EntraOps

1.0.0

Public/PrivilegedAccess/Save-EntraOpsPrivilegedEAMEnrichmentToWatchLists.ps1

                                <#

.SYNOPSIS

    Get information of EntraOps Privileged EAM to add related entries to watchlist templates of HighValueAssets, IdentityCorrelation and VIP Users.

.DESCRIPTION

    Get information from EntraOps Privileged EAM to collect content and create the following watchlists:

    - "High Value Assets" - The High Value Assets watchlist lists devices, resources, and other assets that have critical value in the organization, it includes the identified privileged devices from EntraOps and resources from Get-EntraOpsControlObjects.

    - "VIP Users" - The VIP Users watchlist lists user accounts of employees that have high impact value in the organization, it includes the identified privileged users from EntraOps.

    - "Identity Correlation" - The Identity Correlation watchlist lists related user accounts that belong to the same person, it includes the users which has been identified by using custom security attribute to connect privileged and regular work accounts.

.PARAMETER TenantId

    Tenant ID of the Microsoft Entra ID tenant. Default is the current tenant ID.

.PARAMETER SentinelResourceGroupName

    Resource group name of the Microsoft Sentinel workspace.

.PARAMETER SentinelSubscriptionId

    Subscription ID of the Microsoft Sentinel workspace.

.PARAMETER SentinelWorkspaceName

    Name of the Microsoft Sentinel workspace.

.PARAMETER RbacSystems

    Array of RBAC systems to be processed. Default is Azure, EntraID, IdentityGovernance, DeviceManagement, ResourceApps.

    AzureBilling and Defender remain available as explicit opt-in values.

.PARAMETER WatchListTemplates

    Define scope of WatchList templates which should be updated. Default is "All". Supported templates are "VIPUsers", "HighValueAssets", "IdentityCorrelation".

.EXAMPLE

    Save data of EntraOps Privileged EAM insights to WatchList in Microsoft Sentinel Workspace for correlation between work and privileged accounts.

    Save-EntraOpsPrivilegedEAMEnrichmentToWatchLists WatchListTemplates "IdentityCorrelation" -SentinelSubscriptionId "3f72a077-c32a-423c-8503-41b93d3b0737" -SentinelResourceGroupName "EntraOpsResourceGroup" -SentinelWorkspaceName "EntraOpsWorkspace"

#>

function Save-EntraOpsPrivilegedEAMEnrichmentToWatchLists {

    [CmdletBinding()]

    param (

        [Parameter(Mandatory = $false)]

        [ValidateSet("Object", "RoleClassification")]

        [System.String]$UserClassificationSource = "RoleClassification"

        ,

        [Parameter(Mandatory = $false)]

        [System.String]$ImportPath = $DefaultFolderClassifiedEam

        ,

        [Parameter(Mandatory = $True)]

        [System.String]$SentinelResourceGroupName

        ,

        [Parameter(Mandatory = $True)]

        [System.String]$SentinelSubscriptionId

        ,

        [Parameter(Mandatory = $True)]

        [System.String]$SentinelWorkspaceName

        ,

        [Parameter(Mandatory = $false)]

        [ValidateSet("Azure", "AzureBilling", "EntraID", "IdentityGovernance", "DeviceManagement", "ResourceApps", "Defender")]

        [object]$RbacSystems = ("Azure", "EntraID", "IdentityGovernance", "DeviceManagement", "ResourceApps")

        ,

        [Parameter(Mandatory = $False)]

        [ValidateSet("None", "All", "VIPUsers", "HighValueAssets", "IdentityCorrelation")]

        [object]$WatchListTemplates = "All"

    )

    # --- Path safety: ensure ImportPath is under the expected base directory ---

    $ResolvedImportPath = [System.IO.Path]::GetFullPath($ImportPath)

    $ResolvedBaseFolder = [System.IO.Path]::GetFullPath($EntraOpsBaseFolder)

    if (-not (Test-EntraOpsPathWithinRoot -Path $ImportPath -Root $EntraOpsBaseFolder -AllowRoot)) {

        throw "Security check failed: ImportPath '$ResolvedImportPath' is not under the expected base directory '$ResolvedBaseFolder'."

    }

    try {

        Import-Module "SentinelEnrichment" -ErrorAction Stop

    } catch {

        throw "Issue to import SentinelEnrichment modul!"

    }

    #region EntraOps Classification data

    $Privileges = foreach ($Rbac in $RbacSystems) {

        try {

            Get-Content -Path "$($ImportPath)/$($Rbac)/$($Rbac).json" -ErrorAction Stop | ConvertFrom-Json -Depth 10

        } catch {

            Write-Warning "No information found for $Rbac in file $($ImportPath)/$($Rbac)/$($Rbac).json"

            continue

        }

    }

    #endregion

    #region VIP Users

    if ($WatchListTemplates -eq "All" -or $WatchListTemplates -contains "VIPUsers") {

        $WatchListName = "VIP Users"

        $WatchListAlias = "VIPUsers"

        function Get-VIPUsers {

            $NewVipUserWatchlistItems = New-Object System.Collections.ArrayList

            Write-Host "Collecting data for VIPUsers"

            $PrivilegedUsers = $Privileges | Where-Object { $_.ObjectType -eq "user" } | Select-Object -unique ObjectId, ObjectUserPrincipalName, ObjectAdminTierLevelName

            foreach ($PrivilegedUser in $PrivilegedUsers) {

                $OnPremSid = Invoke-EntraOpsMsGraphQuery -Method Get -Uri "/v1.0/users/$($PrivilegedUser.ObjectId)?`$select=onPremisesSecurityIdentifier"

                # Set tags

                $Tags = New-Object System.Collections.ArrayList

                $Tags.Add("EntraOps") | Out-Null

                $Tags.Add("Automated Enrichment") | Out-Null

                if ($UserClassificationSource -eq "Object") {

                    # Get classification by custom security attribute of the privileged user

                    $Classification = ($Privileges | Where-Object { $_.ObjectId -eq $PrivilegedUser.ObjectId } | Select-Object -Unique ObjectAdminTierLevelName)[0]

                    $Tags.Add($($Classification.AdminTierLevelName)) | Out-Null

                } else {

                    # Get highest classification by assigned roles

                    $Classification = ($Privileges | Where-Object { $_.ObjectId -eq $PrivilegedUser.ObjectId } | Select-Object -ExpandProperty Classification | Sort-Object AdminTierLevel | Select-Object AdminTierLevelName)[0]

                    $Tags.Add($($Classification.AdminTierLevelName)) | Out-Null

                }

                # Check if privileged user object has been classified and is different to role classification

                if ($null -ne $PrivilegedUser.ObjectAdminTierLevelName -and $PrivilegedUser.ObjectAdminTierLevelName -ne $Classification.AdminTierLevelName) {

                    $Tags.Add("TierBreach") | Out-Null

                }

                $CurrentItem = @{

                    "User Identifier"     = $PrivilegedUser.ObjectId

                    "User AAD Object Id"  = $PrivilegedUser.ObjectId

                    "User On-Prem Sid"    = $OnPremSid.onPremisesSecurityIdentifier

                    "User Principal Name" = $PrivilegedUser.ObjectUserPrincipalName

                    "Tags"                = $Tags

                }

                $NewVipUserWatchlistItems.Add( $CurrentItem ) | Out-Null

            }

            return $NewVipUserWatchlistItems

        }

        $NewWatchlistItems = New-Object System.Collections.ArrayList

        $NewWatchlistItems = Get-VIPUsers

        Write-Verbose "Write information to watchlist: $WatchListName"

        if ( $null -ne $NewWatchlistItems ) {

            $SearchKey = "User Identifier"

            $Parameters = @{

                SearchKey         = $SearchKey

                DisplayName       = $WatchListName

                WatchListAlias    = $WatchListAlias

                NewWatchlistItems = $NewWatchlistItems

                SubscriptionId    = $SentinelSubscriptionId

                ResourceGroupName = $SentinelResourceGroupName

                WorkspaceName     = $SentinelWorkspaceName

                OverrideTags      = $true

                Identifiers       = @("EntraOps", "Automated Enrichment")

            }

            Edit-GkSeAzSentinelWatchlist @Parameters

        }

    }

    #endregion

    #region Identity Correlation

    if ($WatchListTemplates -eq "All" -or $WatchListTemplates -contains "IdentityCorrelation") {

        $WatchListName = "Identity Correlation"

        $WatchListAlias = "IdentityCorrelation"

        function Get-IdentityCorrelation {

            $NewIdentityCorrelationWatchlistItems = New-Object System.Collections.ArrayList

            Write-Host "Collecting data for IdentityCorrelation"

            $PrivilegedUsers = $Privileges | Where-Object { $_.ObjectType -eq "user" } | Select-Object -unique ObjectId, AssociatedWorkAccount, ObjectUserPrincipalName, ObjectAdminTierLevelName

            $AssociatedWorkAccounts = $PrivilegedUsers | Select-Object -ExpandProperty AssociatedWorkAccount | Select-Object -Unique

            foreach ($AssociatedWorkAccount in $AssociatedWorkAccounts) {

                $WorkAccountDetails = Invoke-EntraOpsMsGraphQuery -Method Get -Uri "/v1.0/users/$($AssociatedWorkAccount)?`$select=id,userPrincipalName,onPremisesSecurityIdentifier,mail,employeeId"

                $AssociatedPrivilegedUsers = $PrivilegedUsers | Where-Object { $_.AssociatedWorkAccount -eq $AssociatedWorkAccount } | Select-Object -unique ObjectId, ObjectUserPrincipalName, ObjectAdminTierLevelName

                foreach ($AssociatedPrivilegedUser in $AssociatedPrivilegedUsers) {

                    # Set tags

                    $Tags = New-Object System.Collections.ArrayList

                    $Tags.Add("EntraOps") | Out-Null

                    $Tags.Add("Automated Enrichment") | Out-Null

                    if ($UserClassificationSource -eq "Object") {

                        # Get classification by custom security attribute of the privileged user

                        $Classification = ($Privileges | Where-Object { $_.ObjectId -eq $AssociatedPrivilegedUser.ObjectId } | Select-Object -Unique ObjectAdminTierLevelName)[0]

                        $Tags.Add($($Classification.AdminTierLevelName)) | Out-Null

                    } else {

                        # Get highest classification by assigned roles

                        $Classification = ($Privileges | Where-Object { $_.ObjectId -eq $AssociatedPrivilegedUser.ObjectId } | Select-Object -ExpandProperty Classification | Sort-Object AdminTierLevel | Select-Object AdminTierLevelName)[0]

                        $Tags.Add($($Classification.AdminTierLevelName)) | Out-Null

                    }

                    $CurrentItem = @{

                        "User Identifier"                  = $WorkAccountDetails.id

                        "User AAD Object Id"               = $WorkAccountDetails.id

                        "User On-Prem Sid"                 = $WorkAccountDetails.onPremisesSecurityIdentifier

                        "User Principal Name"              = $WorkAccountDetails.userPrincipalName

                        "Employee Id"                      = $WorkAccountDetails.employeeId

                        "Email"                            = $WorkAccountDetails.mail

                        "Associated Privileged Account ID" = $AssociatedPrivilegedUser.ObjectId

                        "Associated Privileged Account"    = $AssociatedPrivilegedUser.ObjectUserPrincipalName

                        "Tags"                             = $Tags

                    }

                    $NewIdentityCorrelationWatchlistItems.Add( $CurrentItem ) | Out-Null

                }

            }

            return $NewIdentityCorrelationWatchlistItems

        }

        $NewWatchlistItems = New-Object System.Collections.ArrayList

        $NewWatchlistItems = Get-IdentityCorrelation

        Write-Verbose "Write information to watchlist: $WatchListName"

        if ( $null -ne $NewWatchlistItems ) {

            $SearchKey = "Associated Privileged Account ID"

            $Parameters = @{

                SearchKey         = $SearchKey

                DisplayName       = $WatchListName

                WatchListAlias    = $WatchListAlias

                NewWatchlistItems = $NewWatchlistItems

                SubscriptionId    = $SentinelSubscriptionId

                ResourceGroupName = $SentinelResourceGroupName

                WorkspaceName     = $SentinelWorkspaceName

                Identifiers       = @("EntraOps", "Automated Enrichment")

                OverrideTags      = $true

            }

            Edit-GkSeAzSentinelWatchlist @Parameters

        }

    }

    #endregion

    #region High Value Assets

    if ($WatchListTemplates -eq "All" -or $WatchListTemplates -contains "HighValueAssets") {

        $WatchListName = "High Value Assets"

        $WatchListAlias = "HighValueAssets"

        function Get-HighValueAssets {

            Write-Host "Collecting data for High Value Assets"

            $HighValueAssets = @()

            $DeviceQuery = 'ExposureGraphNodes

            | where isnotnull(NodeProperties.rawData.criticalityLevel) and (NodeProperties.rawData.criticalityLevel.criticalityLevel <1)

            | where (NodeLabel == "device")

            | extend "Asset Type" == "Device"

            | mv-apply EntityIds = parse_json(EntityIds) on

                (

                where EntityIds.type =~ "DeviceInventoryId"

                | extend

                    DeviceId = tostring(EntityIds.DeviceInventoryId)

                )

            | extend DeviceId = tostring(parse_json(EntityIds).id)

            | project ["AssetType"] = "Device",

                    ["AssetId"] = DeviceId,

                    ["AssetFQDN"] = NodeName,                    

                    ["AssetName"] = NodeName,

                    ["Tags"] = parse_json(NodeProperties).rawData.criticalityLevel.ruleNames;'

            $Body = @{

                "Query" = $DeviceQuery;

            } | ConvertTo-Json

            $Devices = (Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/security/runHuntingQuery" -Body $Body -OutputType PSObject).results

            $HighValueAssets += $Devices

            $AzureResourceQuery = 'ExposureGraphNodes

            | where isnotnull(NodeProperties.rawData.criticalityLevel) and (NodeProperties.rawData.environmentName == "Azure")

            | mv-apply EntityIds = parse_json(EntityIds) on

                (

                where EntityIds.type =~ "AzureResourceId"

                | extend

                    ResourceId = tostring(EntityIds.AzureResourceId)

                )

            | extend AzureResourceId = tostring(parse_json(EntityIds).id)

            | extend IpAddresses = parse_json(NodeProperties).rawData.networkingComponentMetadata.ipAddresses

            | project ["AssetType"] = "Azure resource",

                    ["AssetId"] = AzureResourceId,

                    ["AssetFQDN"] = NodeName,

                    ["AssetName"] = NodeName,

                    ["IPAddress"] = IpAddresses,

                    ["Tags"] = parse_json(NodeProperties).rawData.criticalityLevel.ruleNames'

            $Body = @{

                "Query" = $AzureResourceQuery;

            } | ConvertTo-Json

            $AzureResources = (Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/security/runHuntingQuery" -Body $Body -OutputType PSObject).results

            $HighValueAssets += $AzureResources

            $NewHighValueAssetWatchlistItems = New-Object System.Collections.ArrayList

            foreach ($HighValueAsset in $HighValueAssets) {

                $Tags = New-Object System.Collections.ArrayList

                $Tags.Add("EntraOps") | Out-Null

                $Tags.Add("XSPM") | Out-Null

                $Tags.Add("Automated Enrichment") | Out-Null

                foreach ($Tag in $HighValueAsset.Tags) {

                    $Tags.Add( $Tag ) | Out-Null

                }

                $CurrentItem = @{

                    "Asset Type" = $HighValueAsset.AssetType

                    "Asset Id"   = $HighValueAsset.AssetId

                    "Asset Name" = $HighValueAsset.AssetName

                    "Asset FQDN" = $HighValueAsset.AssetFQDN

                    "IP Address" = $HighValueAsset.IPAddress | ConvertTo-Json -Compress -AsArray

                    "Tags"       = $Tags

                }

                $NewHighValueAssetWatchlistItems.Add( $CurrentItem ) | Out-Null

            }

            return $NewHighValueAssetWatchlistItems

        }

        $NewWatchlistItems = New-Object System.Collections.ArrayList

        $NewWatchlistItems = Get-HighValueAssets

        Write-Verbose "Write information to watchlist: $WatchListName"

        if ( $null -ne $NewWatchlistItems ) {

            $SearchKey = "Asset Id"

            $Parameters = @{

                SearchKey         = $SearchKey

                DisplayName       = $WatchListName

                WatchListAlias    = $WatchListAlias

                NewWatchlistItems = $NewWatchlistItems

                SubscriptionId    = $SentinelSubscriptionId

                ResourceGroupName = $SentinelResourceGroupName

                WorkspaceName     = $SentinelWorkspaceName

                Identifiers       = @("EntraOps", "Automated Enrichment")

                OverrideTags      = $true

            }

            Edit-GkSeAzSentinelWatchlist @Parameters

        }

    }

    #endregion

}

# SIG # Begin signature block

# MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCMeTkozV0kgd/i

# SwfWu4J6F3bt3CdDsW4SiUN15npSyaCCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j

# AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK

# ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy

# dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l

# dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG

# A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl

# BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb

# Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC

# 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va

# qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ

# 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet

# /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe

# GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV

# WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl

# s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb

# MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc

# noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl

# jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA

# AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8

# +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud

# DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w

# bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v

# c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np

# dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG

# CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM

# BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1

# BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR

# mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl

# lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs

# NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv

# n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC

# XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB

# c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp

# Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ

# MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ

# BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy

# MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt

# MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A

# DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg

# HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet

# 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr

# onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl

# 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc

# 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt

# 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9

# cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM

# BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu

# Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr

# BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB

# BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy

# MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH

# MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3

# AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG

# A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF

# AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1

# DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea

# P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN

# F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk

# 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs

# thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x

# GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr

# z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo

# qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR

# qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc

# w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD

# AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT

# AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT

# G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z

# NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0

# YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC

# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO

# STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF

# snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw

# NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9

# eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O

# E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP

# +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8

# MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx

# cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm

# x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J

# qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he

# Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI

# KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj

# YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC

# MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv

# Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E

# BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O

# BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb

# rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L

# xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL

# RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z

# J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY

# Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj

# vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT

# j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT

# j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb

# aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy

# g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz

# pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK

# JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG

# A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt

# IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl

# ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW

# MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu

# MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG

# SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r

# Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52

# NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q

# gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX

# IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx

# F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj

# zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad

# PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t

# 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl

# ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK

# mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH

# mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU

# 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc

# ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud

# HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI

# KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0

# dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv

# Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0

# cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q

# KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3

# Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL

# qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY

# zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb

# QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI

# P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS

# WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/

# DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8

# X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh

# o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q

# EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO

# S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE

# ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl

# cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO

# ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw

# CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw

# IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3

# DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4

# YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W

# ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz

# Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv

# 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x

# 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg

# WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a

# cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf

# SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg

# zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV

# ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z

# EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC

# L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6

# Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp

# MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB

# BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru

# Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov

# L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH

# CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli

# G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f

# KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee

# hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4

# FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9

# sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E

# hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh

# oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf

# 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF

# 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA

# Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC

# UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb

# Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G

# CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI

# hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC

# ARUwLwYJKoZIhvcNAQkEMSIEIGPJ+7PrtHq98ZJZR8qhVwFNc764QzxP//0GUdfC

# H+cRMA0GCSqGSIb3DQEBAQUABIIBgJXSVMt9+h0IBmKoPzLL/zesRfiJ6BAhXvgb

# 2vRSjNcrWXs8/mSI9htAV9/Tc6wMcIiqpiwk2rgboDP2/MQCKMu9VPA/utIQqwyu

# 7h+CcceFkDpt5tJKIlCKid/yRv+TM2Rp7gafFGd0HNZQY5vP0ufRGTcd32UNxL0S

# 95HOsfgsyiqdZJc7n2Q4ohIUdTflZcvEECqD9On9x/MpI3CGNdtx93OGeHXBZwFC

# Rfvd7V6/kR6QmL84byIRPYQVulK/AF3XxQK2hYVQPnHYRhB8zJcTCdZ3uhDwv/Br

# lKYsTdyVNInMUvlyT1X+kEmOuUFLJh9D1FSmo6dJxbYGc/Wlw+sjgsY7jK1Jj+WZ

# uiAcu39ytMP/Md5GZ07gluc6xs4Wr4ad2K8A/A2XmmexbZbrTydWluG/o1L2ls4N

# tPDHBFOilUiD6V+t1LuV7ZPkSHxB6DkybE6+KnMAv19azsTfJAhVGOAFjaV2vILW

# cc+U/AnuyTxTmy6YwSd9lCruaSfu8KGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID

# 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0

# ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ

# KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD

# MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQxMzRaMDcG

# CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY

# 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDD6qFEWYFjvwUPhbdbBG0CQeA4XBY6DtDLd

# SIrWtlgzebkpC3l/daJECAo6Vo9GvRYwgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ

# MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh

# MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0

# dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI

# hvcNAQEBBQAEggIAbAI5sTxl+vay1gPCIYGZN2pMXc9Wau4n+FRfo8j3oL3zuqdc

# WEiN6AyQRNzFgm7t6aF/hbdaNBA6e3b3FAWbK2yVrDrlpc+Kp7OqCqeoRB00UXDU

# vrWQioj9E+OksxNiEzj4CrdhWEF/B/Dwbd9DfZFRUPBp9Wi3r4JpENPhnshAsQ+Z

# 0KGoUsuB7glS3Ifgvpkb+MDRFXBAvi3KgFAAIh+H8zNWDVBRClfFyl5o9JI2XNSZ

# rhLcwfNuo/In5P4RSxHcZLcNNFLNq6xDkuMtBXvaOw/R14mveHCxBjThOcoAlhv+

# EqbhJExhVPdbhx9hdfb5AjOcFzzf2zCMbxDz3DsSZqZL8j5sLYyvEFWSjvt0qTJJ

# 90C70GMOkOMms02Y8/ltea0FBG2I4Aax4p4AN2wztfbX2W3nhmsMg6KOMFGHmHve

# h5iOiWQmzz50zxZlG9q+T3TYw8BZ+x8o84zwoSN7OON9W+UpqA0hM/wIyqQ1QdHe

# Ptd78YITsqZryFIUlml+6XE0OD1JiM1AGmWbP+fPQ4IvAJp0dmrAjUEUushrHToY

# 1DQZlWr2KJj75FNVMwBiAQC/vGrsUCtG0aVOkvnEmkpXzEgXQiLR+oQG+XcKmA3N

# lFznwh2BHHSdbpNDNBX6coGGMQAyl8RWdsqGsEMQK4H2Bn3smZCt5V8gxCk=

# SIG # End signature block