custom/New-AzSentinelAlertRule.ps1
|
# ---------------------------------------------------------------------------------- # # Copyright Microsoft Corporation # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # http://www.apache.org/licenses/LICENSE-2.0 # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ---------------------------------------------------------------------------------- <# .Synopsis Creates or updates the alert rule. .Description Creates or updates the alert rule. .Link https://docs.microsoft.com/powershell/module/az.securityinsights/new-azsentinelalertrule #> function New-AzSentinelAlertRule { [OutputType([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.AlertRule])] [CmdletBinding(DefaultParameterSetName = 'FusionMLTI', PositionalBinding = $false, SupportsShouldProcess, ConfirmImpact = 'Medium')] param( [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '(Get-AzContext).Subscription.Id')] [System.String] # Gets subscription credentials which uniquely identify Microsoft Azure subscription. # The subscription ID forms part of the URI for every service call. ${SubscriptionId}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [System.String] # The Resource Group Name. ${ResourceGroupName}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [System.String] # The name of the workspace. ${WorkspaceName}, [Parameter()] #[Alias('RuleId')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '(New-Guid).Guid')] [System.String] # The Id of the Rule. ${RuleId}, [Parameter(Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertRuleKind])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertRuleKind] # Kind of the the data connection ${Kind}, [Parameter(ParameterSetName = 'FusionMLTI', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertRuleTemplate}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertRuleTemplateName}, [Parameter(ParameterSetName = 'FusionMLTI')] [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${Enabled}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Description}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${DisplayNamesFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${DisplayNamesExcludeFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation', Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.MicrosoftSecurityProductName])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.MicrosoftSecurityProductName] ${ProductFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertSeverity[]] #High, Medium, Low, Informational ${SeveritiesFilter}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Query}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${DisplayName}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = 'New-TimeSpan -Hours 5')] [System.TimeSpan] ${SuppressionDuration}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${SuppressionEnabled}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertSeverity])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertSeverity] ${Severity}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] #[Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AttackTactic] [System.String] #InitialAccess, Execution, Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Collection, Exfiltration, CommandAndControl, Impact, PreAttack ${Tactic}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${CreateIncident}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${GroupingConfigurationEnabled}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${ReOpenClosedIncident}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = 'New-TimeSpan -Hours 5')] [System.TimeSpan] ${LookbackDuration}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '"AllEntities"')] [ValidateSet('AllEntities', 'AnyAlert', 'Selected')] [System.String] ${MatchingMethod}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertDetail])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertDetail] ${GroupByAlertDetail}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [string[]] ${GroupByCustomDetail}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EntityMappingType])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EntityMappingType] ${GroupByEntity}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] #'Account', 'Host', 'IP', 'Malware', 'File', 'Process', 'CloudApplication', 'DNS', 'AzureResource', 'FileHash', 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'URL', 'Mailbox', 'MailCluster', 'MailMessage', 'SubmissionMail' [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.EntityMapping] ${EntityMapping}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertDescriptionFormat}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertDisplayNameFormat}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertSeverityColumnName}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertTacticsColumnName}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.TimeSpan] ${QueryFrequency}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.TimeSpan] ${QueryPeriod}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.TriggerOperator])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.TriggerOperator] ${TriggerOperator}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [int] ${TriggerThreshold}, [Parameter(ParameterSetName = 'Scheduled')] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EventGroupingAggregationKind])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EventGroupingAggregationKind] ${EventGroupingSettingAggregationKind}, [Parameter()] [Alias('AzureRMContext', 'AzureCredential')] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Azure')] [System.Management.Automation.PSObject] # The credentials, account, tenant, and subscription used for communication with Azure. ${DefaultProfile}, [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Run the command as a job ${AsJob}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Wait for .NET debugger to attach ${Break}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.SendAsyncStep[]] # SendAsync Pipeline Steps to be appended to the front of the pipeline ${HttpPipelineAppend}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.SendAsyncStep[]] # SendAsync Pipeline Steps to be prepended to the front of the pipeline ${HttpPipelinePrepend}, [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Run the command asynchronously ${NoWait}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Uri] # The URI for the proxy server to use ${Proxy}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.PSCredential] # Credentials for a proxy server to use for the remote call ${ProxyCredential}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Use the default credentials for the proxy ${ProxyUseDefaultCredentials} ) process { try { #Fusion if ($PSBoundParameters['Kind'] -eq 'Fusion'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.FusionAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } } #MSIC if($PSBoundParameters['Kind'] -eq 'MicrosoftSecurityIncidentCreation'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.MicrosoftSecurityIncidentCreationAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Enabled = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } If($PSBoundParameters['DisplayNamesFilter']){ $AlertRule.Enabled = $PSBoundParameters['DisplayNamesFilter'] $null = $PSBoundParameters.Remove('DisplayNamesFilter') } If($PSBoundParameters['DisplayNamesExcludeFilter']){ $AlertRule.Enabled = $PSBoundParameters['DisplayNamesExcludeFilter'] $null = $PSBoundParameters.Remove('DisplayNamesExcludeFilter') } $AlertRule.ProductFilter = $PSBoundParameters['ProductFilter'] $null = $PSBoundParameters.Remove('ProductFilter') If($PSBoundParameters['SeveritiesFilter']){ $AlertRule.Enabled = $PSBoundParameters['SeveritiesFilter'] $null = $PSBoundParameters.Remove('SeveritiesFilter') } } #ML if ($PSBoundParameters['Kind'] -eq 'MLBehaviorAnalytics'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.MlBehaviorAnalyticsAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } } #NRT if($PSBoundParameters['Kind'] -eq 'NRT'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.NrtAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Enabled = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } $AlertRule.Query = $PSBoundParameters['Query'] $null = $PSBoundParameters.Remove('Query') $AlertRule.DisplayName = $PSBoundParameters['DisplayName'] $null = $PSBoundParameters.Remove('DisplayName') $AlertRule.SuppressionDuration = $PSBoundParameters['SuppressionDuration'] $null = $PSBoundParameters.Remove('SuppressionDuration') If($PSBoundParameters['SuppressionEnabled']){ $AlertRule.SuppressionEnabled = $PSBoundParameters['SuppressionEnabled'] $null = $PSBoundParameters.Remove('SuppressionEnabled') } else{ $AlertRule.SuppressionEnabled = $false } $AlertRule.Severity = $PSBoundParameters['Severity'] $null = $PSBoundParameters.Remove('Severity') If($PSBoundParameters['Tactic']){ $AlertRule.Tactic = $PSBoundParameters['Tactic'] $null = $PSBoundParameters.Remove('Tactic') } If($PSBoundParameters['CreateIncident']){ $AlertRule.IncidentConfigurationCreateIncident = $PSBoundParameters['CreateIncident'] $null = $PSBoundParameters.Remove('CreateIncident') } else{ $AlertRule.IncidentConfigurationCreateIncident = $false } If($PSBoundParameters['GroupingConfigurationEnabled']){ $AlertRule.GroupingConfigurationEnabled = $PSBoundParameters['GroupingConfigurationEnabled'] $null = $PSBoundParameters.Remove('GroupingConfigurationEnabled') } else{ $AlertRule.GroupingConfigurationEnabled = $false } If($PSBoundParameters['ReOpenClosedIncident']){ $AlertRule.GroupingConfigurationReOpenClosedIncident = $PSBoundParameters['ReOpenClosedIncident'] $null = $PSBoundParameters.Remove('ReOpenClosedIncident') } else{ $AlertRule.GroupingConfigurationReOpenClosedIncident = $false } $AlertRule.GroupingConfigurationLookbackDuration = $PSBoundParameters['LookbackDuration'] $null = $PSBoundParameters.Remove('LookbackDuration') $AlertRule.GroupingConfigurationMatchingMethod = $PSBoundParameters['MatchingMethod'] $null = $PSBoundParameters.Remove('MatchingMethod') If($PSBoundParameters['GroupByAlertDetail']){ $AlertRule.GroupingConfigurationGroupByAlertDetail = $PSBoundParameters['GroupByAlertDetail'] $null = $PSBoundParameters.Remove('GroupByAlertDetail') } If($PSBoundParameters['GroupByCustomDetail']){ $AlertRule.GroupingConfigurationGroupByCustomDetail = $PSBoundParameters['GroupByCustomDetail'] $null = $PSBoundParameters.Remove('GroupByCustomDetail') } If($PSBoundParameters['GroupByEntity']){ $AlertRule.GroupingConfigurationGroupByEntity = $PSBoundParameters['GroupByEntity'] $null = $PSBoundParameters.Remove('GroupByEntity') } If($PSBoundParameters['EntityMapping']){ $AlertRule.EntityMapping = $PSBoundParameters['EntityMapping'] $null = $PSBoundParameters.Remove('EntityMapping') } If($PSBoundParameters['AlertDescriptionFormat']){ $AlertRule.AlertDetailOverrideAlertDescriptionFormat = $PSBoundParameters['AlertDescriptionFormat'] $null = $PSBoundParameters.Remove('AlertDescriptionFormat') } If($PSBoundParameters['AlertDisplayNameFormat']){ $AlertRule.AlertDetailOverrideAlertDisplayNameFormat = $PSBoundParameters['AlertDisplayNameFormat'] $null = $PSBoundParameters.Remove('AlertDisplayNameFormat') } If($PSBoundParameters['AlertSeverityColumnName']){ $AlertRule.AlertDetailOverrideAlertSeverityColumnName = $PSBoundParameters['AlertSeverityColumnName'] $null = $PSBoundParameters.Remove('AlertSeverityColumnName') } If($PSBoundParameters['AlertTacticsColumnName']){ $AlertRule.AlertDetailOverrideAlertTacticsColumnName = $PSBoundParameters['AlertTacticsColumnName'] $null = $PSBoundParameters.Remove('AlertTacticsColumnName') } } #Scheduled if ($PSBoundParameters['Kind'] -eq 'Scheduled'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.ScheduledAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } $AlertRule.Query = $PSBoundParameters['Query'] $null = $PSBoundParameters.Remove('Query') $AlertRule.DisplayName = $PSBoundParameters['DisplayName'] $null = $PSBoundParameters.Remove('DisplayName') $AlertRule.SuppressionDuration = $PSBoundParameters['SuppressionDuration'] $null = $PSBoundParameters.Remove('SuppressionDuration') If($PSBoundParameters['SuppressionEnabled']){ $AlertRule.SuppressionEnabled = $PSBoundParameters['SuppressionEnabled'] $null = $PSBoundParameters.Remove('SuppressionEnabled') } else{ $AlertRule.SuppressionEnabled = $false } $AlertRule.Severity = $PSBoundParameters['Severity'] $null = $PSBoundParameters.Remove('Severity') If($PSBoundParameters['Tactic']){ $AlertRule.Tactic = $PSBoundParameters['Tactic'] $null = $PSBoundParameters.Remove('Tactic') } If($PSBoundParameters['CreateIncident']){ $AlertRule.IncidentConfigurationCreateIncident = $PSBoundParameters['CreateIncident'] $null = $PSBoundParameters.Remove('CreateIncident') } else{ $AlertRule.IncidentConfigurationCreateIncident = $false } If($PSBoundParameters['GroupingConfigurationEnabled']){ $AlertRule.GroupingConfigurationEnabled = $PSBoundParameters['GroupingConfigurationEnabled'] $null = $PSBoundParameters.Remove('GroupingConfigurationEnabled') } else{ $AlertRule.GroupingConfigurationEnabled = $false } If($PSBoundParameters['ReOpenClosedIncident']){ $AlertRule.GroupingConfigurationReOpenClosedIncident = $PSBoundParameters['ReOpenClosedIncident'] $null = $PSBoundParameters.Remove('ReOpenClosedIncident') } else{ $AlertRule.GroupingConfigurationReOpenClosedIncident = $false } $AlertRule.GroupingConfigurationLookbackDuration = $PSBoundParameters['LookbackDuration'] $null = $PSBoundParameters.Remove('LookbackDuration') $AlertRule.GroupingConfigurationMatchingMethod = $PSBoundParameters['MatchingMethod'] $null = $PSBoundParameters.Remove('MatchingMethod') If($PSBoundParameters['GroupByAlertDetail']){ $AlertRule.GroupingConfigurationGroupByAlertDetail = $PSBoundParameters['GroupByAlertDetail'] $null = $PSBoundParameters.Remove('GroupByAlertDetail') } If($PSBoundParameters['GroupByCustomDetail']){ $AlertRule.GroupingConfigurationGroupByCustomDetail = $PSBoundParameters['GroupByCustomDetail'] $null = $PSBoundParameters.Remove('GroupByCustomDetail') } If($PSBoundParameters['GroupByEntity']){ $AlertRule.GroupingConfigurationGroupByEntity = $PSBoundParameters['GroupByEntity'] $null = $PSBoundParameters.Remove('GroupByEntity') } If($PSBoundParameters['EntityMapping']){ $AlertRule.EntityMapping = $PSBoundParameters['EntityMapping'] $null = $PSBoundParameters.Remove('EntityMapping') } If($PSBoundParameters['AlertDescriptionFormat']){ $AlertRule.AlertDetailOverrideAlertDescriptionFormat = $PSBoundParameters['AlertDescriptionFormat'] $null = $PSBoundParameters.Remove('AlertDescriptionFormat') } If($PSBoundParameters['AlertDisplayNameFormat']){ $AlertRule.AlertDetailOverrideAlertDisplayNameFormat = $PSBoundParameters['AlertDisplayNameFormat'] $null = $PSBoundParameters.Remove('AlertDisplayNameFormat') } If($PSBoundParameters['AlertSeverityColumnName']){ $AlertRule.AlertDetailOverrideAlertSeverityColumnName = $PSBoundParameters['AlertSeverityColumnName'] $null = $PSBoundParameters.Remove('AlertSeverityColumnName') } If($PSBoundParameters['AlertTacticsColumnName']){ $AlertRule.AlertDetailOverrideAlertTacticsColumnName = $PSBoundParameters['AlertTacticsColumnName'] $null = $PSBoundParameters.Remove('AlertTacticsColumnName') } $AlertRule.QueryFrequency = $PSBoundParameters['QueryFrequency'] $null = $PSBoundParameters.Remove('QueryFrequency') $AlertRule.QueryPeriod = $PSBoundParameters['QueryPeriod'] $null = $PSBoundParameters.Remove('QueryPeriod') $AlertRule.TriggerOperator = $PSBoundParameters['TriggerOperator'] $null = $PSBoundParameters.Remove('TriggerOperator') $AlertRule.TriggerThreshold = $PSBoundParameters['TriggerThreshold'] $null = $PSBoundParameters.Remove('TriggerThreshold') If($PSBoundParameters['EventGroupingSettingAggregationKind']){ $AlertRule.EventGroupingSettingAggregationKind = $PSBoundParameters['EventGroupingSettingAggregationKind'] $null = $PSBoundParameters.Remove('EventGroupingSettingAggregationKind') } } #TI if ($PSBoundParameters['Kind'] -eq 'ThreatIntelligence'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.ThreatIntelligenceAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else { $AlertRule.Enabled = $false } } $null = $PSBoundParameters.Remove('FusionMLTI') $AlertRule.Kind = $PSBoundParameters['Kind'] $null = $PSBoundParameters.Remove('Kind') $null = $PSBoundParameters.Add('AlertRule', $AlertRule) Az.SecurityInsights.internal\New-AzSentinelAlertRule @PSBoundParameters } catch { throw } } } # SIG # Begin signature block # MIIntgYJKoZIhvcNAQcCoIInpzCCJ6MCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCA9kpPEDnLYXRUx # HvIoVMGGaZK4Pj2z63qqQ19qqPh0f6CCDYEwggX/MIID56ADAgECAhMzAAACzI61 # lqa90clOAAAAAALMMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjIwNTEyMjA0NjAxWhcNMjMwNTExMjA0NjAxWjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQCiTbHs68bADvNud97NzcdP0zh0mRr4VpDv68KobjQFybVAuVgiINf9aG2zQtWK # No6+2X2Ix65KGcBXuZyEi0oBUAAGnIe5O5q/Y0Ij0WwDyMWaVad2Te4r1Eic3HWH # UfiiNjF0ETHKg3qa7DCyUqwsR9q5SaXuHlYCwM+m59Nl3jKnYnKLLfzhl13wImV9 # DF8N76ANkRyK6BYoc9I6hHF2MCTQYWbQ4fXgzKhgzj4zeabWgfu+ZJCiFLkogvc0 # RVb0x3DtyxMbl/3e45Eu+sn/x6EVwbJZVvtQYcmdGF1yAYht+JnNmWwAxL8MgHMz # xEcoY1Q1JtstiY3+u3ulGMvhAgMBAAGjggF+MIIBejAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUiLhHjTKWzIqVIp+sM2rOHH11rfQw # UAYDVR0RBEkwR6RFMEMxKTAnBgNVBAsTIE1pY3Jvc29mdCBPcGVyYXRpb25zIFB1 # ZXJ0byBSaWNvMRYwFAYDVQQFEw0yMzAwMTIrNDcwNTI5MB8GA1UdIwQYMBaAFEhu # ZOVQBdOCqhc3NyK1bajKdQKVMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cu # bWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY0NvZFNpZ1BDQTIwMTFfMjAxMS0w # Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx # MS0wNy0wOC5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAeA8D # sOAHS53MTIHYu8bbXrO6yQtRD6JfyMWeXaLu3Nc8PDnFc1efYq/F3MGx/aiwNbcs # J2MU7BKNWTP5JQVBA2GNIeR3mScXqnOsv1XqXPvZeISDVWLaBQzceItdIwgo6B13 # vxlkkSYMvB0Dr3Yw7/W9U4Wk5K/RDOnIGvmKqKi3AwyxlV1mpefy729FKaWT7edB # d3I4+hldMY8sdfDPjWRtJzjMjXZs41OUOwtHccPazjjC7KndzvZHx/0VWL8n0NT/ # 404vftnXKifMZkS4p2sB3oK+6kCcsyWsgS/3eYGw1Fe4MOnin1RhgrW1rHPODJTG # AUOmW4wc3Q6KKr2zve7sMDZe9tfylonPwhk971rX8qGw6LkrGFv31IJeJSe/aUbG # dUDPkbrABbVvPElgoj5eP3REqx5jdfkQw7tOdWkhn0jDUh2uQen9Atj3RkJyHuR0 # GUsJVMWFJdkIO/gFwzoOGlHNsmxvpANV86/1qgb1oZXdrURpzJp53MsDaBY/pxOc # J0Cvg6uWs3kQWgKk5aBzvsX95BzdItHTpVMtVPW4q41XEvbFmUP1n6oL5rdNdrTM # j/HXMRk1KCksax1Vxo3qv+13cCsZAaQNaIAvt5LvkshZkDZIP//0Hnq7NnWeYR3z # 4oFiw9N2n3bb9baQWuWPswG0Dq9YT9kb+Cs4qIIwggd6MIIFYqADAgECAgphDpDS # AAAAAAADMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK # V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0 # IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0 # ZSBBdXRob3JpdHkgMjAxMTAeFw0xMTA3MDgyMDU5MDlaFw0yNjA3MDgyMTA5MDla # MH4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMT # H01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTEwggIiMA0GCSqGSIb3DQEB # AQUAA4ICDwAwggIKAoICAQCr8PpyEBwurdhuqoIQTTS68rZYIZ9CGypr6VpQqrgG # OBoESbp/wwwe3TdrxhLYC/A4wpkGsMg51QEUMULTiQ15ZId+lGAkbK+eSZzpaF7S # 35tTsgosw6/ZqSuuegmv15ZZymAaBelmdugyUiYSL+erCFDPs0S3XdjELgN1q2jz # y23zOlyhFvRGuuA4ZKxuZDV4pqBjDy3TQJP4494HDdVceaVJKecNvqATd76UPe/7 # 4ytaEB9NViiienLgEjq3SV7Y7e1DkYPZe7J7hhvZPrGMXeiJT4Qa8qEvWeSQOy2u # M1jFtz7+MtOzAz2xsq+SOH7SnYAs9U5WkSE1JcM5bmR/U7qcD60ZI4TL9LoDho33 # X/DQUr+MlIe8wCF0JV8YKLbMJyg4JZg5SjbPfLGSrhwjp6lm7GEfauEoSZ1fiOIl # XdMhSz5SxLVXPyQD8NF6Wy/VI+NwXQ9RRnez+ADhvKwCgl/bwBWzvRvUVUvnOaEP # 6SNJvBi4RHxF5MHDcnrgcuck379GmcXvwhxX24ON7E1JMKerjt/sW5+v/N2wZuLB # l4F77dbtS+dJKacTKKanfWeA5opieF+yL4TXV5xcv3coKPHtbcMojyyPQDdPweGF # RInECUzF1KVDL3SV9274eCBYLBNdYJWaPk8zhNqwiBfenk70lrC8RqBsmNLg1oiM # CwIDAQABo4IB7TCCAekwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFEhuZOVQ # BdOCqhc3NyK1bajKdQKVMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1Ud # DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFHItOgIxkEO5FAVO # 4eqnxzHRI4k0MFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9jcmwubWljcm9zb2Z0 # LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcmwwXgYIKwYBBQUHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p # Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAGCNy4DMIGDMD8GCCsGAQUFBwIB # FjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2RvY3MvcHJpbWFyeWNw # cy5odG0wQAYIKwYBBQUHAgIwNB4yIB0ATABlAGcAYQBsAF8AcABvAGwAaQBjAHkA # XwBzAHQAYQB0AGUAbQBlAG4AdAAuIB0wDQYJKoZIhvcNAQELBQADggIBAGfyhqWY # 4FR5Gi7T2HRnIpsLlhHhY5KZQpZ90nkMkMFlXy4sPvjDctFtg/6+P+gKyju/R6mj # 82nbY78iNaWXXWWEkH2LRlBV2AySfNIaSxzzPEKLUtCw/WvjPgcuKZvmPRul1LUd # d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ # Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf # wzIY4vDFLc5bnrRJOQrGCsLGra7lstnbFYhRRVg4MnEnGn+x9Cf43iw6IGmYslmJ # aG5vp7d0w0AFBqYBKig+gj8TTWYLwLNN9eGPfxxvFX1Fp3blQCplo8NdUmKGwx1j # NpeG39rz+PIWoZon4c2ll9DuXWNB41sHnIc+BncG0QaxdR8UvmFhtfDcxhsEvt9B # xw4o7t5lL+yX9qFcltgA1qFGvVnzl6UJS0gQmYAf0AApxbGbpT9Fdx41xtKiop96 # eiL6SJUfq/tHI4D1nvi/a7dLl+LrdXga7Oo3mXkYS//WsyNodeav+vyL6wuA6mk7 # r/ww7QRMjt/fdW1jkT3RnVZOT7+AVyKheBEyIXrvQQqxP/uozKRdwaGIm1dxVk5I # RcBCyZt2WwqASGv9eZ/BvW1taslScxMNelDNMYIZizCCGYcCAQEwgZUwfjELMAkG # A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx # HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9z # b2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAxMQITMwAAAsyOtZamvdHJTgAAAAACzDAN # BglghkgBZQMEAgEFAKCBrjAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgor # BgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQgBIkZkneR # rKNrgT4XmnJY6yHprgOnRDhUpT2RisrPq78wQgYKKwYBBAGCNwIBDDE0MDKgFIAS # AE0AaQBjAHIAbwBzAG8AZgB0oRqAGGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbTAN # BgkqhkiG9w0BAQEFAASCAQCTllaqjqsJC68c96OZJWYDn9w4YqXsI+UNH6cW4e8t # MRN3f1jiNwKFNtFTQdmS+OjN/Mlv6GbXUmF3OCmuRO+a8XKKMVxC/dcPssnhh4uN # eDk/SN+KWlYrZ1HzcJ43NV/Cl48uFn6JsMWnDuSKxXzcCj6IUuTosvywKImsq4Bp # pSDhftBxdtoDKkUEqZudc5DuLZFdRb+puaWhG+CXLCKGk2t+kNYh/IL+GwDpMF9w # FiXegzxdq5WkyqNxb3H7/mJuGCHuwNAmxSXbf5ukfyFCg4fFkHHGZF9BEzrARAsa # awfVJpOYsM0ZxAWAq/fMoRRDa223a1Lx7CVFNAxYmp+OoYIXFTCCFxEGCisGAQQB # gjcDAwExghcBMIIW/QYJKoZIhvcNAQcCoIIW7jCCFuoCAQMxDzANBglghkgBZQME # AgEFADCCAVgGCyqGSIb3DQEJEAEEoIIBRwSCAUMwggE/AgEBBgorBgEEAYRZCgMB # MDEwDQYJYIZIAWUDBAIBBQAEII9Y84sK+lH7+HY+EwhsGb3I0dHbvzuQa6IYxXhp # q0WnAgZi/pJ6T6UYEjIwMjIwODIwMDgyMTQ5LjgyWjAEgAIB9KCB2KSB1TCB0jEL # MAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1v # bmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWlj # cm9zb2Z0IElyZWxhbmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFs # ZXMgVFNTIEVTTjowODQyLTRCRTYtQzI5QTElMCMGA1UEAxMcTWljcm9zb2Z0IFRp # bWUtU3RhbXAgU2VydmljZaCCEWUwggcUMIIE/KADAgECAhMzAAABh0IWZgRc8/SN # AAEAAAGHMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAy # MDEwMB4XDTIxMTAyODE5MjczOVoXDTIzMDEyNjE5MjczOVowgdIxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJ # cmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRTUyBF # U046MDg0Mi00QkU2LUMyOUExJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1w # IFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC+aXgZYz0D # o9ERCIeBkAA8rqf5OHqb4tjApgtpAWVldtOquh2GyeLsdUhGSoEW4byiDUpmvLTb # ESaZt2nz07jTEIhB9bwUpbug7+Vhi1QBBbaSnS4y5gQnVeRnp4eNwy6oQnALjtRq # RnHcB6RqQ/4Z8a4MM72RkZBF7wimKInhCSfqZsOFtGmBxQ52wPOY3PqRcbuB8h+B # yzmTO4og/qc3i2yM+HIXnxVTRl8jQ9IL6fk5fSGxTyF5Z7elSIOvmCo/XprqQiMU # keSA09iAyK8ZNApyM3E1xeefKZP8lW42ztm+TU/kpZ/wbVcb8y1lnn+O6qyDRChS # ZBmNWHRdGS7tikymS1btd8UDfL5gk4bWlXOLMHc/MldQLwxrwBTLC1S5QtaNhPnL # v8TDAdaafVFPQ+Fin2Sal9Lochh8QFuhhS9QtbYecY1/Hrl/hSRzuSA1JBt4AfrK # M7l2DoxTA9/Oj+sF01pl8nFntGxxMHJO2XFuV9RPjrI8cJcAKJf8GFocRjh50WCn # 9whvtccUlu7iY0MA/NGUCQiPVIa470bixuSMz1ek0xaCWPZ0L1As3/SB4EVeg0jw # X4d8fDgmj6nqJI/yGfjeaSRYpIY6JPiEsnOhwSsWe0rmL095tdKrYG8yDNVz4EG8 # I3fkN8PSaiRErFqba1AzTrRI5HLdLu5x6wIDAQABo4IBNjCCATIwHQYDVR0OBBYE # FCJRwBa6QS1hgX7dYXOZkD8NpY0gMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWn # G1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNv # bS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEw # KDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cu # bWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFt # cCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYI # KwYBBQUHAwgwDQYJKoZIhvcNAQELBQADggIBALmrflPZEqMAVE3/dxiOc8XO09rs # p6okomcqC+JSP0gx8Lz8VDajHpTDJ3jRNLvMq+24yXXUUWV9aQSdw3eWqKGJICog # M851W+vWgljg0VAE4fMul616kecyDRQvZRcfO+MqDbhU4jNvR210/r35AjLtIOlx # WH0ojQRcobZuiWkHKmpG20ZMN3QlCQ60x2JKloOk4fCAIw1cTzEi7jyGK5PTvmgi # qccmFrfvz8Om6AjQNmNhxkfVwbzgnTq5yrnKCuh32zOvX05sJkl0kunK8lYLLw9E # MCRGM8mCVKZ+fZRHQq+ejII7OOzMDA0Kn8kmeRGnbTB4i3Ob3uI2D4VkXUn0TXp5 # YgHWwKvtWP1APoq37PzWs5wtF/GGU7b+wrT1TD4OJCQ9u7o5ndOwO8uyvzIb1bYD # zJdyCA2p3heku10SR/nY4g3QaBEtJjUs0MHggpj5mPfgjAxsNuzawKKDkuLYgtYQ # xX/qDIvfsnvU1tbtXOjt9was2d706rGAULZZfl16DHIndLHZsrDqVt/TgppedME5 # LPRAL5F8m7Pyc6kh/bz5aYw+JxfaXuCz8ysLlqebIr+dt4qRo7H4BeHBgvMRM2D7 # UhzKCN3CdupYpp8t0I0p+Gxv+AzlIVuAPkBMRfVsDHBQVXEq9C/R0hECbloOMXcN # mmC/LeZKiNKsE3/zMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAAAAAAFTAN # BgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0 # b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh # dGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9y # aXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYD # VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe # MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3Nv # ZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC # AgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDi # vbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpSg0S3po5G # awcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2rrPY2vjUm # ZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k45GPsjks # UZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSueik3rMvr # g0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09/SDPc31B # mkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR6L8FA6PR # c6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxCaC4Q6oRR # RuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaDIV1fMHSR # lJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMURHXLvjflS # xIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMBAAGjggHd # MIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSa # voKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYD # VR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMBMGA1Ud # JQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1Ud # DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjR # PZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0 # LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNy # bDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0G # CSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2Pk5HZHix # BpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjY # Ni6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1TkeFN1JFe5 # 3Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kpicO8F7BU # hUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKpW99Jo3QM # vOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrYUP4KWN1A # PMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QBjloZkWsN # n6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkBRH58oWFs # c/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue1 # 0CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6g # MTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1VM1izoXBm # 8qGCAtQwggI9AgEBMIIBAKGB2KSB1TCB0jELMAkGA1UEBhMCVVMxEzARBgNVBAgT # Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3BlcmF0 # aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjowODQyLTRCRTYt # QzI5QTElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEB # MAcGBSsOAwIaAxUAeHeTVAQoBkSGwsZgYe1//oMbg/OggYMwgYCkfjB8MQswCQYD # VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe # MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3Nv # ZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIFAOarCyEwIhgP # MjAyMjA4MjAxNTI2MjVaGA8yMDIyMDgyMTE1MjYyNVowdDA6BgorBgEEAYRZCgQB # MSwwKjAKAgUA5qsLIQIBADAHAgEAAgIUgzAHAgEAAgIRRzAKAgUA5qxcoQIBADA2 # BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIB # AAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBADLrnnFUgCAXWv9NeV8McINnlPfsY9mY # xmq3bck5OsNZ6H8AYcthhy78lQz5yUSolTxKkU0HEqVdkD/KaE9C6daHiUJBunHk # w/EprwCQ50y7Fg0ZmiKgntiDrufVyw9k22EGeHRnkWtYVszfYxG8F680Ix4pcU8e # RC8+2o1iwjX3MYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgT # Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENB # IDIwMTACEzMAAAGHQhZmBFzz9I0AAQAAAYcwDQYJYIZIAWUDBAIBBQCgggFKMBoG # CSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgUdXwz6Ds # 3DmCl2dY7aTKE9ZYR50ygIw0069+AX6qqHowgfoGCyqGSIb3DQEJEAIvMYHqMIHn # MIHkMIG9BCDELPCgE26gH3bCwLZLFmHPgdUbK8JmfBg25zOkbJqbWDCBmDCBgKR+ # MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT # HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABh0IWZgRc8/SNAAEA # AAGHMCIEIKCkQ/m1dxQWRNANJPsqu9Xw0zKmLESw1pWbNkfociAFMA0GCSqGSIb3 # DQEBCwUABIICACMYc0BHVSNXItGLxjerTHRllgS/6mesU67lzi1Q7sKKySjp7BU3 # mmbAxCYmUPhNjy8QP/E3loVc3y8wsya4FDeSJyw9feShfWMZsPsy8MejYGAFFwGQ # zMkfY/zgnRHuvlSYmh4H9mYzoMeD2w9brnhkSmqPuEY981EDbOryyadctF6HILKn # ihZ9ww11wHzzVJtOkrDqJ0h9XaTpBsEJViZTH7a+azR52g+6RUJJq64BJFkJftV7 # bXf5FJpU0uxZFmma7doh7N+0Mpw7ZzLIA4dlp7LVg937zt9UyuHLK/+F6h5fhthl # Tyj8CKBwdm4CwdgOjWDO3bWTHkbwOmRfPOMasy26psvNV9XOzjVlWb60Z3pn2XXI # HZpoMBirxDNPzwJV69UBk+kqMYNVa0fHISkrhLSEXuZy+2gtNDY/9s/wzJomlhCV # 3dk9Pr9xThXpvxYRAX0vkceEpopV5wqXoESU/BpwGODfeiK7JmlZyVmSoMKcwJ51 # Eb79OOHeV4ydKiLEYTVpudBqFgTMpHTbu2/2BqyIUjZ8f439ZGr+h25OqEuKan23 # 48sd+OpGjZfJvyaY+7XPAYAsvhwKNKGfrG3k7hYOcZtT0TgGuNAggNQxQnhyJpw+ # rv1NRt0f46mzozXKA+f/lF+fX8uhq1KPOImMVz7YYWaeDOu1jGOxOrHL # SIG # End signature block |