, you create a scheduled query and connect it to the Teams channel y 1. Under the *Event grouping* area, leave the **Group all events into a single alert** as the selected option since we want to generate a single alert every time it runs, as long as the query returns more results than the specified alert threshold above. -1. Select the **Next: Incident settings >** button. +1. Select the **Next: Incident settings >** button. 1. On the *Incident settings* tab, review the default options. 1. Select the **Next: Automated response >** button. -1. On the *Automated response* tab under *Automation rules*, select **+ Add new**. +1. Select the **Next: Review and create >** button. + +1. Select **Save**. -1. For the *Automation rule name*, enter **Tier 2**. +### Task 2: Edit your new rule -1. For the *Actions*, select **Assign owner**. +1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Then select **Assign to me**. Then select **+ Add action**. +1. Select your Microsoft Sentinel Workspace. -1. Use the *And then* drop-down menus to select **Run playbook** +1. Select **Analytics** from the Configuration area. -1. A second drop-down menu appears with an *Information (i)* message regarding playbook permissions and a **Manage playbook permissions link** +1. Make sure that you are in the *Active rules* tab in the command bar and select the **New CloudShell User** rule. - >**Note:** The playbooks will appear grayed out in the drop-down list until permissions are configured. +1. Right click the rule and select **Edit** from the *pop-up* menu. -1. Select the **Manage playbook permissions link** +1. Select the **Next: Set rule logic >** button. -1. On the *Manage Permissions* page, select the **RG-Playbooks** resource group you created in the previous lab, and select **Apply**. +1. Select the **Next: Incident settings >** button. -1. From the drop-down menu, select the playbook **PostMessageTeams-OnIncident** you created in the previous exercise. +1. Select the **Next: Automated response >** button. + +1. On the *Automated response* tab under *Automation rules*, select **+ Add new**. + +1. For the *Automation rule name*, enter **Tier 2**. + +1. For the *Actions*, select **Assign owner**. + +1. Then select **Assign to me**. 1. Select **Apply** @@ -93,8 +101,7 @@ In this task, you create a scheduled query and connect it to the Teams channel y 1. Select **Save**. - -### Task 2: Test your new rule +### Task 3: Test your new rule In this task, you test your new scheduled query rule. @@ -128,7 +135,4 @@ In this task, you test your new scheduled query rule. 1. Select the Incident and review the information in the right blade. -1. Go back to Microsoft Teams by selecting the tab in your Microsoft Edge browser. If you closed it, just open a new tab and type . Go to the *SOC* Teams, select the *New Alerts* channel and see the message post about the incident. - - ## Proceed to Exercise 4 diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md index 64632ddb..483a0468 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md @@ -34,16 +34,9 @@ In this task, you will explore Entity behavior analytics in Microsoft Sentinel. 1. On the popup from *Entity behavior settings*, select **Set UEBA**. -1. On the *Settings* tab under *Entity behaviour analytics*, select **Set UEBA**. - -1. Review the three pre-requisite steps to enable entity behavior analytics. - -1. Close the *Entity behavior configuration* page by selecting the 'x' at the top right of the page. - -1. Scroll down the *Settings* tab to the *Anomalies* sectiom and read through the paragraph. - -1. Select **Go to analytics in oder to configure the anomalies**. +1. On the *Settings* tab under *Entity behaviour analytics*, scroll down the *Anomalies* section and verify read through the paragraph, and verify that the *switch* is *On*. +1. Select the **Go to analytics in oder to configure the anomalies** link. ### Task 2: Confirm and review Anomalies rules diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md index c043349a..45b124f2 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md @@ -24,7 +24,7 @@ In this task, you will create a detection for the first attack of the previous e 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md index f5fcaaa0..2a342bc3 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md @@ -22,7 +22,7 @@ In this task, you will investigate an incident. 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md index 9d6e746b..a8abcc01 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md @@ -10,7 +10,7 @@ lab: ![Lab overview.](../Media/SC-200-Lab_Diagrams_Mod7_L1_Ex9.png) -You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You need to model ASIM parsers for a specific Windows registry event. These parsers will be finalized at a later time following the [Advanced Security Information Model (ASIM) Registry Event normalization schema reference](https://docs.microsoft.com/en-us/azure/sentinel/registry-event-normalization-schema). +You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You need to model ASIM parsers for a specific Windows registry event. These parsers will be finalized at a later time following the [Advanced Security Information Model (ASIM) Registry Event normalization schema reference](https://docs.microsoft.com/azure/sentinel/registry-event-normalization-schema). ### Estimated time to complete this lab: 30 minutes @@ -20,7 +20,7 @@ In this task, you'll review the Registry Schema parsers that are included with t 1. Log in to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Microsoft Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Microsoft Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy, and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md index f50392dc..330ed3b8 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md @@ -22,7 +22,7 @@ In this task, you will explore the Microsoft Sentinel workbook templates. 1. Login to WIN1 virtual machine as Admin with the password: **Pa55w.rd**. -1. In the Edge browser, navigate to the Azure portal at https://portal.azure.com. +1. In the Edge browser, navigate to the Azure portal at . 1. In the **Sign in** dialog box, copy and paste in the **Tenant Email** account provided by your lab hosting provider and then select **Next**. @@ -32,20 +32,23 @@ In this task, you will explore the Microsoft Sentinel workbook templates. 1. Select your Microsoft Sentinel Workspace. -1. Select **Workbooks** under the *Threat Management* left blade. The *Templates* tab is selected by default. +1. Select **Workbooks** under the *Threat Management* section of the navigation menu. -1. Search for and select the **Azure Activity** template workbook. In the right pane, scroll down and select the **View template** button. +1. Select the *Templates* tab, and search for and select the **Azure Activity** template workbook. + +1. In the right details pane, scroll down and select the **View template** button. 1. Review the contents of the workbook. It shows insights of your Azure subscription operations by collecting and analyzing the data from the Activity Log. 1. Close the workbook by selecting the **X** in the top-right corner. - ### Task 2: Save and modify a workbook template In this task, you will save a workbook template and modify it. -1. You should be back in the **Microsoft Sentinel - Workbooks - Templates** tab. Scroll down again and select the **Save** button for the *Azure Activity* workbook. +1. You should be back in the **Microsoft Sentinel | Workbooks | Templates** tab with the *Azure Activity* workbook still selected. + +1. Scroll down again and select the **Save** button in the *Azure Activity* workbook details pane. 1. Leave **East US** as the default value for *Region* and select **OK**. @@ -53,7 +56,7 @@ In this task, you will save a workbook template and modify it. 1. Select **Edit** in the command bar to enable changes in the workbook. -1. Scroll down to the *Caller activities over time* area, look at the color of the *Activities* column since we are going to format those columns. Select the **Edit** button below the grid. +1. Scroll down to the *Caller activities* area, look at the color of the *Activities* column since we are going to format those columns. Select the **Edit** button below the grid. 1. Select the **Column Settings** button, it is located to the right of the *Run Query* command bar. **Hint:** This button only appears if there is data from the KQL query. @@ -61,7 +64,7 @@ In this task, you will save a workbook template and modify it. 1. Change the value for *Column renderer* to **Heatmap**. For *Color palette*, scroll down to select **32-color categorical**. -1. Select **Save and Close**. Notice the change in the *Activities* column. +1. Select **Apply**, then **Save and Close**. Notice the change in the *Activities* column. 1. Select **Done Editing** at the bottom of the query (not the top menu). @@ -110,7 +113,7 @@ In this task, you will create a new workbook with advanced visualizations. 1. Now select **Advanced Settings** tab from the query's command bar. -1. Select **Show refresh icon when not editing** box. +1. Select **Show refresh icon when not editing** box. 1. Scroll down and select **Done Editing** on the bottom menu, for the new *Editing query item: query - 2*. @@ -136,7 +139,7 @@ In this task, you will create a new workbook with advanced visualizations. 1. Select the **RG-Defender** resource group if needed and leave other values as default. -1. Select **Apply** to commit the changes. +1. Select **Apply** to commit the changes. 1. Close the workbook by selecting the **X** at the top-right or select **Workbooks** in the Microsoft Sentinel portal. From 78fcfcf0ab7d6b8cf8f636a284de911e5aca898f Mon Sep 17 00:00:00 2001 From: Ken Lawson <36929766+KenMAG@users.noreply.github.com> Date: Wed, 11 Dec 2024 08:22:36 -0700 Subject: [PATCH 10/19] Create placeholder.md File to be deleted --- Allfiles/Bicep/placeholder.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 Allfiles/Bicep/placeholder.md diff --git a/Allfiles/Bicep/placeholder.md b/Allfiles/Bicep/placeholder.md new file mode 100644 index 00000000..8b137891 --- /dev/null +++ b/Allfiles/Bicep/placeholder.md @@ -0,0 +1 @@ + From b3ebea5a5f19bd73948e2151e6fc212f0514af5f Mon Sep 17 00:00:00 2001 From: Ken Lawson <36929766+KenMAG@users.noreply.github.com> Date: Wed, 11 Dec 2024 08:26:07 -0700 Subject: [PATCH 11/19] Add files via upload --- .../Create-NewSolutionAndRulesFromList.ps1 | 226 ++++++++++++++++++ 1 file changed, 226 insertions(+) create mode 100644 Allfiles/Bicep/Create-NewSolutionAndRulesFromList.ps1 diff --git a/Allfiles/Bicep/Create-NewSolutionAndRulesFromList.ps1 b/Allfiles/Bicep/Create-NewSolutionAndRulesFromList.ps1 new file mode 100644 index 00000000..e4c8eb11 --- /dev/null +++ b/Allfiles/Bicep/Create-NewSolutionAndRulesFromList.ps1 @@ -0,0 +1,226 @@ +param( + [Parameter(Mandatory = $true)][string]$ResourceGroup, + [Parameter(Mandatory = $true)][string]$Workspace, + [Parameter(Mandatory = $true)][string]$Region, + [Parameter(Mandatory = $true)][string[]]$Solutions, + [Parameter(Mandatory = $true)][string]$SubscriptionId, + [Parameter(Mandatory = $true)][string]$TenantId, + [Parameter(Mandatory = $true)][string]$Identity, + [Parameter(Mandatory = $false)][string]$Buffer +) + +Write-Output "Resource Group: $ResourceGroup" +Write-Output "Workspace: $Workspace" +Write-Output "Region: $Region" +Write-Output "Solutions: $Solutions" +Write-Output "SubscriptionId: $SubscriptionId" +Write-Output "TenantId: $TenantId" +Write-Output "Identity: $Identity" +Write-Output "Buffer: " $Buffer + +$VerbosePreference = "Continue" + +Connect-AzAccount -Identity -AccountId $Identity + +$SeveritiesToInclude = @("informational", "low", "medium", "high") +$apiVersion = "?api-version=2024-03-01" +$instanceProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile +$profileClient = New-Object -TypeName Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient -ArgumentList ($instanceProfile) +$token = $profileClient.AcquireAccessToken($TenantId) +$authHeader = @{ + 'Content-Type' = 'application/json' + 'Authorization' = 'Bearer ' + $token.AccessToken +} + +$serverUrl = "https://management.azure.com" +$baseUri = $serverUrl + $SubscriptionId + "/resourceGroups/${ResourceGroup}/providers/Microsoft.OperationalInsights/workspaces/${Workspace}" +$alertUri = "$baseUri/providers/Microsoft.SecurityInsights/alertRules/" + +Write-Output " Base Uri: $baseUri" + +# Get a list of all the solutions +$url = $baseUri + "/providers/Microsoft.SecurityInsights/contentProductPackages" + $apiVersion + +Write-Output " Content Product Packages Uri: $url" + +$allSolutions = (Invoke-RestMethod -Method "Get" -Uri $url -Headers $authHeader ).value + +Write-Output "Number of solutions: " ($allSolutions.count) + +#Deploy each single solution +foreach ($deploySolution in $Solutions) { + Write-Output "Deploy Solution: $deploySolution" + if ($deploySolution.StartsWith("[")) + { + $deploySolution = $deploySolution.Substring(1) + } + Write-Output "Deploy Solution: $deploySolution" + $singleSolution = $allSolutions | Where-Object { $_.properties.displayName -Contains $deploySolution } + if ($null -eq $singleSolution) { + Write-Error "Unable to get find solution with name $deploySolution" + } + else { + $solutionURL = $baseUri + "/providers/Microsoft.SecurityInsights/contentProductPackages/$($singleSolution.name)" + $apiVersion + $solution = (Invoke-RestMethod -Method "Get" -Uri $solutionURL -Headers $authHeader ) + Write-Output "Solution name: " $solution.name + $packagedContent = $solution.properties.packagedContent + #Some of the post deployment instruction contains invalid characters and since this is not displayed anywhere + #get rid of them. + foreach ($resource in $packagedContent.resources) { + if ($null -ne $resource.properties.mainTemplate.metadata.postDeployment ) { + $resource.properties.mainTemplate.metadata.postDeployment = $null + } + } + $installBody = @{"properties" = @{ + "parameters" = @{ + "workspace" = @{"value" = $Workspace } + "workspace-location" = @{"value" = $Region } + } + "template" = $packagedContent + "mode" = "Incremental" + } + } + $deploymentName = ("allinone-" + $solution.name) + if ($deploymentName.Length -ge 64) { + $deploymentName = $deploymentName.Substring(0, 64) + } + $installURL = $serverUrl + $SubscriptionId + "/resourcegroups/$($ResourceGroup)/providers/Microsoft.Resources/deployments/" + $deploymentName + $apiVersion + Write-Output "Deploying solution: $deploySolution" + Write-Output "Deploy URL: $installURL" + + try { + Invoke-RestMethod -Uri $installURL -Method Put -Headers $authHeader -Body ($installBody | ConvertTo-Json -EnumsAsStrings -Depth 50 -EscapeHandling EscapeNonAscii) + Write-Output "Deployed solution: $deploySolution" + } + catch { + $errorReturn = $_ + Write-Error $errorReturn + } + } + +} + +##### +#create rules from any rule templates that came from solutions +##### + +if (($SeveritiesToInclude -eq "None") -or ($null -eq $SeveritiesToInclude)) { + Exit +} + +#Give the system time to update all the needed databases before trying to install the rules. +Start-Sleep -Seconds 60 + +#URL to get all the needed Analytic Rule templates +$solutionURL = $baseUri + "/providers/Microsoft.SecurityInsights/contentTemplates" + $apiVersion +#Add a filter only return analytic rule templates +$solutionURL += "&%24filter=(properties%2FcontentKind%20eq%20'AnalyticsRule')&%24expand=properties/mainTemplate" + +Write-Output "Solution URL: $solutionURL" + +$results = (Invoke-RestMethod -Uri $solutionURL -Method Get -Headers $authHeader).value + +$BaseAlertUri = $baseUri + "/providers/Microsoft.SecurityInsights/alertRules/" +$BaseMetaURI = $baseURI + "/providers/Microsoft.SecurityInsights/metadata/analyticsrule-" + +Write-Output "Results: " ($results.count) + +Write-Output "Severities to include... $SeveritiesToInclude" + +#Iterate through all the rule templates + foreach ($result in $results ) { + #Make sure that the template's severity is one we want to include + $severity = $result.properties.mainTemplate.resources.properties[0].severity + Write-Output "Rule Template's severity is... $severity " + if ($SeveritiesToInclude.Contains($severity.ToLower())) { + Write-Output "Enabling alert rule template... " $result.properties.template.resources.properties.displayName + + $templateVersion = $result.properties.mainTemplate.resources.properties[1].version + $template = $result.properties.mainTemplate.resources.properties[0] + $kind = $result.properties.mainTemplate.resources.kind + $displayName = $template.displayName + $eventGroupingSettings = $template.eventGroupingSettings + if ($null -eq $eventGroupingSettings) { + $eventGroupingSettings = [ordered]@{aggregationKind = "SingleAlert" } + } + $body = "" + $properties = $result.properties.mainTemplate.resources[0].properties + $properties.enabled = $true + #Add the field to link this rule with the rule template so that the rule template will show up as used + #We had to use the "Add-Member" command since this field does not exist in the rule template that we are copying from. + $properties | Add-Member -NotePropertyName "alertRuleTemplateName" -NotePropertyValue $result.properties.mainTemplate.resources[0].name + $properties | Add-Member -NotePropertyName "templateVersion" -NotePropertyValue $result.properties.mainTemplate.resources[1].properties.version + + + #Depending on the type of alert we are creating, the body has different parameters + switch ($kind) { + "MicrosoftSecurityIncidentCreation" { + $body = @{ + "kind" = "MicrosoftSecurityIncidentCreation" + "properties" = $properties + } + } + "NRT" { + $body = @{ + "kind" = "NRT" + "properties" = $properties + } + } + "Scheduled" { + $body = @{ + "kind" = "Scheduled" + "properties" = $properties + } + + } + Default { } + } + #If we have created the body... + if ("" -ne $body) { + #Create the GUId for the alert and create it. + $guid = (New-Guid).Guid + #Create the URI we need to create the alert. + $alertUri = $BaseAlertUri + $guid + "?api-version=2022-12-01-preview" + try { + Write-Output "Attempting to create rule $($displayName)" + $verdict = Invoke-RestMethod -Uri $alertUri -Method Put -Headers $authHeader -Body ($body | ConvertTo-Json -EnumsAsStrings -Depth 50) + #Invoke-RestMethod -Uri $installURL -Method Put -Headers $authHeader -Body ($installBody | ConvertTo-Json -EnumsAsStrings -Depth 50) + Write-Output "Succeeded" + $solution = $allSolutions.properties | Where-Object -Property "contentId" -Contains $result.properties.packageId + $metabody = @{ + "apiVersion" = "2022-01-01-preview" + "name" = "analyticsrule-" + $verdict.name + "type" = "Microsoft.OperationalInsights/workspaces/providers/metadata" + "id" = $null + "properties" = @{ + "contentId" = $result.properties.mainTemplate.resources[0].name + "parentId" = $verdict.id + "kind" = "AnalyticsRule" + "version" = $templateVersion + "source" = $solution.source + "author" = $solution.author + "support" = $solution.support + } + } + Write-Output " Updating metadata...." + $metaURI = $BaseMetaURI + $verdict.name + "?api-version=2022-01-01-preview" + $metaVerdict = Invoke-RestMethod -Uri $metaURI -Method Put -Headers $authHeader -Body ($metabody | ConvertTo-Json -EnumsAsStrings -Depth 5) + Write-Output "Succeeded" + } + catch { + #The most likely error is that there is a missing dataset. There is a new + #addition to the REST API to check for the existance of a dataset but + #it only checks certain ones. Hope to modify this to do the check + #before trying to create the alert. + $errorReturn = $_ + Write-Error $errorReturn + Write-Output $errorReturn + } + #This pauses for 5 second so that we don't overload the workspace. + Start-Sleep -Seconds 1 + } + else { + Write-Outout "No body created" + } + } + } From c0912301e49f349057ca54b93756bdb247a9c971 Mon Sep 17 00:00:00 2001 From: Ken Lawson <36929766+KenMAG@users.noreply.github.com> Date: Wed, 11 Dec 2024 08:30:40 -0700 Subject: [PATCH 12/19] Update and rename placeholder.md to Readme.md --- Allfiles/Bicep/Readme.md | 3 +++ Allfiles/Bicep/placeholder.md | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 Allfiles/Bicep/Readme.md delete mode 100644 Allfiles/Bicep/placeholder.md diff --git a/Allfiles/Bicep/Readme.md b/Allfiles/Bicep/Readme.md new file mode 100644 index 00000000..67a36609 --- /dev/null +++ b/Allfiles/Bicep/Readme.md @@ -0,0 +1,3 @@ +## Folder for Bicep & PowerShell files + +Use to pre-install Microsoft Sentinel and Content Hub Solutions diff --git a/Allfiles/Bicep/placeholder.md b/Allfiles/Bicep/placeholder.md deleted file mode 100644 index 8b137891..00000000 --- a/Allfiles/Bicep/placeholder.md +++ /dev/null @@ -1 +0,0 @@ - From ca374132b19ccf6323fb87a1f963dc86eea54369 Mon Sep 17 00:00:00 2001 From: Ken Lawson <36929766+KenMAG@users.noreply.github.com> Date: Wed, 11 Dec 2024 08:31:18 -0700 Subject: [PATCH 13/19] Add files via upload --- Allfiles/Bicep/Sentinel.bicep | 133 +++++++++++++++++++++++ Allfiles/Bicep/sentinelParams.bicepparam | 12 ++ 2 files changed, 145 insertions(+) create mode 100644 Allfiles/Bicep/Sentinel.bicep create mode 100644 Allfiles/Bicep/sentinelParams.bicepparam diff --git a/Allfiles/Bicep/Sentinel.bicep b/Allfiles/Bicep/Sentinel.bicep new file mode 100644 index 00000000..2b5169f5 --- /dev/null +++ b/Allfiles/Bicep/Sentinel.bicep @@ -0,0 +1,133 @@ +targetScope = 'resourceGroup' + +@description('Specifies the name of the client who needs Sentinel.') +param workspaceName string + +@description('Specifies the number of days to retain data.') +param retentionInDays int + +@description('Which solutions to deploy automatically') +param contentSolutions string[] + +var subscriptionId = subscription().id +var location = resourceGroup().location +//Sentinel Contributor role GUID +var roleDefinitionId = 'ab8e14d6-4a74-4a29-9ba8-549422addade' + +// Create the Log Analytics Workspace +resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = { + name: workspaceName + location: location + properties: { + retentionInDays: retentionInDays + } +} + +// Create Microsoft Sentinel on the Log Analytics Workspace +resource sentinel 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = { + name: 'SecurityInsights(${workspaceName})' + location: location + properties: { + workspaceResourceId: workspace.id + } + plan: { + name: 'SecurityInsights(${workspaceName})' + product: 'OMSGallery/SecurityInsights' + promotionCode: '' + publisher: 'Microsoft' + } +} + +// Onboard Sentinel after it has been created +resource onboardingStates 'Microsoft.SecurityInsights/onboardingStates@2022-12-01-preview' = { + scope: workspace + name: 'default' +} + +/* +// Enable the Entity Behavior directory service +resource EntityAnalytics 'Microsoft.SecurityInsights/settings@2023-02-01-preview' = { + name: 'EntityAnalytics' + kind: 'EntityAnalytics' + scope: workspace + properties: { + entityProviders: ['AzureActiveDirectory'] + } + dependsOn: [ + onboardingStates + ] +} + +// Enable the additional UEBA data sources +resource uebaAnalytics 'Microsoft.SecurityInsights/settings@2023-02-01-preview' = { + name: 'Ueba' + kind: 'Ueba' + scope: workspace + properties: { + dataSources: ['AuditLogs', 'AzureActivity', 'SigninLogs', 'SecurityEvent'] + } + dependsOn: [ + EntityAnalytics + ] +} +*/ + +//Create the user identity to interact with Azure +@description('The user identity for the deployment script.') +resource scriptIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { + name: 'script-identity' + location: location +} + +//Pausing for 5 minutes to allow the new user identity to propagate +resource pauseScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = { + name: 'pauseScript' + location: resourceGroup().location + kind: 'AzurePowerShell' + properties: { + azPowerShellVersion: '12.2.0' + scriptContent: 'Start-Sleep -Seconds 300' + timeout: 'PT30M' + cleanupPreference: 'OnSuccess' + retentionInterval: 'PT1H' + } + dependsOn: [ + scriptIdentity + ] +} + +//Assign the Sentinel Contributor rights on the Resource Group to the User Identity that was just created +resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { + name: guid(resourceGroup().name, roleDefinitionId) + properties: { + roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId) + principalId: scriptIdentity.properties.principalId + } + dependsOn: [ + pauseScript + ] +} + +// Call the external PowerShell script to deploy the solutions and rules +resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = { + name: 'deploySolutionsScript' + location: resourceGroup().location + kind: 'AzurePowerShell' + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${scriptIdentity.id}': {} + } + } + properties: { + azPowerShellVersion: '12.2.0' + arguments: '-ResourceGroup ${resourceGroup().name} -Workspace ${workspaceName} -Region ${resourceGroup().location} -Solutions ${contentSolutions} -SubscriptionId ${subscriptionId} -TenantId ${subscription().tenantId} -Identity ${scriptIdentity.properties.clientId} ' + scriptContent: loadTextContent('./Create-NewSolutionAndRulesFromList.ps1') + timeout: 'PT30M' + cleanupPreference: 'OnSuccess' + retentionInterval: 'P1D' + } + dependsOn: [ + roleAssignment + ] +} diff --git a/Allfiles/Bicep/sentinelParams.bicepparam b/Allfiles/Bicep/sentinelParams.bicepparam new file mode 100644 index 00000000..b60dad02 --- /dev/null +++ b/Allfiles/Bicep/sentinelParams.bicepparam @@ -0,0 +1,12 @@ +using './Sentinel.bicep' + +param workspaceName = 'defenderworkspace' +param retentionInDays = 90 +param contentSolutions = [ + 'Microsoft Defender For Cloud' + 'Sentinel SOAR Essentials' + 'Azure Activity' + 'Windows Security Events' + 'Common Event Format' + 'Syslog' +] From 856336461e3eeee27af3a494baaa8a7c5ba73e73 Mon Sep 17 00:00:00 2001 From: Ken Lawson <36929766+KenMAG@users.noreply.github.com> Date: Wed, 11 Dec 2024 10:59:07 -0700 Subject: [PATCH 14/19] Update Readme.md --- Allfiles/Bicep/Readme.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Allfiles/Bicep/Readme.md b/Allfiles/Bicep/Readme.md index 67a36609..f3add1a8 100644 --- a/Allfiles/Bicep/Readme.md +++ b/Allfiles/Bicep/Readme.md @@ -1,3 +1,8 @@ ## Folder for Bicep & PowerShell files -Use to pre-install Microsoft Sentinel and Content Hub Solutions +Use to pre-install Microsoft Sentinel and Content Hub Solutions from WIN1. + +### Instructions: + +1. Create a *Resource Group*. + From 73ce8656e2333fcbb144a10afe33b3dd5b9ad082 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Wed, 11 Dec 2024 11:18:31 -0700 Subject: [PATCH 15/19] Updated Readme --- Allfiles/Bicep/Readme.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/Allfiles/Bicep/Readme.md b/Allfiles/Bicep/Readme.md index 67a36609..56d7d9c4 100644 --- a/Allfiles/Bicep/Readme.md +++ b/Allfiles/Bicep/Readme.md @@ -1,3 +1,21 @@ ## Folder for Bicep & PowerShell files Use to pre-install Microsoft Sentinel and Content Hub Solutions + +### Instructions + +1. Create a *Resource Group* for the deployment. + +```azurecli + az group create --location eastus --resource-group defender-RG +``` + +1. Deploy the Bicep template. + +```azurecli +az deployment group create --name testDeploy --template-file .\sentinel.bicep --parameters .\sentinelParams.bicepparam --resource-group defender-RG +``` + +### Additional Information + +See the following *Microsoft Tech Community* blog post for more information: [Deploy Microsoft Sentinel using Bicep](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/deploy-microsoft-sentinel-using-bicep/4270970) From 0bd86126610aacc3093fd7549c31bb984940b7b4 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Wed, 11 Dec 2024 11:20:40 -0700 Subject: [PATCH 16/19] Fixed merge mess --- Allfiles/Bicep/Readme.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/Allfiles/Bicep/Readme.md b/Allfiles/Bicep/Readme.md index 40ba3db6..b1b5c074 100644 --- a/Allfiles/Bicep/Readme.md +++ b/Allfiles/Bicep/Readme.md @@ -2,11 +2,6 @@ Use to pre-install Microsoft Sentinel and Content Hub Solutions from WIN1. -### Instructions: - -1. Create a *Resource Group*. - - ### Instructions 1. Create a *Resource Group* for the deployment. From e79b74b1f29c38cf0bbde2052fb109bba3889fd7 Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Wed, 11 Dec 2024 12:34:29 -0700 Subject: [PATCH 17/19] Updated md code. --- Allfiles/Bicep/Readme.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Allfiles/Bicep/Readme.md b/Allfiles/Bicep/Readme.md index b1b5c074..d5e44763 100644 --- a/Allfiles/Bicep/Readme.md +++ b/Allfiles/Bicep/Readme.md @@ -6,15 +6,15 @@ Use to pre-install Microsoft Sentinel and Content Hub Solutions from WIN1. 1. Create a *Resource Group* for the deployment. -```azurecli - az group create --location eastus --resource-group defender-RG -``` + ```azurecli + az group create --location eastus --resource-group defender-RG + ``` 1. Deploy the Bicep template. -```azurecli -az deployment group create --name testDeploy --template-file .\sentinel.bicep --parameters .\sentinelParams.bicepparam --resource-group defender-RG -``` + ```azurecli + az deployment group create --name testDeploy --template-file .\sentinel.bicep --parameters .\sentinelParams.bicepparam --resource-group defender-RG + ``` ### Additional Information From 08856ffa3ea3d5aaa45c9cd22016561fcb33580e Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Thu, 12 Dec 2024 15:04:02 -0700 Subject: [PATCH 18/19] LP 9 Lab 1 Exercise 2 update to preinstalled solution --- Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md index 5f41cda3..2c659fb6 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md @@ -32,9 +32,7 @@ In this task, you'll create a Logic App that is used as a Playbook in Microsoft 1. Select the solution that appears in the results. -1. Within the solution details, select **Install**. - -1. Once installed, select Manage. +1. Within the solution details, select **Manage**. 1. Find the **Defender_XDR_Ransomware_Playbook_for_SecOps-Tasks** playbook and select the name. From 766f332aa69b628a96bc14bb6b9fe203206f396a Mon Sep 17 00:00:00 2001 From: Ken Lawson Date: Thu, 19 Dec 2024 11:40:27 -0700 Subject: [PATCH 19/19] Added hunting exercise and added notes on labs being standalone now --- Allfiles/Bicep/Readme.md | 4 +- Allfiles/Bicep/sentinelParams.bicepparam | 2 +- ...K_04_Lab1_Ex01_Deploy_Defender_Endpoint.md | 2 +- .../Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md | 16 +++-- .../Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md | 2 + .../LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md | 8 ++- .../LAB_AK_08_Lab1_Ex01_Connect_Services.md | 4 ++ .../LAB_AK_08_Lab1_Ex02_Connect_Windows.md | 2 + .../Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md | 2 + .../Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex02_Playbook.md | 2 + .../LAB_AK_09_Lab1_Ex03_Scheduled_Query.md | 2 + .../LAB_AK_09_Lab1_Ex04_Entity_Behavior.md | 4 +- .../LAB_AK_09_Lab1_Ex06_Perform_Attacks.md | 2 + .../Labs/LAB_AK_09_Lab1_Ex07_Detections.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex08_Investigate.md | 4 +- Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md | 4 +- .../Labs/LAB_AK_09_Lab1_Ex10_Workbooks.md | 2 + .../LAB_AK_09_Lab1_Ex11_Content_Management.md | 2 + .../Labs/LAB_AK_10_Lab1_Ex01_Hunting.md | 62 +++++++++++++++++-- .../Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md | 2 + 21 files changed, 115 insertions(+), 21 deletions(-) diff --git a/Allfiles/Bicep/Readme.md b/Allfiles/Bicep/Readme.md index d5e44763..d4aae635 100644 --- a/Allfiles/Bicep/Readme.md +++ b/Allfiles/Bicep/Readme.md @@ -7,13 +7,13 @@ Use to pre-install Microsoft Sentinel and Content Hub Solutions from WIN1. 1. Create a *Resource Group* for the deployment. ```azurecli - az group create --location eastus --resource-group defender-RG + az group create --location eastus --resource-group Defender-RG ``` 1. Deploy the Bicep template. ```azurecli - az deployment group create --name testDeploy --template-file .\sentinel.bicep --parameters .\sentinelParams.bicepparam --resource-group defender-RG + az deployment group create --name testDeploy --template-file .\sentinel.bicep --parameters .\sentinelParams.bicepparam --resource-group Defender-RG ``` ### Additional Information diff --git a/Allfiles/Bicep/sentinelParams.bicepparam b/Allfiles/Bicep/sentinelParams.bicepparam index b60dad02..4f8a1d23 100644 --- a/Allfiles/Bicep/sentinelParams.bicepparam +++ b/Allfiles/Bicep/sentinelParams.bicepparam @@ -1,6 +1,6 @@ using './Sentinel.bicep' -param workspaceName = 'defenderworkspace' +param workspaceName = 'defenderWorkspace' param retentionInDays = 90 param contentSolutions = [ 'Microsoft Defender For Cloud' diff --git a/Instructions/Labs/LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md b/Instructions/Labs/LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md index 6a3b6f98..058bb524 100644 --- a/Instructions/Labs/LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md +++ b/Instructions/Labs/LAB_AK_04_Lab1_Ex01_Deploy_Defender_Endpoint.md @@ -14,7 +14,7 @@ You're a Security Operations Analyst working at a company that is implementing M You start by initializing the Defender for Endpoint environment. Next, you onboard the initial devices for your deployment by running the onboarding script on the devices. You configure security for the environment. Lastly, you create Device groups and assign the appropriate devices. ->**Important:** The lab Virtual Machines are used through different modules. SAVE your virtual machines. If you exit the lab without saving, you will be required to re-run some configurations again. +>**Important:** The lab Virtual Machines are used through different modules. SAVE your virtual machines. If you exit the lab without saving, you will be required to re-run some configurations again. >**Note:** Make sure you have completed successfully Task 3 of the first module. diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md index cb7993a0..63fb0cfd 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex01_Enable_MDC.md @@ -10,6 +10,8 @@ lab: You're a Security Operations Analyst working at a company that is implementing cloud workload protections with Microsoft Defender for Cloud. In this lab, you enable Microsoft Defender for Cloud. +>**Important:** The lab exercises for Learning Path #5 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 15 minutes ### Task 1: Enable Microsoft Defender for Cloud @@ -28,7 +30,9 @@ In this task, you'll enable and configure Microsoft Defender for Cloud. 1. In the Search bar of the Microsoft Azure portal, type *Defender*, then select **Microsoft Defender for Cloud**. -1. In the left navigation menu for Microsoft Defender for Cloud, expand the Management section , and select **Environment settings**. +1. In the left navigation menu for Microsoft Defender for Cloud, expand the *Management* section , and select **Environment settings**. + +1. Select the **Expand all** button to view all subscriptions and resources. 1. Select the **MOC Subscription-lodxxxxxxxx** subscription (or equivalent name in your Language). @@ -38,17 +42,19 @@ In this task, you'll enable and configure Microsoft Defender for Cloud. 1. Select the **Settings & monitoring** tab from the Settings area (next to Save). -1. Review the monitoring extensions. It includes configurations for Virtual Machines, Containers, and Storage Accounts. Close the "Settings & monitoring" page by selecting the 'X' on the upper right of the page. +1. Review the monitoring extensions. It includes configurations for Virtual Machines, Containers, and Storage Accounts. + +1. Select the **Continue** button, or cClose the "Settings & monitoring" page by selecting the 'X' on the upper right of the page. -1. Close the settings page by selecting the 'X' on the upper right of the page to go back to the **Environment settings** and select the '>' to the left of your subscription. +1. Close the settings page by selecting the 'X' on the upper right of the page to go back to the **Environment settings**. -1. Select the Log analytics workspace you created earlier *uniquenameDefender* to review the available options and pricing. + ### Task 3: Understanding the Microsoft Defender for Cloud Dashboard diff --git a/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md b/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md index 827d333f..3b141a0d 100644 --- a/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md +++ b/Instructions/Labs/LAB_AK_05_Lab1_Ex02_Explore_MDC.md @@ -12,6 +12,8 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Defender for Cloud. You need to respond to recommendations and security alerts generated by Microsoft Defender for Cloud. +>**Important:** The lab exercises for Learning Path #5 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 15 minutes ### Task 1: Explore Regulatory Compliance diff --git a/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md b/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md index cde21384..e2723e60 100644 --- a/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md +++ b/Instructions/Labs/LAB_AK_07_Lab1_Ex01_Deploy_Sentinel.md @@ -10,6 +10,10 @@ lab: You are a Security Operations Analyst working at a company that is implementing Microsoft Sentinel. You are responsible for setting up the Microsoft Sentinel environment to meet the company requirement to minimize cost, meet compliance regulations, and provide the most manageable environment for your security team to perform their daily job responsibilities. +>**Important:** The lab exercises for Learning Path #7 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + +### Estimated time to complete this lab: 30 minutes + ### Task 1 - Create a Log Analytics workspace Create a Log Analytics workspace, including region option. Learn more about [onboarding Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/quickstart-onboard). @@ -32,9 +36,9 @@ Create a Log Analytics workspace, including region option. Learn more about [onb 1. Select **Create new** for the Resource group. -1. Enter *RG-Defender* and select **Ok**. +1. Enter *Defender-RG* and select **Ok**. -1. For the Name, enter something unique like: *uniquenameDefender*. +1. For the Name, enter *defenderWorkspace*. 1. You can leave the default region for the workspace. diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex01_Connect_Services.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex01_Connect_Services.md index 8f6a8b41..de67be7d 100644 --- a/Instructions/Labs/LAB_AK_08_Lab1_Ex01_Connect_Services.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex01_Connect_Services.md @@ -12,6 +12,10 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to connect log data from the many data sources in your organization. The organization has data from Microsoft 365, Microsoft 365 Defender, Azure resources, non-azure virtual machines, etc. You start connecting the Microsoft sources first. +>**Important:** The lab exercises for Learning Path #8 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + +### Estimated time to complete this lab: 20 minutes + ### Task 1: Access the Microsoft Sentinel Workspace In this task, you will access your Microsoft Sentinel workspace. diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex02_Connect_Windows.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex02_Connect_Windows.md index 5a5a1059..2fd57328 100644 --- a/Instructions/Labs/LAB_AK_08_Lab1_Ex02_Connect_Windows.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex02_Connect_Windows.md @@ -12,6 +12,8 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to connect log data from the many data sources in your organization. The next source of data is Windows virtual machines inside and outside of Azure, like On-Premises environments or other Public Clouds. +>**Important:** The lab exercises for Learning Path #8 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Create a Windows Virtual Machine in Azure diff --git a/Instructions/Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md b/Instructions/Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md index 08f7892f..6a90ca67 100644 --- a/Instructions/Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md +++ b/Instructions/Labs/LAB_AK_08_Lab1_Ex03_Connect_Linux.md @@ -12,6 +12,8 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to connect log data from the many data sources in your organization. The next source of data are Linux virtual machines using the Common Event Formatting (CEF) via Legacy Agent and Syslog connectors. +>**Important:** The lab exercises for Learning Path #8 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes >**Important:** There are steps within the next Tasks that are done in different virtual machines. Look for the Virtual Machine name references. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md index edb73c35..14f54c69 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex01_Security_Rule.md @@ -12,6 +12,8 @@ lab: You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to detect and mitigate threats using Microsoft Sentinel. First, you need to filter the alerts coming from Defender for Cloud into Microsoft Sentinel, by Severity. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 10 minutes ### Task 1: Activate a Microsoft Security Rule @@ -28,7 +30,7 @@ In this task, you will activate a Microsoft Security rule. 1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Select your Microsoft Sentinel Workspace you created in the previous labs. +1. Select the Microsoft Sentinel Workspace provided. 1. Select **Analytics** from the Configuration area. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md index 2c659fb6..26e699cd 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex02_Playbook.md @@ -12,6 +12,8 @@ You're a Security Operations Analyst working at a company that implemented Micro With a playbook, you can help automate and orchestrate your threat response, integrate with other systems both internal and external, and can be set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Task 1: Create a Playbook in Microsoft Sentinel In this task, you'll create a Logic App that is used as a Playbook in Microsoft Sentinel. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md index 6e613e59..d24e9d70 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex03_Scheduled_Query.md @@ -12,6 +12,8 @@ You're a Security Operations Analyst working at a company that implemented Micro Analytics rules search for specific events or sets of events across your environment, alert you when certain event thresholds or conditions are reached, generate incidents for your SOC to triage and investigate, and respond to threats with automated tracking and reMediation processes. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Create a Scheduled Query diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md index 483a0468..7e250326 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex04_Entity_Behavior.md @@ -12,6 +12,8 @@ You are a Security Operations Analyst working at a company that implemented Micr You need to configure Microsoft Sentinel to perform Entity Behavior Analytics to discover anomalies and provide entity analytic pages. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 15 minutes ### Task 1: Explore Entity Behavior @@ -28,7 +30,7 @@ In this task, you will explore Entity behavior analytics in Microsoft Sentinel. 1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Select your Microsoft Sentinel Workspace you created earlier. +1. Select your Microsoft Sentinel Workspace. 1. Select the **Entity behavior** page. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex06_Perform_Attacks.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex06_Perform_Attacks.md index 9940261a..598c6c23 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex06_Perform_Attacks.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex06_Perform_Attacks.md @@ -12,6 +12,8 @@ lab: You are going to simulate the attacks that you will later use to detect and investigate in Microsoft Sentinel. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Persistence Attack with Registry Key Add diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md index 45b124f2..1e7bd0ed 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex07_Detections.md @@ -14,6 +14,8 @@ You are a Security Operations Analyst working at a company that implemented Micr Analytics rules search for specific events or sets of events across your environment, alert you when certain event thresholds or conditions are reached, generate incidents for your SOC to triage and investigate, and respond to threats with automated tracking and reMediation processes. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Persistence Attack Detection @@ -32,7 +34,7 @@ In this task, you will create a detection for the first attack of the previous e 1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Select your Microsoft Sentinel Workspace you created earlier. +1. Select your Microsoft Sentinel Workspace. 1. Select **Logs** from the *General* section. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md index 2a342bc3..694e1de0 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex08_Investigate.md @@ -14,6 +14,8 @@ You are a Security Operations Analyst working at a company that implemented Micr An incident can include multiple alerts. It is an aggregation of all the relevant evidence for a specific investigation. The properties related to the alerts, such as severity and status, are set at the incident level. After you let Microsoft Sentinel know what kinds of threats you are looking for and how to find them, you can monitor detected threats by investigating incidents. +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Investigate an incident @@ -30,7 +32,7 @@ In this task, you will investigate an incident. 1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Select your Microsoft Sentinel Workspace you created earlier. +1. Select your Microsoft Sentinel Workspace. 1. Select the **Incidents** page. diff --git a/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md b/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md index a8abcc01..d080a7a0 100644 --- a/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md +++ b/Instructions/Labs/LAB_AK_09_Lab1_Ex09_ASIM.md @@ -12,6 +12,8 @@ lab: You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You need to model ASIM parsers for a specific Windows registry event. These parsers will be finalized at a later time following the [Advanced Security Information Model (ASIM) Registry Event normalization schema reference](https://docs.microsoft.com/azure/sentinel/registry-event-normalization-schema). +>**Important:** The lab exercises for Learning Path #9 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Deploy the Registry Schema ASIM parsers @@ -28,7 +30,7 @@ In this task, you'll review the Registry Schema parsers that are included with t 1. In the Search bar of the Azure portal, type *Sentinel*, then select **Microsoft Sentinel**. -1. Select your Microsoft Sentinel Workspace you created earlier. +1. Select your Microsoft Sentinel Workspace. 1. Select the **Search** page under *General* in Microsoft Sentinel. @@ -204,4 +203,57 @@ In this task, you will use a Search job to look for a C2. >**Note:** If you were running the job, the restore would run for a couple of minutes and your data would be available in a new table. +### Task 4: Create a hunt that combines multiple queries into a MITRE tactic + +1. The MITRE ATT&CK map helps you identify specific gaps in your detection coverage. Use predefined hunting queries for specific MITRE ATT&CK techniques as a starting point to develop new detection logic. + +1. In Microsoft Sentinel, expand **Threat management** from the left navigation menus. + +1. Select **MITRE ATT&CK (Preview)**. + +1. Unselect items in the *Active rules* drop-down menu. + +1. Select **Hunting queries** in the *Simulated rules* filter to see which techniques have hunting queries associated with them. + +1. Select the card for **Account Manipulation**. + +1. In the details pane locate *Simulated coverage* and select the **View** link next to *Hunting queries*. + +1. This link takes you to a filtered view of the Queries tab on the Hunting page based on the technique you selected. + +1. Select all the queries for that technique by selecting the box near the top of the list on the left. + +1. Select the **Hunt actions** drop down menu near the middle of the screen above the filters. + +1. Select **Create new hunt**. All the queries you selected are cloned for this new hunt. + +1. Fill out the hunt name and optional fields. The description is a good place to verbalize your hypothesis. The Hypothesis pull down menu is where you set the status of your working hypothesis. + +1. Select **Create** to get started. + +1. Select the **Hunts (Preview)** tab to view your new hunt. + +1. Select the hunt link by name to view the details and take actions. + +1. View the details pane with the Hunt name, Description, Content, Last update time, and Creation time. + +1. Select all of the queries by using the box next to the *Query* column. + +1. Either select **Run selected queries** or uncheck the selected rows and *right click* and **Run** a single query. + +1. You can also select a single query and select **View results** in the details pane. + +1. Review which queries returned results. + +1. Based on the results, determine if there is enough strong evidence to validate the hypothesis. If there isn’t, close the Hunt and mark it as invalidated. + +1. Alternative Steps: + - Go to Microsoft Sentinel. + - Expand Threat management. + - Choose Hunting. + - Select ‘add filter’. + - Set the filter to tactics:persistence. + - Add another filter. + - Set the second filter to have techniques: T1098. + ## Proceed to Exercise 2 diff --git a/Instructions/Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md b/Instructions/Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md index 4cf1e067..006ee7df 100644 --- a/Instructions/Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md +++ b/Instructions/Labs/LAB_AK_10_Lab1_Ex02_Notebooks.md @@ -14,6 +14,8 @@ You're a Security Operations Analyst working at a company that implemented Micro - Create data visualizations that aren't provided out-of-the-box in Microsoft Sentinel, such as custom timelines and process trees. - Integrate data sources outside of Microsoft Sentinel, such as an on-premises data set. +>**Important:** The lab exercises for Learning Path #10 are in a *standalone* environment. If you exit the lab before completing it, you will be required to re-run the configurations again. + ### Estimated time to complete this lab: 30 minutes ### Task 1: Explore Notebooks