custom/New-AzSentinelAlertRule.ps1
|
# ---------------------------------------------------------------------------------- # # Copyright Microsoft Corporation # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # http://www.apache.org/licenses/LICENSE-2.0 # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ---------------------------------------------------------------------------------- <# .Synopsis Creates the alert rule. .Description Creates the alert rule. .Link https://learn.microsoft.com/powershell/module/az.securityinsights/new-azsentinelalertrule #> function New-AzSentinelAlertRule { [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.CmdletBreakingChange("11.0.0", "4.0.0", "2023/11/15", ChangeDescription="Parameters of NRT set will be deprecated.")] [OutputType([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.AlertRule])] [CmdletBinding(DefaultParameterSetName = 'FusionMLTI', PositionalBinding = $false, SupportsShouldProcess, ConfirmImpact = 'Medium')] param( [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '(Get-AzContext).Subscription.Id')] [System.String] # Gets subscription credentials which uniquely identify Microsoft Azure subscription. # The subscription ID forms part of the URI for every service call. ${SubscriptionId}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [System.String] # The Resource Group Name. ${ResourceGroupName}, [Parameter(Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [System.String] # The name of the workspace. ${WorkspaceName}, [Parameter()] #[Alias('RuleId')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Path')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '(New-Guid).Guid')] [System.String] # The Id of the Rule. ${RuleId}, [Parameter(Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertRuleKind])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertRuleKind] # Kind of the the data connection ${Kind}, [Parameter(ParameterSetName = 'FusionMLTI', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertRuleTemplate}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertRuleTemplateName}, [Parameter(ParameterSetName = 'FusionMLTI')] [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${Enabled}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Description}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${DisplayNamesFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String[]] ${DisplayNamesExcludeFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation', Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.MicrosoftSecurityProductName])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.MicrosoftSecurityProductName] ${ProductFilter}, [Parameter(ParameterSetName = 'MicrosoftSecurityIncidentCreation')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertSeverity[]] #High, Medium, Low, Informational ${SeveritiesFilter}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${Query}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${DisplayName}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = 'New-TimeSpan -Hours 5')] [System.TimeSpan] ${SuppressionDuration}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${SuppressionEnabled}, [Parameter(ParameterSetName = 'NRT', Mandatory)] [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertSeverity])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertSeverity] ${Severity}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] #[Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AttackTactic] [System.String[]] #InitialAccess, Execution, Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Collection, Exfiltration, CommandAndControl, Impact, PreAttack ${Tactic}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${CreateIncident}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${GroupingConfigurationEnabled}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Switch] ${ReOpenClosedIncident}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = 'New-TimeSpan -Hours 5')] [System.TimeSpan] ${LookbackDuration}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.DefaultInfo(Script = '"AllEntities"')] [ValidateSet('AllEntities', 'AnyAlert', 'Selected')] [System.String] ${MatchingMethod}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertDetail])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.AlertDetail[]] ${GroupByAlertDetail}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [string[]] ${GroupByCustomDetail}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EntityMappingType])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EntityMappingType[]] ${GroupByEntity}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] #'Account', 'Host', 'IP', 'Malware', 'File', 'Process', 'CloudApplication', 'DNS', 'AzureResource', 'FileHash', 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'URL', 'Mailbox', 'MailCluster', 'MailMessage', 'SubmissionMail' [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.EntityMapping[]] ${EntityMapping}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertDescriptionFormat}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertDisplayNameFormat}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertSeverityColumnName}, [Parameter(ParameterSetName = 'NRT')] [Parameter(ParameterSetName = 'Scheduled')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.String] ${AlertTacticsColumnName}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.TimeSpan] ${QueryFrequency}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [System.TimeSpan] ${QueryPeriod}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.TriggerOperator])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.TriggerOperator] ${TriggerOperator}, [Parameter(ParameterSetName = 'Scheduled', Mandatory)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [int] ${TriggerThreshold}, [Parameter(ParameterSetName = 'Scheduled')] [ArgumentCompleter([Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EventGroupingAggregationKind])] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Support.EventGroupingAggregationKind] ${EventGroupingSettingAggregationKind}, [Parameter()] [Alias('AzureRMContext', 'AzureCredential')] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Azure')] [System.Management.Automation.PSObject] # The credentials, account, tenant, and subscription used for communication with Azure. ${DefaultProfile}, [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Run the command as a job ${AsJob}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Wait for .NET debugger to attach ${Break}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.SendAsyncStep[]] # SendAsync Pipeline Steps to be appended to the front of the pipeline ${HttpPipelineAppend}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Runtime.SendAsyncStep[]] # SendAsync Pipeline Steps to be prepended to the front of the pipeline ${HttpPipelinePrepend}, [Parameter()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Run the command asynchronously ${NoWait}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Uri] # The URI for the proxy server to use ${Proxy}, [Parameter(DontShow)] [ValidateNotNull()] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.PSCredential] # Credentials for a proxy server to use for the remote call ${ProxyCredential}, [Parameter(DontShow)] [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Runtime')] [System.Management.Automation.SwitchParameter] # Use the default credentials for the proxy ${ProxyUseDefaultCredentials} ) process { try { #Fusion if ($PSBoundParameters['Kind'] -eq 'Fusion'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.FusionAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } } #MSIC if($PSBoundParameters['Kind'] -eq 'MicrosoftSecurityIncidentCreation'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.MicrosoftSecurityIncidentCreationAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } If($PSBoundParameters['DisplayNamesFilter']){ $AlertRule.DisplayNamesFilter = $PSBoundParameters['DisplayNamesFilter'] $null = $PSBoundParameters.Remove('DisplayNamesFilter') } If($PSBoundParameters['DisplayNamesExcludeFilter']){ $AlertRule.DisplayNamesExcludeFilter = $PSBoundParameters['DisplayNamesExcludeFilter'] $null = $PSBoundParameters.Remove('DisplayNamesExcludeFilter') } $AlertRule.ProductFilter = $PSBoundParameters['ProductFilter'] $null = $PSBoundParameters.Remove('ProductFilter') If($PSBoundParameters['SeveritiesFilter']){ $AlertRule.SeveritiesFilter = $PSBoundParameters['SeveritiesFilter'] $null = $PSBoundParameters.Remove('SeveritiesFilter') } } #ML if ($PSBoundParameters['Kind'] -eq 'MLBehaviorAnalytics'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.MlBehaviorAnalyticsAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } } #NRT if($PSBoundParameters['Kind'] -eq 'NRT'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.NrtAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } $AlertRule.Query = $PSBoundParameters['Query'] $null = $PSBoundParameters.Remove('Query') $AlertRule.DisplayName = $PSBoundParameters['DisplayName'] $null = $PSBoundParameters.Remove('DisplayName') $AlertRule.SuppressionDuration = $PSBoundParameters['SuppressionDuration'] $null = $PSBoundParameters.Remove('SuppressionDuration') If($PSBoundParameters['SuppressionEnabled']){ $AlertRule.SuppressionEnabled = $PSBoundParameters['SuppressionEnabled'] $null = $PSBoundParameters.Remove('SuppressionEnabled') } else{ $AlertRule.SuppressionEnabled = $false } $AlertRule.Severity = $PSBoundParameters['Severity'] $null = $PSBoundParameters.Remove('Severity') If($PSBoundParameters['Tactic']){ $AlertRule.Tactic = $PSBoundParameters['Tactic'] $null = $PSBoundParameters.Remove('Tactic') } If($PSBoundParameters['CreateIncident']){ $AlertRule.IncidentConfigurationCreateIncident = $PSBoundParameters['CreateIncident'] $null = $PSBoundParameters.Remove('CreateIncident') } else{ $AlertRule.IncidentConfigurationCreateIncident = $false } If($PSBoundParameters['GroupingConfigurationEnabled']){ $AlertRule.GroupingConfigurationEnabled = $PSBoundParameters['GroupingConfigurationEnabled'] $null = $PSBoundParameters.Remove('GroupingConfigurationEnabled') } else{ $AlertRule.GroupingConfigurationEnabled = $false } If($PSBoundParameters['ReOpenClosedIncident']){ $AlertRule.GroupingConfigurationReOpenClosedIncident = $PSBoundParameters['ReOpenClosedIncident'] $null = $PSBoundParameters.Remove('ReOpenClosedIncident') } else{ $AlertRule.GroupingConfigurationReOpenClosedIncident = $false } $AlertRule.GroupingConfigurationLookbackDuration = $PSBoundParameters['LookbackDuration'] $null = $PSBoundParameters.Remove('LookbackDuration') $AlertRule.GroupingConfigurationMatchingMethod = $PSBoundParameters['MatchingMethod'] $null = $PSBoundParameters.Remove('MatchingMethod') If($PSBoundParameters['GroupByAlertDetail']){ $AlertRule.GroupingConfigurationGroupByAlertDetail = $PSBoundParameters['GroupByAlertDetail'] $null = $PSBoundParameters.Remove('GroupByAlertDetail') } If($PSBoundParameters['GroupByCustomDetail']){ $AlertRule.GroupingConfigurationGroupByCustomDetail = $PSBoundParameters['GroupByCustomDetail'] $null = $PSBoundParameters.Remove('GroupByCustomDetail') } If($PSBoundParameters['GroupByEntity']){ $AlertRule.GroupingConfigurationGroupByEntity = $PSBoundParameters['GroupByEntity'] $null = $PSBoundParameters.Remove('GroupByEntity') } If($PSBoundParameters['EntityMapping']){ $AlertRule.EntityMapping = $PSBoundParameters['EntityMapping'] $null = $PSBoundParameters.Remove('EntityMapping') } If($PSBoundParameters['AlertDescriptionFormat']){ $AlertRule.AlertDetailOverrideAlertDescriptionFormat = $PSBoundParameters['AlertDescriptionFormat'] $null = $PSBoundParameters.Remove('AlertDescriptionFormat') } If($PSBoundParameters['AlertDisplayNameFormat']){ $AlertRule.AlertDetailOverrideAlertDisplayNameFormat = $PSBoundParameters['AlertDisplayNameFormat'] $null = $PSBoundParameters.Remove('AlertDisplayNameFormat') } If($PSBoundParameters['AlertSeverityColumnName']){ $AlertRule.AlertDetailOverrideAlertSeverityColumnName = $PSBoundParameters['AlertSeverityColumnName'] $null = $PSBoundParameters.Remove('AlertSeverityColumnName') } If($PSBoundParameters['AlertTacticsColumnName']){ $AlertRule.AlertDetailOverrideAlertTacticsColumnName = $PSBoundParameters['AlertTacticsColumnName'] $null = $PSBoundParameters.Remove('AlertTacticsColumnName') } } #Scheduled if ($PSBoundParameters['Kind'] -eq 'Scheduled'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.ScheduledAlertRule]::new() If($PSBoundParameters['AlertRuleTemplateName']){ $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplateName'] $null = $PSBoundParameters.Remove('AlertRuleTemplateName') } If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else{ $AlertRule.Enabled = $false } If($PSBoundParameters['Description']){ $AlertRule.Description = $PSBoundParameters['Description'] $null = $PSBoundParameters.Remove('Description') } $AlertRule.Query = $PSBoundParameters['Query'] $null = $PSBoundParameters.Remove('Query') $AlertRule.DisplayName = $PSBoundParameters['DisplayName'] $null = $PSBoundParameters.Remove('DisplayName') $AlertRule.SuppressionDuration = $PSBoundParameters['SuppressionDuration'] $null = $PSBoundParameters.Remove('SuppressionDuration') If($PSBoundParameters['SuppressionEnabled']){ $AlertRule.SuppressionEnabled = $PSBoundParameters['SuppressionEnabled'] $null = $PSBoundParameters.Remove('SuppressionEnabled') } else{ $AlertRule.SuppressionEnabled = $false } $AlertRule.Severity = $PSBoundParameters['Severity'] $null = $PSBoundParameters.Remove('Severity') If($PSBoundParameters['Tactic']){ $AlertRule.Tactic = $PSBoundParameters['Tactic'] $null = $PSBoundParameters.Remove('Tactic') } If($PSBoundParameters['CreateIncident']){ $AlertRule.IncidentConfigurationCreateIncident = $PSBoundParameters['CreateIncident'] $null = $PSBoundParameters.Remove('CreateIncident') } else{ $AlertRule.IncidentConfigurationCreateIncident = $false } If($PSBoundParameters['GroupingConfigurationEnabled']){ $AlertRule.GroupingConfigurationEnabled = $PSBoundParameters['GroupingConfigurationEnabled'] $null = $PSBoundParameters.Remove('GroupingConfigurationEnabled') } else{ $AlertRule.GroupingConfigurationEnabled = $false } If($PSBoundParameters['ReOpenClosedIncident']){ $AlertRule.GroupingConfigurationReOpenClosedIncident = $PSBoundParameters['ReOpenClosedIncident'] $null = $PSBoundParameters.Remove('ReOpenClosedIncident') } else{ $AlertRule.GroupingConfigurationReOpenClosedIncident = $false } $AlertRule.GroupingConfigurationLookbackDuration = $PSBoundParameters['LookbackDuration'] $null = $PSBoundParameters.Remove('LookbackDuration') $AlertRule.GroupingConfigurationMatchingMethod = $PSBoundParameters['MatchingMethod'] $null = $PSBoundParameters.Remove('MatchingMethod') If($PSBoundParameters['GroupByAlertDetail']){ $AlertRule.GroupingConfigurationGroupByAlertDetail = $PSBoundParameters['GroupByAlertDetail'] $null = $PSBoundParameters.Remove('GroupByAlertDetail') } If($PSBoundParameters['GroupByCustomDetail']){ $AlertRule.GroupingConfigurationGroupByCustomDetail = $PSBoundParameters['GroupByCustomDetail'] $null = $PSBoundParameters.Remove('GroupByCustomDetail') } If($PSBoundParameters['GroupByEntity']){ $AlertRule.GroupingConfigurationGroupByEntity = $PSBoundParameters['GroupByEntity'] $null = $PSBoundParameters.Remove('GroupByEntity') } If($PSBoundParameters['EntityMapping']){ $AlertRule.EntityMapping = $PSBoundParameters['EntityMapping'] $null = $PSBoundParameters.Remove('EntityMapping') } If($PSBoundParameters['AlertDescriptionFormat']){ $AlertRule.AlertDetailOverrideAlertDescriptionFormat = $PSBoundParameters['AlertDescriptionFormat'] $null = $PSBoundParameters.Remove('AlertDescriptionFormat') } If($PSBoundParameters['AlertDisplayNameFormat']){ $AlertRule.AlertDetailOverrideAlertDisplayNameFormat = $PSBoundParameters['AlertDisplayNameFormat'] $null = $PSBoundParameters.Remove('AlertDisplayNameFormat') } If($PSBoundParameters['AlertSeverityColumnName']){ $AlertRule.AlertDetailOverrideAlertSeverityColumnName = $PSBoundParameters['AlertSeverityColumnName'] $null = $PSBoundParameters.Remove('AlertSeverityColumnName') } If($PSBoundParameters['AlertTacticsColumnName']){ $AlertRule.AlertDetailOverrideAlertTacticsColumnName = $PSBoundParameters['AlertTacticsColumnName'] $null = $PSBoundParameters.Remove('AlertTacticsColumnName') } $AlertRule.QueryFrequency = $PSBoundParameters['QueryFrequency'] $null = $PSBoundParameters.Remove('QueryFrequency') $AlertRule.QueryPeriod = $PSBoundParameters['QueryPeriod'] $null = $PSBoundParameters.Remove('QueryPeriod') $AlertRule.TriggerOperator = $PSBoundParameters['TriggerOperator'] $null = $PSBoundParameters.Remove('TriggerOperator') $AlertRule.TriggerThreshold = $PSBoundParameters['TriggerThreshold'] $null = $PSBoundParameters.Remove('TriggerThreshold') If($PSBoundParameters['EventGroupingSettingAggregationKind']){ $AlertRule.EventGroupingSettingAggregationKind = $PSBoundParameters['EventGroupingSettingAggregationKind'] $null = $PSBoundParameters.Remove('EventGroupingSettingAggregationKind') } } #TI if ($PSBoundParameters['Kind'] -eq 'ThreatIntelligence'){ $AlertRule = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.ThreatIntelligenceAlertRule]::new() $AlertRule.AlertRuleTemplateName = $PSBoundParameters['AlertRuleTemplate'] $null = $PSBoundParameters.Remove('AlertRuleTemplate') If($PSBoundParameters['Enabled']){ $AlertRule.Enabled = $true $null = $PSBoundParameters.Remove('Enabled') } else { $AlertRule.Enabled = $false } } $null = $PSBoundParameters.Remove('FusionMLTI') $AlertRule.Kind = $PSBoundParameters['Kind'] $null = $PSBoundParameters.Remove('Kind') $null = $PSBoundParameters.Add('AlertRule', $AlertRule) Az.SecurityInsights.internal\New-AzSentinelAlertRule @PSBoundParameters } catch { throw } } } # SIG # Begin signature block # MIInwgYJKoZIhvcNAQcCoIInszCCJ68CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBm7zoRtrcolnSH # QDFvgIYkOsU02j20zPfqhln/haX+dKCCDXYwggX0MIID3KADAgECAhMzAAADTrU8 # esGEb+srAAAAAANOMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjMwMzE2MTg0MzI5WhcNMjQwMzE0MTg0MzI5WjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQDdCKiNI6IBFWuvJUmf6WdOJqZmIwYs5G7AJD5UbcL6tsC+EBPDbr36pFGo1bsU # p53nRyFYnncoMg8FK0d8jLlw0lgexDDr7gicf2zOBFWqfv/nSLwzJFNP5W03DF/1 # 1oZ12rSFqGlm+O46cRjTDFBpMRCZZGddZlRBjivby0eI1VgTD1TvAdfBYQe82fhm # WQkYR/lWmAK+vW/1+bO7jHaxXTNCxLIBW07F8PBjUcwFxxyfbe2mHB4h1L4U0Ofa # +HX/aREQ7SqYZz59sXM2ySOfvYyIjnqSO80NGBaz5DvzIG88J0+BNhOu2jl6Dfcq # jYQs1H/PMSQIK6E7lXDXSpXzAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUnMc7Zn/ukKBsBiWkwdNfsN5pdwAw # RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW # MBQGA1UEBRMNMjMwMDEyKzUwMDUxNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci # tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG # CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0 # MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAD21v9pHoLdBSNlFAjmk # mx4XxOZAPsVxxXbDyQv1+kGDe9XpgBnT1lXnx7JDpFMKBwAyIwdInmvhK9pGBa31 # TyeL3p7R2s0L8SABPPRJHAEk4NHpBXxHjm4TKjezAbSqqbgsy10Y7KApy+9UrKa2 # kGmsuASsk95PVm5vem7OmTs42vm0BJUU+JPQLg8Y/sdj3TtSfLYYZAaJwTAIgi7d # hzn5hatLo7Dhz+4T+MrFd+6LUa2U3zr97QwzDthx+RP9/RZnur4inzSQsG5DCVIM # pA1l2NWEA3KAca0tI2l6hQNYsaKL1kefdfHCrPxEry8onJjyGGv9YKoLv6AOO7Oh # JEmbQlz/xksYG2N/JSOJ+QqYpGTEuYFYVWain7He6jgb41JbpOGKDdE/b+V2q/gX # UgFe2gdwTpCDsvh8SMRoq1/BNXcr7iTAU38Vgr83iVtPYmFhZOVM0ULp/kKTVoir # IpP2KCxT4OekOctt8grYnhJ16QMjmMv5o53hjNFXOxigkQWYzUO+6w50g0FAeFa8 # 5ugCCB6lXEk21FFB1FdIHpjSQf+LP/W2OV/HfhC3uTPgKbRtXo83TZYEudooyZ/A # Vu08sibZ3MkGOJORLERNwKm2G7oqdOv4Qj8Z0JrGgMzj46NFKAxkLSpE5oHQYP1H # tPx1lPfD7iNSbJsP6LiUHXH1MIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq # hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x # EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv # bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 # IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG # EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG # A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg # Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC # CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03 # a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr # rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg # OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy # 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9 # sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh # dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k # A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB # w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn # Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90 # lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w # ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o # ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD # VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa # BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny # bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG # AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV # HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG # AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl # AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb # C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l # hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6 # I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0 # wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560 # STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam # ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa # J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah # XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA # 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt # Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr # /Xmfwb1tbWrJUnMTDXpQzTGCGaIwghmeAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp # Z25pbmcgUENBIDIwMTECEzMAAANOtTx6wYRv6ysAAAAAA04wDQYJYIZIAWUDBAIB # BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO # MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIIc7cJ4FWaG3Lgyxul6Hu3T0 # xmnZmKpUj3ep+7yumr19MEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A # cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB # BQAEggEAeRAJqDu21huFWjx7wWEnbVyQq+RjBCcQxRc5jXDYqKvALr7zqbardtdP # PP8wCNb5QeNUTsrg7Hwlj9vtuQj0DXYTOwT/8Xfku82Za0S+VVDrlTRRB+zOETI/ # 2IwN5WcFFZ57XSRPiv9AmSBaVyxrdaKTRX7C8UCbZlFZFyL2v72IxIxHRCr1+jIe # XUaksWL3as0wXotn1toqvni6L7jeyCqDRCXtmQhv3NB/deTkbTt2ncLxH8LsonkX # umKkYdWf5m8+vHNS9fbSrhuc+esULDKr3sx0JZCM4PiFpqtBAomAVBnU8G4DvDml # doW3IVQZWGwUXQOZOoPLs0XxFLkq3KGCFywwghcoBgorBgEEAYI3AwMBMYIXGDCC # FxQGCSqGSIb3DQEHAqCCFwUwghcBAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFZBgsq # hkiG9w0BCRABBKCCAUgEggFEMIIBQAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl # AwQCAQUABCDqCj0Qv6Srbvz6R9DXRYo6aDiZZ1cU3IHOKQ/vFkLtKgIGZN5VuKZV # GBMyMDIzMDkyMDA1NTAzNS4xNTZaMASAAgH0oIHYpIHVMIHSMQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJl # bGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNO # OjA4NDItNEJFNi1DMjlBMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBT # ZXJ2aWNloIIRezCCBycwggUPoAMCAQICEzMAAAGybkADf26plJIAAQAAAbIwDQYJ # KoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x # EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv # bjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcNMjIw # OTIwMjAyMjAxWhcNMjMxMjE0MjAyMjAxWjCB0jELMAkGA1UEBhMCVVMxEzARBgNV # BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv # c29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3Bl # cmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjowODQyLTRC # RTYtQzI5QTElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMqiZTIde/lQ4rC+Bml5f/Wu # q/xKTxrfbG23HofmQ+qZAN4GyO73PF3y9OAfpt7Qf2jcldWOGUB+HzBuwllYyP3f # x4MY8zvuAuB37FvoytnNC2DKnVrVlHOVcGUL9CnmhDNMA2/nskjIf2IoiG9J0qLY # r8duvHdQJ9Li2Pq9guySb9mvUL60ogslCO9gkh6FiEDwMrwUr8Wja6jFpUTny8tg # 0N0cnCN2w4fKkp5qZcbUYFYicLSb/6A7pHCtX6xnjqwhmJoib3vkKJyVxbuFLRhV # XxH95b0LHeNhifn3jvo2j+/4QV10jEpXVW+iC9BsTtR69xvTjU51ZgP7BR4YDEWq # 7JsylSOv5B5THTDXRf184URzFhTyb8OZQKY7mqMh7c8J8w1sEM4XDUF2UZNy829N # VCzG2tfdEXZaHxF8RmxpQYBxyhZwY1rotuIS+gfN2eq+hkAT3ipGn8/KmDwDtzAb # nfuXjApgeZqwgcYJ8pDJ+y/xU6ouzJz1Bve5TTihkiA7wQsQe6R60Zk9dPdNzw0M # K5niRzuQZAt4GI96FhjhlUWcUZOCkv/JXM/OGu/rgSplYwdmPLzzfDtXyuy/GCU5 # I4l08g6iifXypMgoYkkceOAAz4vx1x0BOnZWfI3fSwqNUvoN7ncTT+MB4Vpvf1QB # ppjBAQUuvui6eCG0MCVNAgMBAAGjggFJMIIBRTAdBgNVHQ4EFgQUmfIngFzZEZlP # kjDOVluBSDDaanEwHwYDVR0jBBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYD # VR0fBFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j # cmwvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwG # CCsGAQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIw # MjAxMCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcD # CDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBANxHtu3FzIabaDbW # qswdKBlAhKXRCN+5CSMiv2TYa4i2QuWIm+99piwAhDhADfbqor1zyLi95Y6GQnvI # WUgdeC7oL1ZtZye92zYK+EIfwYZmhS+CH4infAzUvscHZF3wlrJUfPUIDGVP0lCY # Vse9mguvG0dqkY4ayQPEHOvJubgZZaOdg/N8dInd6fGeOc+0DoGzB+LieObJ2Q0A # tEt3XN3iX8Cp6+dZTX8xwE/LvhRwPpb/+nKshO7TVuvenwdTwqB/LT6CNPaElwFe # KxKrqRTPMbHeg+i+KnBLfwmhEXsMg2s1QX7JIxfvT96md0eiMjiMEO22LbOzmLMN # d3LINowAnRBAJtX+3/e390B9sMGMHp+a1V+hgs62AopBl0p/00li30DN5wEQ5If3 # 5Zk7b/T6pEx6rJUDYCti7zCbikjKTanBnOc99zGMlej5X+fC/k5ExUCrOs3/VzGR # CZt5LvVQSdWqq/QMzTEmim4sbzASK9imEkjNtZZyvC1CsUcD1voFktld4mKMjE+u # DEV3IddD+DrRk94nVzNPSuZXewfVOnXHSeqG7xM3V7fl2aL4v1OhL2+JwO1Tx3B0 # irO1O9qbNdJk355bntd1RSVKgM22KFBHnoL7Js7pRhBiaKmVTQGoOb+j1Qa7q+ci # xGo48Vh9k35BDsJS/DLoXFSPDl4mMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJ # mQAAAAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT # Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNh # dGUgQXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1 # WjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEB # BQADggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjK # NVf2AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhg # fWpSg0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJp # rx2rrPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/d # vI2k45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka9 # 7aSueik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKR # Hh09/SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9itu # qBJR6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyO # ArxCaC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItb # oKaDIV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6 # bMURHXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6t # AgMBAAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQW # BBQqp1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacb # UzUZ6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYz # aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnku # aHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIA # QwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2 # VsuP6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwu # bWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEw # LTA2LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93 # d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYt # MjMuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/q # XBS2Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6 # U03dmLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVt # I1TkeFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis # 9/kpicO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTp # kbKpW99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0 # sHrYUP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138e # W0QBjloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJ # sWkBRH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7 # Fx0ViY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0 # dFtq0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQ # tB1VM1izoXBm8qGCAtcwggJAAgEBMIIBAKGB2KSB1TCB0jELMAkGA1UEBhMCVVMx # EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT # FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxh # bmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjow # ODQyLTRCRTYtQzI5QTElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy # dmljZaIjCgEBMAcGBSsOAwIaAxUAjhJ+EeySRfn2KCNsjn9cF9AUSTqggYMwgYCk # fjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIF # AOi0+i0wIhgPMjAyMzA5MjAxMjU3MTdaGA8yMDIzMDkyMTEyNTcxN1owdzA9Bgor # BgEEAYRZCgQBMS8wLTAKAgUA6LT6LQIBADAKAgEAAgIRnAIB/zAHAgEAAgIR0DAK # AgUA6LZLrQIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIB # AAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAGjRjrn62VuBz/kN # RF8KdoG4YOpoAZu0e3XBc+tcCCiG1Je/ZYXUzMrrq/czMFXWzdmSQRBFPRvcFJw8 # LcTRu4C6eQOJywts4MMoyE3nJOUUUsOB/i2h2w7L/fo03EeEXVTQn/aSK7jkMyys # xQEWOw64WNG06Sd08ZDadqbnAc7zMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp # bWUtU3RhbXAgUENBIDIwMTACEzMAAAGybkADf26plJIAAQAAAbIwDQYJYIZIAWUD # BAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0B # CQQxIgQgU07J7soSdg+FwKdvJ7gb0r0CbNYxwknrcVQCGaA6IsQwgfoGCyqGSIb3 # DQEJEAIvMYHqMIHnMIHkMIG9BCBTeM485+E+t4PEVieUoFKX7PVyLo/nzu+htJPC # G04+NTCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u # MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp # b24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAAB # sm5AA39uqZSSAAEAAAGyMCIEILLYuf/URU9tiFRXIhgoOAyZuYAFYpFAH2I0pLSN # 1lWkMA0GCSqGSIb3DQEBCwUABIICAAsf9/YNmGbPnbcPYRzvrkZu1zubx95aJAqO # x6sQDzyAVPYfT+4kXYcfi81OBuyZBQXbOpCOvNtFGt+Wb30TpZRQqcZnNcTa3uXj # WIz6pWMD/ut66nLqpFsdsUm+51TMLujPB1T8KKTMcRlJXbskQxEOSQCbw0lYuOAf # LUmpqx53JgymGEv70cQm5gwb2nrJFnakJdyiMB46iYnTgNyVA9czoT/ynGXXKtsV # ld8T7blzzJYNSXkmvWi5nMM57tLmSlFod8zJIauVDxUTOBXZLIgnWW/92lkamNg6 # MQpM1gjKZBG2HlfNRmvPzi3RdQUy/2dAMU03jf5/Gt/zopKuV+rF+hpPSY9uWW/6 # pu0ZLzamxouxv+9fqp4rkJiMewYqtMWsA/AvpzaVmOP9qEmktV7IRleMedyVO9VC # RNPw3+WKiNSrA0XaP+DwwV/vDbwg+9E+037hJJ1IK2/4zVx8nwl8e+4IS2kI+DEz # yRhoVYgMezZV2mcUXKNcDsTnkpKa8M2S9BF3MfTbtijCr+x6kZn4l7Ldkdda6Uql # jgTVESBD4qcGcLrXMFE9SyWmU1KguKVfNNHLMlZ94OyVpPkWSNvgeIcRq3Q9IWyg # KRQ9hqC8Y6qOIB0fdIAnRA3qrk6YSGm79tw8vpzVU4GQyXM/ahGvnUMlSPWLkuhe # Ob8gqrHY # SIG # End signature block |