From 5aee984673a5b37a60717ff45b79da984c8a0905 Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Mon, 27 Nov 2023 14:31:40 +0530 Subject: [PATCH 1/2] Updating solution name --- ...ptOnAzurePortalAndAWSConsolAtSameTime.yaml | 0 ...uspiciousComputeResourcecreationinGCP.yaml | 0 ...usUserActivityObservedInGCPEnvourment.yaml | 0 ...nauthorizedCredentialsAccessDetection.yaml | 0 ...ddressObservedConductingPasswordSpray.yaml | 0 ...WSConsolLoginByCredentialAceessAlerts.yaml | 0 ...ized_user_access_across_AWS_and_Azure.yaml | 0 .../Analytic Rules/UserImpersonateByAAID.yaml | 0 .../UserImpersonateByRiskyUser.yaml | 0 ...Coverage Essentials - Resource Abuse.json} | 4 +- .../Package/3.0.0.zip | Bin 0 -> 19812 bytes .../Package/createUiDefinition.json | 0 .../Package/mainTemplate.json | 631 +++++++++--------- .../ReleaseNotes.md | 0 .../SolutionMetadata.json | 0 .../Package/3.0.0.zip | Bin 19557 -> 0 bytes 16 files changed, 322 insertions(+), 313 deletions(-) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/CrossCloudUnauthorizedCredentialsAccessDetection.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/Unauthorized_user_access_across_AWS_and_Azure.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/UserImpersonateByAAID.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Analytic Rules/UserImpersonateByRiskyUser.yaml (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse/Data/Solution_MultiCloudAttackCoverageEssentials-ResourceAbuse.json => Multi Cloud Attack Coverage Essentials - Resource Abuse/Data/Solution_Multi Cloud Attack Coverage Essentials - Resource Abuse.json} (97%) create mode 100644 Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/3.0.0.zip rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Package/createUiDefinition.json (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/Package/mainTemplate.json (81%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/ReleaseNotes.md (100%) rename Solutions/{Multi Cloud Attack Coverage Essentials-Resource Abuse => Multi Cloud Attack Coverage Essentials - Resource Abuse}/SolutionMetadata.json (100%) delete mode 100644 Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/3.0.0.zip diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/CrossCloudUnauthorizedCredentialsAccessDetection.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/CrossCloudUnauthorizedCredentialsAccessDetection.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/CrossCloudUnauthorizedCredentialsAccessDetection.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/CrossCloudUnauthorizedCredentialsAccessDetection.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/Unauthorized_user_access_across_AWS_and_Azure.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/Unauthorized_user_access_across_AWS_and_Azure.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/Unauthorized_user_access_across_AWS_and_Azure.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/Unauthorized_user_access_across_AWS_and_Azure.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/UserImpersonateByAAID.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/UserImpersonateByAAID.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/UserImpersonateByAAID.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/UserImpersonateByAAID.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/UserImpersonateByRiskyUser.yaml b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/UserImpersonateByRiskyUser.yaml similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Analytic Rules/UserImpersonateByRiskyUser.yaml rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/UserImpersonateByRiskyUser.yaml diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Data/Solution_MultiCloudAttackCoverageEssentials-ResourceAbuse.json b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Data/Solution_Multi Cloud Attack Coverage Essentials - Resource Abuse.json similarity index 97% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Data/Solution_MultiCloudAttackCoverageEssentials-ResourceAbuse.json rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Data/Solution_Multi Cloud Attack Coverage Essentials - Resource Abuse.json index 3191da80c1a..4a62c77cfa3 100644 --- a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Data/Solution_MultiCloudAttackCoverageEssentials-ResourceAbuse.json +++ b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Data/Solution_Multi Cloud Attack Coverage Essentials - Resource Abuse.json @@ -1,5 +1,5 @@ { - "Name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "Name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "Author": "Microsoft - support@microsoft.com", "Logo": "", "Description": "The rise of Multi Cloud Resource Abuse attacks poses a significant threat to the security and integrity of cloud infrastructures. These attacks target the vulnerabilities within AWS, GCP, and Azure cloud environments, aiming to exploit misconfigurations, weak access controls, or compromised credentials to gain unauthorized access, manipulate resources, and extract valuable data across diverse cloud platforms. The Multi Cloud Resource Abuse Attack Solution is designed to fortify the detection and prevention measures against such malicious activities. By integrating detection capabilities across AWS, GCP, and Azure cloud infrastructures, this solution offers a set of detection strategies across various cloud platforms, including AWS, GCP, and Azure, aiming to identify abnormal activities, unauthorized access attempts, resource misuse, and data exfiltration. The solution encompasses log monitoring, anomaly detection, and behaviour analysis to detect and respond to potential breaches or abuses. This solution extends its coverage to include a wide array of cloud-based services such as AWS IAM, Azure AD, GCP IAM, storage services, and more, ensuring a comprehensive approach to identifying, mitigating, and responding to potential threats.\n\n **Pre-requisites:**\n\n This is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Cv-sudkharat%40microsoft.com%7C8ec0502d0fb449debbc108dbe9849194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638360527889561785%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=XyqFj%2FfDBffyAPs4haVuOLs0g3vFY6jt%2B8pe%2F9gk0%2B0%3D&reserved=0) and does not include any data connectors. To achieve the most robust protection against Multi Cloud Resource Abuse, it is recommended to deploy this solution in conjunction with complementary tools and solutions across the cloud platforms. Install one or more of the listed solutions to unlock the value provided by this solution. \n\n[Microsoft Defender XDR](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-microsoft365defenderazure-sentinel-solution-microsoft365defender)\n\n [Microsoft Entra ID](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivedirectoryazure-sentinel-solution-azureactivedirectory)\r\r\n[Amazon Web Services](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-amazonwebservicesazure-sentinel-solution-amazonwebservices)\n\n[Google Cloud Platform IAM](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpiamazure-sentinel-solution-gcpiam)\n\n \n\n[Google Cloud Platform Audit Logs](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpauditlogs-apiazure-sentinel-solution-gcpauditlogs-api) \n\nThis content covers all stages of the attack chain from an initial resource access attack vector, establishing persistence to an environment, locating and executing malicious activity from data stores, and then perpetrating and hiding their activity. This range of content complements the coverage Microsoft 365 Defender provides across Microsoft Defender products: https://learn.microsoft.com/microsoft-365/security/defender/automatic-attack-disruption\n\n**Keywords:** Multi-cloud, Cross-cloud, AWS, GCP, GuardDuty, AWS GuardDuty, GCP Security, Security Console, Cloud abuse, Resource Abuse", @@ -15,7 +15,7 @@ "Analytic Rules/UserImpersonateByRiskyUser.yaml" ], "Metadata": "SolutionMetadata.json", - "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Multi Cloud Attack Coverage Essentials-Resource Abuse", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Multi Cloud Attack Coverage Essentials - Resource Abuse", "Version": "3.0.0", "TemplateSpec": true, "Is1PConnector": false, diff --git a/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/3.0.0.zip b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..e6820830e1d73893550e97670030d1507244c171 GIT binary patch literal 19812 zcmV)(K#RXnO9KQH00008047>{S7R+z2T&0J05?1U02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH-COH&+&FgrpQ^kAsy7}>uD zR+hPWFc{d8{#>SVs^%&!`|?9osD6~q-8(ZF_ILWby}VEht*!?rg_5QE@$6JhbgE08 zrTynsQtDUp{yUSUf9iC3ubE8aL>08xa~&0#$tGog#A^pDxXBAu7%W7STbsGpxh&*d zm6(JXztRu}qb!~1X)}N!ZC>jSvWPJ_k%>{=`psAx9hq=424iKSLg%I1`JeTCDohbQ zysWuX$m{-8m$PbI8C77%k~l=X;gi_EdlwkgsY(W57Kj`?%chyJ?|%00`ere`?1*a} zmosc|ct3xS$C=X8Sy?~-`7*ss@7?>?tW*!~-4o}Dl17O_O;jPuOq4SvCRvhX*E*ew zv6^Is5;`@dOcENQ_a;j!I?w}gS%}M2{Lg>=w|K$4Y`qq5UMRadZD!tX`4ijI-h9Ne zP|Bb4!YyV7tN?d*hbKu^#rQcYOBr3!KnBr5v+(Ol%EQKXC! zgoh$aFq##3nCC@?FH|g|Ld8zjwA>VY7gZ{&a+VeP118u7x{zzC^D2Qg0PijTj3raO zFAEu!Vj+`CjuRzfSxS5dLt;d%$zb?XYq>*_1Z)5#1Cl@|7Af^) z$-InVZX%vU)Q~x%1L1KFO(8i5Nyjp!FjX|eK@uJ5timw9S}_0n;?dFx6x;)6n>8bu zH)3*!x>-ys8ql@cTSGaUKx7P4R}S2)+j9#K-oMCArLLfz0T zS#U{?Q+z6u;KbccQYKAR^PDuy%a{}k@~}IwVAcDHPD-m~R*d!WR7$EP4dE!sredDK z>tKg;O5bOoVA&kmE;&{+xxhIKJmIy`tcG?HPXHl#ma@?EthA~s#y}-Jo*`|Pq%W*c zA*Z2~DvgcMB`LqPY|Im89xzGv9Y2afHURFy_kbDj9}5kBSbdQ!Z*ewy-gTlLoif+$ zkih|IZU2!y);uFos1*7~!jKkoYK9R2LdYBd#0f$vF_-2L&XiTK8=l??v|)g?ONPyy zxOeXycE3=+RN82mWjG`rXO3u6w>L4E4`h4xGzK}9^Wj0?$ccj4yfS^z<>b@Psxry4 zD|Rs7S4HxWzqzwFy0iNPe_)4;v_G!{228^!ha~vvEqw56ueSER2#N#+xwE@x32R<` zM>_U!c>m7f$#4gMEqbPkuV#oU$~*hR_HKtKM=BcLAMVD($#{SNI9B6vv@<-4$LjcK z|9IzkA5#u@C&x!e{x_*8-($7x*`foJ$ zYB#B#e>kJ(M=$l+!P(W$OuoLR=bv7koE=h(&*ZD>hi7Iu-CI2Q_k(xko!v)AIkEV7dNsrYE%qJs1p24qhr?}))C}sI zW@V%A>C(a%o*;#Qvw|R#0r)cwgUN<;p20>I8Sqq!Mh|N1d9$^KO)5#z3I(yiMa9-g z#|pk_xncsLg&^TwmD?5Hy10F9oue+v6N|mb5DDvFS-r@tO0sg^jVbjV>|YI$D4gU<4$m*MbHu1_|3+p z2-o>(E#zBTBG@331NUwlw5GI2uF9fWXr^PAv+1H|hc#0V(O1K~x!!S@d8rykZH_*7-!&BOrF9(--7qn>4OFV?20IHk6^ z?7yhxbyma_K3H4dV^iA|Cq$TkXkyN%74rAfs$BA5_(;Lgg(IL_|0YggfwKhO!YZ}2 zuA}WrEGZ+31wpEKQ6(JDh+_uDGdj1m@N$g!B;b}$d)IQ!77Dh-e~R^0>g@Q_AJ=Xq z&Z6y3Hz-e-Y8=)lg31M6di_4PlIF_Dn{b8*>n=Y){cHyJye{+%>Yc+~Z~9Os@Q75b zFayZ*%H$HT8svWWflQEJGh;uoT5E|h!oW{WhCR{|&zvOLwdsTt-!=~)LzY>nZeZ73 zm6CwD`hp5oI!3Te1)#rJNcu%6*%g#q!#Fas+4*Nvn^ZuNkYRgPw5a>oI#g$Y02&#r zFG}4&x)`XyC;9>0f`0)=>sWH4OF|LT763pZu2S~bG@7s7O+s)I8=8@;ZN z5>izzbJZ^4)oR@z74uQ9PizsO{S|_(mzqw|VS7fo9ocZiLXGl(ow9^I#hEC6Bj(nq zWhNl|Nnoy3+*&)L%*DyL^JdCUsn|+XIxS~gEhcVl_vwV&-Qo7zPMg)gRB!;Blw_7s z@v!ss@yoVmc5+$Hct`9H_1Fr*iH&sJy&It6a{=@{Twc!=KOgQ6cZa>Yxr`Cq7hvufl34#VZKl$sM4X~9XA6<#jhwRH!Q%p%(tvUZdrJ2-E9Nl?slJJ z_^xpCw#CCgvn!^QWvk4dVa39|gXFin!jEm#zimv|LJB?Sb#hr4wdJ(v?yr}Y=a-!a zmz}$m@~Am~)fIOyJKf6;Q?mK($Gcei?TVgq!d|F&-A05QYfMr&$tl`fZ#@ta<$u$7 z)W&eLB8@h_26~>k8EtXpg@UMb?5%j`#MK{dGP!Xx`V2{C`@2&lZXt%k-N%WH)k_4O z>ShX+3%6F?>ZC<;+SX%|Tz?qZpJG)i7n!vsKBStG)H23aP{V z``0h~^XO+CKRo9=tXH4(XRa3h9JbI_$@$nG_zmpe`Fze_*t*Wz2Q>q2yzeqkX$)lr z;v%O?X`v?H8d^H{DTV%A-ZL0OYKSZdvOIT&A zS8}Np1>z}Yb0;pOttLg{g{e5vo>Wvb6XUF$HI$I0Ku)|&qZzVl?hVXkn!8G?}Z}A7u$O6hHhlj zw)ABLLPC{RrlR(cZ7LO1)xquxF)V%(0qj9jN@;3gGjVB__FToy)dgv*tV&Bk*9ly| z61hmRqy`%ol3fn5*4*I^K2?MQJ5hIzbs9124FOYd7l>-5zR}$7W!mnKQT@yG+oEsp z>!Xj@+Gtrew*3nSJ@FV8vnoi#ZXJbte;gFH^(o2MEYr5dI(01DSS;QG zC$|I4SygW?F;E?dTBsUM!&W=Fb`sXq+*DtIbVW~3DZ5JyJYnjo zEG1n;@J%wY1ukwkwvth7qd?pG*$^3jsD%p*vs-zl`V94=h7A!*_$1&hzsL!IkmoshG9=i1QZIs~J zO>p5RxP_$B8Js#%w9&#e*HFGW67Sz45-%DV1|h$Nm$lqr^vE(={NNobrjh9;=Csq3 zTSw&m-wlzB$F?(dH;9^e501#R85lVRG71FW8Z)jIV=n`6%$s9|gNw{_n#}hRERLs& zZt<0NdgC{(wH#r3?LjHn^XxY^JKV5D-SRv44)-#Jv{b|n72yEGCkUHO1b=Q{T4u-wCPAUH>^;}Kp)~@f?&frOV1`KJ!1iA{rA+TN1_IwRh z&=rNLiCWNYNj)L*d_aLceXF;z0HM!iL)Q3B+m@tY``cpl;8rnOM{8>;W^<)=E5~|p z>u5aqdq$({IKll)U4quu$#pIQUuW(1%IX9A&sW5~hvE_jTVRSD>0hBy-7spG=IWAw|MwF?Ss(ByY(Ik;#1+UUrF-ly zRf`My*I}uxr&1HZTliIcdG|(HW8$iz04kq{JW68ff8l{NQxM0E4R{&1d=oWr?R+s^ zr&QMs+7@+i$OQr7&&vY2s<$7le*+Zo&4o*?US!zR`R!@6aWAK2mml~dskfQ@jezi005$}0RRyI003=a zX>L?yZE$R1bY(7Tb8l|!UF&n(#JK=j`h&^XY&8hmgi!xI1SH+IU79 z^CVgFXNQOKNozqvddC(lOj`7pG-fR~TBvvYu-opOIPJdE?i_k-8AL0jyJm}JKoi#b ziAUj|8wWyx8-)qHd&^?(Md^!(_=FGO5lxeM6eH=S@5T|2W(jc! zPnXLmPX4jb&(I(#M5tMy2^_g5QIIB}j3mk+GK*qznFfhZ&VnfQ$S6su`+=NA_bdh{ z$pz=Y?9+gQqSuT^Y3wpGnx>pJP{C(u>ypM4>;+dWYlFz8iF8dpf``d!$IqhQ}#8l-~nU960F5l88AzuD4SZf#j>O{ZjWH};pxrpEVC zLckC2fK1bbgp7I2BS}P-lygGkg_9&7prv?1etfBvIFosl2A%_~&U5Dclg6GK0o#u) zLVjSx4|&3Ne-A2WakLQRFGs{MG_>8H z<%iF@Ki5UpYu{o+?%Z7O0I;BNfA2NB6Bvq!L^$CZR=RHhEC5S}s6dRNf7)1h955F@ z?Hy#O+27Oe_nOVy?Y`$+-r!j^+G@G{gVskvFjNG~%jk}bLK>_R-{sJkEM_DN#t8;X z$O7zM&XRPw=86?G_cZqDG+=hjKo0Q(Ve!VGesAdB87cdF;^AKNHY3wL^F5d^(#8Wr zeNCX1wR&030t!tq_VAs^k6bm1%$AP+>S$7DfmXR_6cskP%A|F*QmXB9_QrOcsvdfs z2JF@JCjeY02O0ala;0N3umzL%Hla$`V^5OK`fcV7hR$rzpE~`c?#wx9A5n+8J$iiN zx+iU~Z%MKRDG4T(jlKOngQ3=hxoPYtt8vKvyLrM7M*)iypCjciMEabX% z2zR$ZxLY5>f^^^>_lK-MblS8%boy?)O)wN4vtx`eKccE$L*gu{pm5p+O!Q{2ea;g9nadX zH>`wk?+ZY|MU>9<&y>BPE808wn2DM zKMPCJ<702yAD%egpiRNh6W5{be#bfL_otNg`a`cXtAz023qZJr{`wFeJQaj%d9ee8 z2fqUd*YW8AS@>uhgpcY&SddN!of$jowwZTPZiDbpL%6#Y!h-auJ?nMaFja4Njv>~%)0uPJ z?hhP#(q)}l@2E2!PAefid_08f=&ujq;S)i)o)lOZs*wXI_}Bw;JDu(_NpO#{CEi0(O)0J$4>;|dS2`R;p3-= za4nx6kcCgSLHMNpa!!!W`m}r8KJGgB|4x5++;dKby(6dBb32rEI>Y{OPzm9a$3wV| z{`wF;c_Ikc^I``GpFBN;Yx%TwIcJm=J$!(JJb18!`Y2fn*hovt-m2(A7p-%f$%-dz zA%HC%%0Dn|utsMe3FTher$VpKCjiTYh8SANm49HQuhH4kb1!Y_FV3!@FMiTpVShD} z3pBP|>y<4PpD|6JeK8Vq?`?VJ#h${DI(0N>w7~FAN?AWW&f@vilEva+mIfxIP4x1^ zWgOl69`xm*f}_brc7j>@)_GyK-R;Q=31=Czd!K!@NJDi{X?wDsv>`HDo3d8NP7BsC zdE;Ga5^}P`XPePuOBQa$444$Gpud_s5p0hW%9)w0kQfxvB*pO3o=u`It zy%Tb(0?_0SLT)q9px3~##J7*0mCL#F@8@xv%p&k=lwie3@+utR5$;tKCo~v^-sp$P zSrmf4Q8EEHuKfjjuQMMFuxGe+SdQPxM?aZoW8{p^G1?izc$Ax za@T5fb_1q9TfQyG&DYC(&cDpn1r*+uM6dq)l>b^9%{Ar_c}s`Unj@0+C0s zzkqkaTV$M&MHKo;6mtSS8#;bSC>V6_qaz~d;0e|kNf9!FjU*Yw>}7Q4hq|c6w#}GA z;RR1!z#pHb0XjL2AfAmS1oaZW3f*}O_WZ&;0udRqxV7HW*pxm8)|IYKITKAIt5XV% zVH&tp4hs>Lh>aNyI4dK8=}o*sC5MOP5^xSc4!}OJHbGud;Ny{-hG?Jnkobh>Hw}U) zhFp|2ziK<(%t3UQYv6$Lgmj2US2tn65|S54P6@O~rhfk>MDr#f%nzac`ArB0e&Yu~ zl2;Kk3{O#@R_sS9gOGo#t{W|v=UK~=(^Ku2rf&!>7eBi}>M;Vqj5SIK_VbFoihY0r zq;MwYhAB7(i1Hp@XupSy!NcU&^Fe0Zxat((Brb8#fKGbg*VE$}aTP2KlF3f`#4Q`!9tvwVew~Y;fKvU^XLvNHSGl1(evdbZX|q}Bs596d2c3pLY02{+UFn6 z8KjONYw#2zH^jM7A|{XjO8r>ORWen94__gE!3s|WX%b^5hxCJCFX|96hTdF#579B3 z`9I70$~B*L2#Lw6rxg$)Qvx7cEwv#}_{n}rlkNRuulcTho8g6^(uverTR`Ww+5A7@ z$;Pbv!=x(b;_!qc!gUNyNfbt{WLOxxHY8$8hXCPP7RKpprpnI5wJpf!NrCt*2j>VI z#O_}*5~G`l1JR!l7fT>#7lA+sC*Mw9eV^}Bo5$)8nDlV=9%r-rMIp_WZ9#+ZDNblhiE@QktqOEd%kEs*-G7u(vc(S6WyhU4cuK>0=;6%GU6L>16Cr0Z2SE zz{=<_9g<7w3J+B*2xM#=W=eH{BC7MXvOuoSfw-1PZ#B6>2irZ4t;f=#%6tcb=~>rHu{V0OCt!zyE_)kX^gyH^de?B zJYLUfc|$0c>p5tdM*)g&ml`5wN+@x34;_G}l*)_cT*y18356jlgtcB2m+W!Kzmios z{x$GI2PUXWMnRPuw?4CW+3$r9p(0lVG@{OPnL@9PpC+T5WTJCz!p< z5{#gp`7H3ZslvYsb@&Ip7o-bwpGy2&p-+&jJwTtuhP;Zp9H{tL-yX9-+rg-er_!bkW&-bYYHAwiQFv zDy7Jm7vK>)Zg!}hn5~C2`I3_k=**wOTW0Ti81lgTrNu+SP8o#o(2Rv8C*8HYEb)$* z^S!z<>mP5C?6fM^SEZEqU-)=YiIpu}nJdg`nmR772wRQZ2X<|RRDD=p^f`BUeOs0j z$~-l{i%{;VaY2Vxg;AxKs^6Pi)isS#H@E9s1ML_C2i?#K^{#~%m=ZNyZF4*D!w*Pj zj?$%$R$j*g(zE^58vN{5gP;~Q4Bu@4qo%1ig3Vg!&6Ee!)r(DuiMK03ha=ZSNsp05C{2%hjN9g=vB-cuzDOo(6#k;WYk` z720F<5c(6VljT;$Ny&y8MwSSP%7o^3qcYe15F4db^dpMB%0ZyY13q#Q&6TAAhEYDr ziUY8@I1HSCSvNx`W)D#hms6Ur4;U$8ajH6}9O8eaHR9h*<2j5_UKGX8F3!4#=PU%P zUd<*F2dy^}RJdgvxlwS_IIvlZTfEP{OQ$Rjp&R+(B{(O#V0?8(18{o>-t5S11lU|H zK*~rT1=p2v9mRDuzdoNFf}#Zl@Nm85-^z@5jui>t$ik8Bk}Sn7c_gT+F?M6k)R(cJ z`&|5l)oPa}e~k(M*?4q`8)EC!tuwI!SYUc%WgulL0tHN!+j!f_wZiHi*}(L0E42iD zl_G2Li=Sr@R&vtUdX**|k`jc_7ZZtN_l^?nq8Zimt>;)oskxgbCFpV<%#rXZ1vZ|(wo78}fZU668zQJy#*SP6(Azk3JlS_5DTtYyj{C*ELzl~7MMg4#g4bnufDq0aW8eC$W)X@R zCJi^gr!%7Mf*z=YvXd=i)g zf)|(!O~R9fMroXY;Y2KUxNowcrY}dbja_TnRDzunl#k1xUn6x^1dRPS-jGo@B*(28 ztRnx|d|79%Kb4&){^YxoD%||K$6ndIy)^3)GbfkRWZ-#wsXHJyRaOBC1VW||X&_-u zmGz|mB81_TS?eD7geynLGa3;R-zp5UI$BpsXx)ir5oAD)sR%%i0d~n?6!!!%Za#@M z)J?-^X-O@5^sXGTp)uG!4U>E$)fl^h9y{{Q)%WEiMZO3eb9l40)W@e6xX*9rLnUpz ztQ>blmHeeTtZcSiF%KIrON6``?IdH8LTd7vXO59=k#8^6fRr1nMrsC?xt3#*b@O-y zW>c|pvn8v>^1Nmv@N_e8r0I$S?b}Pl#KsnAssxyK(UPN))AdhLwM8FU^ zhnNs?4xl}}X*AzCom>h2HNE3o3`u~*W>GJ`o#ZDLn!XsLQJNHY8XTP(tbGs+7r^a3 z?nBxYu=&`{qJjKLj!$<=wh}EPHy=!-I6lc1%Vc5W`~w>YuP1D}l~BUc(Sw#Y(ZZHY zFFHdA7p<#KCKhESYZjV+LN3)7R$@`ZpvfdPhry-1xSb1MVhEM-o1RJCs;Gz`&CO*$JjWgF16IG#>LOf-Bh%4g-0VC#uB%x0ObnOwI8rMcEMq~ zv#IuCtyH$0%xwBqynl&tLW4`7!Q+X#1+ujYZU;w460yqV9>4WH~WHx!M|-?sTmlmlnS0-v7&UR1d?y5uO-yKhZ5?VAyTg-xVXEZl6c9E zLq*sY_B0fK?om0Tm|kfX^{G;Yy=@^>*x#$UVlltLe=2G0-4l@w?C%vRKZ?bQ2L^>7 zeDPl-%1;Kid12bw`nsWwG`adzNm=<@PuZ_Pl^)7#ezTId($t$#-MU69_r?U;Uco>Y zLkv`+P7v!2xwCxTy`IOG+bPv#$H(79F--1}@zbZ`bo}#Yd0AS#$@cW%aWutcCaewQ zK{8QWM%nSK*cbZrDO>q`{=CtkY;m6%L<*$~sKgJL-sqJWg0Hzc0X$$(#R5c#<|L9o zc_1$N3x7tr^CE;Gk!REPsm@;Jwe|S(=RHC>#~KY#X3851{=?d-tjxhWqmq_Y6+2i? z9GJ6jK>CU#dh?ouvZus~3=Q%{JaGcbg+OZ=$5VHXbr6BP#4p-lq0bic_iJI{Z0}6! zQVV7s@tL2ik);t?|KJ@@tXJlE)0Z=Blm$Gt4fXDQ9*JK=5&wBBrY7Zfr&%L&YC? zrVnVm$mP{%G6H|eVS1N6d#?^;98sX)$Rdx{JXr)A@xKb`!gsIi>Yj?hzjCN;-0S~B zm+fTrFe^1Hm15bOF_rUFjsNvb+QpJ9RkpcdI`TMUL@1_JSyGUf8HI(fxWOKUO#bpj zm2qW{OJ*ZmYrG5Q)v2PZT@m}oyn<6KavXcz-{BRUZW-`)xPnvS<)g3Q>{cR4ew8aY zHA_^L*soV`)NA9y*DE+>bYHLF{JyW?)Xh9!XrTlW9mcXNv1RE)jb zg4{pi-JD)!`Y*aKg#Kag=Hzdgm>sU{o=&i`Z|bOBBD2jCM0a;;OHN*BQCCjYuLp|* z`KDcwCL+pQP^sE2%Vu#J16V_WgN@h$^0~1TeV9?#hc%kmn8P1@(>wXH;qZ1$`ENC^ z-;-&P=PUD@hray%I9N#Og4Y8fUN)H;PdLFPKEez)u>?%v12(0lNE(DUNW{e(xtsX^ z?Ol6w+c=W{|ElggV0@K}T`N15U$N)n>?n4U({3{H#hIDCTcuKzMai5hyB@n&>PD~PLpc_Er(LZ!^Qc(*eh%wx}yUq z9lnYf@umSn1Kt!ptIb#%WuG$^cDo^-1@&*|yVPU0`fctYR;yEQ5mR375s;Om^GuD^nhFA`VU(Nz-EjG( zF&&9KiqiBe3s^hyxD9v6oa=o;5k#Tke$fL*6H>N8X;Sp%`tj6AH3y|;4<3InsCl}U zerI-poW#W&k;Z_uo_I0x!+*r%jgvEft*46`42Ve8Ttyh^^7 zzq-&oW3um234!8CQkORh;6szIl1GRK*Fz&DQtLnQKGy1dsn>SDwpv>g{#>hp3-Fhs z=#34#FpU&c)@uNk9(xLX+-kM|-fG<-@y(Ba`pJCY-yS;!)g0QM&Y*;p8@p!XN@%Ph zLAyPS5p2nB!-bogJPJW5jG}-i<`k_$Ct3p1eqs$hXeX7ma2!Iz3I<0PTx7Yp>eH%g z1Q&}sT&Ht>5V;Qp1ifAw_9%fp87a5WRQp#^nvJl~<3SX!D{;#si&*jhIngQMe5;OSVu+sG>na)^xSjJL)VaV7#d zX?jX^$W%gY=@fDz&Z|A0#&{{ZKwI1-Hru&oypru%pcehQ8FMY>5+HY+_3exr;QJ1 z^EQ~`ig!P*EBS7ua}6k(&T4SEDDLn$qA?sw;uTaqpG-s5%gW(ffzY@2ifL8=b?a9M zD`FKu-SaCiF8sH=q{e`*DuB9o)QJrp)KmTKAE0V8f?Yv9_!Ezf5&WqrNU%d>HYE7# z;xNBv2;kyk^)?hIH~mz=s@{!4dh^krLG7_2xqcWUb+N}(f|t+!EP9U*8H}ewdCC2) zkg$66XAqlaNG$&>Q0Zz0SAXWyEfwx=ZK?}uNoDyk?+rR!vVrR8>7xxUN&q)RXzDLt z)Oh&%m3+=YsshWLbVFyxOM@d#!+##0`_=N+Hb|-w*}7)U;n%O;D4$xEcL|~Y^2IoL z;36vq(L3OIWw25vEOFecWpnFd=kpfGLR37~y^YepN|DP4ij&U(8t-%4=wjqmOxxFJ z;BqkX9^-BfGB1y$c=L_zfQ!Yj%TkM{;X4Je8{K`H8Z8&do^QP=>sH~}S02yq0)v{J z-4(>M@A^946nJ(ImviIUr-K!-rQq31!ny?63ePS+D;6p|yDwdZXJ2hRds)r1Xgs@E zxle@+n*rBe#GWGIa9IY|J}u1!Xkbb0zT?{WCg9rlDqMTCSX{g5%vc)*grDwHxzYQ+ z0qt(D6dCtEI&>c*pnb1U|GVrX(FY4?H%^#r{|9=|u!eQeWOzhq;Ej8}IPD9a!2py1 zkUt3;V(afu&o}ghhXaZZJYYElaV?@=yve6O$1j6Az0b^8+;B)DqIA;<5S;S~&-m&{ zkIw$=Qz3F$4si9~b*S@<<0!W-0FzKce^fahagY1>`xxrhDp_g}WQBz{m5#|vpRnHzv zXM~UG@U|;rK^(?UPx_2AYOLoy0q)eGA${=iBgfulo?KV0^HGabXIki%>9aaDw8v1WF;y>s((e zkb-9MHt9r7Qmi}7FP4vekDGt1Qx*<|qS2ini(^y}eF4|Rco!f)$-@fgQwG*Zd!8S^ z>H~5(P3!FbnVR#@GeQ@LkYuAV78ml58P1+_2i>Ab7!#0tT0 zOdE{qs%J9<*z-ywKqu;gin;2KNKG8G?TuPKGtFXSGX9XyI7&Dtm>ZQlW=0L&!TcUR z#uuEOh%gr&S$>W}jg7C8BZzPovLvEB)o}E#OSL7kj4mO-tpK?8;8d)}Jf-kvhnsNw z-dY2FrwzxHaXhgMtBCfk_1HWUQ>|SQ7;#nrdHZuair4L1S*$*Y;*C5JykBR@@Fa=l zjR9It<@}*DrVf3uX!FbaDEmy4nB6ee1;qCRNFU^i#sFM=Nb;Jgg_yo#B{pIDCMR6f z$>{z8+Vyi%(ZkVQ+!ft<@Cf$tPmj$z5A+*z^Pz}DU59>Ax)3kM8M_?d%GQSoAx&V< zBa|u=3p>3zm1ea$6p0 zKsy?}0GoGAt*ku<rU%vt>B=6Wg zgTpTf2t__DaII(f;P~<-H=<^6>^`TJkdfK39d^bzX`jcWQyCKHFeFyK*EI^gaE8BA z=z3!neXpO+=6ro6D^(%rR~kX@B9WS%y%j{z@A*336bO0`mvbZNr^7L^r6A}_;>ZNq z3PCSED;6pQy)RvbpkHkSeOb-35Cr{#kZdy`>5JG@BphzbAnB*2xd2Tpsoi%Z{r&_b z{eFd{j~0QX*A{U;m`(^wgu@9;v+9gO`iX}Ftt&L?o&{OPx#^q_)8O{|hS$4YRb<@% z=+J$L@cRA2$-!kGi9Qr~Jsz9cKH`OI0O^V#1OMvAK@?0?0;)$RQB0s*x=FvE-0<11 zeai;0$Q|+&;>ao(4k0o4ND%Poo`i-#a$^Zc>tdc<`3^`@u6byTvJ3{PmxOeYCcRf? zTdkO#8x9@t2+ME)kzIr_?+{5Qa8-bEFxVv4Mu4edylY*A((gvV4z@SRb18aN?Ls4g zjDWx;@0XhrK|u9{!z*;wKorrnJ@3D~s-fWvJnBOAq)QCt!Z$Ykb{MYYQ4eW%@B!{4 zct`Pi^Kh3b=XPTXT}f*XDpvzKm{gcdYfL6pCPSU+Epi&*z3Vku`Rj$UL|ZGb%(|-# zsi6^$LnoH+LjrP%BVGJJD3rWkWpJwun9VUg55SoMj7N|HrZ5Fe`R_ebPWS|J^Pd9P z2USodwP@RCj0n6|$-4wIoO+<2jTi#{hr5`(m^{vv@<;w_0;dmIfPs}y#nZ*8COBBSWA8qJntK{{!_TRudo9%h8$n&uxH zu`YQE&I9VQ6PB z@;>i}q#9sDHC`0V%^0obJ9Um+v$EzO#*!oT!gg}ZpA|~QrbK?k3n7dutu2^54VClQ z@kuUlcOX1$GpS23q6Aj~NqZE)L}PeP7VRh^i1?9p3T!(?C0ZA0#kjuu3wowl>Xpj#O>j#6fpu&Kjr|8nrKa7A5FmHgye{GbY%>C z0#NWDQZ7JpPi=+6$*pQ83E3j(N*OV^#2f&+&E1Fz=oV5q`2ZqiQl^SM`9i}wWy=D( zo}zBl*bWM4VT0qb+ zPO4&=4jW}yFVna(7D={BQkP}c1s`ma)h{=;w$$^V;F*T_i5cPGGIXOHC}M$Ik$^fW z)thQ0x-O6a3UCb|@JB1i*Sco6_eQ}YmK@^eYRUHwS3^)o2iuGau~x0BM$e9UiV6n( zaADBaoH9Rx_|AaOOYsW6nm*4Tq9cBDy*MXl^4hgJHoY?@meL2y^|}1ZnGpG9Jk#e; z`(?{6gUBC;o(GTbCCj4DGzoBB)Y^KPgCnKFcCP@od#d4TH{jh~V{lffQ%G!~ml;Y9 zlyX@3X(8^AM0owiy}|gDlBluwm<6HWlu^c*Q`%VjFacz)t*zPFUqJxbzIRPr9zf>d za&7?Gbe1}{6aZOCOQ|4R0m#JX3P4r?$nG(KtgPml89=r~%j^t5vLbdB35V-4K(c9R zEbm%@r z%-BKUeBiQ=L@Uggwyv_#WdO*9s29@!v5`~xTZKu=!~vP(-Sxhpz*Yu|~_V-G8B+J2a@ zJJ(#<>>R8h?9S_rdre4;`1i5!N1 z;$x8a;Laxs6(vXUcZsfZyQIkY^rJ)fA)@P^7OH)heI)u&&~=`G=YwI?7cQ=hxCWLR zesm{g%}okP2F9MQbTX;~A(W0sV4&q}3Zfh%Dne0}Y6_tQ7(6x#(q4%5l7R;R;wGSN z5jctCg(E>-6+q=(0z62}%E*x&=|Bc6033-#BAQco_(wPDkEFFt_}n63UMG^$1`lGe zrq4u}1TOu75g`G~xsEc2jyJWQf^lox{vihxGJL^f1AAv?b>JVMFf>Aw_q z0@S58buYnbzFH)h;&Lc@(on-A)J zf~QZI5i2q_yNu+c&zN5tU2^N))d)bLoV$q?nLw!-YeFUJWuhnqL}Kd&;uoipg%P>9 z3S}NckdekP0?`l(rEC;)$*=@Hj4eCI3k|ZrhPP&@aUf$BVMdfHOIRvYReOVmQ~eK8 zy$i|Mc+H%+6le^rV_N~qEb~YNz5i6<#+MatT!BX$G@{wDw=oSMsR<>OU{aZxD_>p; ztn^xISfWa&F;{0zNa{lB1cj{_d#y}$f^foovcI?1@W{Qjro-D3l9tMvH;B3?bh*}M z-cCAEe--pv^L08#t&P!86V*t85-{`WM#;aWM!+9^qd>xDSoL7q!0HqatS6Uxx3n_Q z5nk)CgVKT4y=dd&Q0so2F#YBYe9o2;`kZ;Az)wp!AN*X>)#1-y zE;#(TS;CS6pgZBu3j?4}41r!Y2zn8`vRokaaiP!)gQ2sM;n1Cc=ti{{5fk0FPK2L3 z9TWyNZ>{~r+b>|Me?vqVh4- z6Y2cPh^ro>VQhgh)fu}RQ{-=GibQ*ldCXrNh`q91nzqYu408 zqpxJ8s(|e)4g7bJRL#!Q6$Ji!cgj-$|2faJkl4FHNq7{9o&s3XgH5|M!c_Anu7nu<(yy5XE6; zxaZZ*Zh^#O^9%|gRa|s*#wU)+EFZfb=cO#W45ag1E=z+N9Z_L}XIuoy1@Bs!cA|@J zr*3$QB{$%5s?IKX$E~r;us;;XP2GObGu+$)f)c$8BkPe;EW8q>9N+$u%T~k^vF@cg zC1n16I7%bloXql|VoKF;>k0c=)(HUD?z+ll%72#v(I)~fQp&|FwkTjsnM81Knm#|e zgxxGp7_oCDe8C#HA+y6Fy+}GdcKpJkff30I)Tn|@vtxJ##MXa$+-kMg|NLXC)%jAd z?S5^wwl==NKk~87=eO;e@`k!$3DfaN3Xh)J87vyOKvf$-@?0SS6<55ku`9IZ!+~r& z65WpX;b6o&MqBt+Gf{+qWcvhAHnYO;Ym561+TWW1MCUyBsfyLi9MHV-h0)?xnsePb zzFeZy^31G3v}IPkX$K;{Rjh8<`96J=d^w{o*w2hvqYVhZ>mA4GFk6GdV9Q z2xPVdBVNs#DK&S^ok6v9RKQ$j?q zQKCiXr+3kNID#Y+J*UJ)?*wu9%skJ3_r-U1W_RE2?CgBj_0le- zQs-XUPB&Ij;`mwoeGS;_Ta+0af|TuhC%u~Da!TD#Kco>1{S_Y%vjt{0{^OMpXV@Je z?-a)uEe{0_-NoA%9`QM!>iwGRDd`VK%b^E5`qA>A9{rg$+vgvu!7(kchI&(m{>hPA zzWRyW%HQp?JcXxBS5RVzw~vGVM6P!{Rdc$RICV*crH*o2DK6>j zr>7iVAMVhwnDENCe~KSh%5nB%Fd2WcMKPyieHZU3-xTlJYIqyY#%euiD5D04Fei*< z#n(cZ(YCDCW}{Ny<2_SubaQ@*dU`Iz!eDOyB?^VK2p`J&wf{W}>lBfN{aDYU4y|J$ zv$(w)8vMKBQPWj?k_PwfR>lb_`RLL_3OJgNrFk~3cJ)h6 zACNW%2$i}sM3@7B&T))(xl@pd?1#*^>Znn-d;g56lL8#t_zmyG=%ZX4b8tfRrbkBp zZdO}x>r5xT7FT~G98KqPTytI8B=GPC&+!kiBQj6qF`pa-?bApB3p}`nJ4w|}z2|`e zjmSvBv<@jDgY4Uyz&jPE^K{;Tu2TiA3}9+KG>@}$h@ zsUl5h7WNFdmm3hG-8iDU&-Z#IW5MR52}pIqme5djkDO;zV2+nU$#LKoK;np#EbPqz zY5WOKX%2+RY$N2)_Vn#c!-m4en(@8Oy0a|snVFx0f;!uUFb%-m2SmOfZ9#S7x^n92 zQ;^J}tQ*7<-WP+gnUHIBu?b_%S~l=!#Vu#}XmVT4fOGpGy7u?WO2HyK4-b%*Od3}_ zAm9%bM&3)k4$7bAXueA7FJr$r{3+HGGfXqm&-to``V&Xd#M*vynl&uQ!|<872++R7 z*gjM(^R?bj=*oKGEz7~JiMiY1W<}KTp`3mn<(I3spj*L6lh}DSN9tlK5Bus+7N2mR z-1i-GutaYeQ|G*$)E7Yk|F9FZQoV4dp3qr0?FP5HN%)MDVxPmV)T~HDrAgH%HY3(R zVUeoW&02;jP0L)8#KVcR=04JA1{Fz-fv3BP9yUexBaA?9i4n@Z)g#7Az}GLQRh(SG z-9;%yJHUZYv}g&Q4Hudl7P=kvR`!PK9GDq4m|URF!#`F#%PaI+u*)(#1Lc=5N_9AFI#G-w zHPFtrZDw=b>kAIs+d53M1|vv*T~CVHAyF}96Nl{~(U8j>81z`>q9 z*vpjE(1m)Fel|8RFO`3h|IBx?vQB->#a=|V)-rW>aCIY17!ZXL{5c*Ds zGK_^I+cs4N8Hh5n`k(@6(G@wRYTb^a!h53mj*a6 z#~XCBc367vPE%$+y)vbFCia#)NvBzI^F+*) zi0~gS(DCCqnhx3(TMm`j8FJoCD9=o%wmIz1Pm@#unM^aI5=bi@smktSw zW@QvJG@Kv-t4DO$57dmTt7)}|@hsnPj5^=$qDcc!dj>P?B@@02zpAMS4nGtlp9Lh7 z4cxzJ(E4Mi+w7&{PKKIxp(*aGRx(0azKV0x;mMqIHLhktbwK#sc1E|985DlJHLbuL&O6vB(4||Ybeuu z0RbpSsA4*tEqSz~im3W>*T|9!DU3NTFRJNow0K!N-u{ql}S{$u3&G1v5^8uLcldGe`rF9R`+RJc}0sF zzQVdNZu}-?q3OZuc4Ngg$VC?K3xzNznh3}rLOc%`lvw6f{e4&wg49Bn(zrPj3F;ARV zEW)@4c^rIXh0k*kFx@(e4;2;^KXYSne7bL2HDY5i`^#!gKTH@~H3%gLR6yXwZ1uDv z22uHtIY2!c> ze{6TKF?x_(aD6q~8XbIfNsGQ{MYRVKQw1KjpEAiX<`?hgbb82P&zoN9=2LpCVl=*2 z7B1}{%d$bQ9&bpkU3xTK5qI8-x9x8yx}U(`WMf_e+AR@58Ez+jHLosCIuFV;6eSp9 zd3MUsn{JmR7|BY00qVa1$lZ-O!+&=w;3a(|jEh!$G&p33g6p1y# z5sB91?3^cA)4RUu_|y8NzLh*64LC>);Ya$a5*tvK<96s~IqMTGwGit`(&#ArF z?^I0*wBTOySMrJ^Ez7yNymT13%Z7)A=Me4{>P)(5)I{>&WR4#zr#dqErX4g}-HGwO zp~q%*3ec^oYmu#yocp({FcoV1!?vSx;j>|s=OeL1t7{Ndb>@zQEilDEdka!3(_s%R zPlzx*DtQB%25SKf)M#!CO{)Y-zgaI~|5wjh%OlXI_g%{EdTymEz}Ujo6D7C9^!EcH zDArH!-eb!h$-q5{+AIWt-~5#(&6Mk-?R-OiZ#ihot`}yKM9FL|XB^(aDlQ{bpSJZM4W=sis!G9>q&7qZbz8>+t&DL_Bem>A57&2Iupgw> z$Y74f&Jc~uMiLJ4D^WDkoNrQkR#QB9ZGCDK_+^!W&{tH?_P+NMD^v~^6q={vb-$Pp zq2u@dY2=+@B<*8SXU~SoRcQKsr#2&|F3SWE#o0kc=6;46$-62+i+}k!Lx_CsZuZlN zDXu+D^_;fwN@BOl={;@?VmK`@)N;SXcSO=Xt=#$f&GtI`h&21UzO3zJktxl#-*J#Z ze*?6W4ZE=wUtZq>NS3}`x}=@Uy|`Zb#g=8mqJF*BY~TQ_Z;S!yjEQhnqEcu!UKx6# znYbbij}C;n!S)*{bCi{9h^b?{)$DHd)M3=m57;0GDGrokXvJIOi0#Ek6>m3f0;k9D z`&wXx$p9X0@%-RV9@?C`;)FI2U7WZbqJkpc@5HO|qA0y3LzW!RtoU=qcTuK#;-h%G zR0N(V@H_`mE+&-Y5O_#ocNW50F>FIZzK(pZE9;G_VaqN9mCtS^B~@4Y$YhI763#YK z*bh9k^V$}DQ|nYwHQL}ct_902>zTX-gG2^*rE$G=qXY?<%Db=i9k`6af^$Qu7NJ|e z*9yi=AK(yuP4V4T%!|zz(_zb3#4tT5DH$8dfB$86P12H(lJNYMYx^&s&Hi_j|BuD} fTlzmuqOZ~1|3l{LK`8)#Q^>A8>RN}M|Be0wR-Zzk literal 0 HcmV?d00001 diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/createUiDefinition.json b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/createUiDefinition.json similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/createUiDefinition.json rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/createUiDefinition.json diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/mainTemplate.json b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/mainTemplate.json similarity index 81% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/mainTemplate.json rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/mainTemplate.json index 2598bd1d724..5ebab0eaabe 100644 --- a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/mainTemplate.json +++ b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/mainTemplate.json @@ -3,7 +3,7 @@ "contentVersion": "1.0.0.0", "metadata": { "author": "Microsoft - support@microsoft.com", - "comments": "Solution template for Multi Cloud Attack Coverage Essentials-Resource Abuse" + "comments": "Solution template for Multi Cloud Attack Coverage Essentials - Resource Abuse" }, "parameters": { "location": { @@ -32,64 +32,73 @@ "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", - "_solutionName": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "_solutionName": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "_solutionVersion": "3.0.0", "solutionId": "azuresentinel.azure-sentinel-solution-multicloudattackcoverage", "_solutionId": "[variables('solutionId')]", - "analyticRuleVersion1": "1.0.0", - "analyticRulecontentId1": "1f40ed57-f54b-462f-906a-ac3a89cc90d4", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", - "analyticRuleVersion2": "1.0.0", - "analyticRulecontentId2": "5c847e47-0a07-4c01-ab99-5817ad6cb11e", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", - "analyticRuleVersion3": "1.0.0", - "analyticRulecontentId3": "58e306fe-1c49-4b8f-9b0e-15f25e8f0cd7", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", - "analyticRuleVersion4": "1.0.1", - "analyticRulecontentId4": "122fbc6a-57ab-4aa7-b9a9-51ac4970cac1", - "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", - "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", - "analyticRuleVersion5": "1.0.0", - "analyticRulecontentId5": "188db479-d50a-4a9c-a041-644bae347d1f", - "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", - "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", - "analyticRuleVersion6": "1.0.0", - "analyticRulecontentId6": "b51fe620-62ad-4ed2-9d40-5c97c0a8231f", - "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", - "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", - "analyticRuleVersion7": "1.0.2", - "analyticRulecontentId7": "60f31001-018a-42bf-8045-a92e1f361b7b", - "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", - "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", - "analyticRuleVersion8": "1.0.0", - "analyticRulecontentId8": "11c3d541-5fa5-49df-8218-d1c98584473b", - "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", - "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", - "analyticRuleVersion9": "1.0.1", - "analyticRulecontentId9": "f4a28082-2808-4783-9736-33c1ae117475", - "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", - "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.0", + "_analyticRulecontentId1": "1f40ed57-f54b-462f-906a-ac3a89cc90d4", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1f40ed57-f54b-462f-906a-ac3a89cc90d4')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1f40ed57-f54b-462f-906a-ac3a89cc90d4')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1f40ed57-f54b-462f-906a-ac3a89cc90d4','-', '1.0.0')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.0", + "_analyticRulecontentId2": "5c847e47-0a07-4c01-ab99-5817ad6cb11e", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5c847e47-0a07-4c01-ab99-5817ad6cb11e')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5c847e47-0a07-4c01-ab99-5817ad6cb11e')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5c847e47-0a07-4c01-ab99-5817ad6cb11e','-', '1.0.0')))]" + }, + "analyticRuleObject3": { + "analyticRuleVersion3": "1.0.0", + "_analyticRulecontentId3": "58e306fe-1c49-4b8f-9b0e-15f25e8f0cd7", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '58e306fe-1c49-4b8f-9b0e-15f25e8f0cd7')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('58e306fe-1c49-4b8f-9b0e-15f25e8f0cd7')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','58e306fe-1c49-4b8f-9b0e-15f25e8f0cd7','-', '1.0.0')))]" + }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.1", + "_analyticRulecontentId4": "122fbc6a-57ab-4aa7-b9a9-51ac4970cac1", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '122fbc6a-57ab-4aa7-b9a9-51ac4970cac1')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('122fbc6a-57ab-4aa7-b9a9-51ac4970cac1')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','122fbc6a-57ab-4aa7-b9a9-51ac4970cac1','-', '1.0.1')))]" + }, + "analyticRuleObject5": { + "analyticRuleVersion5": "1.0.0", + "_analyticRulecontentId5": "188db479-d50a-4a9c-a041-644bae347d1f", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '188db479-d50a-4a9c-a041-644bae347d1f')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('188db479-d50a-4a9c-a041-644bae347d1f')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','188db479-d50a-4a9c-a041-644bae347d1f','-', '1.0.0')))]" + }, + "analyticRuleObject6": { + "analyticRuleVersion6": "1.0.0", + "_analyticRulecontentId6": "b51fe620-62ad-4ed2-9d40-5c97c0a8231f", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b51fe620-62ad-4ed2-9d40-5c97c0a8231f')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b51fe620-62ad-4ed2-9d40-5c97c0a8231f')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b51fe620-62ad-4ed2-9d40-5c97c0a8231f','-', '1.0.0')))]" + }, + "analyticRuleObject7": { + "analyticRuleVersion7": "1.0.2", + "_analyticRulecontentId7": "60f31001-018a-42bf-8045-a92e1f361b7b", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '60f31001-018a-42bf-8045-a92e1f361b7b')]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('60f31001-018a-42bf-8045-a92e1f361b7b')))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','60f31001-018a-42bf-8045-a92e1f361b7b','-', '1.0.2')))]" + }, + "analyticRuleObject8": { + "analyticRuleVersion8": "1.0.0", + "_analyticRulecontentId8": "11c3d541-5fa5-49df-8218-d1c98584473b", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '11c3d541-5fa5-49df-8218-d1c98584473b')]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('11c3d541-5fa5-49df-8218-d1c98584473b')))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','11c3d541-5fa5-49df-8218-d1c98584473b','-', '1.0.0')))]" + }, + "analyticRuleObject9": { + "analyticRuleVersion9": "1.0.1", + "_analyticRulecontentId9": "f4a28082-2808-4783-9736-33c1ae117475", + "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f4a28082-2808-4783-9736-33c1ae117475')]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f4a28082-2808-4783-9736-33c1ae117475')))]", + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f4a28082-2808-4783-9736-33c1ae117475','-', '1.0.1')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", "SystemAlertId": "SystemAlertId", "_SystemAlertId": "[variables('SystemAlertId')]", @@ -104,7 +113,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName1')]", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -113,13 +122,13 @@ "description": "BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId1')]", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -170,6 +179,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -179,40 +189,39 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "AwsUser": "UserIdentityUserName", - "AzureUser": "UserPrincipalName", "UserAgent": "UserAgent", - "AzureClientAppUsed": "ClientAppUsed" + "AzureClientAppUsed": "ClientAppUsed", + "AzureUser": "UserPrincipalName", + "AwsUser": "UserIdentityUserName" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -234,18 +243,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId1')]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "contentKind": "AnalyticsRule", "displayName": "Cross-Cloud Password Spray detection", - "contentProductId": "[variables('_analyticRulecontentProductId1')]", - "id": "[variables('_analyticRulecontentProductId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -254,13 +263,13 @@ "description": "Cross-CloudSuspiciousComputeResourcecreationinGCP_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId2')]", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -311,15 +320,16 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "GCPUserIp", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -329,57 +339,56 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "customDetails": { - "GCPVMType": "VMType", "AWSAlertUserName": "AWSAlertUserNameEntity", + "AWSresourceType": "AWSresourceType", + "GCPVMType": "VMType", "AWSAPICallCount": "APICallCount", - "GCPUserAgent": "GCPUserUA", "AWSArn": "Arn", - "GCPProjectId": "[variables('_ProjectId')]", "AWSInstanceType": "InstanceType", "CorrelationWith": "GCPAuditLogs", + "AWSAPICallName": "APICallName", "GCPVMName": "VMName", - "AWSresourceType": "AWSresourceType", - "AWSAPICallName": "APICallName" + "GCPProjectId": "[variables('_ProjectId')]", + "GCPUserAgent": "GCPUserUA" }, "alertDetailsOverride": { + "alertSeverityColumnName": "Severity", + "alertDisplayNameFormat": "{{AWSNetworkEntity}} from {{AWSAlertTitle}} observed in GCP compute activity with {{GCPUserUPN}}", "alertDescriptionFormat": " This detection compiles and correlates unauthorized user access alerts originating from AWS GuardDuty With Alert Description '{{AWSAlertDescription}}' assocated with GCP compute activities. It focuses on AWS GuardDuty alerts related to unauthorized user access, specifically targeting network IP associations tied to activities such as logins from malicious IP addresses or instance credential exfiltration attempts. The detection leverages these common network IP advisories to detect and pinpoint unauthorized users attempting to access both AWS and Azure resources. \n\n AWS ALert Link : '{{AWSAlertLink}}' \n\n Find More Details :https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html", "alertDynamicProperties": [ { - "alertProperty": "AlertLink", - "value": "AWSAlertLink" + "value": "AWSAlertLink", + "alertProperty": "AlertLink" }, { - "alertProperty": "ProviderName", - "value": "AWS" + "value": "AWS", + "alertProperty": "ProviderName" }, { - "alertProperty": "ProductComponentName", - "value": "AWSGuarduty" + "value": "AWSGuarduty", + "alertProperty": "ProductComponentName" } - ], - "alertDisplayNameFormat": "{{AWSNetworkEntity}} from {{AWSAlertTitle}} observed in GCP compute activity with {{GCPUserUPN}}", - "alertSeverityColumnName": "Severity" + ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -401,18 +410,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId2')]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "contentKind": "AnalyticsRule", "displayName": "Cross-Cloud Suspicious Compute resource creation in GCP", - "contentProductId": "[variables('_analyticRulecontentProductId2')]", - "id": "[variables('_analyticRulecontentProductId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName3')]", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -421,13 +430,13 @@ "description": "CrossCloudSuspiciousUserActivityObservedInGCPEnvourment_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId3')]", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -496,15 +505,16 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "GCPUserIp", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -514,59 +524,58 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "customDetails": { - "AlertUserUPN": "AlertUserUPN", "TimeDiff": "TimeDiff", - "FirstAlert": "FirstAlert", + "AlertName": "AlertName", + "SystemAlertId": "[variables('_SystemAlertId')]", "CorrelationWith": "GCPAuditLogs", - "MethodName": "MethodName", "GCPProjctId": "[variables('_GCPProjctId')]", - "Tactics": "Tactics", - "Request": "Request", + "MethodName": "MethodName", "ServiceName": "ServiceName", "LastAlert": "LastAlert", + "AlertUserUPN": "AlertUserUPN", + "FirstAlert": "FirstAlert", "GCPCallerUA": "GCPCallerUA", - "AlertName": "AlertName", - "SystemAlertId": "[variables('_SystemAlertId')]" + "Request": "Request", + "Tactics": "Tactics" }, "alertDetailsOverride": { + "alertSeverityColumnName": "AlertSeverity", + "alertDisplayNameFormat": "A user {{GCPUserUPN}} has been linked to {{AlertName}}, and has potentially suspicious behavior within the GCP environment from, originating from the IP address {{GCPUserIp}}.", "alertDescriptionFormat": " This detection compiles and correlates unauthorized user access alerts originating from {{ProductName}} With Alert Description '{{Description}}' observed activity in GCP environmeny. It focuses on Microsoft Security, specifically targeting user bhaviour and network IP associations tied to activities such as logins from malicious IP addresses or instance credential exfiltration attempts. The detection leverages these common network IP advisories to detect and pinpoint users suspicious activity to access both Azure and GCP resources. \n\n Microsoft Security ALert Link : '{{AlertLink}}'", "alertDynamicProperties": [ { - "alertProperty": "AlertLink", - "value": "AlertLink" + "value": "AlertLink", + "alertProperty": "AlertLink" }, { - "alertProperty": "ProviderName", - "value": "ProductName" + "value": "ProductName", + "alertProperty": "ProviderName" }, { - "alertProperty": "ProductComponentName", - "value": "Microsoft Security" + "value": "Microsoft Security", + "alertProperty": "ProductComponentName" } - ], - "alertDisplayNameFormat": "A user {{GCPUserUPN}} has been linked to {{AlertName}}, and has potentially suspicious behavior within the GCP environment from, originating from the IP address {{GCPUserIp}}.", - "alertSeverityColumnName": "AlertSeverity" + ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 3", + "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -588,18 +597,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId3')]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "contentKind": "AnalyticsRule", "displayName": "Cross-Cloud Suspicious user activity observed in GCP Envourment", - "contentProductId": "[variables('_analyticRulecontentProductId3')]", - "id": "[variables('_analyticRulecontentProductId3')]", - "version": "[variables('analyticRuleVersion3')]" + "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName4')]", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -608,13 +617,13 @@ "description": "CrossCloudUnauthorizedCredentialsAccessDetection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion4')]", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId4')]", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -660,15 +669,16 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -678,64 +688,63 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "customDetails": { - "AzAuthRequirement": "AuthenticationRequirement", - "alertSeverity": "Severity", + "AWSArn": "Arn", + "AzureUserAgent": "UserAgent", + "AWSAplicationName": "RDSApplication", + "AzureUser": "UserPrincipalName", + "AWSInstanceId": "[variables('_RDSInstanceId')]", + "AWSInstanceType": "RDSactionType", + "AWSresourceType": "AWSresourceType", + "AzConditionalAccess": "ConditionalAccessStatus", "AzureClientAppUsed": "ClientAppUsed", "AzureRiskDetail": "RiskDetail", - "AzureOperationName": "OperationName", - "AzureUserAgent": "UserAgent", + "alertSeverity": "Severity", "AWSAlertUserName": "RDSUser", - "AzConditionalAccess": "ConditionalAccessStatus", - "AWSresourceType": "AWSresourceType", - "AWSInstanceId": "[variables('_RDSInstanceId')]", - "AzureUser": "UserPrincipalName", - "AWSAplicationName": "RDSApplication", - "AWSArn": "Arn", - "AWSInstanceType": "RDSactionType" + "AzureOperationName": "OperationName", + "AzAuthRequirement": "AuthenticationRequirement" }, "alertDetailsOverride": { + "alertSeverityColumnName": "Severity", + "alertDisplayNameFormat": "IP address {{IPAddress}} in {{AWSAlertTitle}} seen in Azure Signin Logs with {{UserPrincipalName}}", "alertDescriptionFormat": "This detection correlates AWS GuardDuty Credential Access alert described '{{AWSAlertDescription}}' related to Amazon Relational Database Service (RDS) activity with Azure portal sign-in activities. It identifies successful and failed logins, anomalous behavior, and malicious IP access. By joining these datasets on network entities and IP addresses, it detects unauthorized credential access attempts across AWS and Azure resources, enhancing cross-cloud security monitoring. \n\n AWS ALert Link : '{{AWSAlertLink}}' \n\n Find More Details :https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html", "alertDynamicProperties": [ { - "alertProperty": "AlertLink", - "value": "AWSAlertLink" + "value": "AWSAlertLink", + "alertProperty": "AlertLink" }, { - "alertProperty": "ProviderName", - "value": "AWS" + "value": "AWS", + "alertProperty": "ProviderName" }, { - "alertProperty": "ProductName", - "value": "AWSGuardDuty" + "value": "AWSGuardDuty", + "alertProperty": "ProductName" }, { - "alertProperty": "ProductComponentName", - "value": "AWSGuardDuty" + "value": "AWSGuardDuty", + "alertProperty": "ProductComponentName" } - ], - "alertDisplayNameFormat": "IP address {{IPAddress}} in {{AWSAlertTitle}} seen in Azure Signin Logs with {{UserPrincipalName}}", - "alertSeverityColumnName": "Severity" + ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 4", - "parentId": "[variables('analyticRuleId4')]", - "contentId": "[variables('_analyticRulecontentId4')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 4", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion4')]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -757,18 +766,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId4')]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "contentKind": "AnalyticsRule", "displayName": "Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login", - "contentProductId": "[variables('_analyticRulecontentProductId4')]", - "id": "[variables('_analyticRulecontentProductId4')]", - "version": "[variables('analyticRuleVersion4')]" + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName5')]", + "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -777,13 +786,13 @@ "description": "SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion5')]", + "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId5')]", + "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -842,6 +851,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -851,39 +861,38 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "AWSUser": "UserIdentityArn", "UserAgent": "UserAgent", - "AWSUserUPN": "CTUPN" + "AWSUserUPN": "CTUPN", + "AWSUser": "UserIdentityArn" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 5", - "parentId": "[variables('analyticRuleId5')]", - "contentId": "[variables('_analyticRulecontentId5')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 5", + "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion5')]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -905,18 +914,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId5')]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "contentKind": "AnalyticsRule", "displayName": "Successful AWS Console Login from IP Address Observed Conducting Password Spray", - "contentProductId": "[variables('_analyticRulecontentProductId5')]", - "id": "[variables('_analyticRulecontentProductId5')]", - "version": "[variables('analyticRuleVersion5')]" + "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName6')]", + "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -925,13 +934,13 @@ "description": "SuspiciousAWSConsolLoginByCredentialAceessAlerts_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion6')]", + "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId6')]", + "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -995,6 +1004,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -1004,40 +1014,39 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "AzureUserUPN": "AccountUPN", "UserAgent": "UserAgent", - "ComonIp": "SourceIpAddress", - "AWSUSerUPN": "CTUPN" + "AWSUSerUPN": "CTUPN", + "AzureUserUPN": "AccountUPN", + "ComonIp": "SourceIpAddress" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 6", - "parentId": "[variables('analyticRuleId6')]", - "contentId": "[variables('_analyticRulecontentId6')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 6", + "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion6')]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -1059,18 +1068,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId6')]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "contentKind": "AnalyticsRule", "displayName": "Suspicious AWS console logins by credential access alerts", - "contentProductId": "[variables('_analyticRulecontentProductId6')]", - "id": "[variables('_analyticRulecontentProductId6')]", - "version": "[variables('analyticRuleVersion6')]" + "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName7')]", + "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1079,13 +1088,13 @@ "description": "Unauthorized_user_access_across_AWS_and_Azure_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion7')]", + "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId7')]", + "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1133,15 +1142,16 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -1151,64 +1161,63 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "customDetails": { + "AWSAPICallName": "APICallName", + "AzureUserAgent": "UserAgent", + "AzureUser": "UserPrincipalName", + "AWSresourceType": "AWSresourceType", + "AWSInstanceType": "InstanceType", + "AWSArn": "Arn", "AWSAPICallCount": "APICallCount", - "AzAuthRequirement": "AuthenticationRequirement", - "alertSeverity": "Severity", + "AzConditionalAccess": "ConditionalAccessStatus", "AzureClientAppUsed": "ClientAppUsed", "AzureRiskDetail": "RiskDetail", - "AzureOperationName": "OperationName", - "AzureUserAgent": "UserAgent", + "alertSeverity": "Severity", "AWSAlertUserName": "AWSAlertUserNameEntity", - "AzConditionalAccess": "ConditionalAccessStatus", - "AWSresourceType": "AWSresourceType", - "AWSAPICallName": "APICallName", - "AzureUser": "UserPrincipalName", - "AWSArn": "Arn", - "AWSInstanceType": "InstanceType" + "AzureOperationName": "OperationName", + "AzAuthRequirement": "AuthenticationRequirement" }, "alertDetailsOverride": { + "alertSeverityColumnName": "Severity", + "alertDisplayNameFormat": "{{AWSNetworkEntity}} from {{AWSAlertTitle}} observed in Azure Singins with {{UserPrincipalName}}", "alertDescriptionFormat": " This detection compiles and correlates unauthorized user access alerts originating from AWS GuardDuty With Alert Description '{{AWSAlertDescription}}' with Azure portal sign-in activities. It focuses on AWS GuardDuty alerts related to unauthorized user access, specifically targeting network IP associations tied to activities such as logins from malicious IP addresses or instance credential exfiltration attempts. The detection leverages these common network IP advisories to detect and pinpoint unauthorized users attempting to access both AWS and Azure resources. \n\n AWS ALert Link : '{{AWSAlertLink}}' \n\n Find More Details :https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html", "alertDynamicProperties": [ { - "alertProperty": "AlertLink", - "value": "AWSAlertLink" + "value": "AWSAlertLink", + "alertProperty": "AlertLink" }, { - "alertProperty": "ProviderName", - "value": "AWS" + "value": "AWS", + "alertProperty": "ProviderName" }, { - "alertProperty": "ProductName", - "value": "AWSGuardDuty" + "value": "AWSGuardDuty", + "alertProperty": "ProductName" }, { - "alertProperty": "ProductComponentName", - "value": "AWSGuardDuty" + "value": "AWSGuardDuty", + "alertProperty": "ProductComponentName" } - ], - "alertDisplayNameFormat": "{{AWSNetworkEntity}} from {{AWSAlertTitle}} observed in Azure Singins with {{UserPrincipalName}}", - "alertSeverityColumnName": "Severity" + ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 7", - "parentId": "[variables('analyticRuleId7')]", - "contentId": "[variables('_analyticRulecontentId7')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 7", + "parentId": "[variables('analyticRuleObject7').analyticRuleId7]", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion7')]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -1230,18 +1239,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId7')]", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "contentKind": "AnalyticsRule", "displayName": "Unauthorized user access across AWS and Azure", - "contentProductId": "[variables('_analyticRulecontentProductId7')]", - "id": "[variables('_analyticRulecontentProductId7')]", - "version": "[variables('analyticRuleVersion7')]" + "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName8')]", + "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1250,13 +1259,13 @@ "description": "UserImpersonateByAAID_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion8')]", + "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId8')]", + "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1295,35 +1304,35 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "AWSUser": "UserIdentityArn", + "AlertIp": "ipAddress", "AlertName": "AlertName", - "AlertIp": "ipAddress" + "AWSUser": "UserIdentityArn" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 8", - "parentId": "[variables('analyticRuleId8')]", - "contentId": "[variables('_analyticRulecontentId8')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 8", + "parentId": "[variables('analyticRuleObject8').analyticRuleId8]", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion8')]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -1345,18 +1354,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId8')]", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "contentKind": "AnalyticsRule", "displayName": "User impersonation by Identity Protection alerts", - "contentProductId": "[variables('_analyticRulecontentProductId8')]", - "id": "[variables('_analyticRulecontentProductId8')]", - "version": "[variables('analyticRuleVersion8')]" + "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName9')]", + "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1365,13 +1374,13 @@ "description": "UserImpersonateByRiskyUser_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion9')]", + "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId9')]", + "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1412,36 +1421,36 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "AwsUser": "UserIdentityArn", - "AzureUser": "UserPrincipalName", + "RiskEventTypes": "RiskEventTypes", "AWSEventName": "EventName", - "RiskEventTypes": "RiskEventTypes" + "AzureUser": "UserPrincipalName", + "AwsUser": "UserIdentityArn" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]", "properties": { - "description": "Multi Cloud Attack Coverage Essentials-Resource Abuse Analytics Rule 9", - "parentId": "[variables('analyticRuleId9')]", - "contentId": "[variables('_analyticRulecontentId9')]", + "description": "Multi Cloud Attack Coverage Essentials - Resource Abuse Analytics Rule 9", + "parentId": "[variables('analyticRuleObject9').analyticRuleId9]", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion9')]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -1463,12 +1472,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId9')]", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "contentKind": "AnalyticsRule", "displayName": "High-Risk Cross-Cloud User Impersonation", - "contentProductId": "[variables('_analyticRulecontentProductId9')]", - "id": "[variables('_analyticRulecontentProductId9')]", - "version": "[variables('analyticRuleVersion9')]" + "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" } }, { @@ -1479,7 +1488,7 @@ "version": "3.0.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", - "displayName": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "displayName": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The rise of Multi Cloud Resource Abuse attacks poses a significant threat to the security and integrity of cloud infrastructures. These attacks target the vulnerabilities within AWS, GCP, and Azure cloud environments, aiming to exploit misconfigurations, weak access controls, or compromised credentials to gain unauthorized access, manipulate resources, and extract valuable data across diverse cloud platforms. The Multi Cloud Resource Abuse Attack Solution is designed to fortify the detection and prevention measures against such malicious activities. By integrating detection capabilities across AWS, GCP, and Azure cloud infrastructures, this solution offers a set of detection strategies across various cloud platforms, including AWS, GCP, and Azure, aiming to identify abnormal activities, unauthorized access attempts, resource misuse, and data exfiltration. The solution encompasses log monitoring, anomaly detection, and behaviour analysis to detect and respond to potential breaches or abuses. This solution extends its coverage to include a wide array of cloud-based services such as AWS IAM, Azure AD, GCP IAM, storage services, and more, ensuring a comprehensive approach to identifying, mitigating, and responding to potential threats.

\n

Pre-requisites:

\n

This is a domain solution and does not include any data connectors. To achieve the most robust protection against Multi Cloud Resource Abuse, it is recommended to deploy this solution in conjunction with complementary tools and solutions across the cloud platforms. Install one or more of the listed solutions to unlock the value provided by this solution.

\n

Microsoft Defender XDR

\n

Microsoft Entra ID

\n

Amazon Web Services

\n

Google Cloud Platform IAM

\n

Google Cloud Platform Audit Logs

\n

This content covers all stages of the attack chain from an initial resource access attack vector, establishing persistence to an environment, locating and executing malicious activity from data stores, and then perpetrating and hiding their activity. This range of content complements the coverage Microsoft 365 Defender provides across Microsoft Defender products: https://learn.microsoft.com/microsoft-365/security/defender/automatic-attack-disruption

\n

Keywords: Multi-cloud, Cross-cloud, AWS, GCP, GuardDuty, AWS GuardDuty, GCP Security, Security Console, Cloud abuse, Resource Abuse

\n

Analytic Rules: 9

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", @@ -1490,7 +1499,7 @@ "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", - "name": "Multi Cloud Attack Coverage Essentials-Resource Abuse", + "name": "Multi Cloud Attack Coverage Essentials - Resource Abuse", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -1508,48 +1517,48 @@ "criteria": [ { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId4')]", - "version": "[variables('analyticRuleVersion4')]" + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId5')]", - "version": "[variables('analyticRuleVersion5')]" + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId6')]", - "version": "[variables('analyticRuleVersion6')]" + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId7')]", - "version": "[variables('analyticRuleVersion7')]" + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId8')]", - "version": "[variables('analyticRuleVersion8')]" + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId9')]", - "version": "[variables('analyticRuleVersion9')]" + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" } ] }, diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/ReleaseNotes.md b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/ReleaseNotes.md similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/ReleaseNotes.md rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/ReleaseNotes.md diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/SolutionMetadata.json b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/SolutionMetadata.json similarity index 100% rename from Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/SolutionMetadata.json rename to Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/SolutionMetadata.json diff --git a/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/3.0.0.zip b/Solutions/Multi Cloud Attack Coverage Essentials-Resource Abuse/Package/3.0.0.zip deleted file mode 100644 index 9c3481e945e63b627bfd343da83b7c70bd4c8fe2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 19557 zcmV)XK&`(}O9KQH000080LhbgS7R+z2T&0J05?1U02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH-COH&+&FgrpQ^kAsy7}>uD zR+hPWFc{d8{#>SVs^%&!`|?9osD6~q-8(ZF_ILWby}VEht*!?rg_5QE@$6JhbgE08 zrTynsQtDUp{yUSUf9iC3ubE8aL>08xa~&0#$tGog#A^pDxXBAu7%W7STbsGpxh&*d zm6(JXztRu}qb!~1X)}N!ZC>jSvWPJ_k%>{=`psAx9hq=424iKSLg%I1`JeTCDohbQ zysWuX$m{-8m$PbI8C77%k~l=X;gi_EdlwkgsY(W57Kj`?%chyJ?|%00`ere`?1*a} zmosc|ct3xS$C=X8Sy?~-`7*ss@7?>?tW*!~-4o}Dl17O_O;jPuOq4SvCRvhX*E*ew zv6^Is5;`@dOcENQ_a;j!I?w}gS%}M2{Lg>=w|K$4Y`qq5UMRadZD!tX`4ijI-h9Ne zP|Bb4!YyV7tN?d*hbKu^#rQcYOBr3!KnBr5v+(Ol%EQKXC! zgoh$aFq##3nCC@?FH|g|Ld8zjwA>VY7gZ{&a+VeP118u7x{zzC^D2Qg0PijTj3raO zFAEu!Vj+`CjuRzfSxS5dLt;d%$zb?XYq>*_1Z)5#1Cl@|7Af^) z$-InVZX%vU)Q~x%1L1KFO(8i5Nyjp!FjX|eK@uJ5timw9S}_0n;?dFx6x;)6n>8bu zH)3*!x>-ys8ql@cTSGaUKx7P4R}S2)+j9#K-oMCArLLfz0T zS#U{?Q+z6u;KbccQYKAR^PDuy%a{}k@~}IwVAcDHPD-m~R*d!WR7$EP4dE!sredDK z>tKg;O5bOoVA&kmE;&{+xxhIKJmIy`tcG?HPXHl#ma@?EthA~s#y}-Jo*`|Pq%W*c zA*Z2~DvgcMB`LqPY|Im89xzGv9Y2afHURFy_kbDj9}5kBSbdQ!Z*ewy-gTlLoif+$ zkih|IZU2!y);uFos1*7~!jKkoYK9R2LdYBd#0f$vF_-2L&XiTK8=l??v|)g?ONPyy zxOeXycE3=+RN82mWjG`rXO3u6w>L4E4`h4xGzK}9^Wj0?$ccj4yfS^z<>b@Psxry4 zD|Rs7S4HxWzqzwFy0iNPe_)4;v_G!{228^!ha~vvEqw56ueSER2#N#+xwE@x32R<` zM>_U!c>m7f$#4gMEqbPkuV#oU$~*hR_HKtKM=BcLAMVD($#{SNI9B6vv@<-4$LjcK z|9IzkA5#u@C&x!e{x_*8-($7x*`foJ$ zYB#B#e>kJ(M=$l+!P(W$OuoLR=bv7koE=h(&*ZD>hi7Iu-CI2Q_k(xko!v)AIkEV7dNsrYE%qJs1p24qhr?}))C}sI zW@V%A>C(a%o*;#Qvw|R#0r)cwgUN<;p20>I8Sqq!Mh|N1d9$^KO)5#z3I(yiMa9-g z#|pk_xncsLg&^TwmD?5Hy10F9oue+v6N|mb5DDvFS-r@tO0sg^jVbjV>|YI$D4gU<4$m*MbHu1_|3+p z2-o>(E#zBTBG@331NUwlw5GI2uF9fWXr^PAv+1H|hc#0V(O1K~x!!S@d8rykZH_*7-!&BOrF9(--7qn>4OFV?20IHk6^ z?7yhxbyma_K3H4dV^iA|Cq$TkXkyN%74rAfs$BA5_(;Lgg(IL_|0YggfwKhO!YZ}2 zuA}WrEGZ+31wpEKQ6(JDh+_uDGdj1m@N$g!B;b}$d)IQ!77Dh-e~R^0>g@Q_AJ=Xq z&Z6y3Hz-e-Y8=)lg31M6di_4PlIF_Dn{b8*>n=Y){cHyJye{+%>Yc+~Z~9Os@Q75b zFayZ*%H$HT8svWWflQEJGh;uoT5E|h!oW{WhCR{|&zvOLwdsTt-!=~)LzY>nZeZ73 zm6CwD`hp5oI!3Te1)#rJNcu%6*%g#q!#Fas+4*Nvn^ZuNkYRgPw5a>oI#g$Y02&#r zFG}4&x)`XyC;9>0f`0)=>sWH4OF|LT763pZu2S~bG@7s7O+s)I8=8@;ZN z5>izzbJZ^4)oR@z74uQ9PizsO{S|_(mzqw|VS7fo9ocZiLXGl(ow9^I#hEC6Bj(nq zWhNl|Nnoy3+*&)L%*DyL^JdCUsn|+XIxS~gEhcVl_vwV&-Qo7zPMg)gRB!;Blw_7s z@v!ss@yoVmc5+$Hct`9H_1Fr*iH&sJy&It6a{=@{Twc!=KOgQ6cZa>Yxr`Cq7hvufl34#VZKl$sM4X~9XA6<#jhwRH!Q%p%(tvUZdrJ2-E9Nl?slJJ z_^xpCw#CCgvn!^QWvk4dVa39|gXFin!jEm#zimv|LJB?Sb#hr4wdJ(v?yr}Y=a-!a zmz}$m@~Am~)fIOyJKf6;Q?mK($Gcei?TVgq!d|F&-A05QYfMr&$tl`fZ#@ta<$u$7 z)W&eLB8@h_26~>k8EtXpg@UMb?5%j`#MK{dGP!Xx`V2{C`@2&lZXt%k-N%WH)k_4O z>ShX+3%6F?>ZC<;+SX%|Tz?qZpJG)i7n!vsKBStG)H23aP{V z``0h~^XO+CKRo9=tXH4(XRa3h9JbI_$@$nG_zmpe`Fze_*t*Wz2Q>q2yzeqkX$)lr z;v%O?X`v?H8d^H{DTV%A-ZL0OYKSZdvOIT&A zS8}Np1>z}Yb0;pOttLg{g{e5vo>Wvb6XUF$HI$I0Ku)|&qZzVl?hVXkn!8G?}Z}A7u$O6hHhlj zw)ABLLPC{RrlR(cZ7LO1)xquxF)V%(0qj9jN@;3gGjVB__FToy)dgv*tV&Bk*9ly| z61hmRqy`%ol3fn5*4*I^K2?MQJ5hIzbs9124FOYd7l>-5zR}$7W!mnKQT@yG+oEsp z>!Xj@+Gtrew*3nSJ@FV8vnoi#ZXJbte;gFH^(o2MEYr5dI(01DSS;QG zC$|I4SygW?F;E?dTBsUM!&W=Fb`sXq+*DtIbVW~3DZ5JyJYnjo zEG1n;@J%wY1ukwkwvth7qd?pG*$^3jsD%p*vs-zl`V94=h7A!*_$1&hzsL!IkmoshG9=i1QZIs~J zO>p5RxP_$B8Js#%w9&#e*HFGW67Sz45-%DV1|h$Nm$lqr^vE(={NNobrjh9;=Csq3 zTSw&m-wlzB$F?(dH;9^e501#R85lVRG71FW8Z)jIV=n`6%$s9|gNw{_n#}hRERLs& zZt<0NdgC{(wH#r3?LjHn^XxY^JKV5D-SRv44)-#Jv{b|n72yEGCkUHO1b=Q{T4u-wCPAUH>^;}Kp)~@f?&frOV1`KJ!1iA{rA+TN1_IwRh z&=rNLiCWNYNj)L*d_aLceXF;z0HM!iL)Q3B+m@tY``cpl;8rnOM{8>;W^<)=E5~|p z>u5aqdq$({IKll)U4quu$#pIQUuW(1%IX9A&sW5~hvE_jTVRSD>0hBy-7spG=IWAw|MwF?Ss(ByY(Ik;#1+UUrF-ly zRf`My*I}uxr&1HZTliIcdG|(HW8$iz04kq{JW68ff8l{NQxM0E4R{&1d=oWr?R+s^ zr&QMs+7@+i$OQr7&&vY2s<$7le*+Zo&4o*?US!zR`R!@6aWAK2mn))cUON7qFom{007LW0RRyI003=a zX>L?yZE$R1bY(7Tb8l|!UH^02xUv8J&Ak5sRXepcW6Jt!NqOV8I@_1J7hgP)FZV;7 zxr0c^WqIA^Sj2KX(V!YvAg)};@d*^>A(Mrkk%i#d(T$1 z^@6nSlVr_b93RUkofQq~9b2(5>Ck_sG3&U|DtpI|``zBu=?btD>aqcDMYZ&}R!D8zPpoi6?_d%t1{^=N_`e8LCth^EPX6eH=C@5T|2 zmI-kPPuJ@xPX4k|&rl&LL^QKP6*zLuqaaP7F_L5ok!2K=#x5hXMao$V#ebHXu4zm`TQJ1XHHciANW-#6@G#k|87jh) z*bncNj%chOzGC5Bau08N`D2eQDQNeW2C3kC7iUVmjH7gY*zTxS-kY*2j>}|mH}=<= zPOa~wgn%915m}@O2^sU4N0NxFDd&X7D_=(H1Hf?b-rQFUuo>Q z5wQK-A>>C!{E#P%dMK47_l*4fF^WI%HFcSz)cl!zy!YLE;&bA$*nfZ~mvOWb!^ z55+l#O2`82Ue1zqT`|Q7ng<&DbP+H!W*~$3fzWtsNdKhi-f1a^2jbyD`+ZKPdggmj zUnGq$3iOINBV!Hnd<7JW;L^i)A~*8PB{EYw>Z_wjofYcjqDoX~ci}N?8 z*);2)H)+5!ReL(STB)*3eCbKL<*>`V(b!pzh6`tS(qB5$?g@3MJD`)P>rT7gFxReL zj;X1gs!nSqKn2vLcX*&t)|oRmjs0YE8FK&bKHZO9U40aM``H)BV{sL4-ErqoD3G2HrS}H0-6NSA z3H`td@=YKejk>7N!O;PY55xx|^_ok)G8wh(f>q}T)I~~ZVvlUDrt1`zOJ-Y0`VHYO z=tk~jIA+7K)1}?9GjzK>hc2d5XEf=JsdwTodOfxS?)^q^@7Ke<|KxD*H->xvnZmul z58V6DAMX8Ta4(x}AsIA;yPz9Q*r0o|WKPc=PMzUm0@;1hg|DM!f5axsuIr6=z_498Q)8+9qbed;>2JM1|p!{LIm!Eo&LmOJ1+Y6SODJ={l64);-GxR0JG+(-Ms zef0d{K57Q{ve_1rlZJ2?bc<1M$xixR=cG?PXUM$1GxdgDXXH-DZkJB_gPm|cX$1F^ zdbpoFIowYg!~Nu$!u@0)xSu?KxSuqGd)aIY$ymX?za8#^?xedM^t!M>?e->+-TRBB zGwBXT4xRQ{Z#g*WEyjx-a342<`?wzN<0psvxG~(v&lK+Cec(QR{%{{RgL~O*3(2Hm zc9(QLci@d+_A*-1ku#in0QY`x;&?rGIvGud!|`Aj+$W9TKB@)ualgD zaq|sN*h&Cg8dQ9seNdq@gRk(?jJY@GbHHdqLkuzGDn8KCD|Dvx!b?;7%d>0fi@&R` zFu!WaB^pz%@ye8n&zPdmzi5et_oh7k0;M5!cK)kR%YosYlu|v%&x8B*n#JOXoCZ3+ zbtv=WbsRnT9`xmL21lKfl!};b*1mCe+wb-VvQoua$Lzsp9}UtlJ2I|Irj?wq<)2=G6T_ z@5-sZ5Nz$dgyDT|8T1e+miXp@e`a!_>foC=O_mW@HA}EcCwU#t@aX(HiW3^lLT~ot z{45Hgy;(8`Gj9A9`$?re8erdWqeKC}laGFKpO^eRNC=R^*}c$YMg359Y*9(_^z~4> zq0G?+QtLpNpNPIM$tYGNeJ;M#(k$;RQK|ku6~9`ew80#qsHu>%E7FP6@`8h#hgGVhK?T+3JN{=Xo!d0R2GQ1bIcZlt*q`!aqMjJ`of+c01WDGDT~1U!;Ae|Q_BdUFuwhv0vH8-jx0`T>v> zn}``kqNw&O_oI|S$iK3#o2}R9xo64gsj^Gaw?r!!zqmo_F#^Dh6-o&9^M<^ReSiXF zW+vv?m!51wHQ@6w5{TFwRw&y-_B>s!ATNN0m>!~(gCEln5d@Iq3_dI<2Wt>P2GAg| zgl|-HT#HdQ3OnW+f)@{-`IDR3g zhz-Gb=>e-JcrDh~H^|SBMe{S zYT<{6IQw|XLY#16C2eozhwUQs><%>5euC`i`EqVH6Sm9~nxtI6*K;?~lzRHc=O4}) zq>dnWcnXml;*=*5bHab5ek`USc~gN8Um<=$3oi@OB*sh*=?BAJ6m?<@{c!y~M8|UJ z|00W3D>kbT5_3>bH9&|=34rWu=?r1`dSlpt%fzyGjNGJ4;aXhvK72wIvM*5020p? zFfuw!hvW)*UCHb+Jzt86b+W z_sDj6O{i3q$(Yd%fPJO;WcV-gcW8~^Qs&ghnQ>7($o)gWU{R)rHT3o$VqBPYN^TKt zN$T9BoLWCK5}D`-70j+0*SNSQu#}-Df;0Fa&cCjYlE~6b6D#-Lo6b`jd5lYx?(kP-8-+RyatCy z-ZnB0t>V&KEXbMXrz<;Ix?W?CLtmYzv0mR^-}L^vi~eHw(g=d_?vBNB8Y6FNy^I+S zk2m+!?ud-#<{nzPj{+3mwJIWJN+@ym03Cp;SmniXF65olgu)ON!dfqiE!!FL&$24V zzZTw(!30&yD5wgfe9KPu-l8P_;XaR4PVSk4EUSdiR{qE7ov#ret29Ourt=4O4o=4x zn}3@XDtBLo%jl7Ie8cYPgCE6u!|I}!@uVG=q1-4O65GYn(c{M*-bau)-gZ^hsj?d z+@7EVOOvEM+@?65#%Y(=j|ylv-X8wxc$(>S($7`}Y%>sju5sEV3S5^tK;e=+ly2#SM*0BZ?&h zcuJ0&9obGy&3R0ASMRuZXl|&u@4?3xUCb??^7U+h!ILl+T8^bF_E_v7`Y^7_Z?C1O zm7~s^3f{I-K0M;wFB2iXR2$j)>?=F7tqC-RvoGqL8ky?6y5ddq{P?{sern((#0$c%(} z%GbV&`^aa}YMmxb+3w=<8R-4+<=ORrcy&>~6pQ3HTU}JORPg^+s*7&JQhgE8YgTR) z6>%LDs_bV2A24W$_^q0(-iU<{ejJ7JKyk4lfXYRF%=$8=v3H&V>k?dnD{>ho5Kd&4 zdVYexBqWQCj4CJOG)j$(bI~-Eb3IW8M8!7K5png#6QMZgJQ5r9X_)d99xbvhJs_me zItv2)7ZvccvRO`4oJ-}xD0E&%(H+DztU(`qJhPG86Zn%>F{pcU&xqKLC)8hY@oQOf zTp$!30D!p1B>Dhp0DwWFWuZiiXYeJsBKCyi@UR3#2&3^wvrr$ShtQrlJ9zEX93*TR z==1zWvIM7pqbfJu578-B(T}KwvV$NyJ^#o>;MSg;YexAbKRZWvaTpN+vu=(~OcbJA ztk7uj_ZG)(jGHKK+VY$8 z`7t!Kq5vMQcEmfm5?GnbzLj+qyCoS7cjSp#R;;ieYu>z#{oLo`2eUT&xcm*K{1=zA zE8J?TQg_b8{#c3W2O|Szsv=N8Rk`)Fn_M+m-y>U?zFbQsL0uNeJ$~`a62eN(-o+%SYxQT+d3tvY8T9r@G0b2HCoC$1`<^8@QMeGBvNiIu z?4`v~F{*SZ7CCBv$2O{!G!tVs zp%Ar?lhkmowKrsx)W4ze9m4{+%rnr$Hg|cdRu4}YJ5>6NTRehgA_5^Rj0I6EQYCuj zhab#Zwd+PaC-e}``R@?c9>DteK3cIq$KrP=Pc_@` zkJTvq=arbRox*Gb_dfr)y!1|CId$o^O?S+*dI8Wof9O)47ZNLiKb?|sr<<|fw*Crp zZynK^XaRU+EF_1+PM35#?Us0)gt}@xX+m^JV^}cQ7K%yNmXRv;O8Kcj^3QUGN;mJCjG)_Qq zB9=Sc*I7`}+mUQy*O)e0uwy~_r49NGQfE!Tn2+Nv8Ffo?+?l~@@{h@vcV_je>^$)& z-&u-Oi|Zb9W%Kq*uSfKpTuzgL=k1m1fWlNc3s4{sGKEMD31h0PCjA#745!Rk_rNDy zIYORMh>-Zs!XPg*b)|&Pomdt@2IQEE0Q4AOR}4mRPY~mtl2}9Cwsb2U*@_yyYlm!b z2791kQgl*-u^Z^IBY(L5-ab+kYosxUw>xWf9C?9T>t;U8q+PCS#~o2bewCf&wL7ku zhh45MLVlR-C1ajKYVw(|_M%xJT8!O18p!YD z_;i=a&P2<|Ee2Cf34bmNo%0uT4p#4PE84fP^wglGR5Y+9(~HUw!bIaHkd8%J=$VJ+ z?~p6=g^^gYVNhq1hQr`mUQI59uhtMp!qZ~?ZyDm2kTV|T>CuuPz)kr>eMQ=qj%?Y* z9bls8O6(T6HYqa1feeVwbm-%hH6u%Se8s=UGiaJEXz<4Wj7pT*>QDA zqpOd#EB-G^X<-&>r}=p??bc;H&!OOQuLSZ0o~o~@%*el17;mpIZWtoXDrUtbM>U&$vd3q6A0kWlmc5BB z0*u`U!Eb)Ib7g_0OKtUha!V_*nAYGwwK8je`X~QUpqffW*@n64BBIUwUNcfeu~;a< zSn{JU{-a67IYh0la^fyKs6KjHrQM~he+rLwb&T#;<7<`0Ue_r1#su14!$229#MGjW zmNwG9jbfOhW6Pv;-jAC(e!$f3sPrIwEgY`nu6%aFPK0PqB6*EoTpSk{ii?LV*a1Wy z=$c0%2cJG!w)sAPJ|L8HENp0!^Gi<3gaZ_Ti~}kHrIlycjNguu=zd#XFm@+BCQGRDA+7&c*akpvZcH zynpcCAXe3KygkYpI%NfqO+~#2pGV>sHpG8_3OVKWfFG`5(Unx)z*Tc-voK3^t@y1K zwbYY8=%I^qI=GQ}D_uT&h5d>rT7H+D;BmCT-7*LoSr1drNE?}}K7GnJa6W(DhDdcpa#p-iq;?i8 zBSHDm*BdI2xuMd3hBs9DHo!Ezp<*viBzsqs*UEW{8!EMpeZ8R~UTXus-cYg8eZ8Ub z{BNj~L;P2{q4I@=tB_IkN)btZvsYKDmJ0sg?A4XxB@Dfnm0x2CHs(c^Y(GeE z=mgQ-UAEMd_dT+Uk=bw0iu3BWS+FGnMc?13+ZW3xPO7`H!~jPJvDf2sttr~Dq^=K3 z7_kM1KNqI9#iir$@`(MHeyi6=I^>&;{>40B{`wfKK2$yEkq|FkmJJD<;9?vRh1*pE zk?;XsX*47i!V4DSUW(i|1W|shcg+5`y=#AN8%fT;rz-!$oKlXZI!dOVmNu4eX~}kU zXRj4YyT0UjJ!kPpafRa|{bN=>Bch3_uAOVr|(ll6iYXO*N&rHvwzxkRAQ9v#m z3~!4-?n&AYVgXIU_Ms~*0Ak^j`It8iBsAnr(YM-+rBU`NV_~ls;;GNzezrR=W~<*j z8+@%Ly;)Se`yvoMuWg(kuX`w%adSAItR26$;d>G!qX;t)p~n7TK5g;gN zGcPy_5n(zCVM9PhP+4Sk^TR27bEN5QzHB~f z*q~n2P^L-+cttF&vW45H| z%k|^RK&~8!%N{)bUeNG#E&a~y0*=JR8xh8SlJd@FD)Czm8tg)2ZFLkR6-4A2^Fhy) zJx#;4avBFEY;lS)D3pe8p;Axf^WVew=W14jof>01Xf!=cztpe{^0@5s_h90zo z%2MR$gkc4PqYLhNT-^+4)is8DH(jpNd3_Mr4jBafej4^EfIS&0Qei6nt0>LJnCbB_ zir1C6WgEN+)aT$g_cQ!`%JV+vZa4;-+>gMM ztKV(73WMl$F`V(%m?F-F2OpiDQXMjsP+K~LoQPeur^6U8MHlFZi?(JvH;h-ZJqy&L zUpKc*3yS&9(3Z;BCZ659B$ot#)4EftA1P4NKa+1(kgJ}M*1e=jQN!x1Vczu)rG=WV z2q>*;Yyzw)-gK0;6B(h_-gWFk!Lc>ZY>kf(&|E62zA6b95q zS8&FvRpfJBbZyxB+tb$N`K%45YQ?)B*Oh!X(!B+|Om{hIIj`E`aYSo0l8Mg*KwNnw zcUd|7UKs7>UU8Z=e!IqRo4@jsnhcn7goMEhB~+MB`SN_<_-%6wgE^be1p`&=0U@~h z+aFZ#HX*R_RG>j0gmBioMx2ZElRxmS zdg-9Q<(Ug_zJf789dHTY*eb9;?0n$Qm9W^xFj;7!9)!tuTYsU@>=q4A8&8eAIvpSc z0^}c!Nzv&@w-Cc4geoxfOVUTvd7rIO#yFN6t{Q`&dR*(0osGVH@w%Lq_46aWts~5b zU=(vXmI0ZRhJ&ph+bQS^kF3hZkd*f$Sfg0}Z3s=Lv zmmlt(AL8?ddy5T6CCt`ruy3bE6=B~_{EGTg##|lP_g)SAo;&Q@w*sYRPHCg zbG-LnZYZ*q#e2Io#rP|W_cqR_Y$5BWYgcW|80aS5zIz$-%3k2m=&lp`omN8y?2=omJs!UZy&AHlv=@T#jVD(z+MGbJLt z1~m7t+K+Tbz!UVIZk!E;Igpn+kZQ0<`Vh#S=9vx?gs{Z96cZjE3K#(Z+mtcP`iC99>@r&`K-yt7;+RacvEmB4; z@wOZ(Jr}#=3qqNdt4B9G?Z{{{gKkGBB(!>(%L&c{E9C(ZOuqYEdM$wDi^~}gO*YVJ zq`FSe&4O=nD|rB2?a;e&qO=e*De ztB87_Vr~XwQWM9lxzTVV(=0Y2;vd|Ib^uTpLcv<9KQw zRu-Lm>+$SdOtp4FV8mJOyzS4OC|0L%gJS*{kXZ;9}`BrMxTlb6lA z6f}Fk7%IKJ-JJWkgXRR-_I~lV?Ok6(d>im45V{`QB*xx-ol;_0;YVnR&4@`Px{(}XzIIu@eYFDArPYiDeD^-vJQ z!!a(l&4qb5%WxEie{Eizt$8{i<~8e8VMM*vU&|T6K3WF>#dvfjCMh9nO*}zT>hQr3 zm2o67A?7rK^p;C-ZXJV^h4T=Wa%LF#jD|Hvmby;Zoj~wCixs4{z0F{It9iR002Kdj zdAlo=W!e^Jeub(GTrX2P-|NbdbqgG>7TI6E065L%6VKrAAKa-C#SQLt4T_%6pPkvM z<`Z9Lfcf4M0?hY(9i}9}+>an)l>woJ=_~?ZUYJ=8FvriT0yV(g7p?}FFF(LMKg8z( zFrO2`Y&M{|Q?rUdb0>a9y(wd^4$yqR2Aaz2 zM$dyRnS@gMEQ;feV=yNlq(b( zdMtyn=S@NqY)S6JY^xo!3xh2IkE;xJh3qPfdD|zMfE@t{z^EowZ48hT#(U9KD6d%u z?4Y?xyqCzy*@H#`89@TqybEqh13Q%y4yup|fl@?bblz2YQA2}CI_g33#o4UK3OI-PtU63$5+-{J=XX}GMsK*|e{#tA(Su!{n#MizIbOzupv zzn&`!Hvw$?r@*~I5mZiX+GiOf0x$pZF2M}O3?#9LVX$D8m)`C%l(K=1B<7|i$Z}Jqt$$;j+Pr%R0n}8YouP-6uJCafjI1xh=sZk z;itmdf^pMOF^_YM)&iCW!oxO`x&-|Za21er#sN$;2JfzDN8x|M4?I&~Tr)l0>8Q!A zq5u#)=qKyjCazY3vYiUb7eAl>bUaRAs!!MTE3=2vAAF4Dd$`I)i~!V+4!%z(+ECCy z6Aw5gIKlw)GKQr-DEP~i3y{c-EoUmus%DyytpxK@M#w5v4)D(ACd0%#3n`pjf=HQ^ zsj8lQp;3>rWdVFnJ{uZr2L-gT;UwEqX4k^&79(D;@Z|tE64}O0#ukYc~{5!=JRMkKR+lq-?~NLa+e7hbsifEOu{crLV_fG1D4RLQgs?A)m&Zk zt2ARHz=9qS^&_ShCsnabhy5?CmuXxXizHhmskx!!ZQu=6O$kR zI?QwAtHgqQK?3TeRBkGf=(>;uqyQ-Sz|VE>mbziL_eQ}Ymgv--Qu4jS%?Q-dL6cD? z)~Z#N=-Dw3QKN)c7bR@XDYFA?=Kw@3SMG&yN-rm4_A1i2o9o3HYbI|ctJBc0R*8l5 z!E$}hefc23dKq4G2h?6R?=pb(N#Jte3on@$b*5?P<)YTEq0b`D5<#CU4c7%UU~chQ zL2SPd*1zOHDG3$-aAAUcjZH$qV6BRrh9H6k95)jW0R`j|FJreUZEsyYeAWIE;;Z(( ztKV|?D!+}4RmMXUrn3lqRbgf|z6w9r_^KLT^^N1J@fo#nYMj;Fa8{D(R^hC0z`VFOcd;QKGPq~YzH>;`L2f9rm4#HfHO2Tfq)Hnf z+4wpD!+z9{so&ecBKLw_k}`3Al;Z~dRzOlqhLBPu-JZ7T_!@x3?M?h^W1&prQ6BPS zBA#{+_EnDnOL7s|iN5K0su#(lc}C}?78a^8Z*Wyn87|KyGU}%wO_MtiR5!VcrL_3) zlTMSEID$0=Bv2t-IO{IaCFN=z%*xDO!5~2dPVDQ@nPcYE#C*q!c&`R@y;P>=8qie( zy3D9GpsNOS)qpND*&5JQ1G;=kEH|Kwt0Yl@?+~)3(QKOsO#rd+|8CR}uGNKb%@c<5 zj?a!)A>ZK4!75*_^fdsj2B7^86|4bhMSZYbpL1V+n*g*LWJbRlWF~)Ku>rqtkeTF? z6hJV&1uxJ8l|W`E$uNn}Mx~{UsI-e3mG*T}X$MP)O7pT-mqexc&5W!vili`|MWE6O zGpkW)__;=<)u^;@9F>+I;xnMq=3u3s4S(j;r6T^!iC0>^(QO4^Sn!rG4n^6>xk|-X#Vo>z?XfsP>Lv<1|gZqf|OM0gMxv&$U zinLSrCRhdArd?A8(>zcY7mRw1r$>$`S9dZoRu117?!fZfZfMq;wYRgi4gl1Q`ef!PX0e_f?UF;TE>` z6CHy)iqkc^py>EWep!cw8C(i>^yihn89 zyO4|xXLQ7+FjZhY+6qW!nMWeX9aH;qUX(9qg{^GSh-Sy$#x!u2Cel)3EoEe`e0eUg zsB5objw+mnB%Pl@&^+Qyq_7oZua%)r5N+oM`&)Yr54ziH+IJ`cO)0NgJyd)ALThd2 z?W9xnS3$2eU#An)+5`<@JY+gUC8U`SOKyit7zKk^FClN9-7tQ0)!- zTg1gbT|!*EcTZdr7w<L}jRe>58?+aJs;+G#6pC956#>GDv z)ixUz-YI`YEW8uHqIQ%qR|gA!SYzSmg@xy%;B3f)W(kldzPN9-&Q8B`%==+(ys?$V zyt_5U_^X0>&z+bV2T zT$V;^bQpzAo^cT*SG*Txnt~Nci|%-fC3iqrw9T%0A8oMfa4-@FOT9tRH%L+eV2Iqb zSoKKh3tos)w5dNk(Tb`>RrjV@5mEj=9H$X)PG<3Mm{K)JAz{16x&gqx^F*smu|Fw{ zc_Pphr3gx~MFE1zB*1~E>0@CfXk+<=5n5J)Nz{PVm>mw&izHocj#U(`b(p*WRVq|5 zJBC+~*!qu;+wIQ!pMGe!yPvlkyIQAGnb zr%EG|yihic%PcVbI^sHjW(yN| zVTbok6|7;#faaAij25@TTDT!8PnhNasH zr{N$ppXoc4zM~C@nwF zdH;FOdEeiC{c)YoIoEytd!73}*Y~?3(;@O>bmTm+SPaYz2Ft0l!Ivg9pM^h%N3Yd2 zj@1>5DwO~SleHA@A@*KWRQF4h&)!{Kv3B^|_YuUe4Zy0#;;2Rb`rj9@&A|J(xYo%O zZ%aNoq2Yoaq`_ zaG^cblc<@;9a`PE*9d86l@iTTu-o#xmcjWOuieyS&w)oKd8Nk-poSY%9N z*$wv2QY#Ldqm2Pu%rUir&mqVd0*Ozx#F;Nz`-TA3h0I+{FBfsnA3t z9v>Bb4z?P|&UvdqdpH(hE}RSfo&lLq*@N=cTX>CK@p~ivRIU;woKe~<;|Vf8XW+o6 zR>%PNve%|@EZ1de8+cL0uG6f;!}?p5^-pT!9>CQ{lhYQjW0PX% z`JIwu&hwzoMvMqCb-OOGtHK2d_%=}ump?KJQQE+iLLAvKf9XYLimfrx`j}PiR%HF| zKfI)&DZ1)J;$EPLyZ_a70Fu-SVLK#*4dgGWJ@$BZ#P~r18)$W}{EB{G=`Pg`wH-CF zst9~=NSNY{O=dI_th5z$xpD)XH*NN205~jVI^KE&{dl`T_HndW&};2^=M^(bWagUW zEbl7Yi*wr^?+`qXB-bGD#|_uGSA8IE&@u4_`tBRKpE+X73n~G*P~SYeLANr`8jFXq zrr*7WZR`*q>~2X`UZGj@+CA6GDKGF_P!lQr`2JgS4@0+QxgS3Ka9tSfR_O5$HziWx zQCkW1S7HTA)w`eL5Vb?2XxI>6FM!{P8qL6^cuQa|oH18WK1-hGZ_yt{W2DNTUl$J4 z-b6znm<0utowALlWXqpn zS@qEgTm|bWRV0^hS^khj|9c`$?OE+e7AWI}2$zuGn=LgE|0$b@s&0u_+3MHYz`X81 ztNK!lJBeP%?n@E;TrXS}sLc2xm}CS$q-3FSf|=XkF>zPhTDksT42$|70au$OX3A%30DSS2%ciPoENHv4R0;1ONP z2OE8qFr5`!Kt4*ygW^o)4fnU;MGL$8Wyb_65mZHV%aeP%qQMVFJ=L|8lS20ns86Jk z8Z9zguOg-JyPaR2(cFVnp%M#H=4*6MKn1$c+n`)7kiQ$X&q+U8YIQ9zxj9lknS@Qn zUA3IYlp%OhCokA5E;^5bj3K(;oCG3yKwE_8f*6D9&r-4v(689iF9vhQg4N3Q=SBMe zvdYw?;}9aL6tu-;_G|ot+a)F;K`TgrCBMny9nIK_U|$CQyO2$`xTScbi%i$(036Q7 zThOh1;Yo1=#;?YBzN(8ioi-Qv<(Q+M>3p%nB;Mqmnr}{D{r-ZpnsX;P?D|PryeSXiW8no+|40w2$R61 zC!Iwwh|ly+Lv87@Po)Mf?ekRJ0|HJxthG|mcE3yDlUUriyMjSQYX11mNUYoUUPmj?!eUnQ(Cv-dOU{Zpo>5*&r`nx>jCV~XzvGv6p+=>sx8JTG)1-^XEMX)lNnF;G@Gqm-9MtH5&O%1&b}L#C&(G}_CLgQpK$p3gkeciQ`i z{q6nX-s&N33DWAbr5W;R(Af*KT`3$4Lro15{iStb(>f$Q(jua0i*@L~@$Jpk z{ZseCnJw4Q(^YP-4)E|)R$Gf^N8=W`sIgR28hfG~dN43Fx3Z}}H23SX$D`l?`n_Y= zVF2ryG0gJP#@zks$oh!>OVjr?B<~!F+vyQWr~4;Zmp}ap<2q5p>oZM5b#3c&&+r zTm~d|caXcYwMg$=Wu98dn}i+4BYl~lKAkc0v66YEx?M2r^H?hI9EpiVE(LqtHl}9S zoK>6eSM2Vk!AXOxp6(=m%(FWl>OG~Z)qgJx8)W^N;uBISniJLrQ;y43uWQ&U&%!6R zccm_XZaYXRoGq+!=<+E~x*%t-aoaoAP~kP8;N{!VIn{PGF6`)$*yNOq$1T;D$HLZP zTB{W!d-dW)!G3*{Ze~**LWWiurY>P0ouy4*C=Ylm6eX7c>c+dwKs!O~FEo!P!Lv&_ zoGAMR{`jlc^K1hOhP(Y!R>A>zP5|YH^a)U)t^OSAd$#wtc6Rm1Jm~>2+qa@^T(N|v z3GQFIMUORg+ZSWQ1cFbBWe6`h+)HadYG5EFY*#_L+1>WL1Zl4^S;zI_Ttj@ay|#oz z+NuhB?`um6tW=#4B=AZOShIqtQ+e;2&G9mp7iRSyOY>gnN60gljAWB(l%$KID(?EB zcAP~YPoIR7mbBqdkISX4CE@dCUzq{XsQfEGE!vGOF#+8D`B;SP)Qpot$_WpdX|CH| zZg|uX@()hy_#$_BXH_UvSVK{{isRL0amfiIE3~zDuP+@IWT09CSA`{HdD(_KVEC!t zUDbTY7~hNsCG8BZBaxs-F`8X)MFOx>Ke>r!m+6zY0Yh3t$p5kN3UHZz(* zkLWj}r~3VmH`OPyQa*&SAPY zF07AEV|MVK6dBB1HB=trZKL9D14WywI@)O1+c%WR%SD#%2}q6eFg^W#B%3JV(6RvI zcI>RmX%4a)8A46Zw|U0g*N^Y`{p7IG_e-8X)!E!B*t2S2Xm`{jcojBHRjLSVh#BloA|br(pj1 z)TbXLwF(^1i^lM&R)l|`!Urgx<{>ht`!0v4C*oFS42-;h|8C}WCM5+h03`lRXXn3I od;RYw|DPE3->d)AB;ib(`hTRUR%Sq!e@ht8BK|B7nEgxt0b(B5s{jB1 From 47725c999cc7d86088998dc7bb0349e30502d2f8 Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Mon, 27 Nov 2023 16:39:54 +0530 Subject: [PATCH 2/2] Updated CreateUi file --- .../Package/3.0.0.zip | Bin 19812 -> 19815 bytes .../Package/createUiDefinition.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/3.0.0.zip b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/3.0.0.zip index e6820830e1d73893550e97670030d1507244c171..3b8c41c30ddc8856ad2968066f32167e41ef1b91 100644 GIT binary patch delta 4382 zcmV+(5#jFSngQpU0T)n90|XQR000O8tAu-3GlvwvQxO0FJ&_k8f7{4%{-3J6!xT@v zmR!8)VqIME*`g)eM<;exvAp&smTPMW49T%T0E+=A(;HXiS@LLkl6>7W0}M#Y$Ii;$ zJ=v8-0vOEnbobZS(Xapb4?=YQ$wV_Xmz@WqGb_v7JQxh@o&H>=a;oMkE&K9ARj7WH z&D}FI81{GiyS=m$t(i>YL>08wa~&0#$tGog#B&ETxWNlm7)(TiTZ_5Jxh&*d zl^BE(ztSz-jIwm1r_BxA(&n}PAd46`Co(arTR#~~qazaz#?4rnsL*-oR{m!_p9)h% z4=-!(6!N-1)#a=jS4I_Bu_O)=Z+Iv6ckco>b*hp9m<1vS&$4NMX6&<{{jUBB-yo2 zr(&!oS)qhZO(~Ov?$C3SB^7Pxfw(NhWh(yXzy4diU|zN!i#IQnot+jlZ@2u8?QU=0 zVp%BV_j%zaGXqwCfIGXxlO(HRe2&UeMptwrgJ_{y`1;rwngnveMGya8D3eu1M9)UV z-+?2EDeBMT?PdorX9`=L%O!R#-dv^Gbt<$mRY_p)oj{2;RKltqZ>=!8;OvlKEgno*89?6h==|J<*X& zOUzC%@NzXOstR2$1z>~4N;TyxOds*YI-L~YdQn9s!Sk_B z08XrW4TW zK@Ngo+|da5pP(G0%$(Z>U&Ag^HcTX}T%+E~->kQ~vt+>~IZpAaOoAPEH%XZ^Rn2qKFfU_LEXc#Iz=BopCpsyumRT{@+fym2 zmNbNaqa>S(c?REu71AlapMip9vt>KwSk2@D`z&yU$40Xn+Ce-3gydPuLeI0(s;U?R zmGFCpv{{nAutJ5LhEl3DHbR%A{MNoPPndbYBw2ZU6oqU6+=B-KGvGxQ8vL;OB3a(z zZ1lYAL_IoXuG?D%8>G4YOLklHj6|VQ=pPAxLt4zK8SVfOLgoMNRlV1iF?;e)Te+S>Pj zA}A6RnHj6>3^8%SF4NCX_OGA4 z8(lv?9qDH$fBiSQ_i8t(o_{!_>qjs3*}>V>&P=|(rt6=uvcUKZj*53tYlXLoMCF<% zIkR40WT_&1K+q#Z)7V5K1`6kY0aaC+WbiEPh2gOjZFQlE#1Xdsls7s(_D$^R5_>^$H*UihM?Uov)^u^v$Q7_MH5v(sCn zkngkWP_Zspd6r)?7BM3JPv4B@@&iQvT8+hpvzE6|X zI$D4gU<4$m*MbHu1_|3*4r3lygYAxhjS|ZpWk^}c{8?>ghMy|@DnP{eCm$~Vpo|9<@ zA5wTxO zSXKysgFV}7)&Z6y3Hz-n=Y8+N6g8Bs>di_4PlIHrzn{b2(t1mx5{cHyJ zye{_)>XpM)Z+cNC@Q75hFayZ*%H$HT8svWUflQEJGh;t7TWg9j!oW`rhCR{|kDMgg zwdsTd-!>N?e?yj8sBU1_T$Pf5x%z<0RXRqnOl6?ISV;OwDA^U1Tf;aqvf24(Q=3#k zk&t0~R&u$iexaH$bWTT{KQT1 zt5%J$3WhM9sOn&k&qlB7t%OvS%Urb!d9_;iN5y=Uf9n%l1Zcm7VC$u(U3A!z z9I;TNJYc6RVNbCqirq9-ZLU3Xs9e3{rX!u+JeGiw{ zb0yG+f4jroVQ+ZU8}8f%!JDL8le9^S*PkiC6GYPpLr;q=KSd7G8lA|oN@)0IZ9se+ zsacl9wz_-4@}aDE^U^C?5M#xd>UY-~zMP_HMAu265`jjTFH{MtbZB_T&A?IdD+=e~Kw(*($SVn6YrrAo=aC@b@WaIUo$h6aDcSt=<6TVsc12G)VJ}p? zZX-gDH6|$>WY5*!dQpYcVgCK=m;HJ4vyLC0a~{^Kclt9|3x5t9X{+RXY~T0| z?BDr(&R^KN&e{t#18uzTGEZp?Wd-6Qr%GvEyW<>VmXXR;8t&Lj|s1iCm;uQiF{P$u5UjYwmC# zpDIFuov1s~!NV&{rmVas6Vx2mcZ7ddVfs@+-=B%nWhZv|1L@iVe zr(vs|TssMCYHp~nK)Rx*rPZ&++$hH$XibFL$ToA9QZ&n2+#VqBwY zE7IlZEz9bnX?^BEyNsQ>_*rWqOHjG=JyT!krCP2rS)|#}Kqykv`3R1mY4xm_N`E*& zTZ<$4_)avPoyg0?o&s?V+dyV?oBK0XNfNNXq1b$=|MaJcBtW{`>Tp3|LTsQV^o=g##qNZ)1dbQS}Y zinT_S?8Z}7QjJJ3WU3&X8N^tBZIB*l3LQ?4rPMs*) zXknUTDBm23_iqu27mW;qkl(_~T5d3UWEm}f@D3Hj$aE8P+Ud!yBl7<5hJQ%LW80a! z6GTnC2S;Su42&ED83lq*jTu*qv4;UT=FKs}!A0gd4d(L*7ROUXr}#=cyz!gXT8=Qh z_MjB(dG;Hd9d4MSZuy;ihkKbqS}J0Pig1A86NJqsg1;(s=5szS3pLxcTPx)ih51ww z_KBnv2gBZ6rEZ@dT^^4t)sOy6|=e0x|L%+xOFrh{5_-5b)4XS zrY=Ei>*P8Yfv+=no}le&|6cI*{}fz@w+OCQ`00`%E9wpL!L0-8@PBs$)P{g_p6kR# zS3&ey-N>LDQoVM#`q_cyO5LWJVLiOPiKH&PU;{gMG@j`45hQ7~(`K81X**$%|N7&( z&Sdb8+99itI>|hE;}aT>@GNs3ZdxoNX?EOBls&;?T)Z2xY+HoJ3vIARwR(6t*J+Me zxm;&M9o@R4y-rYEjDNi$&i&@W>(Omumqf4Ubbc#KEx%!p&wOrv9vnCQI{xtJcZ2We z^%qDfdLB3~7;X9nXQSt$fO`aPrqr;;XA4ZMY(Bn>W^^dcLRGz&a6`%jzPIsYG{xNz zDS%JO=jv&`O%8OEz|2f~&qz+Lnau*JKG&Z`h=on#A;~Y|Du0bLE|>0z8T7m>W-7@Y zC?<()HD08#p+mK%OyAh69p54{{zB2f3vI4MtJFeUJPWsY>xel1gCl~&Br2x0viiXO z^AU0Hp}2&>7MLPO`YSZ58%FKYTwN0Ie?JkF^#PB<_A{74T!Cy-y2tKNwYZ?a4ohu4 zm6`zF!mr}XyMH&z8WUFy1yFfEYbj&zvz&@e4oy3s6e~1QY-O00;n*gtL(mMLP|vgnL&rhZMh45dZ)^ljBS{0+NK2 Y9Zehph!K;a5fhV6O%MjnOaK4?04^qtt^fc4 delta 4400 zcmV-05zp@DngQgR0T)n90|XQR000O8CR%$}V=Yw&P!RwCH<1@2f802B{-3J61FAP3 zORm1@VqIMEPPHZ5tBsveERQ{j<(fj1=x$hSl0%R!wBz(K!V*Zubq)S zv)T1nA_xKp=bZ0c;a~spAB5=qlZj?(E;|oIXI7TEc`z8*k^Wq!a;oMkE&K9ARj7WH z&D}dQ81{GiyS=m$ubE8aL>08xa~&0#$tGog#A^pDxXBAu7%W7STbsGpxh&*d zm6(JXztRu}qb!~1X)}N!ZC>jSvWPJ_k%>{=`psAx9hq=424iKSLg%I1`JeTCDohbQ zysWuX$m{-8m$PbI8C77%k~l=X;gi_EdlwkgsY(W57Kj`?%chxsvG0EN@A_sjz3hl< z9hWm~aCkp|kH?wP(^*+R|M@b#Oz++M*Q`_z?%fmTiIPT%LQPa5%1o3qB_>&tWY;>K zim{qxg%Ub7rA!hUq4y?BDmu^uaaoAVRQ%6>{kM3*yllM|Z(b<7I&Eg&Zut}2)82f< zvQWyO^TI7=2CM*ocXo#-Nmj-9IVwvTUC}@W(L%HE>tkbR5y++YLYb^8A{reLX9tcL zrlmiRw;S4D&J+$gmrI;iytzuV>r`lCs*q-R1qC((<7o6}G(6i*-WItkN(qG}J`pRm z5uX08$k#bNUuSTi!~=pvp)om|2tKypLkoWWK@ShayXVFq##3nCC@?FH|g|Ld8zjwA>VY7gZ{&a+VeP118u7x{zzC^D2Qg0PijT zj3raOFAEu!Vj+`CjuRzfSxS5dLt;d%$zb?XYq>*_1Z)5#1Cl@| z7Af^)$-InVZX%vU)Q~x%1L1KFO(8i5Nyjp!FjX{v!$A@q>8!#qzFIK<`{L2k2^8D| zXPY%6nKxo`hq_rzD;m(X+FL_8n?P$>$DjvLn`Rq)1J+K1O%}3XDpxqy#U4>o#YE)> zIzrvhELm_#j#GRplilpxwALAv-<>pV26veKd%D@Ov5OLB>3qqeDG_pw)VXUiUb9J zxwE@x32R<`M>_U!c>m7f$#4gMEqbPkuV#oU$~*hR_HKtKM=BcLAMVD($#{SNI9B6v zv@<-4$LjcK|9IzkA5#u@C&x!e|Z~7H@bd) zI?~Th{`zk;_G&k&o_{!_=SMH~*}>V>&P=|(rstntotzy!PltE*PO;$La7f$QKi?TX z`A^GVp1cFoCZ~@kljZ2#?9b$@>W61$INe)3`S*i&<(=I}M>(YHX|qwnd`!WW((g@ChyAd><3GYx~uhIF36Miv?HREkCqYU_EkwT4Y9 zNzn=gvA{*e)=0++zG=B)0-=Q<;a!#5#mVt8I1&zNWr6t_92K9U)(USEiOMxka%R20 z$Wlf2fS^Z+rn!km^b@WFs;V@9$>3So3&Ue6I_g3b$>SAT`+{KfrjCgPqF_2)A$~f2 z(LgANFOo?RjQ=U(sCmF6UihM`Uov-_u^v$Q7_MH5v(sCnkjL3| zs8|=QJj*Ycix?6APv4B@@&iQvT8+hpvzE6j}#@-Hp_C)62o2OZSHbv-Swfo#D z7g_jQqi`DKnl}H`TPw>?5Hy10F9oue+v6N|mb5DDvFS-r@tO0sg^jVbjV>|YI$D4g zU<4$m*MbHu1_|3+p2-o=?X)WYiS|ZpWk^}c{8?>ghN3P1ES!kwXm$T`jUXyJHA5x~o z2q?`1;YGf|_YUf(9@ZcDRAu1J!~oGAd~KTxOSX%6d@N$g!B;b}$d)IQ!77Dh- ze~R^0>g@Q_AJ=Xq&Z6y3Hz-e-Y8=)lg31M6di_4PlIF_Dn{b8*>n=Y){cHyJye{+% z>Yc+~Z~9Os@Q75bFayZ*%H$HT8svWWflQEJGh;uoT5E|h!oW{WhCR{|&zvOLwdsTt z-!=~)e?yj8sBU1_T$Pf5x%z?%RXRqnOa-97SV;OsDA^U1Tf;aqvf24(Q=3#kk&t0~ zR&u$i)1id$p7ko@e4O)uUa+2 z`WM1n;6XIm{MZf*DJgxlTW z_S;UI)xT750GpI#mQnGr^Yrn{wq|y6S<{(W3c-nublklgpy6`?^gUc&&lNu( zf9?)n-uP7)tEWo+U zx2!^LS$J&SZ3E!$cAsPTu5k0V#lt_de=DYxWvk4dVa39|gXFin!jEm#zimv|LJB?S zb#hr4wdJ(v?yr}Y=a-!amz}$m@~Am~)fIOyJKf6;Q?mK($Gcei?TVgq!d|F&-A05Q zYfMr&$tl`fZ#@ta<$u$7)W&eLB8@h_26~>k8EtXpg@UMb?5%j`#MK{dGP!XxfBFnb zX8XHSByJ&w!rjM-jMYm7o$6)^l?%64-Ri3MSYt!4RPW0*w{{~8Ut;zn${p7}$#UzQ z*E|+2M|*f&1z9lXtY)QA;7Jn&+_Rus92H!VKP02|TBQ@>n?fB3Uc=#gDE zL}pWopJWjglm(%*Da{78*QiN{#JH$R0x-F~!78(SH67?%WXXan_FO>bYCTe>u!vRq zYPsPCR1b)4s`b7-0o%C?vGLZ z%kyJYnjoEG1okMDR^Au>~$}H@1>dY@aLvU?4Dd=T=H)=r@7*goNK(cjG= z6XQLnyTwrVP0r4p>t&F>%iQfO1}GJ4jVjrVr>dkHkzmO2Wfm+$AICA^W2n!fy_Yj> z*B-j`_HC5l+D&lbCb)&9(ixmOQMA#*G}lnRITG*RA`&lu8W{#5zlE2z++g&`GFtrL z9V(`g=_cm1)010A~_1^Qj{26G704!~d+aV%iwpYKVX3XBQWL;i_*Hy)_eNP`;;NwlDxZfuN@D7N;ej+$ z5XX%Tcp0~R6E$${d@)_8RM!pK7IkpQ1p(sE%L2Kow;!#40~GMhg-fkoWZ2aC?PzKq z>Tx$#Us=hjGOya#fSQX@z2JIa=gmY+7pC0$Ki&qy0k?j`ji9djrILy9U+|S4zx{Qy z^UBpBzW(FS(7O85X`ReJY_+B|m$YckhTZ&~Gv+D&!k_;IP)h>@6aWAK2mml~vy>4< qI}IjUdskyERR>TJ001|W=1e#OFmaP0O&kG*lRZr&2FgqT0001S5{YjB diff --git a/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/createUiDefinition.json b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/createUiDefinition.json index ec2b26023b2..94dc3f88f6a 100644 --- a/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/createUiDefinition.json +++ b/Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Multi%20Cloud%20Attack%20Coverage%20Essentials-Resource%20Abuse/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe rise of Multi Cloud Resource Abuse attacks poses a significant threat to the security and integrity of cloud infrastructures. These attacks target the vulnerabilities within AWS, GCP, and Azure cloud environments, aiming to exploit misconfigurations, weak access controls, or compromised credentials to gain unauthorized access, manipulate resources, and extract valuable data across diverse cloud platforms. The Multi Cloud Resource Abuse Attack Solution is designed to fortify the detection and prevention measures against such malicious activities. By integrating detection capabilities across AWS, GCP, and Azure cloud infrastructures, this solution offers a set of detection strategies across various cloud platforms, including AWS, GCP, and Azure, aiming to identify abnormal activities, unauthorized access attempts, resource misuse, and data exfiltration. The solution encompasses log monitoring, anomaly detection, and behaviour analysis to detect and respond to potential breaches or abuses. This solution extends its coverage to include a wide array of cloud-based services such as AWS IAM, Azure AD, GCP IAM, storage services, and more, ensuring a comprehensive approach to identifying, mitigating, and responding to potential threats.\n\n **Pre-requisites:**\n\n This is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Cv-sudkharat%40microsoft.com%7C8ec0502d0fb449debbc108dbe9849194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638360527889561785%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=XyqFj%2FfDBffyAPs4haVuOLs0g3vFY6jt%2B8pe%2F9gk0%2B0%3D&reserved=0) and does not include any data connectors. To achieve the most robust protection against Multi Cloud Resource Abuse, it is recommended to deploy this solution in conjunction with complementary tools and solutions across the cloud platforms. Install one or more of the listed solutions to unlock the value provided by this solution. \n\n[Microsoft Defender XDR](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-microsoft365defenderazure-sentinel-solution-microsoft365defender)\n\n [Microsoft Entra ID](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivedirectoryazure-sentinel-solution-azureactivedirectory)\r\r\n[Amazon Web Services](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-amazonwebservicesazure-sentinel-solution-amazonwebservices)\n\n[Google Cloud Platform IAM](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpiamazure-sentinel-solution-gcpiam)\n\n \n\n[Google Cloud Platform Audit Logs](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpauditlogs-apiazure-sentinel-solution-gcpauditlogs-api) \n\nThis content covers all stages of the attack chain from an initial resource access attack vector, establishing persistence to an environment, locating and executing malicious activity from data stores, and then perpetrating and hiding their activity. This range of content complements the coverage Microsoft 365 Defender provides across Microsoft Defender products: https://learn.microsoft.com/microsoft-365/security/defender/automatic-attack-disruption\n\n**Keywords:** Multi-cloud, Cross-cloud, AWS, GCP, GuardDuty, AWS GuardDuty, GCP Security, Security Console, Cloud abuse, Resource Abuse\n\n**Analytic Rules:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Multi%20Cloud%20Attack%20Coverage%20Essentials%20-%20Resource%20Abuse/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe rise of Multi Cloud Resource Abuse attacks poses a significant threat to the security and integrity of cloud infrastructures. These attacks target the vulnerabilities within AWS, GCP, and Azure cloud environments, aiming to exploit misconfigurations, weak access controls, or compromised credentials to gain unauthorized access, manipulate resources, and extract valuable data across diverse cloud platforms. The Multi Cloud Resource Abuse Attack Solution is designed to fortify the detection and prevention measures against such malicious activities. By integrating detection capabilities across AWS, GCP, and Azure cloud infrastructures, this solution offers a set of detection strategies across various cloud platforms, including AWS, GCP, and Azure, aiming to identify abnormal activities, unauthorized access attempts, resource misuse, and data exfiltration. The solution encompasses log monitoring, anomaly detection, and behaviour analysis to detect and respond to potential breaches or abuses. This solution extends its coverage to include a wide array of cloud-based services such as AWS IAM, Azure AD, GCP IAM, storage services, and more, ensuring a comprehensive approach to identifying, mitigating, and responding to potential threats.\n\n **Pre-requisites:**\n\n This is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Cv-sudkharat%40microsoft.com%7C8ec0502d0fb449debbc108dbe9849194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638360527889561785%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=XyqFj%2FfDBffyAPs4haVuOLs0g3vFY6jt%2B8pe%2F9gk0%2B0%3D&reserved=0) and does not include any data connectors. To achieve the most robust protection against Multi Cloud Resource Abuse, it is recommended to deploy this solution in conjunction with complementary tools and solutions across the cloud platforms. Install one or more of the listed solutions to unlock the value provided by this solution. \n\n[Microsoft Defender XDR](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-microsoft365defenderazure-sentinel-solution-microsoft365defender)\n\n [Microsoft Entra ID](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivedirectoryazure-sentinel-solution-azureactivedirectory)\r\r\n[Amazon Web Services](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-amazonwebservicesazure-sentinel-solution-amazonwebservices)\n\n[Google Cloud Platform IAM](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpiamazure-sentinel-solution-gcpiam)\n\n \n\n[Google Cloud Platform Audit Logs](https://portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpauditlogs-apiazure-sentinel-solution-gcpauditlogs-api) \n\nThis content covers all stages of the attack chain from an initial resource access attack vector, establishing persistence to an environment, locating and executing malicious activity from data stores, and then perpetrating and hiding their activity. This range of content complements the coverage Microsoft 365 Defender provides across Microsoft Defender products: https://learn.microsoft.com/microsoft-365/security/defender/automatic-attack-disruption\n\n**Keywords:** Multi-cloud, Cross-cloud, AWS, GCP, GuardDuty, AWS GuardDuty, GCP Security, Security Console, Cloud abuse, Resource Abuse\n\n**Analytic Rules:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions",