SecurityInsights.Autorest/custom/New-AzSentinelAlertRule.ps1
|
# ---------------------------------------------------------------------------------- # # Copyright Microsoft Corporation # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # http://www.apache.org/licenses/LICENSE-2.0 # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ---------------------------------------------------------------------------------- <# .Synopsis Creates the alert rule. .Description Creates the alert rule. .Link https://learn.microsoft.com/powershell/module/az.securityinsights/new-azsentinelalertrule #> function New-AzSentinelAlertRule { [OutputType([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.AlertRule])] [CmdletBinding(DefaultParameterSetName = 'FusionMLTI', PositionalBinding = $false, SupportsShouldProcess, ConfirmImpact = 'Medium')] param( [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '(Get-AzContext).Subscription.Id')] [System.String] # Gets subscription credentials which uniquely identify Microsoft Azure subscription. # The subscription ID forms part of the URI for every service call. ${SubscriptionId}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [System.String] # The Resource Group Name. ${ResourceGroupName}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [System.String] # The name of the workspace. ${WorkspaceName}, [Parameter()] #[Alias('RuleId')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '(New-Guid).Guid')] [System.String] # The Id of the Rule. ${RuleId}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("Scheduled", "MicrosoftSecurityIncidentCreation", "Fusion", "MLBehaviorAnalytics", "ThreatIntelligence", "NRT")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] # Kind of the the data connection ${Kind}, [Parameter(ParameterSetName = 'FusionMLTI', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertRuleTemplate}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertRuleTemplateName}, [Parameter(ParameterSetName = 'FusionMLTI')] [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${Enabled}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Description}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${DisplayNamesFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${DisplayNamesExcludeFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for IoT", "Office 365 Advanced Threat Protection", "Microsoft Defender Advanced Threat Protection")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${ProductFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] #High, Medium, Low, Informational ${SeveritiesFilter}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Query}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${DisplayName}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = 'New-TimeSpan -Hours 5')] [System.TimeSpan] ${SuppressionDuration}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${SuppressionEnabled}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("High", "Medium", "Low", "Informational")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Severity}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("InitialAccess", "Execution", "Persistence", "PrivilegeEscalation", "DefenseEvasion", "CredentialAccess", "Discovery", "LateralMovement", "Collection", "Exfiltration", "CommandAndControl", "Impact", "PreAttack")] [System.String[]] #InitialAccess, Execution, Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Collection, Exfiltration, CommandAndControl, Impact, PreAttack ${Tactic}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${CreateIncident}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${GroupingConfigurationEnabled}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${ReOpenClosedIncident}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = 'New-TimeSpan -Hours 5')] [System.TimeSpan] ${LookbackDuration}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '"AllEntities"')] [ValidateSet('AllEntities', 'AnyAlert', 'Selected')] [System.String] ${MatchingMethod}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("DisplayName", "Severity")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${GroupByAlertDetail}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${GroupByCustomDetail}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("Account", "Host", "IP", "Malware", "File", "Process", "CloudApplication", "DNS", "AzureResource", "FileHash", "RegistryKey", "RegistryValue", "SecurityGroup", "URL", "Mailbox", "MailCluster", "MailMessage", "SubmissionMail")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${GroupByEntity}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] #'Account', 'Host', 'IP', 'Malware', 'File', 'Process', 'CloudApplication', 'DNS', 'AzureResource', 'FileHash', 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'URL', 'Mailbox', 'MailCluster', 'MailMessage', 'SubmissionMail' [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.EntityMapping[]] ${EntityMapping}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertDescriptionFormat}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertDisplayNameFormat}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertSeverityColumnName}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertTacticsColumnName}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.TimeSpan] ${QueryFrequency}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.TimeSpan] ${QueryPeriod}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("GreaterThan", "LessThan", "Equal", "NotEqual")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${TriggerOperator}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [int] ${TriggerThreshold}, [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("SingleAlert", "AlertPerResult")] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${EventGroupingSettingAggregationKind}, [Parameter()] [Alias('AzureRMContext', 'AzureCredential')] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Azure')] [System.Management.Automation.PSObject] # The credentials, account, tenant, and subscription used for communication with Azure. ${DefaultProfile}, [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Run the command as a job ${AsJob}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Wait for .NET debugger to attach ${Break}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.SendAsyncStep[]] # SendAsync Pipeline Steps to be appended to the front of the pipeline ${HttpPipelineAppend}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.SendAsyncStep[]] # SendAsync Pipeline Steps to be prepended to the front of the pipeline ${HttpPipelinePrepend}, [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Run the command asynchronously ${NoWait}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Uri] # The URI for the proxy server to use ${Proxy}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.PSCredential] # Credentials for a proxy server to use for the remote call ${ProxyCredential}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Use the default credentials for the proxy ${ProxyUseDefaultCredentials} ) process { try { #Fusion if ($PSBoundParameters['Kind'] -eq 'Fusion'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.FusionAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } } #MSIC if($PSBoundParameters['Kind'] -eq 'MicrosoftSecurityIncidentCreation'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.MicrosoftSecurityIncidentCreationAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } If($PSBoundParameters['DisplayNamesFilter']){ $AlertRule.DisplayNamesFilter = $PSBoundParameters['DisplayNamesFilter'] $null = $PSBoundParameters.Remove('DisplayNamesFilter') } If($PSBoundParameters['DisplayNamesExcludeFilter']){ $AlertRule.DisplayNamesExcludeFilter = $PSBoundParameters['DisplayNamesExcludeFilter'] $null = $PSBoundParameters.Remove('DisplayNamesExcludeFilter') } $AlertRule.ProductFilter = $PSBoundParameters['ProductFilter'] $null = $PSBoundParameters.Remove('ProductFilter') If($PSBoundParameters['SeveritiesFilter']){ $AlertRule.SeveritiesFilter = $PSBoundParameters['SeveritiesFilter'] $null = $PSBoundParameters.Remove('SeveritiesFilter') } } #ML if ($PSBoundParameters['Kind'] -eq 'MLBehaviorAnalytics'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.MlBehaviorAnalyticsAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } } #NRT if($PSBoundParameters['Kind'] -eq 'NRT'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.NrtAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } $AlertRule.Query = $PSBoundParameters['Query'] $null = $PSBoundParameters.Remove('Query') $AlertRule.DisplayName = $PSBoundParameters['DisplayName'] $null = $PSBoundParameters.Remove('DisplayName') $AlertRule.SuppressionDuration = $PSBoundParameters['SuppressionDuration'] $null = $PSBoundParameters.Remove('SuppressionDuration') If($PSBoundParameters['SuppressionEnabled']){ $AlertRule.SuppressionEnabled = $PSBoundParameters['SuppressionEnabled'] $null = $PSBoundParameters.Remove('SuppressionEnabled') } else{ $AlertRule.SuppressionEnabled = $false } $AlertRule.Severity = $PSBoundParameters['Severity'] $null = $PSBoundParameters.Remove('Severity') If($PSBoundParameters['Tactic']){ $AlertRule.Tactic = $PSBoundParameters['Tactic'] $null = $PSBoundParameters.Remove('Tactic') } If($PSBoundParameters['CreateIncident']){ $AlertRule.IncidentConfigurationCreateIncident = $PSBoundParameters['CreateIncident'] $null = $PSBoundParameters.Remove('CreateIncident') } else{ $AlertRule.IncidentConfigurationCreateIncident = $false } If($PSBoundParameters['GroupingConfigurationEnabled']){ $AlertRule.GroupingConfigurationEnabled = $PSBoundParameters['GroupingConfigurationEnabled'] $null = $PSBoundParameters.Remove('GroupingConfigurationEnabled') } else{ $AlertRule.GroupingConfigurationEnabled = $false } If($PSBoundParameters['ReOpenClosedIncident']){ $AlertRule.GroupingConfigurationReOpenClosedIncident = $PSBoundParameters['ReOpenClosedIncident'] $null = $PSBoundParameters.Remove('ReOpenClosedIncident') } else{ $AlertRule.GroupingConfigurationReOpenClosedIncident = $false } $AlertRule.GroupingConfigurationLookbackDuration = $PSBoundParameters['LookbackDuration'] $null = $PSBoundParameters.Remove('LookbackDuration') $AlertRule.GroupingConfigurationMatchingMethod = $PSBoundParameters['MatchingMethod'] $null = $PSBoundParameters.Remove('MatchingMethod') If($PSBoundParameters['GroupByAlertDetail']){ $AlertRule.GroupingConfigurationGroupByAlertDetail = $PSBoundParameters['GroupByAlertDetail'] $null = $PSBoundParameters.Remove('GroupByAlertDetail') } If($PSBoundParameters['GroupByCustomDetail']){ $AlertRule.GroupingConfigurationGroupByCustomDetail = $PSBoundParameters['GroupByCustomDetail'] $null = $PSBoundParameters.Remove('GroupByCustomDetail') } If($PSBoundParameters['GroupByEntity']){ $AlertRule.GroupingConfigurationGroupByEntity = $PSBoundParameters['GroupByEntity'] $null = $PSBoundParameters.Remove('GroupByEntity') } If($PSBoundParameters['EntityMapping']){ $AlertRule.EntityMapping = $PSBoundParameters['EntityMapping'] $null = $PSBoundParameters.Remove('EntityMapping') } If($PSBoundParameters['AlertDescriptionFormat']){ $AlertRule.AlertDetailOverrideAlertDescriptionFormat = $PSBoundParameters['AlertDescriptionFormat'] $null = $PSBoundParameters.Remove('AlertDescriptionFormat') } If($PSBoundParameters['AlertDisplayNameFormat']){ $AlertRule.AlertDetailOverrideAlertDisplayNameFormat = $PSBoundParameters['AlertDisplayNameFormat'] $null = $PSBoundParameters.Remove('AlertDisplayNameFormat') } If($PSBoundParameters['AlertSeverityColumnName']){ $AlertRule.AlertDetailOverrideAlertSeverityColumnName = $PSBoundParameters['AlertSeverityColumnName'] $null = $PSBoundParameters.Remove('AlertSeverityColumnName') } If($PSBoundParameters['AlertTacticsColumnName']){ $AlertRule.AlertDetailOverrideAlertTacticsColumnName = $PSBoundParameters['AlertTacticsColumnName'] $null = $PSBoundParameters.Remove('AlertTacticsColumnName') } } #Scheduled if ($PSBoundParameters['Kind'] -eq 'Scheduled'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.ScheduledAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } $AlertRule.Query = $PSBoundParameters['Query'] $null = $PSBoundParameters.Remove('Query') $AlertRule.DisplayName = $PSBoundParameters['DisplayName'] $null = $PSBoundParameters.Remove('DisplayName') $AlertRule.SuppressionDuration = $PSBoundParameters['SuppressionDuration'] $null = $PSBoundParameters.Remove('SuppressionDuration') If($PSBoundParameters['SuppressionEnabled']){ $AlertRule.SuppressionEnabled = $PSBoundParameters['SuppressionEnabled'] $null = $PSBoundParameters.Remove('SuppressionEnabled') } else{ $AlertRule.SuppressionEnabled = $false } $AlertRule.Severity = $PSBoundParameters['Severity'] $null = $PSBoundParameters.Remove('Severity') If($PSBoundParameters['Tactic']){ $AlertRule.Tactic = $PSBoundParameters['Tactic'] $null = $PSBoundParameters.Remove('Tactic') } If($PSBoundParameters['CreateIncident']){ $AlertRule.IncidentConfigurationCreateIncident = $PSBoundParameters['CreateIncident'] $null = $PSBoundParameters.Remove('CreateIncident') } else{ $AlertRule.IncidentConfigurationCreateIncident = $false } If($PSBoundParameters['GroupingConfigurationEnabled']){ $AlertRule.GroupingConfigurationEnabled = $PSBoundParameters['GroupingConfigurationEnabled'] $null = $PSBoundParameters.Remove('GroupingConfigurationEnabled') } else{ $AlertRule.GroupingConfigurationEnabled = $false } If($PSBoundParameters['ReOpenClosedIncident']){ $AlertRule.GroupingConfigurationReOpenClosedIncident = $PSBoundParameters['ReOpenClosedIncident'] $null = $PSBoundParameters.Remove('ReOpenClosedIncident') } else{ $AlertRule.GroupingConfigurationReOpenClosedIncident = $false } $AlertRule.GroupingConfigurationLookbackDuration = $PSBoundParameters['LookbackDuration'] $null = $PSBoundParameters.Remove('LookbackDuration') $AlertRule.GroupingConfigurationMatchingMethod = $PSBoundParameters['MatchingMethod'] $null = $PSBoundParameters.Remove('MatchingMethod') If($PSBoundParameters['GroupByAlertDetail']){ $AlertRule.GroupingConfigurationGroupByAlertDetail = $PSBoundParameters['GroupByAlertDetail'] $null = $PSBoundParameters.Remove('GroupByAlertDetail') } If($PSBoundParameters['GroupByCustomDetail']){ $AlertRule.GroupingConfigurationGroupByCustomDetail = $PSBoundParameters['GroupByCustomDetail'] $null = $PSBoundParameters.Remove('GroupByCustomDetail') } If($PSBoundParameters['GroupByEntity']){ $AlertRule.GroupingConfigurationGroupByEntity = $PSBoundParameters['GroupByEntity'] $null = $PSBoundParameters.Remove('GroupByEntity') } If($PSBoundParameters['EntityMapping']){ $AlertRule.EntityMapping = $PSBoundParameters['EntityMapping'] $null = $PSBoundParameters.Remove('EntityMapping') } If($PSBoundParameters['AlertDescriptionFormat']){ $AlertRule.AlertDetailOverrideAlertDescriptionFormat = $PSBoundParameters['AlertDescriptionFormat'] $null = $PSBoundParameters.Remove('AlertDescriptionFormat') } If($PSBoundParameters['AlertDisplayNameFormat']){ $AlertRule.AlertDetailOverrideAlertDisplayNameFormat = $PSBoundParameters['AlertDisplayNameFormat'] $null = $PSBoundParameters.Remove('AlertDisplayNameFormat') } If($PSBoundParameters['AlertSeverityColumnName']){ $AlertRule.AlertDetailOverrideAlertSeverityColumnName = $PSBoundParameters['AlertSeverityColumnName'] $null = $PSBoundParameters.Remove('AlertSeverityColumnName') } If($PSBoundParameters['AlertTacticsColumnName']){ $AlertRule.AlertDetailOverrideAlertTacticsColumnName = $PSBoundParameters['AlertTacticsColumnName'] $null = $PSBoundParameters.Remove('AlertTacticsColumnName') } $AlertRule.QueryFrequency = $PSBoundParameters['QueryFrequency'] $null = $PSBoundParameters.Remove('QueryFrequency') $AlertRule.QueryPeriod = $PSBoundParameters['QueryPeriod'] $null = $PSBoundParameters.Remove('QueryPeriod') $AlertRule.TriggerOperator = $PSBoundParameters['TriggerOperator'] $null = $PSBoundParameters.Remove('TriggerOperator') $AlertRule.TriggerThreshold = $PSBoundParameters['TriggerThreshold'] $null = $PSBoundParameters.Remove('TriggerThreshold') If($PSBoundParameters['EventGroupingSettingAggregationKind']){ $AlertRule.EventGroupingSettingAggregationKind = $PSBoundParameters['EventGroupingSettingAggregationKind'] $null = $PSBoundParameters.Remove('EventGroupingSettingAggregationKind') } } #TI if ($PSBoundParameters['Kind'] -eq 'ThreatIntelligence'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.ThreatIntelligenceAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else { $AlertRule.Enabled = $false } } $null = $PSBoundParameters.Remove('FusionMLTI') #Autorest powershell V4 does not need the Kind property. The object has the Kind value for each. # $AlertRule.Kind = $PSBoundParameters['Kind'] $null = $PSBoundParameters.Remove('Kind') $null = $PSBoundParameters.Add('AlertRule', $AlertRule) Az.SecurityInsights.internal\New-AzSentinelAlertRule @PSBoundParameters } catch { throw } } } # SIG # Begin signature block # MIIncQYJKoZIhvcNAQcCoIInYjCCJ14CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBQCIFUVfkP+gjT # DtiJI2lrD80ugF6u1oDCk3Qv5nzDNKCCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghn+MIIZ+gIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZI # hvcNAQkEMSIEIMxCOQK+qmFAn418HaqAUeLBxgS917Bmep4b4GUQWUXDMEIGCisG # AQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAt4DQNn7MOQcRocoIelbl # QxMrHeIjTTwQd9VE2pYViWWBkeYQtxUnuTcMvK+HjjPyKa0zXwWo4kDVm2tYb23G # 7vk8ibil31Bx3QFo7TgcYvbuSLbesyG/qBvljexz6ex4HWYn0aon3p6IEtwQJJYu # JwRZAmuUU5eiPNgvKorEMZmoNN50P++0PByS8eb0+YH0tn94VK3Pm3pkIWXhmULZ # /ECWeWCUmqhISNNVmMikbCnzByPFXhEzp/a1ADtRGl9Sz6jhqMEIRTDTGWL6q8a4 # L4jn+vofi3H7k52T6iHdxJnnb9cl1wLOLZccyKmfrje/qCuv9rrsV86zkm2qHJy5 # pqGCF7AwghesBgorBgEEAYI3AwMBMYIXnDCCF5gGCSqGSIb3DQEHAqCCF4kwgheF # AgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG9w0BCRABBKCCAUkEggFFMIIB # QQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCBJNFI/9nWQvI7e76+L # nqwmaWVTo7qmE++FuUO/NV/cygIGahCT2V37GBMyMDI2MDUyNzEwMjMwNi4zNTha # MASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv # bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0 # aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0 # ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjoyRDFBLTA1RTAtRDk0NzElMCMG # A1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEf4wggcoMIIFEKAD # AgECAhMzAAACEtEIBjzKGE+qAAEAAAISMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m # dCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgxNVoXDTI2MTExMzE4 # NDgxNVowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD # VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTAr # BgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEnMCUG # A1UECxMeblNoaWVsZCBUU1MgRVNOOjJEMUEtMDVFMC1EOTQ3MSUwIwYDVQQDExxN # aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEFAAOC # Ag8AMIICCgKCAgEAr0zToDkpWQtsZekS0cV0quDdKSTGkovvBaZH0OAIEi0O3CcO # 77JiX8c4Epq9uibHVZZ1W/LoufE172vkRXO+QYNtWWorECJ2AcZQ10bpAltkhZNi # XlVJ8L3QzhKgrXrmMkm2J+/g81U23JPcO4wXHEftonT3wpd//936rjmwxMm7Nkbs # ygbJf+4AVBMNr4aMPQhBd76od0KMB6WrvyEGOOU0893OFufS5EDey4n44WgaxJE0 # Vnv3/OOvuOw5Kp1KPqjjYJ+L9ywLuBMtcDfLpNQO/h1eFEoMrbiEM67TOfNlXfxb # Dz4MlsYvLioxgd2Xzey1QxrV1+i+JyVDJMiSe9gKOuzpiQQFE19DUPgsidyjLTzX # EhSVLBlRor0eCVf7gC6Rfk8NY3rO2sggOL79vU5FuDKTh/sIOtcUHeHC42jBGB+t # fdKC1KOBR+UlN9aOzg8mpUNI2FgqQvirVP9ppbeMUfvp2wA9voyTiRWvDgzCxo8x # lJ1nscYTHIQrmkF9j/Ca0IDmt8fvOn64nnlJOGUYZYHMC1l0xtgkYTE1ESUqqkaw # Kk7iqbxdnLyycS+dR+zaxPudMDLrQFz8lgfy9obk0D8HC2dzhWpYNn5hdkoPEzgC # qQUOp8v3Qj/sd4anyupe5KoCkjABOP3yhSQ4W9Z+DrJnhM/rbsXC7oTv26cCAwEA # AaOCAUkwggFFMB0GA1UdDgQWBBRSBblSxb5cYKYOwvd/VfoXOfu33jAfBgNVHSME # GDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5odHRw # Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUaW1l # LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsG # AQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01p # Y3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMB # Af8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIHgDAN # BgkqhkiG9w0BAQsFAAOCAgEAXnSAkmX79Rc7lxS1wOozXJ7V0ou5DntVcOJplIkD # jvEN8BIQph4U+gSOLZuVReP/z9YdUiUkcPwL1PM245/kEX1EegpxNc8HDA6hKCHg # 0ALNEcuxnGOlgKLokXfUer1D5hiW8PABM9R+neiteTgPaaRlJFvGTYvotc0uqGiE # S5hMQhL8RNFhpS9RcIWHtnQGEnrdOUvCAhs4FeViawcmLTKv+1870c/MeTHi0QDd # eR+7/Wg4qhkJ2k1iEHJdmYf8rIV0NRBZcdRTTdHee35SXP5neNCfAkjDIuZycRud # 6jzPLCNLiNYzGXBswzJygj4EeSORT7wMvaFuKeRAXoXC3wwYvgIsI1zn3DGY625Y # +yZSi8UNSNHuri36Zv9a+Q4vJwDpYK36S0TB2pf7xLiiH32nk7YK73Rg98W6fZ2I # NuzYzZ7Ghgvfffkj4EUXg1E0EffY1pEqkbpDTP7h/DBqtzoPXsyw2MUh+7yvWcq2 # BGZSuca6CY6X4ioMuc5PWpsmvOOli7ARNA7Ab8kKdCc2gNDLacglsweZEc9/VQB6 # hls/b6Kk32nkwuHExKlaeoSVrKB5U9xlp1+c8J/7GJj4Rw7AiQ8tcp+WmfyD8KxX # 2QlKbDi4SUjnglv4617R8+a/cDWJyaMt8279Wn7f2yMedN7kfGIQ5SZj66RdhdlZ # Oq8wggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3DQEB # CwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD # VQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAxMDAe # Fw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVaMHwxCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5OGm # TOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1V/YBf2xK4OK9uT4XYDP/XE/H # ZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9alKDRLemjkZrBxTzxXb1hlDc # wUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmvHaus9ja+NSZk2pg7uhp7M62A # W36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928jaTjkY+yOSxRnOlwaQ3KNi1w # jjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3tpK56KTesy+uDRedGbsoy1cCG # MFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEeHT39IM9zfUGaRnXNxF803RKJ # 1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26oElHovwUDo9Fzpk03dJQcNIIP # 8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4CvEJoLhDqhFFG4tG9ahhaYQFz # ymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ugpoMhXV8wdJGUlNi5UPkLiWHz # NgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXpsxREdcu+N+VLEhReTwDwV2xo3 # xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0CAwEAAaOCAd0wggHZMBIGCSsG # AQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYEFCqnUv5kxJq+gpE8RjUpzxD/ # LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtTNRnpcjBcBgNVHSAEVTBTMFEG # DCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jvc29m # dC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wEwYDVR0lBAwwCgYIKwYB # BQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMA8G # A1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186aGMQw # VgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9j # cmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsGAQUF # BwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Br # aS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwDQYJKoZIhvcNAQEL # BQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pcFLY+TkdkeLEGk5c9MTO1OdfC # cTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpTTd2YurYeeNg2LpypglYAA7AF # vonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0jVOR4U3UkV7ndn/OOPcbzaN9l # 9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3+SmJw7wXsFSFQrP8DJ6LGYnn # 8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmRsqlb30mjdAy87JGA0j3mSj5m # O0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSwethQ/gpY3UA8x1RtnWN0SCyx # TkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5bRAGOWhmRaw2fpCjcZxkoJLo4 # S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmxaQFEfnyhYWxz/gq77EFmPWn9 # y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsXHRWJjXD+57XQKBqJC4822rpM # +Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0W2rRnj7tfqAxM328y+l7vzhw # RNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0HVUzWLOhcGbyoYIDWTCCAkEC # AQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv # bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0 # aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0 # ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjoyRDFBLTA1RTAtRDk0NzElMCMG # A1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsOAwIa # AxUA5VHBr4h00EN7jUdQ33SE+qbk/8CggYMwgYCkfjB8MQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1T # dGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIFAO3BALYwIhgPMjAyNjA1Mjcw # NTMzNDJaGA8yMDI2MDUyODA1MzM0MlowdzA9BgorBgEEAYRZCgQBMS8wLTAKAgUA # 7cEAtgIBADAKAgEAAgIJlwIB/zAHAgEAAgIT9zAKAgUA7cJSNgIBADA2BgorBgEE # AYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYag # MA0GCSqGSIb3DQEBCwUAA4IBAQBgab6zvLl2oGGQmcDRfOAdPPjqhWxGaFLIPZz0 # PCosMx1fWbHdihEQghDh/ON3FlmQqH8Iyj437agCQkt+S00PoTkfGy7DF0HE1N1v # tiTFWkYekNsUhcQ40r2EvHaQqvLUgM1K0XZ4eHGDZiGdaO4ZFS+1gwnTeOzg79Zf # IBYhFCnYdbIkdFi7qAOGmTqBpOdlwYGmCYX46/mreqTYcPv1Vokr1/ZeZCBo2D+o # o7vIa20zWYyZDLe4yJoiF0V7nnyIVAO/xZ91MIy1xzix6n1baL2Dbi4GGT1/ojKM # HYQUSreWvqng+yIu088DS765Nu18PcqHvAPwCLXM1vUQAcEvMYIEDTCCBAkCAQEw # gZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIS0QgGPMoYT6oA # AQAAAhIwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0B # CRABBDAvBgkqhkiG9w0BCQQxIgQggng1dn2/E83r1mO/knfsvjWWf8BvDZ6sxFZJ # NMGDGkYwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCBz+X5GvO7WngknH4BZ # eYU+BzBL1Jy5oJ8wVlTNIxfYgzCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w # IFBDQSAyMDEwAhMzAAACEtEIBjzKGE+qAAEAAAISMCIEIAzgfnczJ3wqUEJqPiLy # K65LiUMGsJwOXw1ZNKrUorPQMA0GCSqGSIb3DQEBCwUABIICAFy5l/hdl0IPeobX # Z00NeBPe57xNSc4ZnqI7glORg2mZLWan2y14FdKqgA1cJ1+3nWkOm9y+0AUiCrBg # QCZ/hOyuw9EbNiofSwaVqcG4WEwY+zuhZ5XRMyhuPNEQ2O6InwDcDx3gKdR9Pwtg # iylv6Kol6Bv4Hmw652QvZTAGw0BGyQDL0Kn/j+AQfhcljJqEBhJpdVZ+P0AEJDN4 # bRgyLZyUFcwVp6YEBGUyj4ku36pg73GYlTzYFrc07g41u/ghCMS6HwfjIqE1g/Ws # SoJSp50pARKaYankBZfEuAK3wchIrOFtFIlnpeqcbeCu0q8hn4GZ2gNb6mfEv5BN # W+bx+SpwHUH7f4j90KIwOfuheiqdHIlmhr0NzUOz/tZ59+RNpUFPPAguOSauv8CO # nU7/YKjp5CfWdkqR5g80338xIduRGfvLOV+vvQokrVLcDb1lL7Me1R1nAT8NFwbC # 8GQTX13liihbIrZOxIaMOaUYXMr6YmlGrIonz81kNHvjXBUWL9kcA5zMg9+JFA/7 # kiq8Tg9wxznTIPsox1JtJfa6Q0fvlrQ8Ii6eKL+F+IqUboA74k+SluTEl2mw/udL # A1TOy7AQwc5l4GoEbpRCoz9DJQYk6O9Vd2emYpe6gozGEstfkqMEwo1j8OzUHiM8 # vm3G76NiaEIT9wHqfaV3NgNsvDQD # SIG # End signature block |