Modules/Support/Support.psm1
|
using module '..\ScubaConfig\ScubaConfig.psm1' function Copy-SCuBABaselineDocument { <# .SYNOPSIS Copy security baselines documents to a user specified location. .Description This function makes copies of the security baseline documents included with the installed ScubaGear module. .Parameter Destination Where to copy the baselines. Defaults to <user home>\ScubaGear\baselines .Example Copy-SCuBABaselineDocument .Functionality Public .NOTES SuppressMessage for PSReviewUnusedParameter due to linter bug. Open issue to remove if/when fixed. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '')] param ( [Parameter(Mandatory = $false)] [ValidateScript({Test-Path -Path $_ -IsValid})] [string] $Destination = (Join-Path -Path $env:USERPROFILE -ChildPath "ScubaGear"), [Parameter(Mandatory = $false)] [switch] $Force ) if (-not (Test-Path -Path $Destination -PathType Container)){ New-Item -ItemType Directory -Path $Destination | Out-Null } @("teams", "exo", "defender", "aad", "powerbi", "powerplatform", "sharepoint") | ForEach-Object { $SourceFileName = Join-Path -Path $PSScriptRoot -ChildPath "..\..\baselines\$_.md" $TargetFileName = Join-Path -Path $Destination -ChildPath "$_.md" Copy-Item -Path $SourceFileName -Destination $Destination -Force:$Force -ErrorAction Stop 2> $null Set-ItemProperty -Path $TargetFileName -Name IsReadOnly -Value $true } } function Initialize-SCuBA { <# .SYNOPSIS This script installs the required Powershell modules used by the assessment tool .DESCRIPTION Installs the modules required to support SCuBAGear. If the Force switch is set then any existing module will be re-installed even if already at latest version. If the SkipUpdate switch is set then any existing module will not be updated to th latest version. .EXAMPLE Initialize-SCuBA .NOTES Executing the script with no switches set will install the latest version of a module if not already installed. #> [CmdletBinding()] param( [Parameter(Mandatory = $false, HelpMessage = 'Installs a given module and overrides warning messages about module installation conflicts. If a module with the same name already exists on the computer, Force allows for multiple versions to be installed. If there is an existing module with the same name and version, Force overwrites that version')] [switch] $Force, [Parameter(HelpMessage = 'If specified then modules will not be updated to latest version')] [switch] $SkipUpdate, [Parameter(HelpMessage = 'Do not automatically trust the PSGallery repository for module installation')] [switch] $DoNotAutoTrustRepository, [Parameter(HelpMessage = 'Do not download OPA')] [switch] $NoOPA, [Parameter(Mandatory = $false, HelpMessage = 'The version of OPA Rego to be downloaded, must be in "x.x.x" format')] [Alias('version')] [string] $ExpectedVersion = [ScubaConfig]::ScubaDefault('DefaultOPAVersion'), [Parameter(Mandatory = $false, HelpMessage = 'The operating system the program is running on')] [ValidateSet('Windows','MacOS','Linux')] [Alias('os')] [string] $OperatingSystem = "Windows", [Parameter(Mandatory = $false, HelpMessage = 'The file name that the opa executable is to be saved as')] [Alias('name')] [string] $OPAExe = "", [Parameter(Mandatory=$false, HelpMessage = 'Directory to contain ScubaGear artifacts. Defaults to <home>.')] [ValidateScript({Test-Path -Path $_ -PathType Container})] [string] $ScubaParentDirectory = $env:USERPROFILE ) Write-Output 'Initializing ScubaGear...' # Set preferences for writing messages $PreferenceStack = New-Object -TypeName System.Collections.Stack $PreferenceStack.Push($DebugPreference) $PreferenceStack.Push($InformationPreference) $DebugPreference = "Continue" $InformationPreference = "Continue" if (-not $DoNotAutoTrustRepository) { $Policy = Get-PSRepository -Name "PSGallery" | Select-Object -Property -InstallationPolicy if ($($Policy.InstallationPolicy) -ne "Trusted") { Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted Write-Information -MessageData "Setting PSGallery repository to trusted." } } # Start a stopwatch to time module installation elapsed time $Stopwatch = [System.Diagnostics.Stopwatch]::StartNew() # Since this method is called from the Support module, script root # points to the Support module location # Use script root rather than Get-Module as this may be called by # a script that only imports the function and not the whole module $SupportPath = $PSScriptRoot # Scuba module structure means module home is grandparent of support $ScubaModuleDir = Split-Path -Path $(Split-Path -Path $SupportPath -Parent) -Parent # Removing the import below causes issues with testing, let it be. # Import module magic may be helping by: # * restricting the import so only that only function is exported # * imported function takes precedence over imported modules w/ function Import-Module $SupportPath -Function Initialize-Scuba try { ($RequiredModulesPath = Join-Path -Path $ScubaModuleDir -ChildPath 'RequiredVersions.ps1') *> $null . $RequiredModulesPath } catch { throw "Unable to find RequiredVersions.ps1 in expected directory:`n`t$ScubaModuleDir" } if ($ModuleList) { # Add PowerShellGet to beginning of ModuleList for installing required modules. $ModuleList = ,@{ ModuleName = 'PowerShellGet' ModuleVersion = [version] '2.1.0' MaximumVersion = [version] '2.99.99999' } + $ModuleList } else { throw "Required modules list is required." } foreach ($Module in $ModuleList) { $ModuleName = $Module.ModuleName if (Get-Module -ListAvailable -Name $ModuleName) { $HighestInstalledVersion = (Get-Module -ListAvailable -Name $ModuleName | Sort-Object Version -Descending | Select-Object Version -First 1).Version $LatestVersion = [Version](Find-Module -Name $ModuleName -MinimumVersion $Module.ModuleVersion -MaximumVersion $Module.MaximumVersion).Version if ($HighestInstalledVersion -ge $LatestVersion) { Write-Debug "${ModuleName}: ${HighestInstalledVersion} already has latest installed." if ($Force -eq $true) { Install-Module -Name $ModuleName ` -Force ` -AllowClobber ` -Scope CurrentUser ` -MaximumVersion $Module.MaximumVersion Write-Information -MessageData "Re-installing module to latest acceptable version: ${ModuleName}." } } else { if ($SkipUpdate -eq $true) { Write-Debug "Skipping update for ${ModuleName}: ${HighestInstalledVersion} to newer version ${LatestVersion}." } else { Install-Module -Name $ModuleName ` -Force ` -AllowClobber ` -Scope CurrentUser ` -MaximumVersion $Module.MaximumVersion $MaxInstalledVersion = (Get-Module -ListAvailable -Name $ModuleName | Sort-Object Version -Descending | Select-Object Version -First 1).Version Write-Information -MessageData "${ModuleName}: ${HighestInstalledVersion} updated to version ${MaxInstalledVersion}." } } } else { Install-Module -Name $ModuleName ` -AllowClobber ` -Scope CurrentUser ` -MaximumVersion $Module.MaximumVersion $MaxInstalledVersion = (Get-Module -ListAvailable -Name $ModuleName | Sort-Object Version -Descending | Select-Object Version -First 1).Version Write-Information -MessageData "Installed the latest acceptable version of ${ModuleName}: ${MaxInstalledVersion}." } } if ($NoOPA -eq $true) { Write-Debug "Skipping Download for OPA.`n" } else { try { Install-OPAforSCuBA -OPAExe $OPAExe -ExpectedVersion $ExpectedVersion -OperatingSystem $OperatingSystem -ScubaParentDirectory $ScubaParentDirectory } catch { $Error[0] | Format-List -Property * -Force | Out-Host } } # Stop the clock and report total elapsed time $Stopwatch.stop() Write-Debug "ScubaGear setup time elapsed: $([math]::Round($stopwatch.Elapsed.TotalSeconds,0)) seconds." $InformationPreference = $PreferenceStack.Pop() $DebugPreference = $PreferenceStack.Pop() } function Install-OPAforSCuBA { <# .SYNOPSIS This script installs the required OPA executable used by the assessment tool .DESCRIPTION Installs the OPA executable required to support SCuBAGear. .EXAMPLE Install-OPAforSCuBA #> [CmdletBinding()] param( [Parameter(Mandatory = $false, HelpMessage = 'The version of OPA Rego to be downloaded, must be in "x.x.x" format')] [Alias('version')] [string] $ExpectedVersion = [ScubaConfig]::ScubaDefault('DefaultOPAVersion'), [Parameter(Mandatory = $false, HelpMessage = 'The file name that the opa executable is to be saved as')] [Alias('name')] [string] $OPAExe = "", [Parameter(Mandatory = $false, HelpMessage = 'The operating system the program is running on')] [ValidateSet('Windows','MacOS','Linux')] [Alias('os')] [string] $OperatingSystem = "Windows", [Parameter(Mandatory=$false, HelpMessage = 'Directory to contain ScubaGear artifacts. Defaults to <home>.')] [ValidateScript({Test-Path -Path $_ -PathType Container})] [string] $ScubaParentDirectory = $env:USERPROFILE ) # Constants $ACCEPTABLEVERSIONS = [ScubaConfig]::ScubaDefault('DefaultOPAVersion') # End Versions $FILENAME = @{ Windows = "opa_windows_amd64.exe"; MacOS = "opa_darwin_amd64"; Linux = "opa_linux_amd64_static"} # Set prefernces for writing messages $PreferenceStack = New-Object -TypeName System.Collections.Stack $PreferenceStack.Push($DebugPreference) $PreferenceStack.Push($InformationPreference) $PreferenceStack.Push($ErrorActionPreference) $DebugPreference = "Continue" $InformationPreference = "Continue" $ErrorActionPreference = "Stop" $ScubaHiddenHome = Join-Path -Path $ScubaParentDirectory -ChildPath '.scubagear' $ScubaTools = Join-Path -Path $ScubaHiddenHome -ChildPath 'Tools' if((Test-Path -Path $ScubaTools) -eq $false) { New-Item -ItemType Directory -Force -Path $ScubaTools Write-Output "" | Out-Host } if(-not $ACCEPTABLEVERSIONS.Contains($ExpectedVersion)) { $AcceptableVersionsString = $ACCEPTABLEVERSIONS -join "`r`n" | Out-String throw "Version parameter entered, ${ExpectedVersion}, is not in the list of acceptable versions. Acceptable versions are:`r`n${AcceptableVersionsString}" } $Filename = $FILENAME.$OperatingSystem if($OPAExe -eq "") { $OPAExe = $Filename } if(Test-Path -Path ( Join-Path $ScubaTools $OPAExe) -PathType Leaf) { $Result = Confirm-OPAHash -out $OPAExe -version $ExpectedVersion -name $Filename if($Result[0]) { Write-Debug "${OPAExe}: ${ExpectedVersion} already has latest installed." } else { if($OPAExe -eq $Filename) { Write-Information "SHA256 verification failed, downloading new executable" | Out-Host InstallOPA -out $OPAExe -version $ExpectedVersion -name $Filename } else { Write-Warning "SHA256 verification failed, please confirm file name is correct & remove old file before running script" | Out-Host } } } else { InstallOPA -out $OPAExe -version $ExpectedVersion -name $Filename } $ErrorActionPreference = $PreferenceStack.Pop() $InformationPreference = $PreferenceStack.Pop() $DebugPreference = $PreferenceStack.Pop() } function Get-OPAFile { param ( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('out')] [string]$OPAExe, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('version')] [string]$ExpectedVersion, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('name')] [string]$Filename ) <# .FUNCTIONALITY Internal #> $InstallUrl = "https://openpolicyagent.org/downloads/v$($ExpectedVersion)/$($Filename)" $OutFile = ( Join-Path $ScubaTools $OPAExe ) #(Join-Path (Get-Location).Path $OPAExe) try { $Display = "Downloading OPA executable" Start-BitsTransfer -Source $InstallUrl -Destination $OutFile -DisplayName $Display -MaxDownloadTime 300 Write-Information -MessageData "Installed the specified OPA version (${ExpectedVersion}) to ${OutFile}" | Out-Host } catch { $Error[0] | Format-List -Property * -Force | Out-Host throw "Unable to download OPA executable. To try manually downloading, see details in README under 'Download the required OPA executable'" | Out-Host } } function Get-ExeHash { param ( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('name')] [string]$Filename, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('version')] [string]$ExpectedVersion ) <# .FUNCTIONALITY Internal #> $InstallUrl = "https://openpolicyagent.org/downloads/v$($ExpectedVersion)/$($Filename).sha256" $OutFile = (Join-Path (Get-Location).Path $InstallUrl.SubString($InstallUrl.LastIndexOf('/'))) try { $WebClient = New-Object System.Net.WebClient $WebClient.DownloadFile($InstallUrl, $OutFile) } catch { $Error[0] | Format-List -Property * -Force | Out-Host Write-Error "Unable to download OPA SHA256 hash for verification" | Out-Host } finally { $WebClient.Dispose() } $Hash = ($(Get-Content $OutFile -raw) -split " ")[0] Remove-Item $OutFile return $Hash } function Confirm-OPAHash { <# .FUNCTIONALITY Internal #> param ( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('out')] [string]$OPAExe, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('version')] [string]$ExpectedVersion, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('name')] [string] $Filename ) if ((Get-FileHash ( Join-Path $ScubaTools $OPAExe ) -Algorithm SHA256 ).Hash -ne $(Get-ExeHash -name $Filename -version $ExpectedVersion)) { return $false, "SHA256 verification failed, retry download or install manually. See README under 'Download the required OPA executable' for instructions." } return $true, "Downloaded OPA version ($ExpectedVersion) SHA256 verified successfully`n" } function InstallOPA { param ( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('out')] [string]$OPAExe, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('version')] [string]$ExpectedVersion, [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [Alias('name')] [string] $Filename ) <# .FUNCTIONALITY Internal #> Get-OPAFile -out $OPAExe -version $ExpectedVersion -name $Filename $Result = Confirm-OPAHash -out $OPAExe -version $ExpectedVersion -name $Filename $Result[1] | Out-Host } function Debug-SCuBA { <# .SYNOPSIS Gather diagnostic information from previous run(s) into a single archive bundle for error reporting and troubleshooting. .DESCRIPTION Assists development teams in diagnosing issues with the ScubaGear assessment tool by generating and bundling up information related to one or more previous assessment runs. .EXAMPLE Debug-SCuBA .NOTES Executing the script with no switches will cause it to create an archive of the latest SCuBAGear run report and result files in the current working directory. #> [CmdletBinding()] param ( [Parameter(Mandatory=$false, HelpMessage = 'Directory to contain debug report')] [string] $ReportPath = "$($($(Get-Item $PSScriptRoot).Parent).FullName)\Reports", [Parameter(Mandatory=$false, HelpMessage = 'Include ScubaGear report on tenant configuration?')] [switch] $IncludeReports = $false, [Parameter(Mandatory=$false, HelpMessage = 'Include all available ScubaGear report on tenant configuration?')] [switch] $AllReports = $false ) $PreferenceStack = New-Object -TypeName System.Collections.Stack $PreferenceStack.Push($DebugPreference) $DebugPreference = 'Continue' # Set registry key to inspect $regPath = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client' $regKey = 'AllowBasic' $Timestamp = Get-Date -Format yyyyMMdd_HHmmss Write-Debug "Script started from $PSScriptRoot" Write-Debug "Report Path is $ReportPath" Write-Debug "Timestamp set as $Timestamp" ## Create bundle directory timestamped inside current directory try { $DiagnosticPath = New-Item -ItemType Directory "ScubaGear_diag_$Timestamp" Write-Debug "Created new directory $($DiagnosticPath.FullName)" $EnvFile= New-Item -Path $(Join-Path -Path $DiagnosticPath -ChildPath EnvInfo_$Timestamp) -ItemType File Write-Debug "Created new environment info file at $($EnvFile.FullName)" } catch { Write-Error "ERRROR: Could not create diagnostics directory and/or files." } ## Get environment information "System Environment information from $Timestamp`n" >> $EnvFile "PowerShell Information" >> $EnvFile "----------------------" >> $EnvFile $PSVersionTable >> $EnvFile "`n" >> $EnvFile "WinRM Client Setting" >> $EnvFile "--------------------" >> $EnvFile if (Test-Path -LiteralPath $regPath){ try { $allowBasic = Get-ItemPropertyValue -Path $regPath -Name $regKey } catch [System.Management.Automation.PSArgumentException]{ "Key, $regKey, was not found`n" >> $EnvFile } catch{ "Unexpected error occured attempting to get registry key, $regKey.`n" >> $EnvFile } "AllowBasic = $allowBasic`n" >> $EnvFile } else { "Registry path not found: $regPath" >> $EnvFile } "Installed PowerShell Modules Available" >> $EnvFile "--------------------------------------" >> $EnvFile Get-Module -ListAvailable >> $EnvFile "Imported PowerShell Modules" >> $EnvFile "---------------------------" >> $EnvFile Get-Module >> $EnvFile if($IncludeReports) { # Generate list of ScubaGear Report folder(s) to include in diagnostics $ReportList = @() if($AllReports) { $ReportList = Get-ChildItem -Directory -Path $ReportPath -Filter "M365BaselineConformance*" } else { $ReportList = Get-ChildItem -Directory -Path $ReportPath -Filter "M365BaselineConformance*" | Sort-Object LastWriteTime -Descending | Select-Object -First 1 } Write-Debug "Reports to Include: $ReportList" if($ReportList.Count -eq 0) { Write-Warning "No ScubaGear report folders found at $ReportPath." } # Copy each report folder to diagnostics folder foreach ($ReportFolder in $ReportList) { Write-Debug "Copying $($ReportFolder.FullName) to diagnostic bundle" Copy-Item -Path $ReportFolder.FullName -Destination $DiagnosticPath -Recurse } } # Create archive bundle of report and results directory $ZipFile = "$($DiagnosticPath.FullName).zip" if(Test-Path -Path $ZipFile) { Write-Error "ERROR: Diagnostic archive bundle $ZipFile already exists" } else { Compress-Archive -Path $DiagnosticPath.FullName -DestinationPath $ZipFile } $DebugPreference = $PreferenceStack.Pop() } function Copy-SCuBASampleReport { <# .SYNOPSIS Copy sample reports to user defined location. .Description This function makes copies of the sample reports included with the installed ScubaGear module. .Parameter Destination Where to copy the samples. Defaults to <user home>\ScubaGear\samples\reports .Example Copy-SCuBASampleReport .Functionality Public .NOTES SuppressMessage for PSReviewUnusedParameter due to linter bug. Open issue to remove if/when fixed. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '')] param ( [Parameter(Mandatory = $false)] [ValidateScript({Test-Path -Path $_ -IsValid})] [string] $DestinationDirectory = (Join-Path -Path $env:USERPROFILE -ChildPath "ScubaGear/samples/reports"), [Parameter(Mandatory = $false)] [switch] $Force ) $SourceDirectory = Join-Path -Path $PSScriptRoot -ChildPath "..\..\Sample-Reports\" Copy-ScubaModuleFile -SourceDirectory $SourceDirectory -DestinationDirectory $DestinationDirectory -Force:$Force } function Copy-SCuBASampleConfigFile { <# .SYNOPSIS Copy sample configuration files to user defined location. .Description This function makes copies of the sample configuration files included with the installed ScubaGear module. .Parameter Destination Where to copy the samples. Defaults to <user home>\ScubaGear\samples\config-files .Example Copy-SCuBASampleConfigFile .Functionality Public .NOTES SuppressMessage for PSReviewUnusedParameter due to linter bug. Open issue to remove if/when fixed. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '')] param ( [Parameter(Mandatory = $false)] [ValidateScript({Test-Path -Path $_ -IsValid})] [string] $DestinationDirectory = (Join-Path -Path $env:USERPROFILE -ChildPath "ScubaGear/samples/config-files"), [Parameter(Mandatory = $false)] [switch] $Force ) $SourceDirectory = Join-Path -Path $PSScriptRoot -ChildPath "..\..\Sample-Config-Files\" Copy-ScubaModuleFile -SourceDirectory $SourceDirectory -DestinationDirectory $DestinationDirectory -Force:$Force } function Copy-ScubaModuleFile { <# .SYNOPSIS Copy Scuba module files (read-only) to user defined location. .Description This function makes copies of files included with the installed ScubaGear module. .Parameter Destination Where to copy the files. .Example Copy-ScubaModuleFile =Destination SomeWhere .Functionality Private .NOTES SuppressMessage for PSReviewUnusedParameter due to linter bug. Open issue to remove if/when fixed. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '')] param ( [Parameter(Mandatory=$true)] [ValidateScript({Test-Path -Path $_ -PathType Container})] [string] $SourceDirectory, [Parameter(Mandatory = $true)] [ValidateScript({Test-Path -Path $_ -IsValid})] [string] $DestinationDirectory, [Parameter(Mandatory = $false)] [switch] $Force ) if (-not (Test-Path -Path $DestinationDirectory -PathType Container)){ New-Item -ItemType Directory -Path $DestinationDirectory | Out-Null } try { Get-ChildItem -Path $SourceDirectory | Copy-Item -Destination $DestinationDirectory -Recurse -Container -Force:$Force -ErrorAction Stop 2> $null Get-ChildItem -Path $DestinationDirectory -File -Recurse | ForEach-Object {$_.IsReadOnly = $true} } catch { throw "Scuba copy module files failed." } } function New-SCuBAConfig { <# .SYNOPSIS Generate a config file for the ScubaGear tool .Description Using provided user input generate a config file to run ScubaGear tailored to the end user .Parameter ProductNames A list of one or more M365 shortened product names that the tool will assess when it is executed. Acceptable product name values are listed below. To assess Azure Active Directory you would enter the value aad. To assess Exchange Online you would enter exo and so forth. - Azure Active Directory: aad - Defender for Office 365: defender - Exchange Online: exo - MS Power Platform: powerplatform - SharePoint Online: sharepoint - MS Teams: teams. Use '*' to run all baselines. .Parameter M365Environment This parameter is used to authenticate to the different commercial/government environments. Valid values include "commercial", "gcc", "gcchigh", or "dod". - For M365 tenants with E3/E5 licenses enter the value **"commercial"**. - For M365 Government Commercial Cloud tenants with G3/G5 licenses enter the value **"gcc"**. - For M365 Government Commercial Cloud High tenants enter the value **"gcchigh"**. - For M365 Department of Defense tenants enter the value **"dod"**. Default value is 'commercial'. .Parameter OPAPath The folder location of the OPA Rego executable file. The OPA Rego executable embedded with this project is located in the project's root folder. If you want to execute the tool using a version of OPA Rego located in another folder, then customize the variable value with the full path to the alternative OPA Rego exe file. .Parameter LogIn A `$true` or `$false` variable that if set to `$true` will prompt you to provide credentials if you want to establish a connection to the specified M365 products in the **$ProductNames** variable. For most use cases, leave this variable to be `$true`. A connection is established in the current PowerShell terminal session with the first authentication. If you want to run another verification in the same PowerShell session simply set this variable to be `$false` to bypass the reauthenticating in the same session. Default is $true. Note: defender will ask for authentication even if this variable is set to `$false` ;;;.Parameter Version ;;;Will output the current ScubaGear version to the terminal without running this cmdlet. .Parameter AppID The application ID of the service principal that's used during certificate based authentication. A valid value is the GUID of the application ID (service principal). .Parameter CertificateThumbprint The thumbprint value specifies the certificate that's used for certificate base authentication. The underlying PowerShell modules retrieve the certificate from the user's certificate store. As such, a copy of the certificate must be located there. .Parameter Organization Specify the organization that's used in certificate based authentication. Use the tenant's tenantname.onmicrosoft.com domain for the parameter value. .Parameter OutPath The folder path where both the output JSON and the HTML report will be created. The folder will be created if it does not exist. Defaults to current directory. .Parameter OutFolderName The name of the folder in OutPath where both the output JSON and the HTML report will be created. Defaults to "M365BaselineConformance". The client's local timestamp will be appended. .Parameter OutProviderFileName The name of the Provider output JSON created in the folder created in OutPath. Defaults to "ProviderSettingsExport". .Parameter OutRegoFileName The name of the Rego output JSON and CSV created in the folder created in OutPath. Defaults to "TestResults". .Parameter OutReportName The name of the main html file page created in the folder created in OutPath. Defaults to "BaselineReports". .Parameter DisconnectOnExit Set switch to disconnect all active connections on exit from ScubaGear (default: $false) .Parameter ConfigFilePath Local file path to a JSON or YAML formatted configuration file. Configuration file parameters can be used in place of command-line parameters. Additional parameters and variables not available on the command line can also be included in the file that will be provided to the tool for use in specific tests. .Parameter OmitPolicy A comma-separated list of policies to exclude from the ScubaGear report, e.g., MS.DEFENDER.1.1v1. Note that the rationales will need to be manually added to the resulting config file. .Functionality Public #> [CmdletBinding(DefaultParameterSetName='Report')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '')] param ( [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $Description = "YAML configuration file with default description", #(Join-Path -Path $env:USERPROFILE -ChildPath ".scubagear\Tools"), [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [ValidateSet("teams", "exo", "defender", "aad", "powerplatform", "sharepoint", '*', IgnoreCase = $false)] [string[]] $ProductNames = @("aad", "defender", "exo", "sharepoint", "teams"), [Parameter(Mandatory = $false)] [ValidateSet("commercial", "gcc", "gcchigh", "dod", IgnoreCase = $false)] [ValidateNotNullOrEmpty()] [string] $M365Environment = "commercial", [Parameter(Mandatory = $false)] [ValidateScript({Test-Path -PathType Container $_})] [string] $OPAPath = ".", #(Join-Path -Path $env:USERPROFILE -ChildPath ".scubagear\Tools"), [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [ValidateSet($true, $false)] [boolean] $LogIn = $true, [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [ValidateSet($true, $false)] [boolean] $DisconnectOnExit = $false, [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $OutPath = '.', [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $AppID, [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $CertificateThumbprint, [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $Organization, [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $OutFolderName = "M365BaselineConformance", [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $OutProviderFileName = "ProviderSettingsExport", [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $OutRegoFileName = "TestResults", [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $OutReportName = "BaselineReports", [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string] $ConfigLocation = "./", [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string[]] $OmitPolicy = @() ) $Config = New-Object ([System.Collections.specialized.OrderedDictionary]) ($MyInvocation.MyCommand.Parameters ).Keys | ForEach-Object{ $Val = (Get-Variable -Name $_ -EA SilentlyContinue).Value if( $Val.length -gt 0 ) { #$config[$_] = $val $Config.add($_, $Val) } } if ($config.Contains("OmitPolicy")) { # We don't want to immediately save this parameter to the config, as it's not in the right # format yet. $config.Remove("OmitPolicy") } $CapExclusionNamespace = @( "MS.AAD.1.1v1", "MS.AAD.2.1v1", "MS.AAD.2.3v1", "MS.AAD.3.1v1", "MS.AAD.3.2v1", "MS.AAD.3.3v1", "MS.AAD.3.6v1", "MS.AAD.3.7v1", "MS.AAD.3.8v1" ) $RoleExclusionNamespace = "MS.AAD.7.4v1" $CommonSensitiveAccountFilterNamespace = @( "MS.DEFENDER.1.4v1", "MS.DEFENDER.1.5v1" ) $UserImpersonationProtectionNamespace = "MS.DEFENDER.2.1v1" $AgencyDomainImpersonationProtectionNamespace = "MS.DEFENDER.2.2v1" $PartnerDomainImpersonationProtectionNamespace = "MS.DEFENDER.2.3v1" $OmissionNamespace = "OmitPolicy" # List to track which policies the user specified in $OmitPolicies are properly formatted $OmitPolicyValidated = @() # Hashmap to structure the ignored policies template $config[$OmissionNamespace] = @{} foreach ($Policy in $OmitPolicy) { if (-not ($Policy -match "^ms\.[a-z]+\.[0-9]+\.[0-9]+v[0-9]+$")) { # Note that -match is a case insensitive match # Note that the regex does not validate the product name, this will be done # later $Warning = "The policy, $Policy, in the OmitPolicy parameter, is not a valid " $Warning += "policy ID. Expected format 'MS.[PRODUCT].[GROUP].[NUMBER]v[VERSION]', " $Warning += "e.g., 'MS.DEFENDER.1.1v1'. Skipping." Write-Warning $Warning Continue } $Product = ($Policy -Split "\.")[1] # Here's where the product name is validated if (-not ($ProductNames -Contains $Product)) { $Warning = "The policy, $Policy, in the OmitPolicy parameter, is not encompassed by " $Warning += "the products specified in the ProductName parameter. Skipping." Write-Warning $Warning Continue } # Ensure the policy ID is properly capitalized (i.e., all caps except for the "v1" portion) $PolicyCapitalized = $Policy.Substring(0, $Policy.Length-2).ToUpper() + $Policy.SubString($Policy.Length-2) $OmitPolicyValidated += $PolicyCapitalized $config[$OmissionNamespace][$PolicyCapitalized] = @{ "Rationale" = ""; "Expiration" = ""; } } $Warning = "The following policies have been configured for omission: $($OmitPolicyValidated -Join ', '). " $Warning += "Note that as the New-Config function does not support providing the rationale for omission via " $Warning += "the commandline, you will need to open the resulting config file and manually enter the rationales." Write-Warning $Warning $AadTemplate = New-Object ([System.Collections.specialized.OrderedDictionary]) $AadCapExclusions = New-Object ([System.Collections.specialized.OrderedDictionary]) $AadRoleExclusions = New-Object ([System.Collections.specialized.OrderedDictionary]) $DefenderTemplate = New-Object ([System.Collections.specialized.OrderedDictionary]) $DefenderCommonSensitiveAccountFilter = New-Object ([System.Collections.specialized.OrderedDictionary]) #$defenderUserImpersonationProtection = New-Object ([System.Collections.specialized.OrderedDictionary]) #$defenderAgencyDomainImpersonationProtection = New-Object ([System.Collections.specialized.OrderedDictionary]) #$defenderPartnerDomainImpersonationProtection = New-Object ([System.Collections.specialized.OrderedDictionary]) $AadCapExclusions = @{ CapExclusions = @{} } $AadCapExclusions["CapExclusions"].add("Users", @("")) $AadCapExclusions["CapExclusions"].add("Groups", @("")) $AadRoleExclusions = @{ RoleExclusions = @{} } $AadRoleExclusions["RoleExclusions"].add("Users", @("")) $AadRoleExclusions["RoleExclusions"].add("Groups", @("")) foreach ($Cap in $CapExclusionNamespace){ $AadTemplate.add($Cap, $AadCapExclusions) } $AadTemplate.add($RoleExclusionNamespace, $AadRoleExclusions) $DefenderCommonSensitiveAccountFilter = @{ SensitiveAccounts = @{} } $DefenderCommonSensitiveAccountFilter['SensitiveAccounts'].add("IncludedUsers", @("")) $DefenderCommonSensitiveAccountFilter['SensitiveAccounts'].add("IncludedGroups", @("")) $DefenderCommonSensitiveAccountFilter['SensitiveAccounts'].add("IncludedDomains", @("")) $DefenderCommonSensitiveAccountFilter['SensitiveAccounts'].add("ExcludedUsers", @("")) $DefenderCommonSensitiveAccountFilter['SensitiveAccounts'].add("ExcludedGroups", @("")) $DefenderCommonSensitiveAccountFilter['SensitiveAccounts'].add("ExcludedDomains", @("")) foreach ($Filter in $CommonSensitiveAccountFilterNamespace){ $DefenderTemplate.add($Filter, $DefenderCommonSensitiveAccountFilter) } $DefenderTemplate.add($UserImpersonationProtectionNamespace, @{ SensitiveUsers = @("") }) $DefenderTemplate.add($AgencyDomainImpersonationProtectionNamespace, @{ AgencyDomains = @("") }) $DefenderTemplate.add($PartnerDomainImpersonationProtectionNamespace, @{ PartnerDomains = @("") }) $Products = (Get-Variable -Name ProductNames -EA SilentlyContinue).Value foreach ($Product in $Products){ switch ($Product){ "aad" { $config.add("Aad", $AadTemplate) } "defender" { $config.add("Defender", $DefenderTemplate) } } } convertto-yaml $Config | set-content "$($ConfigLocation)/SampleConfig.yaml" } Export-ModuleMember -Function @( 'Copy-SCuBABaselineDocument', 'Install-OPAforSCuBA', 'Initialize-SCuBA', 'Debug-SCuBA', 'Copy-SCuBASampleReport', 'Copy-SCuBASampleConfigFile', 'New-SCuBAConfig' ) # SIG # Begin signature block # MIIuugYJKoZIhvcNAQcCoIIuqzCCLqcCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBtuo/7Bq4kBYoX # rRMX8rlP/68XtqFsGsaYb0zHvDwDuaCCE6MwggWQMIIDeKADAgECAhAFmxtXno4h # MuI5B72nd3VcMA0GCSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQK # EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNV # BAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0xMzA4MDExMjAwMDBaFw0z # ODAxMTUxMjAwMDBaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ # bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0 # IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB # AL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3EMB/z # G6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKyunWZ # anMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsFxl7s # Wxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU15zHL # 2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJBMtfb # BHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObURWBf3 # JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6nj3c # AORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxBYKqx # YxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5SUUd0 # viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+xq4aL # T8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjQjBAMA8GA1Ud # EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBTs1+OC0nFdZEzf # Lmc/57qYrhwPTzANBgkqhkiG9w0BAQwFAAOCAgEAu2HZfalsvhfEkRvDoaIAjeNk # aA9Wz3eucPn9mkqZucl4XAwMX+TmFClWCzZJXURj4K2clhhmGyMNPXnpbWvWVPjS # PMFDQK4dUPVS/JA7u5iZaWvHwaeoaKQn3J35J64whbn2Z006Po9ZOSJTROvIXQPK # 7VB6fWIhCoDIc2bRoAVgX+iltKevqPdtNZx8WorWojiZ83iL9E3SIAveBO6Mm0eB # cg3AFDLvMFkuruBx8lbkapdvklBtlo1oepqyNhR6BvIkuQkRUNcIsbiJeoQjYUIp # 5aPNoiBB19GcZNnqJqGLFNdMGbJQQXE9P01wI4YMStyB0swylIQNCAmXHE/A7msg # dDDS4Dk0EIUhFQEI6FUy3nFJ2SgXUE3mvk3RdazQyvtBuEOlqtPDBURPLDab4vri # RbgjU2wGb2dVf0a1TD9uKFp5JtKkqGKX0h7i7UqLvBv9R0oN32dmfrJbQdA75PQ7 # 9ARj6e/CVABRoIoqyc54zNXqhwQYs86vSYiv85KZtrPmYQ/ShQDnUBrkG5WdGaG5 # nLGbsQAe79APT0JsyQq87kP6OnGlyE0mpTX9iV28hWIdMtKgK1TtmlfB2/oQzxm3 # i0objwG2J5VT6LaJbVu8aNQj6ItRolb58KaAoNYes7wPD1N1KarqE3fk3oyBIa0H # EEcRrYc9B9F1vM/zZn4wggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0G # CSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ # bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0 # IFRydXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTla # MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE # AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz # ODQgMjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C # 0CiteLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce # 2vnS1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0da # E6ZMswEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6T # SXBCMo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoA # FdE3/hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7Oh # D26jq22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM # 1bL5OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z # 8ujo7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05 # huzUtw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNY # mtwmKwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP # /2NPTLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0T # AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYD # VR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMG # A1UdJQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYY # aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2Fj # ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNV # HR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRU # cnVzdGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATAN # BgkqhkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95Ry # sQDKr2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HL # IvdaqpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5Btf # Q/g+lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnh # OE7abrs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIh # dXNSy0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV # 9zeKiwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/j # wVYbKyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYH # Ki8QxAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmC # XBVmzGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l # /aCnHwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZW # eE4wggdXMIIFP6ADAgECAhANkQ8dPvvR0q3Ytt4H0T3aMA0GCSqGSIb3DQEBCwUA # MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE # AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz # ODQgMjAyMSBDQTEwHhcNMjQwMTMwMDAwMDAwWhcNMjUwMTI5MjM1OTU5WjBfMQsw # CQYDVQQGEwJVUzEdMBsGA1UECBMURGlzdHJpY3Qgb2YgQ29sdW1iaWExEzARBgNV # BAcTCldhc2hpbmd0b24xDTALBgNVBAoTBENJU0ExDTALBgNVBAMTBENJU0EwggIi # MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCT1y7uJCQax8JfiDEYgpiU9URj # EXCTRqtZbDALM9rPUudiuM3mj6A1SUSAAWYv6DTsvGPvxyMI2Idg0mQunl4Ms9DJ # yVwe5k4+Anj/73Nx1AbOPYP8xRZcD10FkctKGhV0PzvrDcwU15hsQWtiepFgg+bX # fHkGMeu426oc69f43vKE43DiqKTf0/UBX/qgpj3JZvJ3zc1kilBOv4sBCksfCjbW # tLZD0tqAgBsNPo3Oy5mQG31E1eZdTNvrdTnEXacSwb3k615z7mHy7nqBUkOruZ9E # tnvC2qla+uL3ks91O/e/LnKzH9Lj1JmEBf6jwPN/MYR9Dymni4Mi3AQ8mpQMyFmi # XcSHymibSNbtTMavpdBWjFfrcvPETX7krROUOoLzMQmNgHArceSh55tgvDRdSU5c # WK3BTvK3l3mgCdgjre7XGYxV3W8apyxk5+RKfHdbv9cpRwpSuDnI8sHeqmB3fnfo # Cr1PPu4WhKegt20CobhDVybiBdhDVqUdR53ful4N/coQOEHDrIExB5nJf9Pvdrza # DyIGKAMIXD79ba5/rQEo+2cA66oJkPlvB5hEGI/jtDcYwDBgalbwB7Kc8zAAhl6+ # JvHfYpXOkppSfEQbaRXZI+LGXWQAFa5pJDfDEAyZSXprStgw594sWUOysp+UOxFe # kSA4mBr0o1jVpdaulwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8R # hvv+YXsIiGX0TkIwHQYDVR0OBBYEFAmyTB5bcWyA+8+rq540jPRLJ1nYMD4GA1Ud # IAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNl # cnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMw # gbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0Rp # Z2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5j # cmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0 # ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEF # BQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t # MFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl # cnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJ # BgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQAh2Jnt9IPoBvOQlYQUlCP9iJ5y # XAvEWe1camOwedqMZsHEPpT2yd6+fMzPZmV3/bYJgaN2OrDS1snf62S7yc+AulVw # PAXSp1lSAiFEbZ6PFEdEBIag9B65Mp/cvRtJsIWQIc//jWqFMHpkU6r3MW9YARRu # vaIf5/0qlM4VEwn3lTf+jJdxhhyoOFTWWd3BrlMPcT06z6F6hFfyycQkZ3Y9wEJ3 # uOU9bCNLZL1HCjlKT+oI0WsgeRdbe2sYrnvv9NmDY9oEi8PEq+DGjiTgLbY5OcAX # uUogPPw6gbcuNn8Hq6FFKPIQxaksB8dF8Gw4m2lQoUWESPRF8Zaq9lmZN3+QzA79 # yskfJtAFqz3gUP5wJBdNfi/u1sGbLI0QnJQkIKfFuz7DfDPldw0gIl05BIYwZBmj # TpFRu1/+gIlP1Ul4L/wt9Lxk6pglObLsdxHP2UQrG30JaUN0gv3xZMBBByHGVVTe # cyU4qwJ0ulMdv/kjHwh+m58uOF8gHXLfyBmOjYpohN3+l0rS0qdArZMNSmLTA7N8 # n3V3AZLKB//1yhPt++gR4pCFdXmgwYDDLRxjlV0cMsG1UeSQUdI0aieh/grg5TQO # CergVXS5h3sz5U0ZQPWND41LJhA0gF2OGZNHdUc9+0dwTsfxAERrjaTdeZp0/rdZ # 9iGBoiRsS4U86S8xkDGCGm0wghppAgEBMH0waTELMAkGA1UEBhMCVVMxFzAVBgNV # BAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0 # IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMQIQDZEPHT770dKt # 2LbeB9E92jANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKACgACh # AoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAM # BgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCBc15sdn5soHzVJkBs58pwqNPIC # lkhkG1zuYlslLVyb4DANBgkqhkiG9w0BAQEFAASCAgBV+uFwr040EuDL+oTY2Hrm # RtXM9Po9Q/FkzWrvy6eD3+b2ZLcVfsus/B2k3O0wqiqbKkg9dt8lEPtMfVlAlXCA # yOEseTuDuj0nlzYRHoVatbxLF2L5nCobFnQBh+u+w4qknt+1e8roWZFxaTN04mbK # j7D3kzA5kM6ozF/HSFpqd4vEjU5mqeErQyibWsqgNl+7STAlSbiL8PXQwEe3Plcl # qeOQTDxghW2XBnVyE0Dg1cKkz4iotTUh+adUCWkYkZxRmZI0XQJCv5FskSqN8usA # ZVZxeJ43jGSiarjd3zWlIqtY3A0mskjZdy0lm7uTaFVDaVdoralmTGrPnzm7gNqy # n/5bRljQHyjOlTEGsExaeWCoJUshlTSH4MrRcdsulnZm3T7zP7TI95JTa6CYw89k # tLlAbIOBJznxoAoFlCvOYom/U1ILXL5Qb2wl3UeqD+KlO/1Uw3zBkz/usaypxrV9 # V16SEP44yvpQLaJwgypre0YGIw0O+Uc2w/BwBck7jXErUdT+OfRep9AViHztIpOv # /vAF/SReeNsWbq9+a6fVmMo3myM74XKn4ZOnEbKOTmCAgDGADIdoIuarkhtiei0Q # cIcU00BYdtIUGEmMqiL9z4krl2Jv5yOeWuPxqTiNvCdoU2yAuj6b/+UOpRn0uunE # 7hC4nBoR0f+D7gwAcTqU9KGCFzowghc2BgorBgEEAYI3AwMBMYIXJjCCFyIGCSqG # SIb3DQEHAqCCFxMwghcPAgEDMQ8wDQYJYIZIAWUDBAIBBQAweAYLKoZIhvcNAQkQ # AQSgaQRnMGUCAQEGCWCGSAGG/WwHATAxMA0GCWCGSAFlAwQCAQUABCC2zhNQgrNU # N7eZf4UlD8HRrT2G6sjvs/QLu3JyKEQ4pgIRAPkY4SnpBFEvH8vyCIhaOOgYDzIw # MjQxMDExMTUxMTEwWqCCEwMwgga8MIIEpKADAgECAhALrma8Wrp/lYfG+ekE4zME # MA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2Vy # dCwgSW5jLjE7MDkGA1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNI # QTI1NiBUaW1lU3RhbXBpbmcgQ0EwHhcNMjQwOTI2MDAwMDAwWhcNMzUxMTI1MjM1 # OTU5WjBCMQswCQYDVQQGEwJVUzERMA8GA1UEChMIRGlnaUNlcnQxIDAeBgNVBAMT # F0RpZ2lDZXJ0IFRpbWVzdGFtcCAyMDI0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A # MIICCgKCAgEAvmpzn/aVIauWMLpbbeZZo7Xo/ZEfGMSIO2qZ46XB/QowIEMSvgjE # dEZ3v4vrrTHleW1JWGErrjOL0J4L0HqVR1czSzvUQ5xF7z4IQmn7dHY7yijvoQ7u # jm0u6yXF2v1CrzZopykD07/9fpAT4BxpT9vJoJqAsP8YuhRvflJ9YeHjes4fduks # THulntq9WelRWY++TFPxzZrbILRYynyEy7rS1lHQKFpXvo2GePfsMRhNf1F41nyE # g5h7iOXv+vjX0K8RhUisfqw3TTLHj1uhS66YX2LZPxS4oaf33rp9HlfqSBePejlY # eEdU740GKQM7SaVSH3TbBL8R6HwX9QVpGnXPlKdE4fBIn5BBFnV+KwPxRNUNK6lY # k2y1WSKour4hJN0SMkoaNV8hyyADiX1xuTxKaXN12HgR+8WulU2d6zhzXomJ2Ple # I9V2yfmfXSPGYanGgxzqI+ShoOGLomMd3mJt92nm7Mheng/TBeSA2z4I78JpwGpT # RHiT7yHqBiV2ngUIyCtd0pZ8zg3S7bk4QC4RrcnKJ3FbjyPAGogmoiZ33c1HG93V # p6lJ415ERcC7bFQMRbxqrMVANiav1k425zYyFMyLNyE1QulQSgDpW9rtvVcIH7Wv # G9sqYup9j8z9J1XqbBZPJ5XLln8mS8wWmdDLnBHXgYly/p1DhoQo5fkCAwEAAaOC # AYswggGHMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQM # MAoGCCsGAQUFBwMIMCAGA1UdIAQZMBcwCAYGZ4EMAQQCMAsGCWCGSAGG/WwHATAf # BgNVHSMEGDAWgBS6FtltTYUvcyl2mi91jGogj57IbzAdBgNVHQ4EFgQUn1csA3cO # KBWQZqVjXu5Pkh92oFswWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2NybDMuZGln # aWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5NlNIQTI1NlRpbWVTdGFt # cGluZ0NBLmNybDCBkAYIKwYBBQUHAQEEgYMwgYAwJAYIKwYBBQUHMAGGGGh0dHA6 # Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBYBggrBgEFBQcwAoZMaHR0cDovL2NhY2VydHMu # ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5NlNIQTI1NlRpbWVT # dGFtcGluZ0NBLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAPa0eH3aZW+M4hBJH2UOR # 9hHbm04IHdEoT8/T3HuBSyZeq3jSi5GXeWP7xCKhVireKCnCs+8GZl2uVYFvQe+p # PTScVJeCZSsMo1JCoZN2mMew/L4tpqVNbSpWO9QGFwfMEy60HofN6V51sMLMXNTL # fhVqs+e8haupWiArSozyAmGH/6oMQAh078qRh6wvJNU6gnh5OruCP1QUAvVSu4kq # VOcJVozZR5RRb/zPd++PGE3qF1P3xWvYViUJLsxtvge/mzA75oBfFZSbdakHJe2B # VDGIGVNVjOp8sNt70+kEoMF+T6tptMUNlehSR7vM+C13v9+9ZOUKzfRUAYSyyEmY # tsnpltD/GWX8eM70ls1V6QG/ZOB6b6Yum1HvIiulqJ1Elesj5TMHq8CWT/xrW7tw # ipXTJ5/i5pkU5E16RSBAdOp12aw8IQhhA/vEbFkEiF2abhuFixUDobZaA0VhqAsM # HOmaT3XThZDNi5U2zHKhUs5uHHdG6BoQau75KiNbh0c+hatSF+02kULkftARjsyE # pHKsF7u5zKRbt5oK5YGwFvgc4pEVUNytmB3BpIiowOIIuDgP5M9WArHYSAR16gc0 # dP2XdkMEP5eBsX7bf/MGN4K3HP50v/01ZHo/Z5lGLvNwQ7XHBx1yomzLP8lx4Q1z # ZKDyHcp4VQJLu2kWTsKsOqQwggauMIIElqADAgECAhAHNje3JFR82Ees/ShmKl5b # MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy # dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD # ZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yMjAzMjMwMDAwMDBaFw0zNzAzMjIyMzU5 # NTlaMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjE7MDkG # A1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNIQTI1NiBUaW1lU3Rh # bXBpbmcgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGhjUGSbPB # PXJJUVXHJQPE8pE3qZdRodbSg9GeTKJtoLDMg/la9hGhRBVCX6SI82j6ffOciQt/ # nR+eDzMfUBMLJnOWbfhXqAJ9/UO0hNoR8XOxs+4rgISKIhjf69o9xBd/qxkrPkLc # Z47qUT3w1lbU5ygt69OxtXXnHwZljZQp09nsad/ZkIdGAHvbREGJ3HxqV3rwN3mf # XazL6IRktFLydkf3YYMZ3V+0VAshaG43IbtArF+y3kp9zvU5EmfvDqVjbOSmxR3N # Ng1c1eYbqMFkdECnwHLFuk4fsbVYTXn+149zk6wsOeKlSNbwsDETqVcplicu9Yem # j052FVUmcJgmf6AaRyBD40NjgHt1biclkJg6OBGz9vae5jtb7IHeIhTZgirHkr+g # 3uM+onP65x9abJTyUpURK1h0QCirc0PO30qhHGs4xSnzyqqWc0Jon7ZGs506o9UD # 4L/wojzKQtwYSH8UNM/STKvvmz3+DrhkKvp1KCRB7UK/BZxmSVJQ9FHzNklNiyDS # LFc1eSuo80VgvCONWPfcYd6T/jnA+bIwpUzX6ZhKWD7TA4j+s4/TXkt2ElGTyYwM # O1uKIqjBJgj5FBASA31fI7tk42PgpuE+9sJ0sj8eCXbsq11GdeJgo1gJASgADoRU # 7s7pXcheMBK9Rp6103a50g5rmQzSM7TNsQIDAQABo4IBXTCCAVkwEgYDVR0TAQH/ # BAgwBgEB/wIBADAdBgNVHQ4EFgQUuhbZbU2FL3MpdpovdYxqII+eyG8wHwYDVR0j # BBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1Ud # JQQMMAoGCCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0 # cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0 # cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8E # PDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVz # dGVkUm9vdEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgBhv1sBwEw # DQYJKoZIhvcNAQELBQADggIBAH1ZjsCTtm+YqUQiAX5m1tghQuGwGC4QTRPPMFPO # vxj7x1Bd4ksp+3CKDaopafxpwc8dB+k+YMjYC+VcW9dth/qEICU0MWfNthKWb8RQ # TGIdDAiCqBa9qVbPFXONASIlzpVpP0d3+3J0FNf/q0+KLHqrhc1DX+1gtqpPkWae # LJ7giqzl/Yy8ZCaHbJK9nXzQcAp876i8dU+6WvepELJd6f8oVInw1YpxdmXazPBy # oyP6wCeCRK6ZJxurJB4mwbfeKuv2nrF5mYGjVoarCkXJ38SNoOeY+/umnXKvxMfB # wWpx2cYTgAnEtp/Nh4cku0+jSbl3ZpHxcpzpSwJSpzd+k1OsOx0ISQ+UzTl63f8l # Y5knLD0/a6fxZsNBzU+2QJshIUDQtxMkzdwdeDrknq3lNHGS1yZr5Dhzq6YBT70/ # O3itTK37xJV77QpfMzmHQXh6OOmc4d0j/R0o08f56PGYX/sr2H7yRp11LB4nLCbb # bxV7HhmLNriT1ObyF5lZynDwN7+YAN8gFk8n+2BnFqFmut1VwDophrCYoCvtlUG3 # OtUVmDG0YgkPCr2B2RP+v6TR81fZvAT6gt4y3wSJ8ADNXcL50CN/AAvkdgIm2fBl # dkKmKYcJRyvmfxqkhQ/8mJb2VVQrH4D6wPIOK+XW+6kvRBVK5xMOHds3OBqhK/bt # 1nz8MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG9w0BAQwF # ADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQL # ExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElE # IFJvb3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBiMQswCQYD # VQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGln # aWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIi # MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKn # JS7JIT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/W # BTxSD1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHi # LQwb7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhm # V1efVFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHE # tWoYOAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6 # MUSaM0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mX # aXpI8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZ # xd9LBADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfh # vbfmQ6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvl # EFDrMcXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn1 # 5GkvmB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV # HQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReuir/SSy4Ix # LVGLp6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0wazAkBggr # BgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdo # dHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290 # Q0EuY3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNv # bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAGBgRVHSAA # MA0GCSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9mqyhhyzs # hV6pGrsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxSA8hO0Cre # +i1Wz/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/6Fmo8L8v # C6bp8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSMb++hUD38 # dglohJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt9H5xaiNr # Iv8SuFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmUMYIDdjCCA3ICAQEw # dzBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xOzA5BgNV # BAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNBNDA5NiBTSEEyNTYgVGltZVN0YW1w # aW5nIENBAhALrma8Wrp/lYfG+ekE4zMEMA0GCWCGSAFlAwQCAQUAoIHRMBoGCSqG # SIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcNMjQxMDExMTUx # MTEwWjArBgsqhkiG9w0BCRACDDEcMBowGDAWBBTb04XuYtvSPnvk9nFIUIck1YZb # RTAvBgkqhkiG9w0BCQQxIgQgXIZMe3mIEzsLZ+E8Wn8QfwVWI5dWpQclqDfdJuIY # j8MwNwYLKoZIhvcNAQkQAi8xKDAmMCQwIgQgdnafqPJjLx9DCzojMK7WVnX+13Pb # BdZluQWTmEOPmtswDQYJKoZIhvcNAQEBBQAEggIALE8vIp5aaQqu09Vy4pAWmqzQ # sP2bniFd+wQoLJP4eBZSNAT/cxz4+EiJPktD686JTH3BCKPZ4k0Hrge98WjjOHEC # 4MeXL5oHXmtrqg2/amj39kRm/q7Atv1EyEGKzbTVZD0tL08rwhEmpIBHvpK/uLau # AI4lPPPjUhC2Qv/XyLKVUIgshqsTRI3lAaX7AIOnpKCvDuk1z5sxKpxRVFnW6AyP # 9LBxQvRabAh+tPgW+ikzs8l1UAMQC0trEWVtxW5N/RsNUgsK0bEdJVeSXcW9Rsfn # 85BYyIH8NIStHHiTOa771RTxVF0tw+PiHo136k2QY5mpMb4jHBw/EUiJirWrBuFu # 6KZadoqT46acZR40+jvCgSXSgsCaZpTt2PikX8KMosakf0oV2tzHExy2XeVZ9UD1 # ZrKFO+tjjJvXEq0yBrqNO+P3CQieUfgEr1CYekdbz1y4f2KXxZBpdfuSRLjKhaGT # HbDvVaKPFqydmYQOk+xwLWoC15rAUnDAzFKqxPgEcKnCBVm634dbwZQepZ3y95qr # SiTSISQUJMjgZCYHIJ/EHWGma/QFZdx6pZas81eDqoDk5O3f1ezygMRgzfbNULgW # hwHTQJ6GURr3ytfCTO4wsdx4K6nbmpme3dkwYEN4jT+cci0SbQmt5G0wFQvXTw+Z # /cBNzSJdTxl+/I4IEAo= # SIG # End signature block |