Public/PrivilegedAccess/Save-EntraOpsPrivilegedEAMWatchLists.ps1
|
<# .SYNOPSIS Save Privileged EAM classification from EntraOps as WatchList. .DESCRIPTION Get information from EntraOps about classification based on Enterprise Access Model and save it as WatchList in Microsoft Sentinel. .PARAMETER ImportPath Folder where the classification files should be stored. Default is ./PrivilegedEAM. .PARAMETER ExportFolder Folder where the local WatchList CSV files should be written. Default is the current working directory. .PARAMETER SentinelSubscriptionId Subscription ID of the Microsoft Sentinel workspace. Required unless SkipUploadSaveLocal is set. .PARAMETER SentinelResourceGroupName Resource group name of the Microsoft Sentinel workspace. Required unless SkipUploadSaveLocal is set. .PARAMETER SentinelWorkspaceName Name of the Microsoft Sentinel workspace. Required unless SkipUploadSaveLocal is set. .PARAMETER WatchListPrefix Prefix for all WatchLists wihich will be created by this cmldet. Default is EntraOps_. .PARAMETER WatchListTemplates Type of WatchLists to be created. Default is None. Possible values are All, VIPUsers, HighValueAssets, IdentityCorrelation. .PARAMETER WatchListWorkloadIdentity Type of WatchLists to be created. Default is None. Possible values are All, ManagedIdentityAssignedResourceId, WorkloadIdentityAttackPaths, WorkloadIdentityInfo, WorkloadIdentityRecommendations. .PARAMETER RbacSystems Array of RBAC systems to be processed. Default is Azure, EntraID, IdentityGovernance, DeviceManagement, ResourceApps. AzureBilling and Defender remain available as explicit opt-in values. .PARAMETER SkipUploadSaveLocal Skip upload to Sentinel and save WatchList locally. Default is false. .EXAMPLE Save data of EntraOps Privileged EAM insights to WatchList in Microsoft Sentinel Workspace defined in parameter. Save-EntraOpsPrivilegedEAMWatchLists -SentinelSubscriptionId "3f72a077-c32a-423c-8503-41b93d3b0737" -SentinelResourceGroupName "EntraOpsResourceGroup" -SentinelWorkspaceName "EntraOpsWorkspace" .EXAMPLE Save data of EntraOps Privileged EAM insights to WatchList in Microsoft Sentinel Workspace defined in config file and available in global variable. $SentinelWatchListsParams = $EntraOpsConfig.SentinelWatchLists Save-EntraOpsPrivilegedEAMWatchLists @SentinelWatchListsParams #> function Save-EntraOpsPrivilegedEAMWatchLists { [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [System.String]$ImportPath = $DefaultFolderClassifiedEam , [Parameter(Mandatory = $false)] [System.String]$ExportFolder = $PWD , [Parameter(Mandatory = $false)] [System.String]$SentinelSubscriptionId , [Parameter(Mandatory = $false)] [System.String]$SentinelResourceGroupName , [Parameter(Mandatory = $false)] [System.String]$SentinelWorkspaceName , [Parameter(Mandatory = $false)] [System.String]$WatchListPrefix = "EntraOps_" , [Parameter(Mandatory = $false)] [ValidateSet("Azure", "AzureBilling", "EntraID", "IdentityGovernance", "DeviceManagement", "ResourceApps", "Defender")] [object]$RbacSystems = ("Azure", "EntraID", "IdentityGovernance", "DeviceManagement", "ResourceApps") , [Parameter(Mandatory = $False)] [ValidateSet("None", "All", "VIPUsers", "HighValueAssets", "IdentityCorrelation")] [object]$WatchListTemplates = "None" , [Parameter(Mandatory = $False)] [ValidateSet("None", "ManagedIdentityAssignedResourceId", "All", "WorkloadIdentityAttackPaths", "WorkloadIdentityInfo", "WorkloadIdentityRecommendations")] [object]$WatchListWorkloadIdentity = "None" , [Parameter(Mandatory = $False)] [boolean]$SkipUploadSaveLocal = $false ) # --- Path safety: ensure ImportPath is under the expected base directory --- $ResolvedImportPath = [System.IO.Path]::GetFullPath($ImportPath) $ResolvedBaseFolder = [System.IO.Path]::GetFullPath($EntraOpsBaseFolder) if (-not (Test-EntraOpsPathWithinRoot -Path $ImportPath -Root $EntraOpsBaseFolder -AllowRoot)) { throw "Security check failed: ImportPath '$ResolvedImportPath' is not under the expected base directory '$ResolvedBaseFolder'." } # --- Ensure ExportFolder exists so local WatchList CSVs have somewhere to land --- $ResolvedExportFolder = [System.IO.Path]::GetFullPath($ExportFolder) if (-not (Test-Path -LiteralPath $ResolvedExportFolder)) { try { New-Item -ItemType Directory -Path $ResolvedExportFolder -Force -ErrorAction Stop | Out-Null } catch { throw "Failed to create ExportFolder '$ResolvedExportFolder': $($_.Exception.Message)" } } if ( -not $SkipUploadSaveLocal ) { if ([string]::IsNullOrEmpty($SentinelSubscriptionId) -or [string]::IsNullOrEmpty($SentinelResourceGroupName) -or [string]::IsNullOrEmpty($SentinelWorkspaceName)) { throw "SentinelSubscriptionId, SentinelResourceGroupName and SentinelWorkspaceName are required when SkipUploadSaveLocal is not set." } Install-EntraOpsRequiredModule -ModuleName SentinelEnrichment } $NewPrincipalsWatchlistItems = New-Object System.Collections.ArrayList $NewRoleAssignmentsWatchlistItems = New-Object System.Collections.ArrayList $NewRoleAssignmentClassificationsWatchlistItems = New-Object System.Collections.ArrayList $SeenClassificationUniqueIds = [System.Collections.Generic.HashSet[string]]::new() foreach ($Rbac in $RbacSystems) { try { $Privileges = Get-Content -Path "$($ImportPath)/$($Rbac)/$($Rbac).json" -ErrorAction Stop | ConvertFrom-Json -Depth 10 } catch { Write-Warning "No information found for $Rbac in file $($ImportPath)/$($Rbac)/$($Rbac).json" continue } if ( ![string]::IsNullOrEmpty($Privileges) ) { foreach ( $Privilege in $Privileges) { $CurrentPrincipalItem = [PSCustomObject]@{ "ObjectId" = $Privilege.ObjectId "ObjectTenantId" = $Privilege.ObjectTenantId "ObjectType" = $Privilege.ObjectType "ObjectSubType" = $Privilege.ObjectSubType "ObjectDisplayName" = $Privilege.ObjectDisplayName "ObjectUserPrincipalName" = $Privilege.ObjectUserPrincipalName "ObjectAdminTierLevel" = $Privilege.ObjectAdminTierLevel "ObjectAdminTierLevelName" = $Privilege.ObjectAdminTierLevelName "OnPremSynchronized" = $Privilege.OnPremSynchronized "AssignedAdministrativeUnits" = $Privilege.AssignedAdministrativeUnits | ConvertTo-Json -Depth 10 -Compress -AsArray "RestrictedManagementByRAG" = $Privilege.RestrictedManagementByRAG -eq $true "RestrictedManagementByAadRole" = $Privilege.RestrictedManagementByAadRole -eq $true "RestrictedManagementByRMAU" = $Privilege.RestrictedManagementByRMAU -eq $True "RoleSystem" = $Rbac # Principal-level KQL filters consume only this unique tier and service summary. # Classification evidence is represented separately at role-assignment granularity below. "Classification" = $Privilege.Classification | Select-Object AdminTierLevel, AdminTierLevelName, Service | Sort-Object AdminTierLevel, AdminTierLevelName, Service -Unique | ConvertTo-Json -Depth 10 -Compress -AsArray "Owners" = $Privilege.Owners | ConvertTo-Json -Depth 10 -Compress -AsArray "Sponsors" = $Privilege.Sponsors | ConvertTo-Json -Depth 10 -Compress -AsArray "OwnedObjects" = $Privilege.OwnedObjects | ConvertTo-Json -Depth 10 -Compress -AsArray "OwnedDevices" = $Privilege.OwnedDevices | ConvertTo-Json -Depth 10 -Compress -AsArray "IdentityParent" = $Privilege.IdentityParent "AssociatedWorkAccount" = $Privilege.AssociatedWorkAccount | ConvertTo-Json -Depth 10 -Compress -AsArray "AssociatedPawDevice" = $Privilege.AssociatedPawDevice | ConvertTo-Json -Depth 10 -Compress -AsArray "Tags" = @("$($Rbac)", "Privileged Principal", "Automated Enrichment") | ConvertTo-Json -Depth 10 -Compress "UniqueId" = "$($Privilege.ObjectId)-$($Rbac)" } $NewPrincipalsWatchlistItems.Add( $CurrentPrincipalItem ) | Out-Null foreach ( $RoleAssignment in $Privilege.RoleAssignments) { # Extract classification into separate watchlist to avoid 10 KB item limit $RoleAssignmentClassifications = $RoleAssignment.Classification if ($null -ne $RoleAssignmentClassifications) { foreach ($ClassificationItem in $RoleAssignmentClassifications) { $ClassificationUniqueId = "$($RoleAssignment.RoleAssignmentId)_$($ClassificationItem.AdminTierLevelName)_$($ClassificationItem.Service)" if (-not $SeenClassificationUniqueIds.Add($ClassificationUniqueId)) { continue } $ClassificationWatchlistItem = [PSCustomObject]@{ "RoleAssignmentId" = $RoleAssignment.RoleAssignmentId "RoleAssignmentScopeId" = $RoleAssignment.RoleAssignmentScopeId "RoleDefinitionName" = $RoleAssignment.RoleDefinitionName "RoleDefinitionId" = $RoleAssignment.RoleDefinitionId "RoleSystem" = $Rbac "AdminTierLevel" = $ClassificationItem.AdminTierLevel "AdminTierLevelName" = $ClassificationItem.AdminTierLevelName "Service" = $ClassificationItem.Service "TaggedBy" = $ClassificationItem.TaggedBy "TaggedByObjectIds" = $ClassificationItem.TaggedByObjectIds | ConvertTo-Json -Depth 10 -Compress -AsArray "TaggedByObjectDisplayNames" = $ClassificationItem.TaggedByObjectDisplayNames | ConvertTo-Json -Depth 10 -Compress -AsArray "TaggedByRoleSystem" = $ClassificationItem.TaggedByRoleSystem "Tags" = @("$($Rbac)", "RoleClassification", "Automated Enrichment") | ConvertTo-Json -Depth 10 -Compress -AsArray "UniqueId" = $ClassificationUniqueId } $NewRoleAssignmentClassificationsWatchlistItems.Add($ClassificationWatchlistItem) | Out-Null } } # Remove Classification from RoleAssignment to reduce watchlist item size $RoleAssignment.PSObject.Properties.Remove("Classification") if ($null -eq $RoleAssignment.TransitiveByObjectId ) { $RoleAssignment | Add-Member -MemberType NoteProperty -Name "UniqueId" -Value "$($RoleAssignment.RoleAssignmentId)_$($RoleAssignment.PrincipalId)" -Force } else { $RoleAssignment | Add-Member -MemberType NoteProperty -Name "UniqueId" -Value "$($RoleAssignment.RoleAssignmentId)_$($RoleAssignment.PrincipalId)_$($RoleAssignment.TransitiveByObjectId)" -Force } $TagValue = @("$($Rbac)", "Role Assignment", "Automated Enrichment") | ConvertTo-Json -Depth 10 -Compress -AsArray $RoleAssignment | Add-Member -MemberType NoteProperty -Name "RoleSystem" -Value $Rbac -Force $RoleAssignment | Add-Member -MemberType NoteProperty -Name "Tags" -Value $TagValue -Force if ($RoleAssignment.PSObject.Properties.Match('TransitiveByNestingObjectDisplayNames').Count -gt 0) { $RoleAssignment.TransitiveByNestingObjectDisplayNames = $RoleAssignment.TransitiveByNestingObjectDisplayNames | ConvertTo-Json -Depth 10 -Compress -AsArray } if ($RoleAssignment.PSObject.Properties.Match('TransitiveByNestingObjectIds').Count -gt 0) { $RoleAssignment.TransitiveByNestingObjectIds = $RoleAssignment.TransitiveByNestingObjectIds | ConvertTo-Json -Depth 10 -Compress -AsArray } $NewRoleAssignmentsWatchlistItems.Add( $RoleAssignment ) | Out-Null } } } } if ( $NewPrincipalsWatchlistItems.Count -gt 0 ) { $WatchListName = "$($WatchListPrefix)Principals" Write-Output "Write information to watchlist: $WatchListName" $WatchListPath = Join-Path $ResolvedExportFolder "$($WatchListName).csv" $NewPrincipalsWatchlistItems | Sort-Object ObjectDisplayName | Export-Csv -Path $WatchListPath -NoTypeInformation -Encoding utf8 -Delimiter "," $Parameters = @{ WatchListFilePath = $WatchListPath DisplayName = $WatchListName itemsSearchKey = "UniqueId" SubscriptionId = $SentinelSubscriptionId ResourceGroupName = $SentinelResourceGroupName WorkspaceName = $SentinelWorkspaceName DefaultDuration = "P14D" ReplaceExistingWatchlist = $true } if ( -not $SkipUploadSaveLocal ) { New-GkSeAzSentinelWatchlist @Parameters -Verbose $null = Test-EntraOpsSentinelWatchlistDeployment -SubscriptionId $SentinelSubscriptionId -ResourceGroupName $SentinelResourceGroupName -WorkspaceName $SentinelWorkspaceName -WatchListName $WatchListName -ExpectedItemCount $NewPrincipalsWatchlistItems.Count -WatchListFilePath $WatchListPath Remove-Item -Path $WatchListPath -Force } } if ( $NewRoleAssignmentsWatchlistItems.Count -gt 0 ) { $WatchListName = "$($WatchListPrefix)RoleAssignments" Write-Output "Write information to watchlist: $WatchListName" $WatchListPath = Join-Path $ResolvedExportFolder "$($WatchListName).csv" $NewRoleAssignmentsWatchlistItems | Sort-Object AdminTierLevel, RoleSystem, ObjectDisplayName | Export-Csv -Path $WatchListPath -NoTypeInformation -Encoding utf8 -Delimiter "," $Parameters = @{ WatchListFilePath = $WatchListPath DisplayName = $WatchListName itemsSearchKey = "UniqueId" SubscriptionId = $SentinelSubscriptionId ResourceGroupName = $SentinelResourceGroupName WorkspaceName = $SentinelWorkspaceName DefaultDuration = "P14D" ReplaceExistingWatchlist = $true } if ( -not $SkipUploadSaveLocal ) { New-GkSeAzSentinelWatchlist @Parameters -Verbose $null = Test-EntraOpsSentinelWatchlistDeployment -SubscriptionId $SentinelSubscriptionId -ResourceGroupName $SentinelResourceGroupName -WorkspaceName $SentinelWorkspaceName -WatchListName $WatchListName -ExpectedItemCount $NewRoleAssignmentsWatchlistItems.Count -WatchListFilePath $WatchListPath Remove-Item -Path $WatchListPath -Force } } if ( $NewRoleAssignmentClassificationsWatchlistItems.Count -gt 0 ) { $WatchListName = "$($WatchListPrefix)RoleClassifications" Write-Output "Write information to watchlist: $WatchListName" $WatchListPath = Join-Path $ResolvedExportFolder "$($WatchListName).csv" $NewRoleAssignmentClassificationsWatchlistItems | Sort-Object AdminTierLevel, Service | Export-Csv -Path $WatchListPath -NoTypeInformation -Encoding utf8 -Delimiter "," $Parameters = @{ WatchListFilePath = $WatchListPath DisplayName = $WatchListName itemsSearchKey = "UniqueId" SubscriptionId = $SentinelSubscriptionId ResourceGroupName = $SentinelResourceGroupName WorkspaceName = $SentinelWorkspaceName DefaultDuration = "P14D" ReplaceExistingWatchlist = $true } if ( -not $SkipUploadSaveLocal ) { New-GkSeAzSentinelWatchlist @Parameters -Verbose $null = Test-EntraOpsSentinelWatchlistDeployment -SubscriptionId $SentinelSubscriptionId -ResourceGroupName $SentinelResourceGroupName -WorkspaceName $SentinelWorkspaceName -WatchListName $WatchListName -ExpectedItemCount $NewRoleAssignmentClassificationsWatchlistItems.Count -WatchListFilePath $WatchListPath Remove-Item -Path $WatchListPath -Force } } if ($WatchListTemplates -notcontains "None") { $Parameters = @{ SentinelSubscriptionId = $SentinelSubscriptionId SentinelResourceGroupName = $SentinelResourceGroupName SentinelWorkspaceName = $SentinelWorkspaceName WatchListTemplates = $WatchListTemplates RbacSystems = $RbacSystems } if ( -not $SkipUploadSaveLocal ) { Save-EntraOpsPrivilegedEAMEnrichmentToWatchLists @Parameters } } if ($WatchListWorkloadIdentity -notcontains "None") { $Parameters = @{ SentinelSubscriptionId = $SentinelSubscriptionId SentinelResourceGroupName = $SentinelResourceGroupName SentinelWorkspaceName = $SentinelWorkspaceName WatchLists = $WatchListWorkloadIdentity } if ( -not $SkipUploadSaveLocal ) { Save-EntraOpsWorkloadIdentityEnrichmentWatchLists @Parameters } } } # SIG # Begin signature block # MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCA7wwQlDI+zlqsw # ZicrZ16dv+0sapSgd+qvwbxt9nmJLaCCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j # AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK # ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy # dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l # dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG # A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl # BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb # Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC # Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC # 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va # qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ # 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet # /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe # GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV # WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl # s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb # MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc # noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl # jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA # AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8 # +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud # DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w # bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v # c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np # dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG # CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM # BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1 # BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR # mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl # lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs # NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv # n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC # XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB # c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp # Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ # MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ # BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy # MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt # MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A # DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg # HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet # 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr # onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl # 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc # 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt # 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9 # cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM # BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu # Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr # BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB # BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy # MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH # MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3 # AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG # A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF # AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1 # DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea # P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN # F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk # 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs # thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x # GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr # z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo # qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR # qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc # w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD # AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT # AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT # G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z # NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0 # YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO # STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF # snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw # NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9 # eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O # E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP # +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8 # MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx # cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm # x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J # qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he # Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI # KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj # YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC # MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv # Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E # BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O # BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb # rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L # xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL # RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z # J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY # Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj # vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT # j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT # j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb # aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy # g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz # pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK # JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG # A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt # IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl # ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW # MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu # MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG # SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r # Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52 # NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q # gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX # IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx # F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj # zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad # PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t # 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl # ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK # mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH # mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU # 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc # ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud # HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI # KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0 # dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv # Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0 # cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q # KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3 # Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL # qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY # zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb # QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI # P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS # WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/ # DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8 # X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh # o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q # EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO # S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE # ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl # cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO # ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw # CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw # IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3 # DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4 # YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W # ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz # Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv # 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x # 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg # WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a # cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf # SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg # zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV # ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z # EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC # L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6 # Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp # MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB # BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru # Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov # L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH # CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli # G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f # KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee # hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4 # FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9 # sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E # hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh # oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf # 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF # 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA # Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC # UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb # Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G # CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI # hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC # ARUwLwYJKoZIhvcNAQkEMSIEIKWVna8HIQhG5tUUCc5y5gMlgw4ZJB1PA0GJyzdR # aoBXMA0GCSqGSIb3DQEBAQUABIIBgDyEkWrHWDc2DQnWRFiPwWrHvi6y8hFWg54/ # PyWrDNKZ0tLsv2gQiMpaSXpABVK3/JNH0EV3sow6LULbZyIpjcwSqudMFxkb20eW # gUOM0uFgUMSJtVu3h+oevkAWIJHdtHS9zsMbFD8KCWKVU9XwJym3EortxyQ/7S9K # L7ZLp5frdKEtKQwGUjkS0ikOGrXtOEpDrD0n63D9zwsbaT516bsXj18VtGbWrt4i # 4eVKmeH0vFI0wKz0zFBx0tYZUO7wRAfsOdmq/1VCBp6Fr6aOzHQyzjZu5txUCq+T # A2MMH5yJOB0cei0kb+JUMc4gIppzvThTykIYjwjCLs9jWIwdfVg1+dcEiKHETyJR # sLCtADlOAUeG33/JaDiDeh0deiigDr8DnIi83WCqSXjBVaWOt8LViD8dI+Wtw5Xq # asZ8iYZs95KEgdwCOru7fTo0v+uB8LyvkDyzrSh57yfaapQ15Y9CK4ta0pNZsIks # bnrRYfNj71puqGmZa6ia71fAz/BBHaGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID # 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0 # ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ # KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD # MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQxMzhaMDcG # CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY # 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDBM7eb04PrJj9rC0h1nTaOA7vCrYr7sBbxa # lbF9maBiVFoyTphAqqP0ZmgWxAYBfOkwgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ # MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh # MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0 # dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI # hvcNAQEBBQAEggIAF2HYSsiaZs5ZJyh3FtJgAtnMcBeB3EHBWQ6R6Jy+s+HmnW0P # JKrmnZllez7mVVjsYXbaOuk34esN9rfGnaD4LFzbJ7fifpODJu5uBhBwVDkLbf0E # UGP1SEbVKdKQwx2cKCsz3AKBDSh07aaALhm+XJQIVMbrmADb9yxqWVmjyIiU03nU # M0E8FH4xBCHX7rrOsOSckpAQstpWrGuXqADkZ8ZEGwj2WNoZDybj0toLAFQntwU/ # bnDBfgU2tPhkgihvuq5YDzAw6ZEGlPQH2vEwHfVsswqzzp40f3mtkV9ihu+qTfej # zdz6GQvirdRdEhW3JZE7GfFxA78awmejPXMePUP/9MA9P1MuDyCXiDwcvitlZfrR # oGvC++w9GH9cSZB74d4Kh0U+/NQ2mWhd9vZ/wQP3lmMM8PHSatTDuVJCXmSAwiit # sQUfmhisHCqooU3KKKr2WoIO+gqB05cktwnjYmYrXcPp41R5Sx6SDeiovER40qSo # tKYsJXPuuZAj0X3irwU+TQBtelPHpH5fRnHjC6Z4U+SgmbRdchwyP6DFFoS0+FI9 # /l3bgzYtLu9vn2XC1f3GbFdOSnULkJrp3r5WWa8THnUEwaannzPCbV2fEZFbSE9k # qeBsYxWKVQ+mUCGUjMNg5TFiV8Nok3pFCpxmU8N/yNutcy3RVFt9sx1O2e0= # SIG # End signature block |