From 0ad762641070c2a7325c959eb63f1a7d72a5dc30 Mon Sep 17 00:00:00 2001 From: sdolgin Date: Wed, 15 Nov 2023 02:14:38 +0000 Subject: [PATCH] [create-pull-request] automated change --- checklists/azurespringapps_checklist.en.json | 169 +- checklists/azurespringapps_checklist.es.json | 150 ++ checklists/azurespringapps_checklist.ja.json | 150 ++ checklists/azurespringapps_checklist.ko.json | 150 ++ checklists/azurespringapps_checklist.pt.json | 150 ++ checklists/checklist.en.master.json | 2294 +++++++++-------- .../azurespringapps_checklist.en.xlsx | Bin 0 -> 19803 bytes .../azurespringapps_checklist.es.xlsx | Bin 0 -> 19995 bytes .../azurespringapps_checklist.ja.xlsx | Bin 0 -> 20383 bytes .../azurespringapps_checklist.ko.xlsx | Bin 0 -> 20393 bytes .../azurespringapps_checklist.pt.xlsx | Bin 0 -> 20016 bytes .../macrofree/checklist.en.master.xlsx | Bin 283698 -> 284940 bytes .../alz_checklist.en_network_counters.json | 444 ++-- ...hecklist.en_network_counters_template.json | 2 +- .../alz_checklist.en_network_tabcounters.json | 1340 +++++----- ...klist.en_network_tabcounters_template.json | 2 +- .../alz_checklist.en_network_workbook.json | 484 ++-- ...hecklist.en_network_workbook_template.json | 2 +- 18 files changed, 3020 insertions(+), 2317 deletions(-) create mode 100644 checklists/azurespringapps_checklist.es.json create mode 100644 checklists/azurespringapps_checklist.ja.json create mode 100644 checklists/azurespringapps_checklist.ko.json create mode 100644 checklists/azurespringapps_checklist.pt.json create mode 100644 spreadsheet/macrofree/azurespringapps_checklist.en.xlsx create mode 100644 spreadsheet/macrofree/azurespringapps_checklist.es.xlsx create mode 100644 spreadsheet/macrofree/azurespringapps_checklist.ja.xlsx create mode 100644 spreadsheet/macrofree/azurespringapps_checklist.ko.xlsx create mode 100644 spreadsheet/macrofree/azurespringapps_checklist.pt.xlsx diff --git a/checklists/azurespringapps_checklist.en.json b/checklists/azurespringapps_checklist.en.json index e1ac9943b..23802d409 100644 --- a/checklists/azurespringapps_checklist.en.json +++ b/checklists/azurespringapps_checklist.en.json @@ -1,86 +1,86 @@ { - "items": [ - { - "category": "BC and DR", - "subcategory": "High Availability", - "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", - "waf": "Reliability", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps" - }, - { - "category": "Application Deployment", - "subcategory": "DevOps", - "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", - "waf": "Reliability", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies" - }, - { - "category": "Operations", - "subcategory": "Monitoring", - "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", - "waf": "Reliability", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services" - }, - { - "category": "BC and DR", - "subcategory": "Disaster Recovery", - "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", - "waf": "Reliability", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region" - }, - { - "category": "Operations", - "subcategory": "Scalability", - "text": "Set up autoscaling in Spring Cloud Gateway", - "waf": "Reliability", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway" - }, - { - "category": "Operations", - "subcategory": "Support", - "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", - "waf": "Reliability", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/spring-apps/overview" - }, - { - "category": "Operations", - "subcategory": "Scalability", - "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", - "waf": "Reliability", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "cost": 1, - "severity": "Low", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale" - }, - { - "category": "BC and DR", - "subcategory": "High Availability", - "text": "Use more than 1 app instance for your apps", - "waf": "Reliability", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "cost": 1, - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment" - } - ], + "items": [ + { + "category": "Application Deployment", + "subcategory": "DevOps", + "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", + "waf": "Reliability", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies" + }, + { + "category": "BC and DR", + "subcategory": "Disaster Recovery", + "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", + "waf": "Reliability", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region" + }, + { + "category": "BC and DR", + "subcategory": "High Availability", + "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", + "waf": "Reliability", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps" + }, + { + "category": "BC and DR", + "subcategory": "High Availability", + "text": "Use more than 1 app instance for your apps", + "waf": "Reliability", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment" + }, + { + "category": "Operations", + "subcategory": "Monitoring", + "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", + "waf": "Reliability", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services" + }, + { + "category": "Operations", + "subcategory": "Scalability", + "text": "Set up autoscaling in Spring Cloud Gateway", + "waf": "Reliability", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway" + }, + { + "category": "Operations", + "subcategory": "Scalability", + "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", + "waf": "Reliability", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "cost": 1, + "severity": "Low", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale" + }, + { + "category": "Operations", + "subcategory": "Support", + "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", + "waf": "Reliability", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "cost": 1, + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/spring-apps/overview" + } + ], "categories": [ { "name": "BC and DR" @@ -145,7 +145,6 @@ "metadata": { "name": "Azure Spring Apps Review", "state": "Preview", - "timestamp": "November 14, 2023" + "timestamp": "November 15, 2023" } - -} +} \ No newline at end of file diff --git a/checklists/azurespringapps_checklist.es.json b/checklists/azurespringapps_checklist.es.json new file mode 100644 index 000000000..dd2c44112 --- /dev/null +++ b/checklists/azurespringapps_checklist.es.json @@ -0,0 +1,150 @@ +{ + "categories": [ + { + "name": "BC y DR" + }, + { + "name": "Operaciones" + }, + { + "name": "Implementación de aplicaciones" + } + ], + "items": [ + { + "category": "Implementación de aplicaciones", + "cost": 1, + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "severity": "Medio", + "subcategory": "DevOps (Operaciones de desarrollo)", + "text": "Azure Spring Apps permite dos implementaciones para cada aplicación, de las cuales solo una recibe tráfico de producción. Puede lograr cero tiempo de inactividad con estrategias de implementación azul verde. La implementación azul verde solo está disponible en los niveles Estándar y Enterprise. Puede automatizar la implementación mediante CI/CD con acciones de ADO/GitHub", + "waf": "Fiabilidad" + }, + { + "category": "BC y DR", + "cost": 1, + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "severity": "Medio", + "subcategory": "Recuperación ante desastres", + "text": "Las instancias de Azure Spring Apps se pueden crear en varias regiones para las aplicaciones y el tráfico se puede enrutar mediante Traffic Manager o Front Door.", + "waf": "Fiabilidad" + }, + { + "category": "BC y DR", + "cost": 1, + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "severity": "Medio", + "subcategory": "Alta disponibilidad", + "text": "En la región admitida, Azure Spring Apps se puede implementar como zona redundante, lo que significa que las instancias se distribuyen automáticamente entre las zonas de disponibilidad. Esta función solo está disponible en los niveles Standard y Enterprise.", + "waf": "Fiabilidad" + }, + { + "category": "BC y DR", + "cost": 1, + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "severity": "Medio", + "subcategory": "Alta disponibilidad", + "text": "Usar más de 1 instancia de aplicación para las aplicaciones", + "waf": "Fiabilidad" + }, + { + "category": "Operaciones", + "cost": 1, + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "severity": "Medio", + "subcategory": "Monitorización", + "text": "Supervise Azure Spring Apps con registros, métricas y seguimiento. Integre ASA con la información de las aplicaciones, realice un seguimiento de los errores y cree libros de trabajo.", + "waf": "Fiabilidad" + }, + { + "category": "Operaciones", + "cost": 1, + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "severity": "Medio", + "subcategory": "Escalabilidad", + "text": "Configuración del escalado automático en Spring Cloud Gateway", + "waf": "Fiabilidad" + }, + { + "category": "Operaciones", + "cost": 1, + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "severity": "Bajo", + "subcategory": "Escalabilidad", + "text": "Habilite el escalado automático para las aplicaciones con el consumo estándar y el plan dedicado.", + "waf": "Fiabilidad" + }, + { + "category": "Operaciones", + "cost": 1, + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "severity": "Medio", + "subcategory": "Apoyo", + "text": "Use el plan Enterprise para obtener soporte comercial de Spring Boot para aplicaciones de misión crítica. Con otros niveles, obtienes soporte OSS.", + "waf": "Fiabilidad" + } + ], + "metadata": { + "name": "Azure Spring Apps Review", + "state": "Preview", + "timestamp": "November 15, 2023" + }, + "severities": [ + { + "name": "Alto" + }, + { + "name": "Medio" + }, + { + "name": "Bajo" + } + ], + "status": [ + { + "description": "Esta comprobación aún no se ha examinado", + "name": "No verificado" + }, + { + "description": "Hay un elemento de acción asociado a esta comprobación", + "name": "Abrir" + }, + { + "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella", + "name": "Cumplido" + }, + { + "description": "Recomendación entendida, pero no necesaria por los requisitos actuales", + "name": "No es necesario" + }, + { + "description": "No aplicable para el diseño actual", + "name": "N/A" + } + ], + "waf": [ + { + "name": "Fiabilidad" + }, + { + "name": "Seguridad" + }, + { + "name": "Costar" + }, + { + "name": "Operaciones" + }, + { + "name": "Rendimiento" + } + ] +} \ No newline at end of file diff --git a/checklists/azurespringapps_checklist.ja.json b/checklists/azurespringapps_checklist.ja.json new file mode 100644 index 000000000..7afe18fef --- /dev/null +++ b/checklists/azurespringapps_checklist.ja.json @@ -0,0 +1,150 @@ +{ + "categories": [ + { + "name": "BCとDR" + }, + { + "name": "オペレーションズ" + }, + { + "name": "アプリケーションの展開" + } + ], + "items": [ + { + "category": "アプリケーションの展開", + "cost": 1, + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "severity": "中程度", + "subcategory": "DevOpsの", + "text": "Azure Spring Apps では、アプリごとに 2 つのデプロイが許可され、そのうちの 1 つだけが運用トラフィックを受信します。ブルーグリーンデプロイ戦略により、ダウンタイムをゼロにすることができます。ブルー グリーン デプロイは、Standard レベルと Enterprise レベルでのみ使用できます。CI/CD と ADO/GitHub Actions を使用してデプロイを自動化できます", + "waf": "確実" + }, + { + "category": "BCとDR", + "cost": 1, + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "severity": "中程度", + "subcategory": "災害復旧", + "text": "Azure Spring Apps インスタンスは、アプリケーション用に複数のリージョンに作成でき、トラフィックは Traffic Manager/Front Door によってルーティングできます。", + "waf": "確実" + }, + { + "category": "BCとDR", + "cost": 1, + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "severity": "中程度", + "subcategory": "高可用性", + "text": "サポートされているリージョンでは、Azure Spring Apps をゾーン冗長としてデプロイできるため、インスタンスは可用性ゾーン間で自動的に分散されます。この機能は、Standard レベルと Enterprise レベルでのみ使用できます。", + "waf": "確実" + }, + { + "category": "BCとDR", + "cost": 1, + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "severity": "中程度", + "subcategory": "高可用性", + "text": "アプリに複数のアプリ インスタンスを使用する", + "waf": "確実" + }, + { + "category": "オペレーションズ", + "cost": 1, + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "severity": "中程度", + "subcategory": "モニタリング", + "text": "Azure Spring Apps をログ、メトリック、トレースで監視します。ASA を Application Insights と統合し、障害を追跡し、ブックを作成します。", + "waf": "確実" + }, + { + "category": "オペレーションズ", + "cost": 1, + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "severity": "中程度", + "subcategory": "拡張性", + "text": "Spring Cloud Gateway で自動スケーリングを設定する", + "waf": "確実" + }, + { + "category": "オペレーションズ", + "cost": 1, + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "severity": "低い", + "subcategory": "拡張性", + "text": "Standard 従量課金プランと専用プランのアプリの自動スケーリングを有効にします。", + "waf": "確実" + }, + { + "category": "オペレーションズ", + "cost": 1, + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "severity": "中程度", + "subcategory": "支える", + "text": "ミッション クリティカルなアプリの Spring Boot の商用サポートには、Enterprise プランを使用します。他のレベルでは、OSS のサポートを受けることができます。", + "waf": "確実" + } + ], + "metadata": { + "name": "Azure Spring Apps Review", + "state": "Preview", + "timestamp": "November 15, 2023" + }, + "severities": [ + { + "name": "高い" + }, + { + "name": "中程度" + }, + { + "name": "低い" + } + ], + "status": [ + { + "description": "このチェックはまだ検討されていません", + "name": "未確認" + }, + { + "description": "このチェックにはアクションアイテムが関連付けられています", + "name": "開ける" + }, + { + "description": "このチェックは検証済みで、これ以上のアクションアイテムは関連付けられていません", + "name": "達成" + }, + { + "description": "推奨事項は理解されているが、現在の要件では不要", + "name": "必要なし" + }, + { + "description": "現在のデザインには適用されません", + "name": "該当なし" + } + ], + "waf": [ + { + "name": "確実" + }, + { + "name": "安全" + }, + { + "name": "費用" + }, + { + "name": "オペレーションズ" + }, + { + "name": "パフォーマンス" + } + ] +} \ No newline at end of file diff --git a/checklists/azurespringapps_checklist.ko.json b/checklists/azurespringapps_checklist.ko.json new file mode 100644 index 000000000..031cffca9 --- /dev/null +++ b/checklists/azurespringapps_checklist.ko.json @@ -0,0 +1,150 @@ +{ + "categories": [ + { + "name": "BC 및 DR" + }, + { + "name": "작업" + }, + { + "name": "응용 프로그램 배포" + } + ], + "items": [ + { + "category": "응용 프로그램 배포", + "cost": 1, + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "severity": "보통", + "subcategory": "데브옵스", + "text": "Azure Spring Apps는 모든 앱에 대해 두 개의 배포를 허용하며, 그 중 하나만 프로덕션 트래픽을 수신합니다. 블루-그린 배포 전략을 통해 가동 중지 시간 제로를 달성할 수 있습니다. 파란색 녹색 배포는 표준 및 엔터프라이즈 계층에서만 사용할 수 있습니다. ADO/GitHub 작업과 함께 CI/CD를 사용하여 배포를 자동화할 수 있습니다.", + "waf": "신뢰도" + }, + { + "category": "BC 및 DR", + "cost": 1, + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "severity": "보통", + "subcategory": "재해 복구", + "text": "Azure Spring Apps 인스턴스는 애플리케이션에 대해 여러 지역에서 만들 수 있으며 Traffic Manager/Front Door에서 트래픽을 라우팅할 수 있습니다.", + "waf": "신뢰도" + }, + { + "category": "BC 및 DR", + "cost": 1, + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "severity": "보통", + "subcategory": "고가용성", + "text": "지원되는 지역에서 Azure Spring Apps는 영역 중복으로 배포할 수 있으며, 이는 인스턴스가 가용성 영역에 자동으로 분산됨을 의미합니다. 이 기능은 Standard 및 Enterprise 계층에서만 사용할 수 있습니다.", + "waf": "신뢰도" + }, + { + "category": "BC 및 DR", + "cost": 1, + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "severity": "보통", + "subcategory": "고가용성", + "text": "앱에 1개 이상의 앱 인스턴스 사용", + "waf": "신뢰도" + }, + { + "category": "작업", + "cost": 1, + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "severity": "보통", + "subcategory": "모니터링", + "text": "로그, 메트릭 및 추적을 사용하여 Azure Spring Apps를 모니터링합니다. ASA를 Application Insights와 통합하고, 오류를 추적하고, 통합 문서를 만듭니다.", + "waf": "신뢰도" + }, + { + "category": "작업", + "cost": 1, + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "severity": "보통", + "subcategory": "확장성", + "text": "Spring Cloud Gateway에서 자동 크기 조정 설정", + "waf": "신뢰도" + }, + { + "category": "작업", + "cost": 1, + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "severity": "낮다", + "subcategory": "확장성", + "text": "표준 소비 및 전용 플랜이 있는 앱에 대해 자동 크기 조정을 사용하도록 설정합니다.", + "waf": "신뢰도" + }, + { + "category": "작업", + "cost": 1, + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "severity": "보통", + "subcategory": "지원", + "text": "중요 업무용 앱에 대한 Spring Boot의 상업적 지원을 위해 Enterprise 플랜을 사용합니다. 다른 계층에서는 OSS 지원을 받을 수 있습니다.", + "waf": "신뢰도" + } + ], + "metadata": { + "name": "Azure Spring Apps Review", + "state": "Preview", + "timestamp": "November 15, 2023" + }, + "severities": [ + { + "name": "높다" + }, + { + "name": "보통" + }, + { + "name": "낮다" + } + ], + "status": [ + { + "description": "이 검사는 아직 검토되지 않았습니다", + "name": "확인되지 않음" + }, + { + "description": "이 검사와 연관된 작업 항목이 있습니다", + "name": "열다" + }, + { + "description": "이 검사는 확인되었으며 이와 관련된 추가 작업 항목이 없습니다", + "name": "성취" + }, + { + "description": "권장 사항은 이해되었지만 현재 요구 사항에 필요하지 않음", + "name": "필요 없음" + }, + { + "description": "현재 설계에는 적용되지 않습니다.", + "name": "해당 없음" + } + ], + "waf": [ + { + "name": "신뢰도" + }, + { + "name": "안전" + }, + { + "name": "비용" + }, + { + "name": "작업" + }, + { + "name": "공연" + } + ] +} \ No newline at end of file diff --git a/checklists/azurespringapps_checklist.pt.json b/checklists/azurespringapps_checklist.pt.json new file mode 100644 index 000000000..e40b6e6fc --- /dev/null +++ b/checklists/azurespringapps_checklist.pt.json @@ -0,0 +1,150 @@ +{ + "categories": [ + { + "name": "BC e DR" + }, + { + "name": "Operações" + }, + { + "name": "Implantação de aplicativos" + } + ], + "items": [ + { + "category": "Implantação de aplicativos", + "cost": 1, + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "severity": "Média", + "subcategory": "DevOps", + "text": "Os Aplicativos Spring do Azure permitem duas implantações para cada aplicativo, apenas um dos quais recebe tráfego de produção. Você pode obter tempo de inatividade zero com estratégias de implantação em verde azul. A implantação verde azul só está disponível nas camadas Standard e Enterprise. Você pode automatizar a implantação usando CI/CD com ações do ADO/GitHub", + "waf": "Fiabilidade" + }, + { + "category": "BC e DR", + "cost": 1, + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "severity": "Média", + "subcategory": "Recuperação de desastres", + "text": "As instâncias do Azure Spring Apps podem ser criadas em várias regiões para seus aplicativos e o tráfego pode ser roteado pelo Gerenciador de Tráfego/Front Door.", + "waf": "Fiabilidade" + }, + { + "category": "BC e DR", + "cost": 1, + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "severity": "Média", + "subcategory": "Alta Disponibilidade", + "text": "Na região com suporte, os Aplicativos Spring do Azure podem ser implantados como zona redundante, o que significa que as instâncias são distribuídas automaticamente entre zonas de disponibilidade. Esse recurso só está disponível nas camadas Standard e Enterprise.", + "waf": "Fiabilidade" + }, + { + "category": "BC e DR", + "cost": 1, + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "severity": "Média", + "subcategory": "Alta Disponibilidade", + "text": "Usar mais de 1 instância de aplicativo para seus aplicativos", + "waf": "Fiabilidade" + }, + { + "category": "Operações", + "cost": 1, + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "severity": "Média", + "subcategory": "Monitorização", + "text": "Monitore os Aplicativos Spring do Azure com logs, métricas e rastreamento. Integre o ASA com insights de aplicativos e rastreie falhas e crie pastas de trabalho.", + "waf": "Fiabilidade" + }, + { + "category": "Operações", + "cost": 1, + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "severity": "Média", + "subcategory": "Escalabilidade", + "text": "Configurar o dimensionamento automático no Spring Cloud Gateway", + "waf": "Fiabilidade" + }, + { + "category": "Operações", + "cost": 1, + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "severity": "Baixo", + "subcategory": "Escalabilidade", + "text": "Habilite o dimensionamento automático para os aplicativos com o plano de consumo padrão e dedicado.", + "waf": "Fiabilidade" + }, + { + "category": "Operações", + "cost": 1, + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "severity": "Média", + "subcategory": "Apoio", + "text": "Use o plano Enterprise para suporte comercial de inicialização spring para aplicativos de missão crítica. Com outras camadas, você obtém suporte a OSS.", + "waf": "Fiabilidade" + } + ], + "metadata": { + "name": "Azure Spring Apps Review", + "state": "Preview", + "timestamp": "November 15, 2023" + }, + "severities": [ + { + "name": "Alto" + }, + { + "name": "Média" + }, + { + "name": "Baixo" + } + ], + "status": [ + { + "description": "Esta verificação ainda não foi analisada", + "name": "Não verificado" + }, + { + "description": "Há um item de ação associado a essa verificação", + "name": "Abrir" + }, + { + "description": "Essa verificação foi verificada e não há outros itens de ação associados a ela", + "name": "Cumprido" + }, + { + "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais", + "name": "Não é necessário" + }, + { + "description": "Não aplicável ao projeto atual", + "name": "N/A" + } + ], + "waf": [ + { + "name": "Fiabilidade" + }, + { + "name": "Segurança" + }, + { + "name": "Custar" + }, + { + "name": "Operações" + }, + { + "name": "Desempenho" + } + ] +} \ No newline at end of file diff --git a/checklists/checklist.en.master.json b/checklists/checklist.en.master.json index 110231c97..045225d6d 100644 --- a/checklists/checklist.en.master.json +++ b/checklists/checklist.en.master.json @@ -168,8 +168,8 @@ "id": "A03.06", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "subcategory": "Enterprise Agreement", @@ -228,8 +228,8 @@ "id": "A04.04", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "subcategory": "Microsoft Customer Agreement", @@ -259,8 +259,8 @@ "id": "B02.01", "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server", "services": [ - "Entra", - "ASR" + "ASR", + "Entra" ], "severity": "Medium", "subcategory": "Microsoft Entra ID", @@ -290,8 +290,8 @@ "id": "B03.02", "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", "services": [ - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Identity", @@ -306,10 +306,10 @@ "id": "B03.03", "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", "services": [ - "ACR", - "Entra", + "Subscriptions", "RBAC", - "Subscriptions" + "ACR", + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -324,8 +324,8 @@ "id": "B03.04", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "Low", "subcategory": "Identity", @@ -356,8 +356,8 @@ "id": "B03.06", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -418,9 +418,9 @@ "id": "B03.10", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "services": [ - "Entra", + "Subscriptions", "RBAC", - "Subscriptions" + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -435,8 +435,8 @@ "id": "B03.11", "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", "services": [ - "Entra", - "Subscriptions" + "Subscriptions", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -497,8 +497,8 @@ "id": "B03.15", "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -530,10 +530,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations", "services": [ "RBAC", - "AKV", - "ACR", + "Storage", "Entra", - "Storage" + "AKV", + "ACR" ], "severity": "Medium", "subcategory": "Landing zones", @@ -606,9 +606,9 @@ "id": "C02.03", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ - "AzurePolicy", + "Subscriptions", "RBAC", - "Subscriptions" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -623,10 +623,10 @@ "id": "C02.04", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ + "Subscriptions", "ExpressRoute", "DNS", - "VWAN", - "Subscriptions" + "VWAN" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -656,8 +656,8 @@ "id": "C02.06", "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", "services": [ - "RBAC", - "Subscriptions" + "Subscriptions", + "RBAC" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -686,9 +686,9 @@ "id": "C02.08", "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", "services": [ - "AzurePolicy", "Subscriptions", "RBAC", + "AzurePolicy", "Cost" ], "severity": "High", @@ -718,9 +718,9 @@ "id": "C02.10", "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations", "services": [ - "AzurePolicy", "VM", "Subscriptions", + "AzurePolicy", "Cost" ], "severity": "High", @@ -737,8 +737,8 @@ "id": "C02.11", "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity", "services": [ - "Monitor", - "Subscriptions" + "Subscriptions", + "Monitor" ], "severity": "High", "subcategory": "Subscriptions", @@ -770,8 +770,8 @@ "id": "C02.13", "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", "services": [ - "Entra", - "Subscriptions" + "Subscriptions", + "Entra" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -903,8 +903,8 @@ "id": "D02.02", "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", "services": [ - "VPN", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "Low", "subcategory": "Encryption", @@ -935,13 +935,13 @@ "id": "D03.02", "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", "services": [ - "VPN", - "DNS", "NVA", + "VPN", "VNet", - "Entra", "Firewall", - "ExpressRoute" + "ExpressRoute", + "Entra", + "DNS" ], "severity": "High", "subcategory": "Hub and spoke", @@ -969,9 +969,9 @@ "id": "D03.04", "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", "services": [ - "VPN", "ARS", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "Low", "subcategory": "Hub and spoke", @@ -986,8 +986,8 @@ "id": "D03.05", "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", "services": [ - "ARS", - "VNet" + "VNet", + "ARS" ], "severity": "Low", "subcategory": "Hub and spoke", @@ -1001,8 +1001,8 @@ "id": "D03.06", "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", "services": [ - "ACR", - "VNet" + "VNet", + "ACR" ], "severity": "Medium", "subcategory": "Hub and spoke", @@ -1034,8 +1034,8 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", "services": [ "VNet", - "Entra", - "ExpressRoute" + "ExpressRoute", + "Entra" ], "severity": "Medium", "subcategory": "Hub and spoke", @@ -1112,8 +1112,8 @@ "id": "D04.03", "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", "services": [ - "VPN", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "Medium", "subcategory": "Hybrid", @@ -1256,8 +1256,8 @@ "id": "D04.12", "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", "services": [ - "Monitor", - "ExpressRoute" + "ExpressRoute", + "Monitor" ], "severity": "Medium", "subcategory": "Hybrid", @@ -1273,8 +1273,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", "services": [ "ACR", - "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "Monitor" ], "severity": "Medium", "subcategory": "Hybrid", @@ -1320,8 +1320,8 @@ "id": "D05.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "services": [ - "ACR", - "VNet" + "VNet", + "ACR" ], "severity": "High", "subcategory": "IP plan", @@ -1401,8 +1401,8 @@ "id": "D05.06", "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", "services": [ - "ACR", "VNet", + "ACR", "DNS" ], "severity": "Medium", @@ -1434,9 +1434,9 @@ "id": "D05.08", "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", "services": [ + "VM", "VNet", - "DNS", - "VM" + "DNS" ], "severity": "High", "subcategory": "IP plan", @@ -1466,8 +1466,8 @@ "id": "D06.02", "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", "services": [ - "Bastion", - "VNet" + "VNet", + "Bastion" ], "severity": "Medium", "subcategory": "Internet", @@ -1497,10 +1497,10 @@ "id": "D06.04", "link": "https://learn.microsoft.com/azure/firewall/", "services": [ - "ACR", - "AzurePolicy", "Firewall", - "RBAC" + "RBAC", + "ACR", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Internet", @@ -1530,8 +1530,8 @@ "id": "D06.06", "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", "services": [ - "ACR", "FrontDoor", + "ACR", "AzurePolicy", "WAF" ], @@ -1550,8 +1550,8 @@ "services": [ "FrontDoor", "AzurePolicy", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Low", "subcategory": "Internet", @@ -1584,8 +1584,8 @@ "id": "D06.09", "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", "services": [ - "DDoS", - "VNet" + "VNet", + "DDoS" ], "severity": "High", "subcategory": "Internet", @@ -1668,9 +1668,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", "services": [ "NVA", + "Storage", "VNet", "Firewall", - "Storage", "VWAN" ], "severity": "High", @@ -1761,9 +1761,9 @@ "id": "D07.05", "link": "https://learn.microsoft.com/azure/app-service/networking-features", "services": [ - "NVA", "PrivateLink", "Firewall", + "NVA", "DNS" ], "severity": "Medium", @@ -1798,9 +1798,9 @@ "id": "D08.02", "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", "services": [ - "VPN", "VNet", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "High", "subcategory": "Segmentation", @@ -1844,8 +1844,8 @@ "id": "D08.05", "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "services": [ - "ACR", - "VNet" + "VNet", + "ACR" ], "severity": "Medium", "subcategory": "Segmentation", @@ -1860,8 +1860,8 @@ "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", "id": "D08.06", "services": [ - "VNet", - "VM" + "VM", + "VNet" ], "severity": "Medium", "subcategory": "Segmentation", @@ -1876,8 +1876,8 @@ "id": "D08.07", "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "services": [ - "NVA", "VNet", + "NVA", "Entra" ], "severity": "Medium", @@ -1985,8 +1985,8 @@ "id": "D09.06", "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", "services": [ - "Monitor", - "VWAN" + "VWAN", + "Monitor" ], "severity": "Medium", "subcategory": "Virtual WAN", @@ -2014,9 +2014,9 @@ "id": "D09.08", "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", "services": [ + "ExpressRoute", "VPN", - "VWAN", - "ExpressRoute" + "VWAN" ], "severity": "Medium", "subcategory": "Virtual WAN", @@ -2088,8 +2088,8 @@ "id": "E01.03", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "AzurePolicy", - "RBAC" + "RBAC", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Governance", @@ -2103,8 +2103,8 @@ "id": "E01.04", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "AzurePolicy", - "Subscriptions" + "Subscriptions", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Governance", @@ -2132,8 +2132,8 @@ "id": "E01.06", "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", "services": [ - "AzurePolicy", - "Subscriptions" + "Subscriptions", + "AzurePolicy" ], "severity": "Low", "subcategory": "Governance", @@ -2162,10 +2162,10 @@ "id": "E01.08", "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", "services": [ - "Entra", - "AzurePolicy", + "Subscriptions", "RBAC", - "Subscriptions" + "Entra", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Governance", @@ -2179,8 +2179,8 @@ "id": "E01.09", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "AzurePolicy", - "Subscriptions" + "Subscriptions", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Governance", @@ -2257,8 +2257,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "services": [ "FrontDoor", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "subcategory": "App delivery", @@ -2273,9 +2273,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "services": [ "FrontDoor", - "WAF", + "Sentinel", "AppGW", - "Sentinel" + "WAF" ], "severity": "Medium", "subcategory": "App delivery", @@ -2315,10 +2315,10 @@ "id": "F03.01", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "Monitor", - "AzurePolicy", + "RBAC", "Entra", - "RBAC" + "AzurePolicy", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2362,8 +2362,8 @@ "id": "F03.04", "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/govern/policy-compliance/regulatory-compliance", "services": [ - "Monitor", - "AzurePolicy" + "AzurePolicy", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2378,9 +2378,9 @@ "id": "F03.05", "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", "services": [ - "Monitor", + "VM", "AzurePolicy", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2395,8 +2395,8 @@ "id": "F03.06", "link": "https://learn.microsoft.com/azure/automation/update-management/overview", "services": [ - "Monitor", - "VM" + "VM", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2411,8 +2411,8 @@ "id": "F03.07", "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", "services": [ - "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2442,9 +2442,9 @@ "id": "F03.09", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "Monitor", + "RBAC", "AzurePolicy", - "RBAC" + "Monitor" ], "severity": "Low", "subcategory": "Monitoring", @@ -2500,9 +2500,9 @@ "id": "F03.13", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "Monitor", + "RBAC", "Entra", - "RBAC" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2530,8 +2530,8 @@ "id": "F03.15", "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview", "services": [ - "Monitor", - "Storage" + "Storage", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2587,8 +2587,8 @@ "id": "F04.01", "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", "services": [ - "AzurePolicy", - "VM" + "VM", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Operational compliance", @@ -2603,9 +2603,9 @@ "id": "F04.02", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", "services": [ - "Monitor", + "VM", "AzurePolicy", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Operational compliance", @@ -2619,9 +2619,9 @@ "id": "F05.01", "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", "services": [ - "ACR", "VM", - "ASR" + "ASR", + "ACR" ], "severity": "Medium", "subcategory": "Protect and Recover", @@ -2693,8 +2693,8 @@ "id": "F06.03", "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", "services": [ - "ACR", "LoadBalancer", + "ACR", "AppGW" ], "severity": "Medium", @@ -2763,8 +2763,8 @@ "id": "G02.03", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", - "AzurePolicy" + "AzurePolicy", + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2778,9 +2778,9 @@ "id": "G02.04", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", + "RBAC", "Entra", - "RBAC" + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2822,9 +2822,9 @@ "id": "G02.07", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ + "VNet", "AKV", - "PrivateLink", - "VNet" + "PrivateLink" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2838,9 +2838,9 @@ "id": "G02.08", "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", "services": [ - "Monitor", + "Entra", "AKV", - "Entra" + "Monitor" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2854,8 +2854,8 @@ "id": "G02.09", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", - "AzurePolicy" + "AzurePolicy", + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2897,9 +2897,9 @@ "id": "G02.12", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ + "ASR", "ACR", - "AKV", - "ASR" + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2928,8 +2928,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal", "services": [ "ARS", - "Monitor", - "Storage" + "Storage", + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -2944,8 +2944,8 @@ "id": "G03.03", "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", "services": [ - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Operations", @@ -2960,8 +2960,8 @@ "id": "G03.04", "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", "services": [ - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Operations", @@ -2976,8 +2976,8 @@ "id": "G03.05", "link": "https://www.microsoft.com/en-gb/security/business/solutions/cloud-workload-protection", "services": [ - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Operations", @@ -3004,8 +3004,8 @@ "id": "G03.07", "link": "https://learn.microsoft.com/azure/security-center/", "services": [ - "Monitor", - "Defender" + "Defender", + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -3019,8 +3019,8 @@ "id": "G03.08", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -3168,8 +3168,8 @@ "id": "H01.06", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", "services": [ - "AKV", - "VM" + "VM", + "AKV" ], "severity": "High", "subcategory": "DevOps Team Topologies", @@ -3262,8 +3262,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data", "services": [ "SQL", - "AKV", - "Backup" + "Backup", + "AKV" ], "severity": "Medium", "subcategory": "Azure Key Vault", @@ -3279,8 +3279,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups", "services": [ "SQL", - "Storage", - "Backup" + "Backup", + "Storage" ], "severity": "Medium", "subcategory": "Backup", @@ -3296,8 +3296,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy", "services": [ "SQL", - "Storage", - "Backup" + "Backup", + "Storage" ], "severity": "Low", "subcategory": "Backup", @@ -3357,8 +3357,8 @@ "id": "E01.01", "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", "services": [ - "EventHubs", "SQL", + "EventHubs", "Defender" ], "severity": "High", @@ -3392,8 +3392,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", "services": [ "SQL", - "Monitor", - "Defender" + "Defender", + "Monitor" ], "severity": "High", "subcategory": "Defender for Azure SQL", @@ -3409,8 +3409,8 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview", "services": [ "SQL", - "Monitor", - "Defender" + "Defender", + "Monitor" ], "severity": "High", "subcategory": "Vulnerability Assessment", @@ -3457,8 +3457,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption", "services": [ "SQL", - "AKV", - "Storage" + "Storage", + "AKV" ], "severity": "Low", "subcategory": "Column Encryption", @@ -3474,8 +3474,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server", "services": [ "SQL", - "Storage", - "Backup" + "Backup", + "Storage" ], "severity": "High", "subcategory": "Transparent Data Encryption", @@ -3538,8 +3538,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities", "services": [ "SQL", - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Azure Active Directory", @@ -3570,11 +3570,11 @@ "id": "G02.01", "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", "services": [ - "SQL", - "AKV", - "ACR", + "RBAC", "Entra", - "RBAC" + "AKV", + "SQL", + "ACR" ], "severity": "Low", "subcategory": "Managed Identities", @@ -3622,8 +3622,8 @@ "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management", "services": [ "SQL", - "AzurePolicy", - "Storage" + "Storage", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Database Digest", @@ -3685,8 +3685,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ "SQL", - "AzurePolicy", - "Storage" + "Storage", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Auditing", @@ -3701,12 +3701,12 @@ "id": "I01.02", "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ - "SQL", + "EventHubs", + "Storage", "Monitor", "Backup", - "EventHubs", "Entra", - "Storage" + "SQL" ], "severity": "Low", "subcategory": "Auditing", @@ -3721,11 +3721,11 @@ "id": "I01.03", "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ - "SQL", - "Monitor", - "Subscriptions", "EventHubs", - "Storage" + "Storage", + "Monitor", + "SQL", + "Subscriptions" ], "severity": "Medium", "subcategory": "Auditing", @@ -3772,8 +3772,8 @@ "id": "I02.03", "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ - "EventHubs", - "SQL" + "SQL", + "EventHubs" ], "severity": "Medium", "subcategory": "SIEM/SOAR", @@ -3837,9 +3837,9 @@ "id": "J02.01", "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql", "services": [ - "APIM", + "SQL", "EventHubs", - "SQL" + "APIM" ], "severity": "Medium", "subcategory": "Outbound Control", @@ -3870,11 +3870,11 @@ "id": "J03.01", "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server", "services": [ - "SQL", "Monitor", "VNet", + "Firewall", "PrivateLink", - "Firewall" + "SQL" ], "severity": "Medium", "subcategory": "Private Access", @@ -3941,8 +3941,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules", "services": [ "SQL", - "AzurePolicy", - "VNet" + "VNet", + "AzurePolicy" ], "severity": "High", "subcategory": "Public Access", @@ -3990,8 +3990,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview", "services": [ "SQL", - "AzurePolicy", - "VNet" + "VNet", + "AzurePolicy" ], "severity": "High", "subcategory": "Public Access", @@ -4147,9 +4147,9 @@ "NVA", "VNet", "AppGW", - "Subscriptions", "Entra", - "WAF" + "WAF", + "Subscriptions" ], "severity": "Medium", "subcategory": "App delivery", @@ -4198,8 +4198,8 @@ "services": [ "FrontDoor", "AzurePolicy", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App delivery", @@ -4264,8 +4264,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "services": [ "FrontDoor", - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "subcategory": "App delivery", @@ -4613,8 +4613,8 @@ "id": "01.02.01", "link": "https://learn.microsoft.com/azure-stack/hci/concepts/fault-tolerance#parity", "services": [ - "Storage", - "Backup" + "Backup", + "Storage" ], "severity": "Medium", "subcategory": "S2D", @@ -5008,9 +5008,9 @@ "id": "05.01.01", "link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines", "services": [ - "ASR", "VM", - "Backup" + "Backup", + "ASR" ], "severity": "High", "subcategory": "VM", @@ -5280,9 +5280,9 @@ "id": "A01.01", "link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "Storage", + "Backup", "AVS", - "Backup" + "Storage" ], "severity": "Medium", "subcategory": "Backup", @@ -5297,8 +5297,8 @@ "id": "A02.01", "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "AVS", - "Backup" + "Backup", + "AVS" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -5313,9 +5313,9 @@ "id": "A02.02", "link": "Best practice to deploy backup in the same region as your AVS deployment", "services": [ - "ASR", + "Backup", "AVS", - "Backup" + "ASR" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -5440,9 +5440,9 @@ "id": "A03.06", "link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.", "services": [ - "ExpressRoute", "NVA", "AVS", + "ExpressRoute", "ASR" ], "severity": "Medium", @@ -5458,8 +5458,8 @@ "id": "B01.01", "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud", "services": [ - "VWAN", - "AVS" + "AVS", + "VWAN" ], "severity": "Medium", "subcategory": "Direct (no vWAN, no H&S)", @@ -5554,10 +5554,10 @@ "id": "B03.02", "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ - "VPN", "VNet", "AVS", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -5572,9 +5572,9 @@ "id": "B03.03", "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ - "VPN", "VNet", "AVS", + "VPN", "ExpressRoute" ], "severity": "Medium", @@ -5590,10 +5590,10 @@ "id": "B03.04", "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ - "VPN", "VNet", "AVS", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -5624,8 +5624,8 @@ "id": "B05.01", "link": "https://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", "services": [ - "Bastion", - "AVS" + "AVS", + "Bastion" ], "severity": "Medium", "subcategory": "Jumpbox & Bastion", @@ -5640,9 +5640,9 @@ "id": "B05.02", "link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal", "services": [ - "Bastion", "VNet", - "AVS" + "AVS", + "Bastion" ], "severity": "Medium", "subcategory": "Jumpbox & Bastion", @@ -5657,9 +5657,9 @@ "id": "B05.03", "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", "services": [ - "Bastion", + "VM", "AVS", - "VM" + "Bastion" ], "severity": "Medium", "subcategory": "Jumpbox & Bastion", @@ -5674,8 +5674,8 @@ "id": "B06.01", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "VPN", @@ -5690,8 +5690,8 @@ "id": "B06.02", "link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "VPN", @@ -5706,8 +5706,8 @@ "id": "B06.03", "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "VPN", @@ -5722,8 +5722,8 @@ "id": "B07.01", "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-site-to-site-portal#openvwan", "services": [ - "VWAN", - "AVS" + "AVS", + "VWAN" ], "severity": "Medium", "subcategory": "vWAN hub", @@ -5738,8 +5738,8 @@ "id": "B07.02", "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal", "services": [ - "VPN", "AVS", + "VPN", "VWAN" ], "severity": "Medium", @@ -5755,9 +5755,9 @@ "id": "B07.03", "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-expressroute-portal", "services": [ - "VWAN", "Firewall", - "AVS" + "AVS", + "VWAN" ], "severity": "Medium", "subcategory": "vWAN hub", @@ -5772,8 +5772,8 @@ "id": "C01.01", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Access", @@ -5788,8 +5788,8 @@ "id": "C01.02", "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Access", @@ -5804,8 +5804,8 @@ "id": "C01.03", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Access", @@ -5820,8 +5820,8 @@ "id": "C01.04", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-external-identity-source-nsx-t", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Access", @@ -5836,8 +5836,8 @@ "id": "C02.01", "link": "https://youtu.be/4jvfbsrhnEs", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Security", @@ -5852,9 +5852,9 @@ "id": "C02.02", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "Medium", "subcategory": "Security", @@ -5869,9 +5869,9 @@ "id": "C02.03", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity#view-the-vcenter-server-privileges", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "Medium", "subcategory": "Security", @@ -5886,9 +5886,9 @@ "id": "C02.04", "link": "Best practice", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "Medium", "subcategory": "Security", @@ -5903,9 +5903,9 @@ "id": "C03.01", "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "RBAC", + "AVS", "Entra", - "AVS" + "RBAC" ], "severity": "Medium", "subcategory": "Security ", @@ -5920,9 +5920,9 @@ "id": "C03.02", "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "RBAC", + "AVS", "Entra", - "AVS" + "RBAC" ], "severity": "Medium", "subcategory": "Security ", @@ -5937,9 +5937,9 @@ "id": "C03.03", "link": "Best practice", "services": [ - "Monitor", + "AVS", "Entra", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Security ", @@ -5954,8 +5954,8 @@ "id": "C03.04", "link": "https://learn.microsoft.com/azure/azure-vmware/rotate-cloudadmin-credentials?tabs=azure-portal", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Security ", @@ -5970,9 +5970,9 @@ "id": "D01.01", "link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview", "services": [ - "Arc", + "VM", "AVS", - "VM" + "Arc" ], "severity": "Medium", "subcategory": "Operations", @@ -5987,9 +5987,9 @@ "id": "D01.02", "link": "https://docs.microsoft.com/azure/governance/policy/overview", "services": [ - "Monitor", + "AVS", "AzurePolicy", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -6034,8 +6034,8 @@ "id": "D01.05", "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Medium", "subcategory": "Operations", @@ -6050,8 +6050,8 @@ "id": "E01.01", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Alerts", @@ -6066,8 +6066,8 @@ "id": "E01.02", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Alerts", @@ -6082,8 +6082,8 @@ "id": "E01.03", "link": "https://www.virtualworkloads.com/2021/04/azure-vmware-solution-azure-service-health/", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Alerts", @@ -6100,9 +6100,9 @@ "services": [ "VM", "Monitor", - "AzurePolicy", + "Backup", "AVS", - "Backup" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Backup", @@ -6117,9 +6117,9 @@ "id": "E03.01", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ - "Monitor", + "AVS", "AzurePolicy", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Capacity", @@ -6134,8 +6134,8 @@ "id": "E04.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern", "services": [ - "Monitor", "Subscriptions", + "Monitor", "AVS", "Cost" ], @@ -6152,9 +6152,9 @@ "id": "E05.01", "link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards", "services": [ - "Monitor", + "AVS", "NetworkWatcher", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Dashboard", @@ -6169,9 +6169,9 @@ "id": "E06.01", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "Monitor", + "AVS", "Storage", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Logs & Metrics", @@ -6186,8 +6186,8 @@ "id": "E06.02", "link": "Is vROPS or vRealize Network Insight going to be used? ", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Logs & Metrics", @@ -6202,9 +6202,9 @@ "id": "E06.03", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "Monitor", + "VM", "AVS", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Logs & Metrics", @@ -6220,10 +6220,10 @@ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ "VPN", - "Monitor", - "AVS", "NetworkWatcher", - "ExpressRoute" + "Monitor", + "ExpressRoute", + "AVS" ], "severity": "Medium", "subcategory": "Network", @@ -6238,9 +6238,9 @@ "id": "E07.02", "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ - "Monitor", "AVS", - "ExpressRoute" + "ExpressRoute", + "Monitor" ], "severity": "Medium", "subcategory": "Network", @@ -6255,8 +6255,8 @@ "id": "E07.03", "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Network", @@ -6271,8 +6271,8 @@ "id": "E08.01", "link": "Firewall logging and alerting rules are configured (Azure Firewall or 3rd party)", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Security", @@ -6287,8 +6287,8 @@ "id": "E08.02", "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Security", @@ -6303,8 +6303,8 @@ "id": "E09.01", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "VMWare", @@ -6319,9 +6319,9 @@ "id": "E10.01", "link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard", "services": [ - "Monitor", + "VM", "AVS", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "VMware", @@ -6366,9 +6366,9 @@ "id": "F01.03", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", "services": [ - "ARS", "NVA", - "AVS" + "AVS", + "ARS" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -6383,8 +6383,8 @@ "id": "F01.04", "link": "https://learn.microsoft.com/azure/route-server/route-server-faq", "services": [ - "ARS", - "AVS" + "AVS", + "ARS" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -6415,9 +6415,9 @@ "link": "Research and choose optimal solution for each application", "services": [ "FrontDoor", + "AVS", "NVA", - "AppGW", - "AVS" + "AppGW" ], "severity": "Medium", "subcategory": "Internet", @@ -6432,8 +6432,8 @@ "id": "F03.01", "link": "https://docs.microsoft.com/azure/route-server/route-server-faq#route-server-limits", "services": [ - "ARS", - "AVS" + "AVS", + "ARS" ], "severity": "Medium", "subcategory": "Routing", @@ -6448,15 +6448,15 @@ "id": "F04.01", "link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection", "services": [ - "VPN", - "DDoS", "VM", - "LoadBalancer", + "VPN", "VNet", + "FrontDoor", + "ExpressRoute", "AppGW", "AVS", - "ExpressRoute", - "FrontDoor" + "DDoS", + "LoadBalancer" ], "severity": "Medium", "subcategory": "Security", @@ -6501,9 +6501,9 @@ "id": "F06.01", "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", "services": [ - "VWAN", "Firewall", - "AVS" + "AVS", + "VWAN" ], "severity": "Medium", "subcategory": "Virtual WAN", @@ -6518,8 +6518,8 @@ "id": "F06.02", "link": "https://learn.microsoft.com/azure/firewall-manager/secure-cloud-network", "services": [ - "VWAN", - "AVS" + "AVS", + "VWAN" ], "severity": "Medium", "subcategory": "Virtual WAN", @@ -6534,8 +6534,8 @@ "id": "G01.01", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-nsx-network-components-azure-portal", "services": [ - "AVS", - "Subscriptions" + "Subscriptions", + "AVS" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -6550,9 +6550,9 @@ "id": "G01.02", "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale", "services": [ - "AzurePolicy", + "AVS", "Storage", - "AVS" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -6612,8 +6612,8 @@ "id": "G01.06", "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-management-and-monitoring", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -6674,8 +6674,8 @@ "id": "H01.02", "link": "Internal policy or regulatory compliance", "services": [ - "AzurePolicy", - "AVS" + "AVS", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Pre-deployment", @@ -6720,8 +6720,8 @@ "id": "H01.05", "link": "Done through the subscription/resource providers/ AVS register in the portal", "services": [ - "AVS", - "Subscriptions" + "Subscriptions", + "AVS" ], "severity": "Medium", "subcategory": "Pre-deployment", @@ -6736,8 +6736,8 @@ "id": "H01.06", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/enterprise-scale-landing-zone", "services": [ - "AVS", - "Subscriptions" + "Subscriptions", + "AVS" ], "severity": "Medium", "subcategory": "Pre-deployment", @@ -6905,8 +6905,8 @@ "id": "I01.01", "link": "General recommendation for storing encryption keys.", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Medium", "subcategory": "Encryption", @@ -6937,9 +6937,9 @@ "id": "I01.03", "link": "https://docs.microsoft.com/azure/key-vault/general/authentication", "services": [ - "AKV", "AVS", - "ExpressRoute" + "ExpressRoute", + "AKV" ], "severity": "Medium", "subcategory": "Encryption", @@ -6969,8 +6969,8 @@ "id": "I03.01", "link": "https://learn.microsoft.com/azure/sentinel/overview", "services": [ - "Sentinel", - "AVS" + "AVS", + "Sentinel" ], "severity": "Medium", "subcategory": "Investigation", @@ -7001,8 +7001,8 @@ "id": "I04.02", "link": "https://docs.microsoft.com/azure/azure-vmware/azure-security-integration", "services": [ - "AzurePolicy", - "AVS" + "AVS", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Security", @@ -7167,8 +7167,8 @@ "id": "J04.01", "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7183,9 +7183,9 @@ "id": "J04.02", "link": "3rd-Party tools", "services": [ - "Storage", + "VM", "AVS", - "VM" + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7200,9 +7200,9 @@ "id": "J04.03", "link": "Contact VMware", "services": [ - "Storage", + "VM", "AVS", - "VM" + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7217,8 +7217,8 @@ "id": "J04.04", "link": "Contact VMware", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7233,8 +7233,8 @@ "id": "J04.05", "link": "Contact VMware", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7249,10 +7249,10 @@ "id": "J04.06", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ - "AzurePolicy", - "Storage", + "VM", "AVS", - "VM" + "Storage", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Storage", @@ -7267,10 +7267,10 @@ "id": "J04.07", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy", "services": [ - "AzurePolicy", - "Storage", + "VM", "AVS", - "VM" + "Storage", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Storage", @@ -7285,9 +7285,9 @@ "id": "J04.08", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ - "AzurePolicy", + "AVS", "Storage", - "AVS" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Storage", @@ -7302,8 +7302,8 @@ "id": "J04.09", "link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7381,9 +7381,9 @@ "id": "A02.01", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", "services": [ + "RBAC", "ACR", - "Entra", - "RBAC" + "Entra" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -7398,9 +7398,9 @@ "id": "A02.02", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", "services": [ + "RBAC", "ACR", - "Entra", - "RBAC" + "Entra" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -7415,9 +7415,9 @@ "id": "A02.03", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", "services": [ + "RBAC", "ACR", - "Entra", - "RBAC" + "Entra" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -7463,9 +7463,9 @@ "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", "id": "A02.06", "services": [ - "ACR", - "EventHubs", "PrivateLink", + "EventHubs", + "ACR", "Entra" ], "severity": "High", @@ -7499,8 +7499,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", "services": [ "ACR", - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Logging and Monitoring", @@ -7515,10 +7515,10 @@ "id": "A04.01", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "ACR", - "VNet", "PrivateLink", - "Firewall" + "Firewall", + "VNet", + "ACR" ], "severity": "Medium", "subcategory": "Network Security", @@ -7533,8 +7533,8 @@ "id": "A04.02", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", "services": [ - "ACR", - "PrivateLink" + "PrivateLink", + "ACR" ], "severity": "Medium", "subcategory": "Network Security", @@ -7549,8 +7549,8 @@ "id": "A04.03", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", "services": [ - "ACR", - "PrivateLink" + "PrivateLink", + "ACR" ], "severity": "Medium", "subcategory": "Network Security", @@ -7636,11 +7636,11 @@ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", "services": [ - "AzurePolicy", "EventHubs", - "Entra", "RBAC", - "TrafficManager" + "Entra", + "TrafficManager", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -7655,10 +7655,10 @@ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", "services": [ "VM", - "AKV", "EventHubs", + "Storage", "Entra", - "Storage" + "AKV" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -7673,8 +7673,8 @@ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", "services": [ "EventHubs", - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -7688,9 +7688,9 @@ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", "services": [ + "VNet", "EventHubs", - "Monitor", - "VNet" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -7704,9 +7704,9 @@ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", "services": [ + "PrivateLink", "EventHubs", - "VNet", - "PrivateLink" + "VNet" ], "severity": "Medium", "subcategory": "Networking", @@ -7734,8 +7734,8 @@ "id": "A01.01", "link": "https://learn.microsoft.com/azure/openshift/howto-create-service-principal?pivots=aro-azurecli", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -7763,8 +7763,8 @@ "id": "A01.03", "link": "https://docs.openshift.com/container-platform/4.13/applications/projects/working-with-projects.html", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -7778,8 +7778,8 @@ "id": "A01.04", "link": "https://docs.openshift.com/container-platform/4.13/authentication/using-rbac.html", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -7793,9 +7793,9 @@ "id": "A01.05", "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", "services": [ - "AKV", - "Entra" - ], + "Entra", + "AKV" + ], "severity": "Medium", "subcategory": "Identity", "text": "Minimize the number of users who have administrator rights and secrets access.", @@ -7808,8 +7808,8 @@ "id": "A01.06", "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -7823,12 +7823,12 @@ "id": "B01.01", "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "services": [ - "DDoS", "VNet", - "Subscriptions", "Firewall", "Entra", - "WAF" + "DDoS", + "WAF", + "Subscriptions" ], "severity": "Low", "subcategory": "DDoS", @@ -7869,8 +7869,8 @@ "id": "B03.02", "link": "https://learn.microsoft.com/azure/openshift/howto-secure-openshift-with-front-door", "services": [ - "FrontDoor", - "PrivateLink" + "PrivateLink", + "FrontDoor" ], "severity": "Medium", "subcategory": "Internet", @@ -7884,9 +7884,9 @@ "id": "B03.03", "link": "https://learn.microsoft.com/azure/openshift/howto-restrict-egress", "services": [ + "Firewall", "NVA", - "AzurePolicy", - "Firewall" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Internet", @@ -7914,8 +7914,8 @@ "id": "B04.02", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "ACR", - "PrivateLink" + "PrivateLink", + "ACR" ], "severity": "Medium", "subcategory": "Private access", @@ -8237,8 +8237,8 @@ "id": "E01.02", "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster", "services": [ - "Arc", - "AKS" + "AKS", + "Arc" ], "severity": "High", "subcategory": "Control plane", @@ -8264,8 +8264,8 @@ "id": "E03.01", "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", "services": [ - "Arc", "AKS", + "Arc", "Defender" ], "severity": "Medium", @@ -8280,9 +8280,9 @@ "id": "E04.01", "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider", "services": [ + "AKS", "Arc", - "AKV", - "AKS" + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -8308,8 +8308,8 @@ "id": "E05.02", "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes#install-azure-policy-extension-for-azure-arc-enabled-kubernetes", "services": [ - "Monitor", - "AzurePolicy" + "AzurePolicy", + "Monitor" ], "severity": "Medium", "subcategory": "Workload", @@ -8337,8 +8337,8 @@ "id": "E05.04", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "ACR", - "Subscriptions" + "Subscriptions", + "ACR" ], "severity": "Low", "subcategory": "Workload", @@ -8409,9 +8409,9 @@ "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", "services": [ - "SQL", + "VM", "Storage", - "VM" + "SQL" ], "severity": "Medium", "subcategory": "Virtual Machines", @@ -8425,9 +8425,9 @@ "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", "services": [ + "VM", "ACR", - "Storage", - "VM" + "Storage" ], "severity": "Medium", "subcategory": "Virtual Machines", @@ -8455,8 +8455,8 @@ "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", "link": "https://learn.microsoft.com/azure/virtual-machines/availability", "services": [ - "ASR", - "VM" + "VM", + "ASR" ], "severity": "High", "subcategory": "Virtual Machines", @@ -8613,8 +8613,8 @@ "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", "services": [ - "Storage", - "Backup" + "Backup", + "Storage" ], "severity": "Low", "subcategory": "Backup", @@ -8697,8 +8697,8 @@ "guid": "ced126cd-032a-4f5b-8fc6-998a535e3378", "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", "services": [ - "AppGW", - "Storage" + "Storage", + "AppGW" ], "severity": "High", "subcategory": "Application Gateways", @@ -8726,10 +8726,10 @@ "guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a", "link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager", "services": [ - "Monitor", "ASR", + "TrafficManager", "DNS", - "TrafficManager" + "Monitor" ], "severity": "Low", "subcategory": "DNS", @@ -8743,9 +8743,9 @@ "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", "services": [ + "ASR", "ACR", - "DNS", - "ASR" + "DNS" ], "severity": "Low", "subcategory": "DNS", @@ -8787,8 +8787,8 @@ "guid": "a359c373-e7dd-4616-83a3-64a907ebae48", "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "services": [ - "ExpressRoute", - "Backup" + "Backup", + "ExpressRoute" ], "severity": "Medium", "subcategory": "ExpressRoute", @@ -8802,10 +8802,10 @@ "guid": "ead53cc7-de2e-48aa-ab35-71549ab9153d", "link": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", "services": [ + "Backup", "ExpressRoute", "VPN", - "Cost", - "Backup" + "Cost" ], "severity": "Low", "subcategory": "ExpressRoute", @@ -8833,8 +8833,8 @@ "guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574", "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", "services": [ - "LoadBalancer", - "VM" + "VM", + "LoadBalancer" ], "severity": "Low", "subcategory": "Load Balancers", @@ -8938,9 +8938,9 @@ "id": "A03.01", "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", "services": [ - "Storage", + "Subscriptions", "RBAC", - "Subscriptions" + "Storage" ], "severity": "Medium", "subcategory": "Governance", @@ -9046,9 +9046,9 @@ "id": "A09.01", "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", "services": [ - "AzurePolicy", + "Subscriptions", "Storage", - "Subscriptions" + "AzurePolicy" ], "severity": "High", "subcategory": "Data Availability, Compliance", @@ -9123,9 +9123,9 @@ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", "id": "A11.02", "services": [ + "RBAC", "Entra", - "Storage", - "RBAC" + "Storage" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -9156,10 +9156,10 @@ "id": "A11.04", "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", "services": [ + "Monitor", "Entra", - "AKV", "Storage", - "Monitor" + "AKV" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -9174,10 +9174,10 @@ "id": "A12.01", "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", "services": [ - "Monitor", "AKV", + "Storage", "AzurePolicy", - "Storage" + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -9193,9 +9193,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", "services": [ "Entra", - "AKV", + "Storage", "AzurePolicy", - "Storage" + "AKV" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -9211,8 +9211,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", "services": [ "Entra", - "AzurePolicy", - "Storage" + "Storage", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -9227,10 +9227,10 @@ "id": "A13.03", "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", "services": [ - "AKV", "Entra", + "Storage", "AzurePolicy", - "Storage" + "AKV" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -9244,8 +9244,8 @@ "id": "A14.01", "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", "services": [ - "AKV", - "Storage" + "Storage", + "AKV" ], "severity": "Medium", "subcategory": "CI/CD", @@ -9277,8 +9277,8 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", "services": [ "Entra", - "AzurePolicy", - "Storage" + "Storage", + "AzurePolicy" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -9340,9 +9340,9 @@ "id": "A15.06", "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", "services": [ + "RBAC", "Entra", - "Storage", - "RBAC" + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -9372,8 +9372,8 @@ "id": "A16.01", "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", "services": [ - "AzurePolicy", - "Storage" + "Storage", + "AzurePolicy" ], "severity": "High", "subcategory": "Networking", @@ -9540,8 +9540,8 @@ "id": "A05.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "AzurePolicy", "Storage", + "AzurePolicy", "Cost" ], "subcategory": "Policy", @@ -9581,8 +9581,8 @@ "id": "A08.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "Backup", "VM", + "Backup", "Storage", "Cost" ], @@ -9597,8 +9597,8 @@ "id": "A09.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "AzurePolicy", "Storage", + "AzurePolicy", "Cost" ], "subcategory": "storage accounts lifecycle policy", @@ -9885,9 +9885,9 @@ "id": "D02.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", "services": [ + "VM", "SQL", "AzurePolicy", - "VM", "Cost" ], "subcategory": "check AHUB is applied to all Windows VMs, RHEL and SQL", @@ -9940,8 +9940,8 @@ "id": "D06.01", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "services": [ - "ARS", "VM", + "ARS", "Cost" ], "subcategory": "reservations/savings plans", @@ -10018,8 +10018,8 @@ "id": "D10.01", "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", "services": [ - "SQL", "VM", + "SQL", "Cost" ], "subcategory": "SQL Database Reservations", @@ -10159,8 +10159,8 @@ "id": "E04.01", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "LoadBalancer", "VM", + "LoadBalancer", "Cost" ], "subcategory": "databricks", @@ -10275,8 +10275,8 @@ "id": "E06.02", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "EventHubs", "FrontDoor", + "EventHubs", "Cost" ], "subcategory": "Networking", @@ -10419,8 +10419,8 @@ "id": "E11.01", "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", "services": [ - "EventHubs", "Monitor", + "EventHubs", "Cost" ], "subcategory": "Synapse", @@ -10537,8 +10537,8 @@ "id": "E12.04", "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "services": [ - "Monitor", "VM", + "Monitor", "Cost" ], "subcategory": "VM", @@ -10559,15 +10559,119 @@ "text": "containerizing an application can improve VM density and save money on scaling it", "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/" }, + { + "category": "Application Deployment", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "services": [], + "severity": "Medium", + "subcategory": "DevOps", + "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "services": [ + "FrontDoor", + "ASR", + "TrafficManager" + ], + "severity": "Medium", + "subcategory": "Disaster Recovery", + "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "services": [ + "ACR" + ], + "severity": "Medium", + "subcategory": "High Availability", + "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "services": [], + "severity": "Medium", + "subcategory": "High Availability", + "text": "Use more than 1 app instance for your apps", + "waf": "Reliability" + }, + { + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "services": [ + "Monitor" + ], + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", + "waf": "Reliability" + }, + { + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "services": [], + "severity": "Medium", + "subcategory": "Scalability", + "text": "Set up autoscaling in Spring Cloud Gateway", + "waf": "Reliability" + }, + { + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "services": [], + "severity": "Low", + "subcategory": "Scalability", + "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", + "waf": "Reliability" + }, + { + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "cost": 1, + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "services": [], + "severity": "Medium", + "subcategory": "Support", + "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", + "waf": "Reliability" + }, { "category": "Identity", "checklist": "Azure VMware Solution Design Review", "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", "id": "A01.01", "services": [ - "Entra", + "Subscriptions", "AVS", - "Subscriptions" + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -10580,8 +10684,8 @@ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", "id": "A01.02", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -10594,8 +10698,8 @@ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", "id": "A01.03", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -10608,8 +10712,8 @@ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", "id": "A01.04", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -10622,8 +10726,8 @@ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", "id": "A01.05", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -10636,8 +10740,8 @@ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", "id": "A01.06", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -10650,9 +10754,9 @@ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", "id": "A01.07", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -10665,9 +10769,9 @@ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", "id": "A01.08", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -10680,9 +10784,9 @@ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", "id": "A01.09", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -10710,10 +10814,10 @@ "id": "B02.01", "services": [ "VPN", - "Monitor", - "AVS", "NetworkWatcher", - "ExpressRoute" + "Monitor", + "ExpressRoute", + "AVS" ], "severity": "High", "subcategory": "Monitoring", @@ -10727,10 +10831,10 @@ "id": "B02.02", "services": [ "VM", - "Monitor", - "AVS", "NetworkWatcher", - "ExpressRoute" + "Monitor", + "ExpressRoute", + "AVS" ], "severity": "Medium", "subcategory": "Monitoring", @@ -10743,10 +10847,10 @@ "guid": "25659d35-58fd-4772-99c9-31112d027fe4", "id": "B02.03", "services": [ - "Monitor", - "NetworkWatcher", + "VM", "AVS", - "VM" + "NetworkWatcher", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -10759,8 +10863,8 @@ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", "id": "B03.01", "services": [ - "ARS", - "AVS" + "AVS", + "ARS" ], "severity": "High", "subcategory": "Routing", @@ -10773,9 +10877,9 @@ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", "id": "C01.01", "services": [ + "AVS", "Entra", - "RBAC", - "AVS" + "RBAC" ], "severity": "High", "subcategory": "Security (identity)", @@ -10788,9 +10892,9 @@ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", "id": "C01.02", "services": [ + "AVS", "Entra", - "RBAC", - "AVS" + "RBAC" ], "severity": "High", "subcategory": "Security (identity)", @@ -10803,8 +10907,8 @@ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", "id": "C01.03", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "High", "subcategory": "Security (identity)", @@ -10817,9 +10921,9 @@ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", "id": "C01.04", "services": [ - "Entra", + "AVS", "RBAC", - "AVS" + "Entra" ], "severity": "Medium", "subcategory": "Security (identity)", @@ -10832,8 +10936,8 @@ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", "id": "C01.05", "services": [ - "Entra", - "AVS" + "AVS", + "Entra" ], "severity": "Medium", "subcategory": "Security (identity)", @@ -10846,9 +10950,9 @@ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", "id": "C01.06", "services": [ - "Entra", + "VM", "AVS", - "VM" + "Entra" ], "severity": "High", "subcategory": "Security (identity)", @@ -10902,8 +11006,8 @@ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", "id": "C02.04", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Security (network)", @@ -10917,10 +11021,10 @@ "id": "C02.05", "services": [ "VPN", - "DDoS", "VNet", + "ExpressRoute", "AVS", - "ExpressRoute" + "DDoS" ], "severity": "Medium", "subcategory": "Security (network)", @@ -10960,8 +11064,8 @@ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", "id": "C03.02", "services": [ - "Arc", - "AVS" + "AVS", + "Arc" ], "severity": "Medium", "subcategory": "Security (guest/VM)", @@ -10988,8 +11092,8 @@ "guid": "a3592718-e6e2-4051-9267-6ae46691e883", "id": "C03.04", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Low", "subcategory": "Security (guest/VM)", @@ -11015,10 +11119,10 @@ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", "id": "C04.01", "services": [ - "AzurePolicy", - "Storage", + "VM", "AVS", - "VM" + "Storage", + "AzurePolicy" ], "severity": "High", "subcategory": "Governance (platform)", @@ -11045,9 +11149,9 @@ "guid": "d88408f3-7273-44c8-96ba-280214590146", "id": "C04.03", "services": [ - "AzurePolicy", + "AVS", "Storage", - "AVS" + "AzurePolicy" ], "severity": "High", "subcategory": "Governance (platform)", @@ -11073,8 +11177,8 @@ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", "id": "C04.05", "services": [ - "AzurePolicy", - "AVS" + "AVS", + "AzurePolicy" ], "severity": "Low", "subcategory": "Governance (platform)", @@ -11143,9 +11247,9 @@ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", "id": "C05.02", "services": [ - "Arc", + "VM", "AVS", - "VM" + "Arc" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -11171,9 +11275,9 @@ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", "id": "C05.04", "services": [ - "Monitor", + "VM", "AVS", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -11186,10 +11290,10 @@ "guid": "589d457a-927c-4397-9d11-02cad6aae11e", "id": "C05.05", "services": [ - "AzurePolicy", "VM", + "Backup", "AVS", - "Backup" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -11202,9 +11306,9 @@ "guid": "ee29711b-d352-4caa-ab79-b198dab81932", "id": "C06.01", "services": [ - "Monitor", "AVS", - "Defender" + "Defender", + "Monitor" ], "severity": "Medium", "subcategory": "Compliance", @@ -11257,8 +11361,8 @@ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", "id": "D01.01", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -11271,8 +11375,8 @@ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", "id": "D01.02", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -11285,8 +11389,8 @@ "guid": "9659e396-80e7-4828-ac93-5657d02bff45", "id": "D01.03", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -11299,8 +11403,8 @@ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", "id": "D01.04", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -11313,9 +11417,9 @@ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", "id": "D01.05", "services": [ - "Monitor", + "AVS", "Storage", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -11328,8 +11432,8 @@ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", "id": "D01.06", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Low", "subcategory": "Monitoring", @@ -11342,10 +11446,10 @@ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", "id": "D02.01", "services": [ - "AzurePolicy", - "Storage", + "VM", "AVS", - "VM" + "Storage", + "AzurePolicy" ], "severity": "High", "subcategory": "Operations", @@ -11371,9 +11475,9 @@ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", "id": "D02.03", "services": [ - "Storage", + "Backup", "AVS", - "Backup" + "Storage" ], "severity": "Medium", "subcategory": "Operations", @@ -11386,8 +11490,8 @@ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", "id": "D02.04", "services": [ - "Arc", - "AVS" + "AVS", + "Arc" ], "severity": "Medium", "subcategory": "Operations", @@ -11400,8 +11504,8 @@ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", "id": "D02.05", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -11427,9 +11531,9 @@ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", "id": "D02.07", "services": [ - "Monitor", + "AVS", "AzurePolicy", - "AVS" + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -11442,9 +11546,9 @@ "guid": "ab79b188-dab8-4193-8c9f-c9d1bb77036f", "id": "D02.08", "services": [ - "Storage", + "VM", "AVS", - "VM" + "Storage" ], "severity": "High", "subcategory": "Operations", @@ -11471,8 +11575,8 @@ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", "id": "E01.01", "services": [ - "AVS", - "Backup" + "Backup", + "AVS" ], "severity": "Medium", "subcategory": "Backup", @@ -11555,10 +11659,10 @@ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", "id": "E02.06", "services": [ - "ASR", "NVA", "AVS", - "ExpressRoute" + "ExpressRoute", + "ASR" ], "severity": "Medium", "subcategory": "Disaster Recovery", @@ -11571,8 +11675,8 @@ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", "id": "E03.01", "services": [ - "AVS", - "Backup" + "Backup", + "AVS" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -11585,8 +11689,8 @@ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", "id": "E03.02", "services": [ - "AVS", - "Backup" + "Backup", + "AVS" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -11677,8 +11781,8 @@ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", "id": "F02.03", "services": [ - "AzurePolicy", - "AVS" + "AVS", + "AzurePolicy" ], "severity": "Low", "subcategory": "Automated Deployment", @@ -11691,8 +11795,8 @@ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", "id": "F03.01", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Low", "subcategory": "Automated Connectivity", @@ -11705,9 +11809,9 @@ "guid": "255461e2-aee3-4553-afc8-339248b262d6", "id": "F03.02", "services": [ - "AKV", "AVS", - "ExpressRoute" + "ExpressRoute", + "AKV" ], "severity": "Low", "subcategory": "Automated Connectivity", @@ -11745,9 +11849,9 @@ "checklist": "Azure VMware Solution Design Review", "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", "id": "F04.01", - "services": [ - "AVS", - "Subscriptions" + "services": [ + "Subscriptions", + "AVS" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -11760,9 +11864,9 @@ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", "id": "F04.02", "services": [ - "AzurePolicy", + "AVS", "Storage", - "AVS" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -11814,8 +11918,8 @@ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", "id": "F04.06", "services": [ - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -11840,8 +11944,8 @@ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Best practices", @@ -11853,8 +11957,8 @@ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", "services": [ - "APIM", - "ASR" + "ASR", + "APIM" ], "severity": "Medium", "subcategory": "Business continuity and disaster recovery", @@ -11866,8 +11970,8 @@ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", "link": "https://learn.microsoft.com/azure/api-management/high-availability", "services": [ - "APIM", - "ASR" + "ASR", + "APIM" ], "severity": "Medium", "subcategory": "Business continuity and disaster recovery", @@ -11879,9 +11983,9 @@ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", "services": [ - "APIM", + "Backup", "ASR", - "Backup" + "APIM" ], "severity": "High", "subcategory": "Business continuity and disaster recovery", @@ -11893,8 +11997,8 @@ "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Performance and scalability", @@ -11907,9 +12011,9 @@ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", "services": [ - "APIM", "EventHubs", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Low", "subcategory": "Performance and scalability", @@ -11921,8 +12025,8 @@ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Performance and scalability", @@ -11959,8 +12063,8 @@ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Development best practices", @@ -11972,8 +12076,8 @@ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Development best practices", @@ -11985,9 +12089,9 @@ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", "services": [ - "APIM", "ACR", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Development best practices", @@ -12011,8 +12115,8 @@ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", "services": [ - "APIM", - "Monitor" + "Monitor", + "APIM" ], "severity": "High", "subcategory": "Monitoring", @@ -12024,8 +12128,8 @@ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", "services": [ - "APIM", - "Monitor" + "Monitor", + "APIM" ], "severity": "Medium", "subcategory": "Monitoring", @@ -12037,8 +12141,8 @@ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", "services": [ - "APIM", - "Monitor" + "Monitor", + "APIM" ], "severity": "High", "subcategory": "Monitoring", @@ -12050,9 +12154,9 @@ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", "services": [ - "APIM", + "Entra", "AKV", - "Entra" + "APIM" ], "severity": "High", "subcategory": "Data protection", @@ -12064,8 +12168,8 @@ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", "services": [ - "APIM", - "Entra" + "Entra", + "APIM" ], "severity": "High", "subcategory": "Identity", @@ -12077,8 +12181,8 @@ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", "services": [ - "APIM", - "Entra" + "Entra", + "APIM" ], "severity": "Medium", "subcategory": "Identity", @@ -12090,8 +12194,8 @@ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", "services": [ - "APIM", - "Entra" + "Entra", + "APIM" ], "severity": "Medium", "subcategory": "Privileged access", @@ -12103,8 +12207,8 @@ "guid": "cd45c90e-7690-4753-930b-bf290c69c074", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", "services": [ - "APIM", - "VNet" + "VNet", + "APIM" ], "severity": "Medium", "subcategory": "Security", @@ -12116,9 +12220,9 @@ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", "services": [ - "APIM", + "VNet", "Monitor", - "VNet" + "APIM" ], "severity": "Medium", "subcategory": "Security", @@ -12130,9 +12234,9 @@ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", "services": [ - "APIM", "VNet", - "PrivateLink" + "PrivateLink", + "APIM" ], "severity": "Medium", "subcategory": "Security", @@ -12156,8 +12260,8 @@ "guid": "7519e385-a88b-4d34-966b-6269d686e890", "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", "services": [ - "APIM", - "FrontDoor" + "FrontDoor", + "APIM" ], "severity": "Medium", "subcategory": "Connectivity", @@ -12181,8 +12285,8 @@ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", "services": [ - "APIM", - "Entra" + "Entra", + "APIM" ], "severity": "Medium", "subcategory": "Best practices", @@ -12194,8 +12298,8 @@ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", "services": [ - "APIM", - "Entra" + "Entra", + "APIM" ], "severity": "Medium", "subcategory": "Best practices", @@ -12279,8 +12383,8 @@ "guid": "f8af3d94-1d2b-4070-846f-849197524258", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", "services": [ - "APIM", - "AKV" + "AKV", + "APIM" ], "severity": "High", "subcategory": "Data protection", @@ -12292,8 +12396,8 @@ "guid": "791abd8b-7706-4e31-9569-afefde724be3", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", "services": [ - "APIM", - "Entra" + "Entra", + "APIM" ], "severity": "Medium", "subcategory": "Identities", @@ -12305,10 +12409,10 @@ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", "services": [ - "APIM", "WAF", "Entra", - "AppGW" + "AppGW", + "APIM" ], "severity": "High", "subcategory": "Network", @@ -12339,8 +12443,8 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", "services": [ "AppSvc", - "AKV", - "Entra" + "Entra", + "AKV" ], "severity": "High", "subcategory": "Data Protection", @@ -12450,8 +12554,8 @@ "id": "A02.04", "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", "services": [ - "AKV", - "Entra" + "Entra", + "AKV" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -12466,8 +12570,8 @@ "id": "A02.05", "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", "services": [ - "ACR", - "Entra" + "Entra", + "ACR" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -12483,8 +12587,8 @@ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", "services": [ "AppSvc", - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Logging and Monitoring", @@ -12500,8 +12604,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ "AppSvc", - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Logging and Monitoring", @@ -12516,10 +12620,10 @@ "id": "A04.01", "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", "services": [ - "Monitor", - "NVA", "VNet", - "Firewall" + "Firewall", + "NVA", + "Monitor" ], "severity": "Medium", "subcategory": "Network Security", @@ -12535,10 +12639,10 @@ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", "services": [ "NVA", - "PrivateLink", + "Storage", "VNet", - "Firewall", - "Storage" + "PrivateLink", + "Firewall" ], "severity": "Low", "subcategory": "Network Security", @@ -12571,8 +12675,8 @@ "services": [ "AppSvc", "Monitor", - "AppGW", "FrontDoor", + "AppGW", "WAF" ], "severity": "High", @@ -12683,11 +12787,11 @@ "id": "A04.11", "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "services": [ - "DDoS", "NVA", + "EventHubs", "VNet", "AppGW", - "EventHubs", + "DDoS", "WAF" ], "severity": "Medium", @@ -12703,9 +12807,9 @@ "id": "A04.12", "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", "services": [ + "VNet", "ACR", - "PrivateLink", - "VNet" + "PrivateLink" ], "severity": "Medium", "subcategory": "Network Security", @@ -12852,10 +12956,10 @@ "id": "02.02.01", "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", "services": [ - "LoadBalancer", - "FrontDoor", "AKS", - "TrafficManager" + "LoadBalancer", + "TrafficManager", + "FrontDoor" ], "severity": "Medium", "subcategory": "High Availability", @@ -12921,8 +13025,8 @@ "id": "02.02.05", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", "services": [ - "ACR", - "AKS" + "AKS", + "ACR" ], "severity": "High", "subcategory": "High Availability", @@ -13017,8 +13121,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", "security": 1, "services": [ - "AzurePolicy", - "AKS" + "AKS", + "AzurePolicy" ], "severity": "Medium", "simple": -1, @@ -13068,8 +13172,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/", "security": 1, "services": [ - "ACR", - "AKS" + "AKS", + "ACR" ], "severity": "Medium", "simple": -1, @@ -13149,8 +13253,8 @@ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", "security": 1, "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "Medium", "simple": -1, @@ -13166,8 +13270,8 @@ "link": "https://learn.microsoft.com/azure/aks/update-credentials", "security": 1, "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -13183,8 +13287,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", "security": 1, "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -13200,8 +13304,8 @@ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", "security": 1, "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "Low", "subcategory": "Secrets", @@ -13217,9 +13321,9 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", "security": 1, "services": [ - "AKV", "AKS", - "Defender" + "Defender", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -13286,8 +13390,8 @@ "security": 1, "services": [ "AKS", - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "Medium", "simple": -1, @@ -13304,9 +13408,9 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", "security": 1, "services": [ - "Entra", "AKS", - "RBAC" + "RBAC", + "Entra" ], "severity": "High", "simple": -1, @@ -13442,8 +13546,8 @@ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", "security": 1, "services": [ - "ACR", "AKS", + "ACR", "AppGW" ], "severity": "Medium", @@ -13495,8 +13599,8 @@ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", "scale": 1, "services": [ - "LoadBalancer", - "AKS" + "AKS", + "LoadBalancer" ], "severity": "High", "subcategory": "Best practices", @@ -13528,10 +13632,10 @@ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", "security": 1, "services": [ - "PrivateLink", - "AKS", "VNet", - "Cost" + "AKS", + "Cost", + "PrivateLink" ], "severity": "Medium", "simple": -1, @@ -13548,8 +13652,8 @@ "id": "06.03.01", "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "services": [ - "VPN", - "AKS" + "AKS", + "VPN" ], "severity": "Medium", "subcategory": "HA", @@ -13726,8 +13830,8 @@ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", "security": 2, "services": [ - "NVA", - "AKS" + "AKS", + "NVA" ], "severity": "High", "simple": -2, @@ -13778,8 +13882,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-network-policies", "security": 1, "services": [ - "AzurePolicy", - "AKS" + "AKS", + "AzurePolicy" ], "severity": "Medium", "simple": -1, @@ -13796,8 +13900,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-network-policies", "security": 1, "services": [ - "AzurePolicy", - "AKS" + "AKS", + "AzurePolicy" ], "severity": "High", "subcategory": "Security", @@ -13812,8 +13916,8 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", "security": 1, "services": [ - "AzurePolicy", - "AKS" + "AKS", + "AzurePolicy" ], "severity": "High", "simple": -1, @@ -13849,9 +13953,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", "security": 2, "services": [ - "DDoS", "VNet", - "AKS" + "AKS", + "DDoS" ], "severity": "Medium", "subcategory": "Security", @@ -13899,8 +14003,8 @@ "id": "07.01.01", "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "High", "simple": -1, @@ -14117,8 +14221,8 @@ "id": "07.02.15", "link": "https://learn.microsoft.com/azure/aks/monitor-aks", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "Low", "subcategory": "Compliance", @@ -14183,8 +14287,8 @@ "id": "07.04.01", "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "High", "simple": -1, @@ -14201,8 +14305,8 @@ "id": "07.04.02", "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "High", "simple": -1, @@ -14218,8 +14322,8 @@ "id": "07.04.03", "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "Medium", "simple": -1, @@ -14235,8 +14339,8 @@ "id": "07.04.04", "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "Medium", "simple": -1, @@ -14254,10 +14358,10 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", "services": [ "ServiceBus", - "Monitor", "EventHubs", - "AKS", - "Storage" + "Storage", + "Monitor", + "AKS" ], "severity": "Medium", "simple": -1, @@ -14274,9 +14378,9 @@ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", "services": [ "LoadBalancer", - "Monitor", + "AKS", "NVA", - "AKS" + "Monitor" ], "severity": "Medium", "simple": -1, @@ -14292,8 +14396,8 @@ "id": "07.04.07", "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", "services": [ - "Monitor", - "AKS" + "AKS", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -14953,10 +15057,10 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", "services": [ "ServiceBus", - "AzurePolicy", - "Entra", "RBAC", - "TrafficManager" + "Entra", + "TrafficManager", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -14970,12 +15074,12 @@ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", "services": [ - "AppSvc", "ServiceBus", + "AppSvc", "VM", - "AKV", + "Storage", "Entra", - "Storage" + "AKV" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -14990,10 +15094,10 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", "services": [ "ServiceBus", + "RBAC", "Storage", - "Subscriptions", "Entra", - "RBAC" + "Subscriptions" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -15007,9 +15111,9 @@ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", "services": [ - "Monitor", + "ServiceBus", "VNet", - "ServiceBus" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -15023,9 +15127,9 @@ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", "services": [ - "PrivateLink", "ServiceBus", - "VNet" + "VNet", + "PrivateLink" ], "severity": "Medium", "subcategory": "Networking", @@ -15054,9 +15158,9 @@ "id": "A01.01", "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/", "services": [ - "AVD", - "Subscriptions", "VM", + "Subscriptions", + "AVD", "ASR" ], "severity": "High", @@ -15072,8 +15176,8 @@ "id": "A01.02", "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr", "services": [ - "AVD", "VM", + "AVD", "Storage", "ASR" ], @@ -15106,8 +15210,8 @@ "id": "A01.04", "link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262", "services": [ - "ACR", "AVD", + "ACR", "ASR" ], "severity": "High", @@ -15123,10 +15227,10 @@ "id": "A01.05", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AVD", - "ASR", "VM", - "Backup" + "Backup", + "AVD", + "ASR" ], "severity": "Medium", "subcategory": "Compute", @@ -15141,10 +15245,10 @@ "id": "A01.06", "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery", "services": [ - "AVD", "VM", "Cost", "Backup", + "AVD", "ASR" ], "severity": "Medium", @@ -15160,11 +15264,11 @@ "id": "A02.01", "link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery", "services": [ - "AVD", "VM", - "ACR", + "Storage", + "AVD", "ASR", - "Storage" + "ACR" ], "severity": "Low", "subcategory": "Dependencies", @@ -15212,11 +15316,11 @@ "id": "A03.02", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AVD", - "AzurePolicy", + "Storage", "Backup", + "AVD", "ASR", - "Storage" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Storage", @@ -15283,11 +15387,11 @@ "id": "A03.06", "link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering", "services": [ - "AVD", + "Storage", "Backup", - "ACR", + "AVD", "ASR", - "Storage" + "ACR" ], "severity": "Medium", "subcategory": "Storage", @@ -15347,9 +15451,9 @@ "id": "B01.04", "link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries", "services": [ + "VM", "AVD", - "Storage", - "VM" + "Storage" ], "severity": "Low", "subcategory": "Golden Images", @@ -15503,10 +15607,10 @@ "id": "B02.03", "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", "services": [ + "VM", "AVD", - "Storage", "RBAC", - "VM" + "Storage" ], "severity": "Medium", "subcategory": "MSIX & AppAttach", @@ -15566,8 +15670,8 @@ "id": "B03.01", "link": "https://docs.microsoft.com/azure/virtual-machines/generation-2", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "Medium", "subcategory": "Session Host", @@ -15597,8 +15701,8 @@ "id": "C01.01", "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -15613,8 +15717,8 @@ "id": "C01.02", "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -15659,8 +15763,8 @@ "id": "C01.05", "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "Medium", "subcategory": "Capacity Planning", @@ -15691,8 +15795,8 @@ "id": "C01.07", "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits", "services": [ - "ACR", "AVD", + "ACR", "Entra" ], "severity": "Medium", @@ -15723,9 +15827,9 @@ "id": "C01.09", "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop", "services": [ + "VM", "AVD", - "Storage", - "VM" + "Storage" ], "severity": "Low", "subcategory": "Capacity Planning", @@ -15740,8 +15844,8 @@ "id": "C01.10", "link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -15787,8 +15891,8 @@ "id": "C01.13", "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "Low", "subcategory": "Capacity Planning", @@ -15818,10 +15922,10 @@ "id": "C02.02", "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json", "services": [ - "VPN", "AVD", - "Storage", - "ExpressRoute" + "ExpressRoute", + "VPN", + "Storage" ], "severity": "Medium", "subcategory": "Clients & Users", @@ -15911,9 +16015,9 @@ "id": "C03.03", "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "services": [ + "VM", "AVD", - "Storage", - "VM" + "Storage" ], "severity": "Low", "subcategory": "General", @@ -15928,8 +16032,8 @@ "id": "D01.01", "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", "services": [ - "AVD", "VNet", + "AVD", "Entra", "Storage" ], @@ -15994,9 +16098,9 @@ "id": "D01.05", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts", "services": [ + "VM", "AVD", - "Entra", - "VM" + "Entra" ], "severity": "Medium", "subcategory": "Active Directory", @@ -16028,9 +16132,9 @@ "link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable", "services": [ "AVD", - "AzurePolicy", + "Entra", "Storage", - "Entra" + "AzurePolicy" ], "severity": "High", "subcategory": "Active Directory", @@ -16078,10 +16182,10 @@ "id": "D03.01", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", "services": [ - "AVD", "VNet", - "Entra", - "Subscriptions" + "Subscriptions", + "AVD", + "Entra" ], "severity": "High", "subcategory": "Requirements", @@ -16144,9 +16248,9 @@ "id": "D03.05", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", "services": [ + "VM", "AVD", - "Entra", - "VM" + "Entra" ], "severity": "High", "subcategory": "Requirements", @@ -16178,8 +16282,8 @@ "link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template", "services": [ "AVD", - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Low", "subcategory": "Management", @@ -16194,9 +16298,9 @@ "id": "E01.02", "link": "https://learn.microsoft.com/azure/virtual-desktop/management", "services": [ + "VM", "AVD", - "Monitor", - "VM" + "Monitor" ], "severity": "Low", "subcategory": "Management", @@ -16227,10 +16331,10 @@ "id": "E01.04", "link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios", "services": [ - "AVD", - "Monitor", "VM", - "Cost" + "AVD", + "Cost", + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -16245,10 +16349,10 @@ "id": "E01.05", "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect", "services": [ + "VM", "AVD", - "Monitor", "Cost", - "VM" + "Monitor" ], "severity": "Low", "subcategory": "Management", @@ -16263,11 +16367,11 @@ "id": "E01.06", "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them", "services": [ - "AVD", "VM", + "Cost", "Monitor", - "AzurePolicy", - "Cost" + "AVD", + "AzurePolicy" ], "severity": "Low", "subcategory": "Management", @@ -16283,12 +16387,12 @@ "link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources", "services": [ "VPN", - "AVD", - "DNS", - "Monitor", + "Storage", "Cost", + "Monitor", "ExpressRoute", - "Storage", + "AVD", + "DNS", "VWAN" ], "severity": "Low", @@ -16305,9 +16409,9 @@ "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations", "services": [ "AVD", - "Monitor", "Entra", - "Cost" + "Cost", + "Monitor" ], "severity": "Low", "subcategory": "Management", @@ -16354,9 +16458,9 @@ "id": "E01.11", "link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool", "services": [ + "VM", "AVD", - "Monitor", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -16371,9 +16475,9 @@ "id": "E01.12", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops", "services": [ + "VM", "AVD", - "Monitor", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -16388,9 +16492,9 @@ "id": "E01.13", "link": "https://docs.microsoft.com/azure/virtual-desktop/faq", "services": [ + "VM", "AVD", - "Monitor", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -16421,9 +16525,9 @@ "id": "E02.02", "link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics", "services": [ + "VM", "AVD", - "Monitor", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -16439,8 +16543,8 @@ "link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal", "services": [ "AVD", - "Monitor", - "Storage" + "Storage", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -16471,10 +16575,10 @@ "id": "F01.01", "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", "services": [ - "VPN", - "AVD", "NVA", - "ExpressRoute" + "AVD", + "ExpressRoute", + "VPN" ], "severity": "Medium", "subcategory": "Networking", @@ -16489,8 +16593,8 @@ "id": "F01.02", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity", "services": [ - "AVD", "VNet", + "AVD", "VWAN" ], "severity": "Medium", @@ -16506,8 +16610,8 @@ "id": "F01.03", "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", "services": [ - "VPN", - "AVD" + "AVD", + "VPN" ], "severity": "Medium", "subcategory": "Networking", @@ -16522,10 +16626,10 @@ "id": "F01.04", "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", "services": [ - "AVD", - "NVA", "VNet", - "Firewall" + "Firewall", + "AVD", + "NVA" ], "severity": "Medium", "subcategory": "Networking", @@ -16571,10 +16675,10 @@ "id": "F01.07", "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", "services": [ - "AVD", - "NVA", "VNet", - "Firewall" + "Firewall", + "AVD", + "NVA" ], "severity": "Low", "subcategory": "Networking", @@ -16589,8 +16693,8 @@ "id": "F01.08", "link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "High", "subcategory": "Networking", @@ -16605,8 +16709,8 @@ "id": "F01.09", "link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "Low", "subcategory": "Networking", @@ -16621,11 +16725,11 @@ "id": "F01.10", "link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints", "services": [ - "AVD", - "VNet", - "PrivateLink", + "Storage", "Cost", - "Storage" + "PrivateLink", + "VNet", + "AVD" ], "severity": "Medium", "subcategory": "Networking", @@ -16640,8 +16744,8 @@ "id": "F01.11", "link": "https://docs.microsoft.com/azure/virtual-desktop/shortpath", "services": [ - "VPN", - "AVD" + "AVD", + "VPN" ], "severity": "Medium", "subcategory": "Networking", @@ -16687,10 +16791,10 @@ "id": "G02.02", "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", "services": [ + "VM", "AVD", - "AKV", "Storage", - "VM" + "AKV" ], "severity": "Low", "subcategory": "Host Configuration", @@ -16705,9 +16809,9 @@ "id": "G02.03", "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch", "services": [ + "VM", "AVD", - "Monitor", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Host Configuration", @@ -16722,8 +16826,8 @@ "id": "G02.04", "link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements", "services": [ - "AVD", - "VM" + "VM", + "AVD" ], "severity": "High", "subcategory": "Host Configuration", @@ -16814,12 +16918,12 @@ "id": "G03.04", "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud", "services": [ - "AVD", "VM", - "AKV", - "Subscriptions", + "Storage", + "AVD", "Defender", - "Storage" + "AKV", + "Subscriptions" ], "severity": "Medium", "subcategory": "Management", @@ -16835,8 +16939,8 @@ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs", "services": [ "AVD", - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -16931,8 +17035,8 @@ "id": "H01.02", "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance", "services": [ - "ACR", "AVD", + "ACR", "Storage", "Cost" ], @@ -16981,8 +17085,8 @@ "id": "H02.03", "link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections", "services": [ - "AVD", "VNet", + "AVD", "Storage" ], "severity": "High", @@ -17014,9 +17118,9 @@ "id": "H03.02", "link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile", "services": [ + "VM", "AVD", - "Storage", - "VM" + "Storage" ], "severity": "High", "subcategory": "Capacity Planning", @@ -17129,10 +17233,10 @@ "id": "H04.04", "link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples", "services": [ - "ACR", "AVD", - "AKV", - "Storage" + "ACR", + "Storage", + "AKV" ], "severity": "High", "subcategory": "FSLogix", @@ -17163,9 +17267,9 @@ "id": "H04.06", "link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference", "services": [ + "VM", "AVD", - "Storage", - "VM" + "Storage" ], "severity": "Low", "subcategory": "FSLogix", @@ -17207,8 +17311,8 @@ "guid": "aa359271-8e6e-4205-8725-769e46691e88", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", "services": [ - "Arc", - "Entra" + "Entra", + "Arc" ], "severity": "Medium", "subcategory": "Capacity Planning", @@ -17222,8 +17326,8 @@ "guid": "deace4bb-1deb-44c6-9fc3-fc14eeaa3692", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-resource-providers", "services": [ - "Arc", - "Subscriptions" + "Subscriptions", + "Arc" ], "severity": "High", "subcategory": "General", @@ -17292,8 +17396,8 @@ "guid": "f9ccbd86-8266-4abc-a264-f9a19bf39d95", "link": "https://learn.microsoft.com/azure/azure-arc/servers/organize-inventory-servers#organize-resources-with-built-in-azure-hierarchies", "services": [ - "Arc", - "Subscriptions" + "Subscriptions", + "Arc" ], "severity": "Low", "subcategory": "Organization", @@ -17307,9 +17411,9 @@ "guid": "9bf39d95-d44c-47c8-a19c-a1f6d5215ae5", "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#identity-and-access-control", "services": [ - "Arc", + "RBAC", "Entra", - "RBAC" + "Arc" ], "severity": "Medium", "subcategory": "Access", @@ -17322,9 +17426,9 @@ "guid": "14ba34d4-585e-4111-89bd-7ba012f7b94e", "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad", "services": [ + "Entra", "Arc", - "AKV", - "Entra" + "AKV" ], "severity": "Low", "subcategory": "Access", @@ -17338,9 +17442,9 @@ "guid": "35ac9322-23e1-4380-8523-081a94174158", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", "services": [ - "Arc", + "Subscriptions", "Entra", - "Subscriptions" + "Arc" ], "severity": "High", "subcategory": "Requirements", @@ -17354,9 +17458,9 @@ "guid": "33ee7ad6-c6d3-4733-865c-7acbe44bbe60", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", "services": [ - "Arc", + "RBAC", "Entra", - "RBAC" + "Arc" ], "severity": "Medium", "subcategory": "Requirements", @@ -17370,9 +17474,9 @@ "guid": "9d79f2e8-7778-4424-a516-775c6fa95b96", "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", "services": [ - "Arc", + "RBAC", "Entra", - "RBAC" + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -17386,9 +17490,9 @@ "guid": "ad88408e-3727-434b-a76b-a28f21459013", "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", "services": [ - "Arc", + "RBAC", "Entra", - "RBAC" + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -17402,9 +17506,9 @@ "guid": "65d38e53-f9cc-4bd8-9826-6abca264f9a1", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", "services": [ - "Arc", + "RBAC", "Entra", - "RBAC" + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -17449,8 +17553,8 @@ "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions", "services": [ "Arc", - "Monitor", - "AzurePolicy" + "AzurePolicy", + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -17607,10 +17711,10 @@ "guid": "94174158-33ee-47ad-9c6d-3733165c7acb", "link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security", "services": [ - "Arc", - "VPN", "PrivateLink", - "ExpressRoute" + "ExpressRoute", + "Arc", + "VPN" ], "severity": "Medium", "subcategory": "Networking", @@ -17666,9 +17770,9 @@ "guid": "a264f9a1-9bf3-49d9-9d44-c7c8919ca1f6", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-arc-servers-connectivity#define-extensions-connectivity-method", "services": [ + "PrivateLink", "Arc", - "Monitor", - "PrivateLink" + "Monitor" ], "severity": "Low", "subcategory": "Networking", @@ -17764,10 +17868,10 @@ "guid": "6d02bfe4-564b-40d8-94a3-48726ee79d6b", "link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret", "services": [ - "Arc", "Entra", - "AKV", - "Storage" + "Arc", + "Storage", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -17823,8 +17927,8 @@ "guid": "4b69bad3-8aad-453c-a78e-1d76667357c4", "link": "https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication", "services": [ - "Arc", - "Entra" + "Entra", + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -17889,8 +17993,8 @@ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal", "services": [ - "LoadBalancer", - "ASR" + "ASR", + "LoadBalancer" ], "severity": "Medium", "subcategory": " ", @@ -17902,10 +18006,10 @@ "guid": "cbe05bbe-209d-4490-ba47-778424d11678", "link": "https://learn.microsoft.com/azure/security-center/", "services": [ - "ASR", - "Entra", + "VM", "RBAC", - "VM" + "Entra", + "ASR" ], "severity": "Medium", "subcategory": " ", @@ -17917,9 +18021,9 @@ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", "link": "https://learn.microsoft.com/azure/security-center/", "services": [ + "ASR", "ACR", - "SAP", - "ASR" + "SAP" ], "severity": "Medium", "subcategory": " ", @@ -17931,9 +18035,9 @@ "guid": "80dc0591-cf65-4de8-b130-9cccd579266b", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ + "VM", "ASR", - "Entra", - "VM" + "Entra" ], "severity": "Medium", "subcategory": " ", @@ -17945,8 +18049,8 @@ "guid": "cca275fa-a1ab-4fe9-b55d-04c3c4919cb1", "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response", "services": [ - "LoadBalancer", - "ASR" + "ASR", + "LoadBalancer" ], "severity": "Medium", "subcategory": " ", @@ -17958,9 +18062,9 @@ "guid": "b3d1325a-e124-4ba3-9df6-85eddce9bd3b", "link": "https://www.microsoft.com/itshowcase/implementing-a-zero-trust-security-model-at-microsoft", "services": [ + "VM", "ASR", - "Storage", - "VM" + "Storage" ], "severity": "Medium", "subcategory": " ", @@ -17984,8 +18088,8 @@ "guid": "b2173676-aff6-4691-a493-5ada42223ece", "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response", "services": [ - "SAP", - "ASR" + "ASR", + "SAP" ], "severity": "Medium", "subcategory": " ", @@ -18009,8 +18113,8 @@ "guid": "43165c3a-cbe0-45bb-b209-d490da477784", "services": [ "VM", - "Entra", - "ASR" + "ASR", + "Entra" ], "severity": "Medium", "subcategory": " ", @@ -18044,9 +18148,9 @@ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", "services": [ - "Entra", + "Subscriptions", "RBAC", - "Subscriptions" + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -18126,9 +18230,9 @@ "checklist": "Azure Landing Zone Review", "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", "services": [ - "AKV", "Entra", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Identity", @@ -18141,9 +18245,9 @@ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", "services": [ - "AKV", "Entra", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Identity", @@ -18246,9 +18350,9 @@ "guid": "6ba28021-4591-4147-9e39-e5309cccd979", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", "services": [ + "Subscriptions", "AzurePolicy", - "SAP", - "Subscriptions" + "SAP" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -18261,8 +18365,8 @@ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "services": [ - "SAP", - "Subscriptions" + "Subscriptions", + "SAP" ], "severity": "High", "subcategory": "Subscriptions", @@ -18355,8 +18459,8 @@ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", "services": [ - "Monitor", - "Backup" + "Backup", + "Monitor" ], "severity": "High", "subcategory": "BCDR", @@ -18369,10 +18473,10 @@ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", "services": [ - "Monitor", "VM", "Entra", - "Storage" + "Storage", + "Monitor" ], "severity": "Medium", "subcategory": "BCDR", @@ -18384,8 +18488,8 @@ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", "services": [ - "Monitor", - "SAP" + "SAP", + "Monitor" ], "severity": "High", "subcategory": "Management", @@ -18397,8 +18501,8 @@ "guid": "c3c7abc0-716c-4486-893c-40e181d65539", "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", "services": [ - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -18424,9 +18528,9 @@ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", "link": "https://learn.microsoft.com/azure/lighthouse/overview", "services": [ - "Monitor", "Entra", - "SAP" + "SAP", + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -18438,8 +18542,8 @@ "guid": "4d116785-d2fa-456c-96ad-48408fe72734", "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", "services": [ - "Monitor", - "VM" + "VM", + "Monitor" ], "severity": "Medium", "subcategory": "Management", @@ -18452,8 +18556,8 @@ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", "services": [ - "Monitor", - "SAP" + "SAP", + "Monitor" ], "severity": "Low", "subcategory": "Management", @@ -18467,8 +18571,8 @@ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", "services": [ "SQL", - "Monitor", - "SAP" + "SAP", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -18481,10 +18585,10 @@ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", "services": [ - "Monitor", + "VM", "Entra", "SAP", - "VM" + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -18497,8 +18601,8 @@ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "Monitor", - "AzurePolicy" + "AzurePolicy", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -18511,9 +18615,9 @@ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", "services": [ - "Monitor", + "SAP", "NetworkWatcher", - "SAP" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -18526,9 +18630,9 @@ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", "services": [ - "Monitor", + "ASR", "SAP", - "ASR" + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -18541,9 +18645,9 @@ "guid": "73686af4-6791-4f89-95ad-a43324e13811", "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", "services": [ - "Monitor", + "VM", "SAP", - "VM" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -18555,9 +18659,9 @@ "guid": "616785d6-fa96-4c96-ad88-518f482734c8", "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", "services": [ - "Monitor", + "Subscriptions", "SAP", - "Subscriptions" + "Monitor" ], "severity": "High", "subcategory": "Monitoring", @@ -18570,9 +18674,9 @@ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", "services": [ - "Monitor", + "ASR", "Storage", - "ASR" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -18585,9 +18689,9 @@ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", "services": [ - "Monitor", "Sentinel", - "SAP" + "SAP", + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -18614,8 +18718,8 @@ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", "services": [ - "Monitor", - "VM" + "VM", + "Monitor" ], "severity": "Low", "subcategory": "Performance", @@ -18627,9 +18731,9 @@ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", "services": [ - "Monitor", + "ASR", "SAP", - "ASR" + "Monitor" ], "severity": "Medium", "subcategory": "Performance", @@ -18642,9 +18746,9 @@ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", "services": [ - "Monitor", "Storage", - "SAP" + "SAP", + "Monitor" ], "severity": "Medium", "subcategory": "Performance", @@ -18656,8 +18760,8 @@ "guid": "c027f893-f404-41a9-b33d-39d625a14964", "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", "services": [ - "Monitor", - "SAP" + "SAP", + "Monitor" ], "severity": "Low", "subcategory": "Performance", @@ -18669,9 +18773,9 @@ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", "services": [ - "Monitor", "Storage", - "SAP" + "SAP", + "Monitor" ], "severity": "Medium", "subcategory": "Performance", @@ -18685,8 +18789,8 @@ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", "services": [ "SQL", - "Monitor", - "SAP" + "SAP", + "Monitor" ], "severity": "Medium", "subcategory": "Performance", @@ -18700,8 +18804,8 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "services": [ "AzurePolicy", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App delivery", @@ -18744,8 +18848,8 @@ "guid": "a3592829-e6e2-4061-9368-6af46791f893", "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", "services": [ - "ACR", "VNet", + "ACR", "SAP" ], "severity": "Medium", @@ -18773,8 +18877,8 @@ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", "services": [ - "ACR", "SAP", + "ACR", "VWAN" ], "severity": "Medium", @@ -18788,8 +18892,8 @@ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", "services": [ - "NVA", - "VNet" + "VNet", + "NVA" ], "severity": "Medium", "subcategory": "Hybrid", @@ -18802,10 +18906,10 @@ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", "services": [ - "NVA", "VNet", - "VWAN", - "SAP" + "NVA", + "SAP", + "VWAN" ], "severity": "Medium", "subcategory": "Hybrid", @@ -18818,9 +18922,9 @@ "guid": "82734c88-6ba2-4802-8459-11475e39e530", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "services": [ + "VM", "VNet", - "SAP", - "VM" + "SAP" ], "severity": "High", "subcategory": "IP plan", @@ -18899,8 +19003,8 @@ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "services": [ - "ACR", "FrontDoor", + "ACR", "AzurePolicy", "WAF" ], @@ -18917,8 +19021,8 @@ "services": [ "FrontDoor", "AzurePolicy", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "Internet", @@ -18932,8 +19036,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "services": [ "LoadBalancer", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "Internet", @@ -18946,8 +19050,8 @@ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", "services": [ - "ACR", "SAP", + "ACR", "VWAN" ], "severity": "Medium", @@ -18961,11 +19065,11 @@ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", "services": [ + "Storage", "VNet", - "PrivateLink", "Backup", - "ACR", - "Storage" + "PrivateLink", + "ACR" ], "severity": "Medium", "subcategory": "Internet", @@ -18978,8 +19082,8 @@ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", "services": [ - "SAP", - "VM" + "VM", + "SAP" ], "severity": "High", "subcategory": "Segmentation", @@ -19005,9 +19109,9 @@ "guid": "6791f893-5ada-4433-84e1-3811523181aa", "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "services": [ + "VM", "VNet", - "SAP", - "VM" + "SAP" ], "severity": "Medium", "subcategory": "Segmentation", @@ -19075,8 +19179,8 @@ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", "services": [ - "SAP", - "VM" + "VM", + "SAP" ], "severity": "High", "subcategory": "Segmentation", @@ -19115,9 +19219,9 @@ "guid": "209d490d-a477-4784-84d1-16785d2fa56c", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ + "Subscriptions", "RBAC", - "SAP", - "Subscriptions" + "SAP" ], "severity": "High", "subcategory": "Governance", @@ -19129,8 +19233,8 @@ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "NVA", "PrivateLink", + "NVA", "SAP" ], "severity": "Medium", @@ -19144,9 +19248,9 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ "SQL", + "Backup", "Storage", - "SAP", - "Backup" + "SAP" ], "severity": "Medium", "subcategory": "Governance", @@ -19214,8 +19318,8 @@ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", - "AzurePolicy" + "AzurePolicy", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -19227,9 +19331,9 @@ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", + "RBAC", "AzurePolicy", - "RBAC" + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -19256,9 +19360,9 @@ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", "RBAC", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -19270,8 +19374,8 @@ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -19283,9 +19387,9 @@ "guid": "55d04c3c-4919-4cb1-a3d1-325ae124ba34", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", "Entra", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -19297,8 +19401,8 @@ "guid": "df685edd-ce9b-4d3b-a0cd-b3b55eb2ec14", "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -19358,8 +19462,8 @@ "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", "services": [ - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Pricing & Settings", @@ -19371,8 +19475,8 @@ "guid": "349f0364-d28d-442e-abbb-c868255abc91", "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", "services": [ - "Monitor", - "Defender" + "Defender", + "Monitor" ], "severity": "High", "subcategory": "Pricing & Settings", @@ -19471,9 +19575,9 @@ "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", "services": [ - "Monitor", "Sentinel", - "Defender" + "Defender", + "Monitor" ], "severity": "Medium", "subcategory": "Pricing & Settings", @@ -19509,9 +19613,9 @@ "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", "services": [ - "Monitor", "Entra", - "Defender" + "Defender", + "Monitor" ], "severity": "Low", "subcategory": "Pricing & Settings", @@ -19548,8 +19652,8 @@ "guid": "50259226-4429-42bb-9285-37a55119bf8e", "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", "services": [ - "Monitor", - "Defender" + "Defender", + "Monitor" ], "severity": "Medium", "subcategory": "Security Alerts", @@ -19586,8 +19690,8 @@ "guid": "93846da9-7cc3-4923-856b-22586f4a1641", "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", "services": [ - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Secure Score", @@ -19612,8 +19716,8 @@ "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", "services": [ - "Defender", - "VM" + "VM", + "Defender" ], "severity": "High", "subcategory": "Azure Defender", @@ -19653,8 +19757,8 @@ "guid": "6ceb5443-5025-4922-9442-92bb628537a5", "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", "services": [ - "DDoS", "Firewall", + "DDoS", "Defender" ], "severity": "Medium", @@ -19667,8 +19771,8 @@ "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", "services": [ - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Coverage", @@ -19680,8 +19784,8 @@ "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", "services": [ - "VNet", - "VM" + "VM", + "VNet" ], "severity": "High", "subcategory": "Public IPs", @@ -19694,9 +19798,9 @@ "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", "services": [ - "EventHubs", + "VM", "Firewall", - "VM" + "EventHubs" ], "severity": "High", "subcategory": "Public IPs", @@ -19900,8 +20004,8 @@ "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", "services": [ - "Monitor", - "VNet" + "VNet", + "Monitor" ], "severity": "High", "subcategory": "Virtual Networks", @@ -19913,9 +20017,9 @@ "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", "services": [ - "AzurePolicy", + "VNet", "AKS", - "VNet" + "AzurePolicy" ], "severity": "High", "subcategory": "Virtual Networks", @@ -19927,8 +20031,8 @@ "guid": "3c005674-c1e9-445b-959c-373e7ed71623", "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", "services": [ - "NVA", - "VNet" + "VNet", + "NVA" ], "severity": "High", "subcategory": "Virtual Networks", @@ -19940,9 +20044,9 @@ "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", "services": [ - "Monitor", "VNet", - "Sentinel" + "Sentinel", + "Monitor" ], "severity": "High", "subcategory": "Virtual Networks", @@ -19954,8 +20058,8 @@ "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", "services": [ - "VPN", - "ExpressRoute" + "ExpressRoute", + "VPN" ], "severity": "High", "subcategory": "Connectivity", @@ -19980,8 +20084,8 @@ "guid": "718d1dca-1f62-4565-aee5-580a38249c93", "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", "services": [ - "Monitor", - "VWAN" + "VWAN", + "Monitor" ], "severity": "High", "subcategory": "Virtual WAN", @@ -19993,8 +20097,8 @@ "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", "services": [ - "AppGW", - "RBAC" + "RBAC", + "AppGW" ], "severity": "High", "subcategory": "Application Gateway", @@ -20007,8 +20111,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", "services": [ "EventHubs", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "subcategory": "Application Gateway", @@ -20021,8 +20125,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", "services": [ "EventHubs", - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "subcategory": "Application Gateway", @@ -20207,8 +20311,8 @@ "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "High", "subcategory": "Privileged administration", @@ -20220,8 +20324,8 @@ "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Privileged administration", @@ -20245,8 +20349,8 @@ "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", "services": [ - "Monitor", - "Entra" + "Entra", + "Monitor" ], "severity": "Medium", "subcategory": "Privileged administration", @@ -20282,8 +20386,8 @@ "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", "services": [ - "Entra", - "RBAC" + "RBAC", + "Entra" ], "severity": "High", "subcategory": "External Identities", @@ -20367,8 +20471,8 @@ "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Password Reset", @@ -20440,9 +20544,9 @@ "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", "services": [ - "Monitor", "Sentinel", - "Entra" + "Entra", + "Monitor" ], "severity": "High", "subcategory": "Diagnostic Settings", @@ -20478,8 +20582,8 @@ "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Conditional Access Policies", @@ -20491,8 +20595,8 @@ "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Conditional Access Policies", @@ -20504,8 +20608,8 @@ "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Conditional Access Policies", @@ -20517,8 +20621,8 @@ "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Conditional Access Policies", @@ -20530,8 +20634,8 @@ "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Conditional Access Policies", @@ -20543,8 +20647,8 @@ "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Conditional Access Policies", @@ -20556,8 +20660,8 @@ "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "High", "subcategory": "Conditional Access Policies", @@ -20570,8 +20674,8 @@ "guid": "a7144351-e19d-4d34-929e-b7228137a151", "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Guest users", @@ -20595,8 +20699,8 @@ "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", "services": [ - "AzurePolicy", - "Entra" + "Entra", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Break Glass Accounts", @@ -20608,8 +20712,8 @@ "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "AzurePolicy", - "VM" + "VM", + "AzurePolicy" ], "severity": "High", "subcategory": "Access Control", @@ -20792,8 +20896,8 @@ "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", "services": [ - "LoadBalancer", - "VM" + "VM", + "LoadBalancer" ], "severity": "Medium", "subcategory": "Encrypt your VHDs", @@ -20805,8 +20909,8 @@ "guid": "5173676a-e466-491e-a835-ad942223e138", "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", "services": [ - "Entra", - "VM" + "VM", + "Entra" ], "severity": "High", "subcategory": "Restrict direct internet connection ", @@ -20818,8 +20922,8 @@ "guid": "10523081-a941-4741-9833-ff7ad7c6d373", "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", "services": [ - "Entra", - "VM" + "VM", + "Entra" ], "severity": "High", "subcategory": "Restrict direct internet connection ", @@ -20855,8 +20959,8 @@ "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", "services": [ - "VPN", - "VM" + "VM", + "VPN" ], "severity": "High", "subcategory": "Restrict direct internet connection ", @@ -20868,8 +20972,8 @@ "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", "services": [ - "Bastion", - "VM" + "VM", + "Bastion" ], "severity": "High", "subcategory": "Restrict direct internet connection ", @@ -20881,8 +20985,8 @@ "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", "services": [ - "Monitor", - "Sentinel" + "Sentinel", + "Monitor" ], "severity": "High", "subcategory": "Architecture ", @@ -20907,8 +21011,8 @@ "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", "services": [ "ACR", - "Monitor", - "Sentinel" + "Sentinel", + "Monitor" ], "severity": "Medium", "subcategory": "Architecture ", @@ -20956,8 +21060,8 @@ "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", "services": [ - "Sentinel", - "Entra" + "Entra", + "Sentinel" ], "severity": "High", "subcategory": "Data Connectors", @@ -20969,8 +21073,8 @@ "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", "services": [ - "Sentinel", - "Entra" + "Entra", + "Sentinel" ], "severity": "High", "subcategory": "Data Connectors", @@ -21007,8 +21111,8 @@ "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", "services": [ - "Sentinel", - "Firewall" + "Firewall", + "Sentinel" ], "severity": "High", "subcategory": "Data Connectors", @@ -21153,8 +21257,8 @@ "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", "services": [ - "Monitor", - "Firewall" + "Firewall", + "Monitor" ], "severity": "Medium", "subcategory": "Diagnostic Settings", @@ -21179,9 +21283,9 @@ "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", "services": [ - "AzurePolicy", "Firewall", - "RBAC" + "RBAC", + "AzurePolicy" ], "severity": "High", "subcategory": "Firewall Manager", @@ -21193,8 +21297,8 @@ "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", "services": [ - "AzurePolicy", - "Firewall" + "Firewall", + "AzurePolicy" ], "severity": "High", "subcategory": "Firewall Manager", @@ -21206,8 +21310,8 @@ "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", "link": "https://learn.microsoft.com/azure/firewall/rule-processing", "services": [ - "AzurePolicy", - "Firewall" + "Firewall", + "AzurePolicy" ], "severity": "High", "subcategory": "Firewall Manager", @@ -21219,8 +21323,8 @@ "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", "link": "https://learn.microsoft.com/azure/firewall/rule-processing", "services": [ - "AzurePolicy", - "Firewall" + "Firewall", + "AzurePolicy" ], "severity": "High", "subcategory": "Firewall Manager", @@ -21232,8 +21336,8 @@ "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", "link": "https://learn.microsoft.com/azure/firewall/rule-processing", "services": [ - "AzurePolicy", - "Firewall" + "Firewall", + "AzurePolicy" ], "severity": "High", "subcategory": "Firewall Manager", @@ -21245,8 +21349,8 @@ "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", "link": "https://learn.microsoft.com/azure/firewall/features", "services": [ - "AzurePolicy", - "Firewall" + "Firewall", + "AzurePolicy" ], "severity": "High", "subcategory": "Firewall Manager", @@ -21331,8 +21435,8 @@ "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", "services": [ - "DDoS", - "Firewall" + "Firewall", + "DDoS" ], "severity": "Medium", "subcategory": "DDOS Protection", @@ -21341,7 +21445,7 @@ ], "metadata": { "name": "Master checklist", - "timestamp": "November 09, 2023" + "timestamp": "November 15, 2023" }, "severities": [ { diff --git a/spreadsheet/macrofree/azurespringapps_checklist.en.xlsx b/spreadsheet/macrofree/azurespringapps_checklist.en.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..c9450bdcacdcc2b95ba33ce38cc6db9f41e71b00 GIT binary patch literal 19803 zcmdUX1ys~sw?2Z1gmj2fN=t`ySV*Tzi68}Awnm21e$wbaS+O4-NX&wapDk0cQFJAaG&qQHa|LKWwD#C@ zd{X5W7`F#G=$U^pwf&wc7dM_3747W!T}R1mRW|*E6i@OrQxMNOc=2Hth8D|aLQ&hR2ci}R zF=MxcK$y>&E4DCA1E&qXQDwA3uw^WBtvcYEWpnN0%PyQOCR%n~dgMif0e?dArFcfFigx;J#iDu@qtP^GyYu#y z5F%@+8A+H7J95`#$jJs$@|aiM5@HfQ8#Y9>2c<6x$$qchL;mVJUjTA>N8vr&I4CPgk2GI1p%Rs0s#RJ0M6Es#qy1g zkN=F8x&CBglzq49Aa+l_v4 zv5%C^$eQxijOy9aNTNbF1KxD8E^U-}MCo1i`h4j#* zouR(dvf#0b>5(bst^Ffq?}w~zvqVyFRZ+y=hty>{Za-|J2-dc@q>yDV&THQ8?kLwf zWrV-vJ9Vp~$wyK~2ZF!E7Z0kvWMxh^ckI$YGZI)D6&reyQ5iWn$>$HOEfreSAkd4;!v!P)1>n<`qtZlAE@L&rI^4 zK^M_9`hF-aydFrsvxSc@hx?KHcfoUd2cK@{TMr+bycxCXnN^gu*h16M`D{Q#-cY8D z-hONR1wvA*NYJDAF*3{8+i%yfshwneN!igTmTBl-A--P-0_8U?$L{g!F>KKF|D>Z7 zyt!IiC-<`+TZk5~kJZFgkpszYd#rYLd^*M7Mc8R|VtplZt(be#IN?o5r~|Z<`(ST5 zc?Du3T;aTvPR5e6rBvy-G3PHloTPpyufkz-ZaX)8*ah0tCVO|8Mik0eCi;NUmw&6b zsOf=n!fV9A>FMAZy?!oCZc%S`upg@GV23t|U$Sls6<{6AEY`#cAp=UEg?=cc> zc9~<}-wBdr|8vU*TT4Yd`eQkQ2Og6yF0#tJG~0V@kvgGZRa`01EphU_x1ZH)hG~`K zOr8(F!$`skm=JHadXC6pB`hqb8p``DdCu6apEL80djiKIJj4vKA!`PRHl4{jU2$gMHEs3qU-fY~4P zDbmRfUE~a@A(}*scD{9T9HAkts4>3bs)!)_RDH||u$Dlx7E z));lQ>EpV7pOuGehjYpX=Xzs0As!Ou zhX6?f%&TpeA&uS!v-%YTp-o}kgd&!>3EN&l(o-C^{puYJ-zjxUD(*rUQx!Vv2IVS=O45fg`rFLFcI+^w;LBq`2V0|zv{DSxX8ShE1R+=xohb-J|?6V z(y!!5sLGiBF8wJ_c@az4D$C+E#4tN$dMogxeVW48@Mw@*r*Su$Rc6PXJO=fAkdcFN z`jC_M4N>}Dy)eO)j#Pp>B5e#j1pJ>g(ulsvq;^?;Yf-J&6N(zRp;)o?B7%D|AIft6 z2)leO8*`Nd0ihpy3E}$T5oTjzZea07N5|5F1^x?uj+KK0rMDO~vfup;j;04f5L2%l_;_LjS{gU1F zseR)@^%rC&mKIPNUcr{(!S7s!na=wwwvodv%mv|KYpdM-*>2Bj>NURttX*)+LP_$V_S{L;MS1C9JfrkJq=#Epbbq_PsikFS z(>b?1cHxhbaJhZ--Uv}j!wOeDcyIbObkccwx(_y(@2p?gH1T{G_ks+w6I8!K;pv$(x4+V) znx0u|Q2D~LZKjf(d~mG02gRjma=8uq&e0{t5W*>(vDl;U0M&?Yf=(~WXtXf*D5ZIV zp*>BFrhOWP8s9cL%T{~(R*abodLZ=&u}*enJ7uN&wbf8(hc(OH>hF+BvN&BxN_5M@ zxUiDTlBZCSQBawTw_)6*_~zLCppttW$Trt{IkV0+B!Q; z1bz3hXFG3o%-$+N6(PIr!1ri#9=jGixtFKLs3G)t-_qC7-dAUT%qU#8@C6zqo~AG7 z1F_DEWx!b9{jnZ-A<{(0f({}RKH&w8Cn=pbQ`&tZJc*`qm8SOAtpauQ)E~{i8mi=+ zZc~p2X{tNAdRDJzwgQKt?zXTkD-_*we~(~C*p3zIW4S+1K$sn~Pr!BH*FvM2yZzbL z5z~Zh*wW8L+df|dx;JjTt5d)~G_^bxGLcy+l)UWMU2daJlCfS;`Ug7xwA6>Y&=cze z*6xe?=*5KH_~HF=&BD0UHn30S3zJ2Na7CXD#5RGONLJLAoA2ksxCP%^d$&pabv*nh zte2NizayBGOq0LQx+-gFR`z;zzP*f64&8q5@=`pe)y}-85a@P_XQa@geg(<=+{%;L ztveCSOQu~7jSxnvIvl2*>{H*IdUb#GLn)w8h(yxU*_gI*t` znKnUK2F)w`g$L0Kb6Et|7No-old$~eJOqtOZPHs7x)qCN`wC5VmP(E5L8Y;#O*<=L zYxu_cHfg18xd*#hL*g7eO_GKC{v1q$-|fm&9&qnwRm=>1_P7~WY5FjqKsab1d~pdo z-F=`q+_ra&pI;OMGBJ3T;GP7GMbs&4FbjM4h(=b zN)J@p3Y2nL;<<_9OP@MrFXkB9xPvxVN7;rJZPL=xT57?42LnRQ%!;06yLO$VI-C9* z8T@;jO$!y0lOUo7=yYE_*mGmP)405XbkGDMZC==)DQxrylBv5?V_>*QPTo8h-aTc% zv9e>j(^9gwziFOd8e?@35jg<0?-8us-7u_FSz3%IYuy|zS@SeD0|{dIZ<)G8yytUB zTpxevkOsP0+NT7%IXkyilOzvr|LUp1px#@xy<@&cQC?cXGD5guEzDm=sc!Tqyu;z9 zV9*>6=KXsDi=V2B4*=l=Z|K|X?!30h9vCvo+{|Pt;5Je8RBHTGHT&A4qx|w>smXF7 z5x5izZP2u!tuK#pj2&y}X%RQ^NEBta{jkxg<+4dV&vLm1?{{z`i_gYw6#`nH&r&iS zI(BwB60*W^&9a%R{>e5iz zuu&2DS|H0*)ENtsf^Cu$j?Ch=;k0eZ?oxM{jux)D=8i$|ad51w|vdNA) zHlI2+|FYi?bXGnCth?P!DGQ^j!%jmLmgC<_3;PD@u_{{f_pYgwTL$C~^g*jZAZr_* z6f&EG>Atnj?d26{_Cd^iMsZ0zbbJ~4WnqQmjF5o|#Kn2%wrQ@q7472wn!d0ty0Vq1 z!_N1G)&=n5+D=XrL1|0d^gZ5#w^bK7gEX-#_w zJ#J2Et(#ASNw%?ec8{ujZYZa*X?u^ViG?}5p?i=0g@$;_&Q?*i1!?UkTk*P-U4c2v z_=B)csK?Fv*hLnS3E`3_<5K|&r5x+lT*8in@7FBXZ!tPIkdixD&Xt)~4)a*e(6Geu zt-t(6yX{mt8)vy>0eapzx-ezB-7p#-KJ0CzJMPKG7dT~mJCL({*~>CpO*^eAIL)8D z6fc!WT1M!LPg-!dP6b^U(QK_Av-4{|e}29|F%s`^ZO7Zx^0W%83*o_Fw>j^e-qLVm zr;2jWd?A0ak$hkwp%9h7*^2${?0y@l{v~9^8mFR4-Ll6{kRL1*Cq!!AKEL2u=-)%; z2oj9(^yGCcZy$cG1nP6%inA`8S=qJNiez^zp|x4#JQxo29Lc8FQ^6vC+)=TId`?aFLklfLlx7vj@WFB&$9VOxKfPSkeY9#&`>-R5Zk3Fv0hu3>4v zfn-9sjobJN}!(pWA2iesp>z&3eQQJ3`r*m~+Rpv(+_XEQirbIcC?# zXB%`@SJqd}%ZvER1B8bOZTSLu@L3wREF}_UQr5X+WmpDxk~?QTqN4}2isocf>X$rr z+rZ;JKkNO|14>GWenYEU#lrV9~}q5yv^P2>6>g4z;7t*Wv|`No`P7cB0zS6^s&zwbns6`6k%~ zCdGiln`x-O_@0qbVlmIILMB`vv>3v`EW5h?%GoYonMsKVeI=x6IfT-TPCaOaK3p`` zocH?@srQ3+x+}GxpUSQ}rt8vKxo~QZ0syr6S^IT-hM{k()ATiz$xMd|O(gL;zK?>S zR~~y%iEvaFd(ammO&uyGZx{$lgd0AWEp`GI`SCqI%VT(pq)x5p4swLp`w35p=uNG! zbz6iG!W)>uXUA?K#<>Q9De~zJ{<~N5-*}-EOBl&<<851VQM^#o1(IYDScvV7L0{v$ zsn-)DZ0L^mre5cW)6{Omjw^xGd{=o20O$5(QU5}|UtF7Fi} zqIin$g^6ZFl!>`^=`d?0+0|8^=EloW@15-JzB9@Z0?)?K5ARd3lPa-w<*_9sT8?)6 z)RONPY-?-WWbv;!0-}2IFaapb`RdH}NgaHGBI;c=07N$skwmZ@a5+4NP=4Xr1L4mwaU%yzxmmi#Xk!~S3rKe=WgK3UDwZYoZk1d>7KbQph(05;|{7`=Y+h!Hz5^u zBSn!2ep&B&v=^H^eCoKYs9eOr51q7|^c4x8F}X6T@!Cgs;Zw($_9{{JDgk(I63`vi z@&I|{YsD*9C*)%v=!VpUy%GtWz;8KKe9tjzViuZjp~^2Ajw9_xEcM*y`uQr$0l*r= z8tX7rsi%;vAB&fc%Zv=n!|0{cE6C_BGolClPBkC_8<-Gt*!Df$W@^_wKhSLAW#B99~hwvS#C<{P^@q2KcdG(pk51$|N z7ywv8bHF%+rq&PXq-y_d6GL_dLw30+d;rKpRq^rChfm>qKW3vNOqR&b6wA(p;m2@< z-+_yT=mr5XK=LDKbO6$K!N$_>osds*{;LTbJ&kssEOx-xQO{T0uC6$#JH{^Bp@Pga zu4^9WpE@o&#&gsVz6&Nf7frn2T^0)K zvI5-WE@KGPJn6(|??DgW15FXE33+=W2=J-nViR*=06#$1*N{#H0X}sC46Al8YXT?C z>aZJ#@Vens$KtA49iUnLwgYB$*b4h5Z$$25@B#~td`$LIPV`bHaPn?mJ@o;fI`*OU z{P*xP>=jfdi`v;Pr&?kO5VIy#8;*~5CZ6OJm9Uo(8HmVR2|={3iIhl*H{NCI7ZR20=$^?(w>v?;9D z>{JQsvupfL^o!b>gl+>DX!6%yz}a+o>inG>*!dhb+JkjYlH^E=+uz-lp37n*%@M&VZu*9IS z#Ewr}RTZ3WXMA9IgwZqLFjgP}#+=B2!;_=pFDCGd#{wXOjakq`8EpLA?~gcubu5Eu zz`k>Ce14Vdt9xM4`%bkdXm2ctZrX3B$7({4QF!LMfgPj>`J#tfr?1W=!o9ijgNlfOTi&(Jm$U{M!rEPbAl{}(2Sp)InBbN=Jq6Ul7! zG%eZ@j8D3Qv-rO7kt}boMnv6f>#6Tz=cQrk(DsnG`n95;_ki(H1ZS{jj?^>RF|=$# zRFn|K54BGkL@-N?c~nb zJwEg&0rQu9Y-iO7_xJRSo#LTCxLx|O-NvDv@)^6=hyEmC{_>CQteW8d)XvyhANqsa zl^@$}9NN7+WB2~hpA^hr?XjIzGu)r{8N0AUe{j1NxSg%XT9NhZ)&-29R~=IC8`z%- ziZeX=R(;8X;PzctcY@pbQhp6SoGO}X{2bHPSH#)$XsWd%zs1!EnjydIx*W7wLx2&a zwR&566JM#Sx!CQ#f>cxktIC&ev@1`?(Y^>LI5rcU_YR%#q(sM3jjI6VyFpwa9oGfFJytT`DYfPF(Gl5_}@+UI!YmiMf<| zQUlufod{kfRxxjJ4q}?7ryEp@UJiswGy!?Eiz)#m!9;pFDMfKQt%B$$nRz*ku_LFV zQZ0Bj;ZxO5h(yiPXGld_M7kxNKonQRc3&S+++nQlGCW)dZv&~R!HCmvx7uqzHpJY- zgKhM{Sn6=2pG9@rtsha3HtKdw(lLdwO)ny)>cAphVGk-=q#RvDIzcaK4K)=L1z+() z*JWJb<%sZRAkm*7l+$P#CRCGP0A`5T2Pyu_zY51$@w$=^m733KKmdLsJ4g}?6T?#C z?%zIZ-0Hb4c2qK^AXBC@xuF#kiWd>W(gQpnrUz6*1UEzEEYLl-Q2`Iq0F!`S4m->& zU+gEa{V_qj7$)lAff-A|0t51f5kT>JPXyIjq>5+(cz}YzAcYq!ZtO;|`%OHm+N4N~ zV4ZLFxR9EUs0w&u{dn9o@R0kSsA&b6YMlu=?l4}5v7>k$yf4H%2wMvTD+}xl3)WWF z2dG8WNi6_6JE#IE06=fL9|0|EmjBDm0OxERAQX5UHsr@~K(a^9)C*vHl`EX>$SCk+ z0k)em7LD9HVY`{^;42D%!h&W#u5bzq*5+SFH)cCUb`VdA03NB@vqM;A&7Re|rJQOcCP{rkVTsmcGM+cN`-&gi&ru{}zmK!AUcxN3Cakh&wbE`_G7P z9S}4FoYIdxIu3+xPyZ7j6aNTE%s&ERai+9?3yAqY0&+GP;Mn?Wul)MQUg7;mcASDS zcdvuJ$nsaQaE z(>pK{yqkgdg_O;m&b~j0!${u|&vA60c&sLxHQ|SF;vU%ks~$x=Ok)K)3(*Xf?rxb+CVi*q5Y&gkm;1TCAfp;u+gDm(Jn&8r` zQ!}|qJ#Br~xoO3Oso#n7QOAZ+lC#cTS$JJ3Pa;RuFh>+UQhvUGJPer;NtqEbreNR{ z{1`4@L%r;V$8#if-LCFBfF1)cr>j|bTq%!kKcr%+S7?{xfa?OHC|rKn$8c?{P|xp8 zgdfosc?>(VD^bjkvx(us><{l54S%~DF#k7;Wjok`aNx&0u^DRF$YsAXC5`!kew>(e z7*05Rbfms0L19&J^Aphi=ZkHLb<_}H2%n&$d<8fMftTZYQ7;FbffNSUk~n~z=@HkM zUBfSeBJR2!a|V@$3z)*}Pf_{HYQX&8EQT=+2nTlQfuRB`{y9`8E}v2fwG0@YgY<+e z|Et9x!vbR-Q!fLbqjXr0VVl`zhkb$yuR5-YJnEk9UDYczriUN2U~HpV20ES9mE*AD z|6dq1Rn@S)<~UALEQ+UY{$2-c3ZBDQ?aQ%<t zJ~V!=yaAlBDcBu3ZfkEHTr(ZxecDk{B*3i%c!A&C8){JEV=VkCPU}n4+FnSjH%8(V zc<5f6)vUGf?AzPcGG^ zQ;$A!McQ&j@YKtnsubQdPk%6{nO~w9Ec8fQp$HybnX_*<^G-K=9o2s99ei}kys;SG z=@{N4(n~o8z(=R3#c)i=aL^t#oEH{5Y;>YwNnRFHF&0yg4$o1673~0Cyw;eLtZ`}l zfa^8za`-t0*gDd5>d~2`TVn*p@qpOi>I*p6{TYdOHfswSe4Jy6gN1h1c@Rx&B**C4 zy#C@GRafTd9*Re<-RgcJ@Okkl7*4QT)qmW#6pzJmwYDfMXaIcAA_`0MkVh*35t@rf zn!Qfyp*aRz!hsj~sUb}x^eYDa45F~4a{-zG4i9N|e@g8lr0CusrltP%a*L|t%>fce z!bay1XFeA>Y;>ldfAz~n-2 z)?HxA>+`*N);YX4$In(X@}hI%b5!s>Q%o4%7kcwQ>bv;?d9UEYiJc=AX<_pl)BD;JytV$^z0Y5(GU z>bL>mdS!8@n13S+=K}xV`sO%yenbKaa8AU5G!J#Q4o?G=)(c5_x`e+`gn61SaSiR^O`bomW9Q@=tOD%rZxYYtHaL~1U5RW@-Q4u zsd5e#7{%4j^yaGo-m@zI*WOgQDDoG2^P-9qp6|`G&f#1+r?h`@4hZv^bJOiiIsc|N z|D(Pc&-EtZ1w?gEj;@uOru$QjXPNZZ-n>Yp3%z-<)+!3;dh?uf7){SrQ}?3tuya(9 z{P(^2zw+IbQbvWbS1g6eaaBRb%hQfIv6@k)^2@vG_{nN9cHU-3(+FO&Dd7EJ49wsW z&A6s<&7naT^-Rd&e+i${taPd@9?G=I1?_y}A6fOx-5!OQV%7HzsT*%bFD%UMK&@?Z z`vL-$*6+;ID!Y=&>1Mx#)2Rq}@>dua9w!go=BN`pC z;Mq!38p|I3(6*GE5=$Cq!GFb-JY<^-KB$B2i*Why{moX zoF1zvYrT#Ydm|E#tCKw&(<#HdgVQNngH6H{#Y9cy^PMO^oBS7-$?;r!_E*8VEZ$2_ zn?9M*EHhh`)44ru>Z?RxFgSO&JuTZoX?Q5zCJkEPK&g5Fsh-;bdk0k|I!-SBDa=%N zocbx4G+g9ayG+*4ZBhxwBpfb!XK9PFM4pkE$<@;XZdxjdpSTGL{uuYmT6kBdd_c{p zVl8g!;GORJN7{9#%qXhu`@;K5jFnKj>B`PT$64e3o;sle4f|Uy2QwV6_6KC=mh5NC zSe$Licg2IDfx{f;j)_ppA>Cn7mqNPznI%GM!4=`DQV%BQ<-VLqN&&Y(_rY#c!UvWybx>jGEGRyRyyT#v+IdP=b{VYYU|j`m z6CSdHSXcBr^;^o$**kR$rgZjzPzweecLopaD$DuzQ+MZ~MWCfZZs@R3rcyWcd~1cx!f@A?FwI5G^v*vpFY4k|2?5)Ql>8%NC*g4=m`JndqV86@4J3f z)U+6&!-g{W3PEnyi#r5a+;|6ia))#-hukwk2LryBFZ?eAo7v-LBC9>gye01?Lm#T0{>$GDK#vt?k2k-sd zI@|D??@PS8(IMk(l~g^UBkw6-Og^(zb~~^9S|MxCDtVyRUGX7WMo+gw+#dTCg59~Etmz(rxw-?lm>79hXM1OuIE?w^ zOY54&C7hyUzdzvZTWbHUd;ea{P&M9l*HSa@N7Hp3hFIl-C?bC8*AS+4-&**|>Eo$d zm|ZD(kBIRV<2o<9L&(q1;W2{WE3eE5#eRBj=~*q8;Eu4rh_R2N9onG~j`-lgp4pZC z(6k(C6VI$B?o`>$oJgFH9Ht*8o1P=}W5vr{zU04T zPsher*DjIKJt(-MfF%2r!5PeC;N&IczjJG;PSJ^?R12ALTaCM)A~-}QxoC-A%!WJ0k+-|K5xm8}Wdv~e8KT_!`OFu) z3$;*f!?@V{N9BFye!huthNW-_&R~2C*n>a1=Fg|?_w_+W#1ElgzrJBp@U8BoGqmi|3U761lw_Ch-!g_=kOGUNs=nc zc~fH<P`B&!2U$a1;sfARGC-ZFVR}Lcq=O^Oq*yPW@yh^<1H}T3amMC zkZEM~$+ucx7RULfPlh3n5_Z-!Gi&}g(zZ7AQf3q&8bME2%U0cDsOW{nU z@+0dynlpPP&wcDIzv+lLjyyGR|DN*qYQ||wWu%-mxgiXl0val5bBUjOKQcgMqR}WF zHcUNMf}OdZ`%v7;BAjj7=?%79-M`6ZzP)6ZcvvSF*1YvmAt>21XKY6&+}uS`rRb*e zL#X35vO6TGzq_Aap?Tg?za!=R<%v$pCx_f;!7fjy>8W_UeiMplfvgrkzK)We%5umn z$9F=I}Cz=KFdVOjZ$V>KUCkP<=s$L ze3EuuJGv{B@)|i~Wi2Y+m*6p_#yBnkYp=2chlj*Fai6G%8g~~~IZbYIk$<7@gFaZk z;}xhj6YtMM?2#N-@P&B4s=X$L5?8KAUA}Jl!Qh%&d%jB!tJD4GipU0~^LK|KDYlXb zo}^j1_AQI8E#NMEPr>A^Wefq4uWTRsNHJbrTaziA0vWeBkVe>)#@^d&tq(3(%o-t( zv*x?>Zr`Rq%&NW{AI0WNZ_ahQd)J%lD&9O^*%4I{;1v^C^9`^GBqa45oIRi#3YHQQ z&-IDi8+!L(yuE%2Pqfc!M`jf?^_3lY7t|k~g)s!CUul%9s82L(XrL>gxDkEF;rX3s zsWh9R^*h{V%3?Pder{jEdmn7?w52%S^TM0mEx2;-vGJX4(a;LB_&Jf6xz4;we=KPe z-wgDk;Kqsm%(s7sG3bWI?W@S4QoQ}NAdc=kQeh zT{WLrYB&A8h~k;BGWULrv=AwDiT954TD~Cq^yLNN@MRg2PdY`n=96*#Hg=md@C`OQ4^D9Djl*(^ku$$0x$`}GISW0ZG?yt_*2-(KxfcyN!(oq|vd zsY}70;*aQhlP6T+LBJ;$wTWs~q3_A-e%@bJ(O+FsEh9&H+jRfsKnD8zLR-7Jw{`fw zpTOSaKPZ05&Ae4cTUK9)^buHUcWbD^$`f z`5(TxR0xcL`ftOGe5|h!yMf9?@GmEbQPBsKXP_fD5@;lp|B%rhxR3C`9XmmDAVJKs zmk>wnA@(Ja0{iJ!TaI|*NdeuigPW||MCY$Pg`!~ZAAl4R0*^)kZaxSa<~oKJEX=Ui z*dR$`L^h0jnYcO{QmHkFY~Opc9)3VC@|sSJtO?YrS>OEF`-9>Qj^sgH98)G1XM#0} z#Xz!Q9cztRpW@wggd79u7=C z5{os6lZ@XW#5@2~iR+m*4b$zB~jBB(SbS=$$$0Ymf@#XJdk1`I85 z$HO|*e%SZGUzwN~z^`>dCI$nn*mafOw1`gmd@BXk*RnP946pebeW$il(FT){wv$uF zg7e~?gGhBTJ+hTLENG#Ni-C%eb3%yvO zq|pm4WSav0yVoUhxA*Q?CGdQ@tNv=d@7^wXmT_(`h1kiPDqlhGuC@xrX+oEpz5lbtCzJW)*9W16ywp(jpad zO$yjHz;>HIDm)iU{?ClShQ|(O+h91VG#B7T|WmcD}fx!_V%<0L$Od)fNC zY~@acxZlbj$eKlAtNUoOqkZ?1HTJqS`sY=G4C>7c)#YGtpKylm!zWs_i29rqW0G-c zl)JMDz7>vqAL}I-k!1R|Fty4@Tp!)~QPb+<)A@*K>9xk|o~Azgf}))=3EK5BDUZfW zO0^mUVU*d%p(WQ=Q?`wZd5U@Wzm8qFu&1e;Gv@(?{0K1j#$iDZ$$Pe}a3a?RNu#}E z#eSTLYmOjlH2e8$n(-hZ3%2E6RgHUd$lL-$iQFe20i5KQbDx(wXvjM7f8I? zXIvHf*h~2lLYZ!exLWZvbLVe7ULkQpk_j!>#~x!Xa~<2XCMV1LS=PTwY+$;d%bh#Mn~D*iz%EovDt+ z3mAcGpEk)W>s^~gzja6gG9f%>WD(X|!Zxm);1WWVH zw)Ly48`zg}TUGo$-h3E)r=ZL=!r6#jWs!{8pf@(0_e?%KeaKCS@?~j}0WG)s!4GoSrlY6HwV;UN@AgAx3)irBwnW znVi7yBa4Gr!_xpG%g?$C*T3+k1z-}&sZa5Yvv=jwe?psVHS?*7xTn;M5Rhw575gHP zhK${JxU}KQl_(!?3{Vnw;1fyH(jm663Vwg7%U;c)596pJ9ad34$(Fgz6^;pvLIV14 z;XSQpcWTzK5Ly}5*ItQ#JoMnr!Ol-enq~i1@TI!~jA;OOE+OJ0{p&|q0ieSFyoEg` z>Mswpy14q{1EmhvA|SlIly!FX@#Cc~F2DF#rPJlJ!1jOhkfnuS2OP9dkdVzlczUbxRrTWCnrJ{RqFQ-@Ri%TyaKBr5YM9v*W7Z+X> z^V5ZSk53{$miCK_FAB%$Vh=I+;(s9{7yVpp%2PjP;(yzsa+1ivv$PNp(15@0fNE7q Hz()TC*jM2) literal 0 HcmV?d00001 diff --git a/spreadsheet/macrofree/azurespringapps_checklist.es.xlsx b/spreadsheet/macrofree/azurespringapps_checklist.es.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..0673b1c4510dfa660a25d0794a74c51885e2532f GIT binary patch literal 19995 zcmdUX1yogA_b(wRAs~$sDo9H!4HlgSjdTb~cMB2%N_QhAAs|ReN{F-)5{FKSLvx73 zfw#}0x%azw{NMY=8}BI`Tx-uY*POrkn{%!`WN&#X)C+`2NJy8EeqJ$C5>@?%?E#EF z1K)VSx1O1@LMZ5#J1X#hr16+3XUps5t9LV|Mzj$d_vYUcD7m#b(>uXw{)RX!2+5 z)kBRM#Y6@SML|Nka@t;9GfREA!Ct|dQgv*E4b_sfPBG~!KAyR_j6!eGzIlwRi7yuG ztohJ%f5p^V*folTj1NpXCV>*oH1X%*WPcg(Q`B=sXa! zdKoujj+b@j*{o#i8JxE7#GyDGC3KvNv6-(nIB$ zGQ)Y-9w)G6Dtoyu=(2TdgXje}E><&Lhi)UPQsSWB;e^sWqu)w*`t8MI`V?a^HD`Oi z>?t8d*WY3$zx}GSa7~tq5|r_UWz{1oF6qOorkGzLpB9DWavFBgKE7Kh9&&r+cjlgYa`UjuvaOl7)ZDydmgw?ox``7<0N*3R8yI_N)N~3n)W-iln2jH1Rv30zr*j)DIy6ora zdGT_WtZ;gfOOGn%<7n#G;Q92#vO#q%HkLF?=Wb0*zJU2>F;cL!=sg+rjDbvRMkyBt zq-~*`FCTxY+;(Uuk40{axjF&C=$q||nikVoEevdeheuh;NyxyZhw;K01TOiQnW;tdWNDr#Ad-{m!8+Mpk( zrKc9Ww%YJrzP1rhh>oD2&CFeq6V+jRykT}?CL_>I*kyHceI;+LjC;y7=|xz$6ReAS ze|I@;Wz$T!%5~=xC2PT!QnmBOT%hnsss`hiDksR?c46d*8?3iO?#?o;7>v0>>;dyT z{;j^!mIum71}K9wGogRb-qPdKBc-DE1-qkEaEd(hd8yswxyh@CNwMtc{Lx(Sl0CC8 zx;_6TqEQyzFAb%(yd|M!1uecQ!LF8+h8A{L_&VFbpLk0Nbtq_ zl9gaTPZRf#vbWOx$nsK@KghR`dU5#=-skukED&X>$zB>XI(sF(^$&JF9$&Pekiwr~ zZ|oF1C`-IIV~7;T?;Cb_x+;3H?<0B;#g`tsAwjkK`h&XN z2%U0*ncB!3>{Q&KNr_e)H55)8VcA(c?f6w%-0+2g$w${HKG~;wLU6tlQlub%|6Uo( zClJdfIID)N7k*9IFjh_ceNQTtHnRScC%rGor9ANqF51^yZY{|6;&%{=+!%L=S$fwK zG+V=vA(Q6RO~sTMwyf7RC$Zp*7cVjI`Z_FMa_0e6-c!nWyFmBWG5#N;RxS5*gbPg^ z-|D#3tm6@qeznHB`B{UeUp7-YC;VDgtnC!~%TL1?66?Rm4L>bd2+Q`beZx%fXSG>< z((LFS>I21%xMM;n1|^jZX~~){$l4ZGyyM`sT@X>0qtEg(I#97CrsUNLd+6|=HS?4&k~%xDTO3_hFf zm(ZhqDiL;vCTprNn0|ny;X|(WW2P!!ukaO2a#?iAVW0B$cUL^Gd9Ghy>5_IG8^YSO zPGIlRkK}5}<|mmp@_Ix&_zXXq4SRH1nW{=lvv=N6De?e$ksz-#Wz#H+&xHn9Acn$T1wc zmqJvclWFYsb#e}pVaWS(sL7tEzN(c>#b&Hu+7~kGAek+DM_U8X&lHhGKGl~$*=*%Qy6zO2%A>vQg%qGc_&Fr?$YEx}A5{dy`Rjk^29>qOX z1Yswo~B7PwHSmltJ6-YE@aV)QPL)HYW z`2N)uH*vPm)aFG~Zcq20F5{d|8c*@{*RXFH(=#SacCm_Mm>@a2D&~c@#!9sMUuc@S zAwFC(*|eEhQeHjcruqpI>Nfn!bji(r!>GC%y4V&AZIR24or2AShvtgI=fR5xWoG-O z(5>k`(-Kt;3N!0MhtRl$_TfS1-jY1m-97v05gC>erECL-!kw`mpSoLJ5yiOBwjJA^ zaadhjo8@Lpd5-~f+efKOX$VdDld$Um6|4Q)#HL+KU^Z?xY-DlZ+7~zHHS0;L>T1=I z9Mh#<5U9!223D6{(qtzjC=*b^t1(mEo87Tl>6SR?HsD%ZzM(KQ>;zqx)s%s>_~T}` z%~@7|DR;*rU~Ws4lh6r0P=>?j3e8OL^!}$jNa6s$%bhaS=d4tB zp{$X&YxRXqgd?*v9NIKy8q3QDO&0_A`L}lg^qgQVK2R8BdKTiNvgF1q&;c1S{aq5c zufA7!&2gz%VwI0!)ksKcl>|3LfP#jMN-wyweI{deovBegAs|?Yf|`Pgx=ll_uq#jS z-6CFp*NuXe8v__3lsDb@9_=mQHOz0XTL-sm3VmOgB`sWGpDrXZ<9GWCRxjOWZkiEk zrT5QxL)d|XUmeiU#ZKIzxHB%3kumgg4xlu%Y~mTnzqiB(_bo2; zdCNQ`2}(7xx0A0X)1A>XHNrg)g>9Naz=D*2+NQd$3||f~hi=8;BqeAGp~EgTkYayx zLSd?jg>3uWNFDP{Z+uDHLD|NS65csMXTNX#vC9y5ZI+nRF{*zeH+^k5mr^)9AkSlE z73X409cPP<;?|gHNfnI8!O6}}c-v^h3OY*%UR{yzFMM1xb(MuXFp{nVJ?z)((R)*C zEf=kz9G<)O4Th|>cIIV{6}#J}W2>9If|jLkR=20#hzVf@I->`YvnX-ePnwr`O@x^{ z!0a73uGR70e>i%n0_n|cYvOSEYVYTahfvdj%hs+HTId;d4p2dd)neEVbLC#OYZopq ziM7d@L)GcFn4zd5)H z!zvkM-NfCj1utNAI6HNvqs_iaan_atL7u;KajGOTb%boh?u|SzpMVU>mg;ZVw-}*w z7nM&9Wi;(OD1%eUU>j*_`(SA-?rbWvh@WjjIV_-(7h~Qttb_6<4S|!>X;A)0Ok=i- zX`oMLi}lxbNKBQhD288{=aR@Jx)kn5nU?pzO5>ETH2*n6)d>D& zHc;Z#)B|xXSQHGNfDPTYYiXKVH6}}F?OKDbjU~T|*aZI=Fd3FxEQtkAj@kBmueNM7 z7#EBbDM_zZtLL$n_+$@*i_OxwyY9SM*WwGkHwxA~0%CBYo8V)W_tzGlk zQ$3RfE*&aEOLi@=xd}&yxEfW`&DCC?wp16pGS$k2?iP~V)vXtx6d|GSO+7n%rcUKm zeL1w*APD=AoGFOQ&0aOVydA6nWpj&;0>O-Xah6+GU~QgxTkRI6 zS?>r+iS0{1$~P&ue$oxOZBDlt6b%klRjFt$7H@*)Ve>8Ew%Dn$Df>U61CbL=1uneB z4&x9@o04kbvOa+vS)oP6Y*1)+&yWGMMLUabi0QsSN;`UB>Ly-xM&sTB)0ig499xc{T+yFbw#DKBc1)8 zsqIKr4|#hFs7W8HU}VRW=%%rVqcl>K7sI+_ayjUAEz!n=;{#Zzi0eQG^Q@nFMF&6b9P9V=f@tXQHuKeX5j2> zNtOHP8-~P5?h3C3#n_EiHV}*z<|aH_sUW_DQ^&tpEohAk*@ix(>%e*|yG$|e_*K0v zVl7m}kx#HG7i9Ofp~u=Wq=O}Ix@lvbQSG_Z5?@L5&P~J}pBWN#p9(aJ&&h6)m&avnug*>GjDHYp^y`|OyeX9@ z7ok-6B}&sEGJ|vFslEN+H(t?k`3jmkD`sE5#*n<~ILB=bfeww*Z3ib;a7p>y*WRJ` zfH6<2PhH7IA}H|sSmEaCRvjeJr=tZ7OAIvBjoC|sEmx>hR`HDF2?^zx{RT4`LLDuC zyG9gcnyfft%PY;QzsC(y-F0LT zn;MJ9k^OT)?nTH~0!PfXU9NKJ&aTjYqnJd!uA71?lP$ZcKV}N`92|K0<7dV(;zu!L z5FQioz2{5r8nJy)ZEj`dRyN374GG?^Mec?`9APWk+&mL^!I7PH7J0=ftmU9OlCF%x z=O)FtN(AMDc|xpd=&HC&j^?73%Sl`BJ|vP?Ig9>+v&4=sMaV=raiN4RQcm}Id`|7= z#$xvDl(sn?m4&%sofsF-&=Y|nAUJ=vWt2!%EW%0XW{qteI$dv=bbRUZ?+VSH9ABR^ z4%bN3XiiLINHC?rX^`R&7%KSKbsK7u0m9;T+qQNZLz>c+R*|W)4QNX1`aC#HzGty- z-sS&Z&csT}4ya=bm3#>oR(;gHGbXWccb`Mc7!rcl--JbWh&wV*h3-}vPQr}$f4VxD zh`HbjKjphNyfj+TvRpx($)9ZaIm)oh2&!Uh$zEQ?*VG9qH2vjW7b^02vbSaaRX7X& z3PRF?UL$18AyO>fZrhB137`w89L(D3FJ5U~S3Q(h8@-ao>mX29Oakoz8*`V944c@2 z8TzZ770d53nBr&>B??Uro0LEsU*fhmKrn%G$+EA5!$*&2+@R-sIw; zvl5__006eoe6Goomj?=6W{jp1#tMbRG3Uw}^iQqN@jY*kjLfu`owk<^;UQ#gT8@ho zi4Wye9^ohS`tTUrPXq|$wrYob*5ZrWT0m6-1(-bTKEmbZ>Bmg56V2j;exmI3#A(j> zM*1`gc3j%}G&Xd#&Ei)Hea3H*2AI|wh2Mi;^ym#A!k+G|Op!_6X-Itaq5J7h@HnsJ8#r6v zgx`8BoGkr^PGU*^aBt~9Vv>gR3Le6*9%K^iAa@)})`g3}O6ilSo>n}3Onj-m=WU-zI<|6#F@EzVNR$1jARuOhsAr`G9|Jg&$LEi|!BEhG zn>a-(883gsCZID34!61f;|;|JGCz*dCNLInM}Xa&&p-P}nXH)VXisRc7S#QNJeS}7 z&-D5p;ER&s!1xJWpKB7=--}R)c~D%GjMr*(KirG`F=FZnUW~hBz!$xZhYb1wuyqZO z?jWWPBSqV%MAN5~)QtflI*ieNjO{bcU>(h4JN!O9^80i_GG2%2WD~^H(IyPGxI-qM z4O*K&ee+2dC=Z~C`nY(bVG;QVX~Oc02S6`SK1n99S0%H>J@RNXNN4l)k<)%dsFLA2 zn?IY@s*&OI#}E!Z1TLN0kzN5V8voBCaHjSNTHnmUF28t4)hs9R&rbJ_r~+7+CJBr) zp8|FtvH6_HNX5O(C$DbF&k?F&grPSi+e>&e`5WJYPaRQng_~7Aix7$##@A4Va+EqB zcKm>;qZE6(+lCd!*g%V#Ci}VR-T{BM_9uyZ^z{1llIRKF>&P=pMvs|kBt0XuC8xLX z2I7iH1%Ti->O{fiqPt8O+{p&UU&4g`u3 z7^k&=&O7n>FCvJ#u)qW_ATDTr2j#0rX%fhmqiE@Bx<9cIBLJ?80RK^OQjj)?cmWd* z<2BtUIoT(f)XiIrf0$t;1U-nUV>L|fPo~a_C=s6*`86b}j9rW$f64!wA_{_p{=UYy zEKf+-`q}9RoXJ+lOlG0YLQEZzz0vzdqc<|(wf2$MQ6CXg$G}|kCclOr#s`-=sQ)@2 zuEM8|NNn|r)bbUn{2W~BAQSe}3O{;ldtW|IP0ocY27S~?-N4VogaXVEi_#7}O7SUd zkOzV+x8YZ*W;=P3 zK`zm60M`$F_xGJc_<9&e-ntR(dzl7(Y=H9sNXH4M9i?4&;{1LBy5yZYpzI`QpRR6o z@CtRaL;>L*IgbUG0mflpYXF4@3DW#GBET^U zsHp(EPj~jmr#ibk(AgE_8&`T|6Wn0*AM<#Q&l9<@ADSK2#hf|9NAY9M-@BKI35@4Z z=8yd2_sFoX5+*(|rmSWMHBA+65i5YeanN>j-2vkd506*?2Jk~`bN(J2ZNTWmvm5L) zu==Q$z@0&)_f`uPR&oSz_Ba;oW_4pe>4ui@xD>%-s{sV-_~Zd@JjDSLfL71oM3_S> zKEbHR^}L!M3K@9#<1aA*o%86-AWVEh$};#qs_^3->zTHy3m9?iAFxjre4hrS}+ zf360dDKCHMY7E(|Uwc`O%(ko$N_?$d!>I9yKkSS}nPmw!sG?LaO9E@yl! z7lDu~JtYS|kc))NIUdVJBIIgL$z3Ku;1UIw^E;M{Ldg9%C3pKkE*dTugOD4;%&-8r zhJnav8d9UNL-iT?LloaW^FqaBdX$BV!Su*DiaeCW=u2&>twA#wJ4B~b+PjG(oWj>> z91}eghX(A+L`u^*DRLFekn0g`iS{NniYrvRKw4jHJo7t|wB0=;uPr4T6bYtDO!Ovp zhhR~rciCF$>ff$2(6;GCF+c4OE`5-TnCNj&B?8t@MpcNX5Per*dzz~iL>OwoAsvyq zAg+Ex2{ADT7+&Ua|9~J9j8P0qY~p?roMf~u&unQHeVvF?`GUUCEvf_|jLs-c&~FyR zI&Cxu8p7xn!Xu-lqb;L7PK-_{Wxt<=D&aK#{Q|;VC%>1{>4Q-x=5GCJc;6IujR3yU z15@dPjcQB3>ovc}INV6VJyqX)lYMFt^?=G_93iEP)MJaN66}XePF=&u#Jord0DTc( z@ohI7FD+~53onZyvD%@FC)P4es;2TMeR+^8!WW|Wqv%qI?&{6=ilj>ZH0u5*1_Ahq zd_|RHnjDdq@XY$4cBA*EctDdsm#Vh#b7}gs_a~i2qIshIZU~otg0ZSOa z8tQqC;FxImoAvK8o=}Jn5OC8XOdfcut{Y;md&=a51ACpu5AAjGJ7@18d@W$C9I!Lo zSaUfeK!@ci9i0hJ00-yp)g}a8r9EUSu|yg1{p0duAvfr99iX3}#il!geu51)R19`h zrY&c4Fwx~Q9-xtR?+}eF zzp!k~(`dL{K%lXC

R`U`s0Z)8q`ihajgA${{)Dsh=!TpG0qv09cDaL+l`QauzO+ znq4lOgwAPP2nCS=&`U=d5GY<2c<(eAVh3PQA;72;)CY8YKcz#$skszx2Zqyw!{U%p zDs*!~2<4dG02)*WXaLLL+yKxJ(;E~!jRs&gf*XNHXzaXw2iSB}gaB^*4H|&je@27j zU(q=22~foTipCGXx&MepieSUW6*2(iQ$+`Q>7eLPA5r6N2T7z~P8)9mhJwgb^TVX4l)M*obO@dO0Xfo^ar;Q-D5!sCDC$Nzg~AX?Te z+e9bwQOlaPNUMvJx_Fq7StuAS@RV;k0`py|fp&Wv%3)zaEO+@C`~^D~_aF=2mF{S@ zZy=w(F2xq!9SWu2C8z#-|H(h&i zT|&o~(_p+AE~i(Ej{v&|tRpI?s;GKuqE)KcVHz_AeZg)ATeXA5FNeabQN)!<&`caC z`0#WAS6;UrSI2v-+-r^3$Lh553qms&0*)=maBjySKV)>)y-p4u_YPin>O0c#uB$G3 zC9(!fcJ!z~py5XVl@RziSzR%DA>gozDO@)qi>u)eiTH*=j;QD@Z>2`j=*-XTts$=^ zWO&Hoccm9J%u!A|CJUEO_5RPR0r7uWOaTCYA>a`6Tgx5)kf9v$tp87xw0zM8fg>S8S-s^LQp9iffsmA$)YZ%S|z-J;#PawkpCmNF3?Ba!p8sJv7*{bHk9&4PE}6K{xv)^i!}$BoRQg(xiyW6RE{lK^ z3JHQ49zR6F`gS-H%(VKR)ROTy-i$cj;DckXOhqJObX?_R;y7o*IO&dbZ*ss#$6lxU zT204UP9NUyajj?|MyIxJk9*o4caRj9=@QmC3~Qqaj=ip}4+c)y^{2Kb0E7<@NoXOo z?a_tQMu2(2@cS~ja%mo`o5!UjhR3ko^X543(}UvgyLnc5XFabK?HRw$E9V?*^*utg zvNhU#`q3G~;h44h9$@z0){S8(dsux5mh{^_&mjtT^MD9(_5&?(42H7DOu!%z0~#v9 zVR1%a!g~&r0C-RyA?_CHouWCX&c*tv-`knPM5i4-s~qld^qFW%pI3f{3Wm+6f(geP z&TzmN1jGN^y3^0Z63(jAM1i|`5KHrM6;>+)K=_!#(&WIs3-FpGxhv_=D@Ip#l`1#ou)d>ot*;2ed=^{8LK3AP{(asHdDYI{us;xk{1U3#^OB2kZgzJCcPSUgctD`+ z4cE%b=cdDEcHAv6R~M*-<$hoz6Y)rNWA&6XtgFu8PXE4T3GmFrT%uih56s0WRw=Z6 z$gx~)$!&W~p?o3RO(XF+YuTCG zqr|;xvwV}>8S|pshNJ-G+RAq2`j@r3H5S@pnBn%8U4W+RTc3U6P=VJ10zcgLn=1B8 z%;N8JWZal^`$-5lXnJkxVo42M^;W@N|7?lS<}8EIW&_pgp#QcVWEOR7O3ZF6(6{EL z+ul?^NkfScbiHL7i*Ijfdtsw6a(BwOkhh$w;ws2)13YA0GH3?k{?H>#84=6MBm9*jV;Btn+fC)^rV=L0Qw_ywCI7pFDvLT0P~cyYl}I^NEj z31?Q%rmaRCL4|h8MOMVzN|b*R?CVyk^^Nl<_`1L{&?9Bb-yMke|VAS8`;P_$JDnWti2{gkJJ6!0REe7y3 zjCpcDxVU`JtECNiUS`O^0lGN>8kw*f$XVLdB<6yx_)Ksu?t|r)_QITd_d1vt40qNq zR0|Xvk__%|!Ja#r&9n?P+CWq9X3s--N@`rXNG8RWRLFE(GMTwOpAegID7i_l6 z*r8~EVz0Z(F}DQdvQ-z`i0Y;crdp&0Q!14}Cn)xo=S<5%OA+%f5_A_2Mug4Zl~Et2CncjR!C64w>l^xox)IFzh()5ll&z+-U}xib5dJ44 zq$XB;BpqDaj)do0U)dqQ6p(%-gm;@pJbSwV<+4#h^DF0k`X-&#>$4xVj7jv@0hA6k z>RVmEwAdtwNcf`VKtw(k zv81jUwMms;bpF`%I(-($L8#3O1?>5&^#QvSaowg}=isLciiMNUYc1*R zsV(&HmgM^z4Wbx`euYGud~K_{U;BG>S=8Fy@cqLSTX8O>2Oap9qAN3y5&jNyrd9roS3y+TO)s|O16A8b+v4yUkMZ7E(SWfz_Ej>)Bs| z(+Tlzjt3G$Lp=fha75R;U|@fYHbwY_AU>73bjLlM-3oNI<=3mxrD9#zJO= zKw7eMVS{&WgA7$&oa@Hp06t;wD}{O94);lJPB{E_t>+dK8~U}{ zroxbK{QEs>EZO^{6=qJx=er%cs6BV&a}m0x3#!fI0aa|38IYlTvO;espPyVR#~Hq7zcR z84V4qgCm7)O*>dEe(dlo(E(K7zA+JJ*TrzFunJ^X=-+ zGyvyunz|G#vygB7@QE}ak)RJCo!n1Z92dvcc)sVp;{|&1qLGHslY<9(Tf5k4xk#7G zhW}>4Z||MLfeuDTp*I_xS>v^&3v{fkBk2a;F*PaoJ|y0%T2W)kce(({gKWE<&3(n7 zKhOSLKtiHtLqfWI@GPU1wZkiYE5w8NYHESmck%X^-fmJ}!eddu&%DMk7d((c4OX0E z!jRSJ(ZX!M%UfMlW!^&jFjsHZmH^CRFRJs?-oeu_)qj&A)`q@y$3%%}2qEeGjis{Nx&2t}bD_|xnf%A*{{J^eq zP95_MwK8f!w)`-*elabLjHP7lZcXkGrC996PP^N^HiBJ+K6^0ysnRRkbTb?5H+p_j z{>jqfkbL-EKB9H&{gaS1pMvon{YXnUMU~QP$`4`Amnj*^F@E+uL#I`1Yuu4`O@FGN zk?d5c5bE}9hJl91_b0K4?vTymdxIFc>3pXzm4q%x@|=dZ6ABZ!@u)g*7sMVfQ=;iT z$D!F@HocRf;#rWTtKz7_MRw(j-UH#f?4k-Su5g|(_N)HcmwcFFJhNuPjh*H!+qi%C ztLF9-w^cY5)GM(Q+DIjFD(LAq%t~L@D7xvE?w56$M^%0KIt$*7j@t3W7RHdfCFReJ zjiYz&gkUgub67Ne@?R!NYnHaqtx>dREj)eRT~>7nCF%?Wn} zY<(;CogR|yBqZM&Zia$axy-KJrAlY$hdo$k^bJ=3lNiWD=9QLEoKCj)?N@yqHNJeW z#^dkH4+huNe-*hEu({k`g7ofh2_z7aQMUHQ<2R$&k-zjpclx;sN zPN2_0EvY8Dh1@QZX?HoB;tA&^ltwD--DDG}`|Lh0y#Vd+#M?W+RM#!VgonyP`7dTr zZzMO4{pw%Q4J>>IrpO-DnpyS)+v*nfuj5eKep^T>cbLg3y{;gv%)J*UBSZmP;$?JQ zD-y(-xd0Z9T$UwI)-S!WkcJ--c0X~v{#$Il#RvA}K~S=r`edD|P)^!< zfM5D5mJYIN1=YpZE%&uRxmeyM_6~EezZ1Sop7*1wx&A}`&ue8AaOaN_ntM_MaX&8S zhpTm=TbJDuxgV)^ll9R(Y%f_nBn%`S42t~6HSh3gkeGvwUq_hu+oF?s3{{8_UPuzB zVF;?s#X@T)(oCwXk<|m;M|$gtm!u6!61VOnz9Rk*4_Tzxai-m#Gm&gcz_5G&8rwF> z*^*cyHt$yhltNv!JswE-#+&a8{;8Aw@@MTYuP(nc$+_jAqBl=Y@r#N&e*R0MYY2rQj@M_UPAfXt;$pC3ybZK- zz{T=s^Hy3*G>vhD5zs7Rpi-dM7-a)|Z4BZiQYO!J(d>$i?~qCsZtpVMB=IEQ(a@Rb zzXzp?Fe5h~yM<(QCy7g}&abDhpEdHCVhwKY4Z}cu7$izdLN#aH;LXqNYLXAq3BPoG zF=uZX!ZeVjxUP0@Vcs;fim*2-cbZ@BxjH_VY^j(TciX!jom_i^b{FrO%VgRTwa@LV z+U0STntI4vmMrBOCXa(!Rctx;?SY3N7HQDxGv@7s?6>)2A`5XJ|NbMe;k9$uL1YU% zc{)k8K=bjHQhwRxw*KP#h4bYYrl|z{j&hB6*ehL1@Uto($XUeTY4~e%VCMMBnfl%s z`>m5Ci*YSibvbmtUpUwB;Zt2Y6l1RI<5CIP)X>?acU8`O?;E8SQDytLaC9q2-5=ek zsc-l9?|MYCWT0u#+tTk?T)I;sNw+>O?bVE|)SyWeLH*e@{Oje_jBV30o-*FOkK?#! znVYR)$?^pVa*R}TVuK;F|~MG(0mL8=hz$z9o{F$?S)Z*`|ZUta#SD-|9VE z!{)$DU*(hiO;fX%Wqv>@r9D|gX`=nA^h5HDnUc^H5hbZ#B2VZQ4!ng9LT1IO$YnF?vGKhoI=)=r{o?@g7f4|Uj z1&ve1uR=1dBU>DEtK_jWn_mal%>=H_^upMb_Guj`gtgwFb! zHg-*!3Lvi*aCm{gM@a3VnW?qDskP=a2XlR^=WqfyJZq7yW5e4G|Iy26JL`^W?3k>c ze9^UrCic6Z=BlaG&gLt8Rg7n)(9CZq9@FA9$%KMi}Rw$5y3VJFl)l@;_+zTGQ7AD_06Ibp)}jpU}gNU&f)jYc*e zpXf_T8FeKmO_!%l!bCK7IHa$n>&Z|brMF9Br%@3Fyk~V1Z+aGFV*SAoOq$M@9fU(H zuQAOt!O>mBkc>IiZsA`abx)}eDX7qrCjNOaEhWdhk@6;V^ca6X?4eY=;HOgN<-_a| zRs4a{7kpd8A12U5JFQ|Q%T;*Hm5d9FZ3Ye8Ab3{C;nJ#UCA2bPthbUVI{e_p{!Z;? zw)MbPDDoWv=4^mF$S8!U|M?YM0H}yRui>w``pXNs&aXcILac+ez)Lca^G~lndOg

y}ub+UXG*#2)`5_Mj|`ImAWD{#-bgi!Feujn|h<@~Mii56$Uztw`cF+Q*5{Gs|- z3$p!vgqD*d_W7mfo6pHof6+6o=={R-#r$NUwb-%cN2UGz;`4>$WU+_@V)1_{Bj@#; gPs$TL?2><*qViH`z`MYZkT8M2o*EWc#Akqj(DvfkVgQ7^6G}0kTcZZ;egrsx}h&0kUsFbvnNJ~o%T>}IE zJwx+6@AIth```7i^(zePoY`leeXf1&Yv04-zU3s5F5@B~AY4QEfn}lcSp6%S7clw^ zd}9LN1{V5q))tmF%(|AAOpa!z(t*;~zp-FGI*^zhHdk6EXC?1R`Q79q#&s{);GwF!ufq6j6|AJ;zY&L9+}y7fYp^nSaOKTf|<9c4aI zBa#lD6nlH@9?3#6?+kGj=Q!PLR;hPXoNc5rEA4iq$y%UyUlm!2#f~m=O&A1O?p(YE zNKwC05rIH2As}F#jaT2o+7K47cZjxREemdajl`@=%ttk!*SQ$s{0Xu7a@RL@t-9-o%Ir1A)+&{lro34QjkhrHT z&;#1z__xhvZqx?fux+h>eA$D8*+So`=LK2W&ETKmxKiA|zm`Gz9mQgPDaWE}&-NDW zs~|+zQ85rRnsybg$&ir_rWY}-dL_jreK2i`=?u*Q3(98K?;(E*SST6xc;t8OL8|GR zR|sCpx}W2f9;GUc4!7sjWBX-$?bTVh@xq^#>K0{q9W5%_ z;)_T`qzc_g#L7h$w7dD2?%Ma0;Uv}ngkrgb);x+e4!g(5%Yd#E*0UtAzdbTB;qSOH zATIWfq7_+JzLr7jvow;ZAW`u19+stz3h$T~*L*)9eqi`^!^Y3s$!vG6BliO%;crYL zax!1W9u_1znx_#|t^|+AQDc8!OSnOZ5%QXeObsb8@PUO`PNL4OtUDKj+Z1`%f1{p{9eDl zdZSxL=wq>4uR5xHG(~L4{Kv%dAq^cCrZj8U9&J?Kz7q#GT= zj$n4tr%p9Sr*`64#I~4Q!;8k18j8z=(5V})-O~HGu1?+#_m+oqOABuyaeC2y^qYsx(7`TKAeXgAlv z-g4T?mW2?=9g;)JT(GTDnv_8LC8u83OpW zf0eZet0q0WG&D04_6PYbEjBGe>Xlz1o|mfFMHGEZbbDWK@fe_zEIYe?vJ|-H$l!a$ zk?$JbZzlbs`Z9Z-(y;P^7T=T*cWY83D+eszuC~P-o-!O+@=0HrG<+TJX+dO*6s*8} zj!+}hfX|N?5O4cwI{0=(>pXnHPyYBiR*txHD)WXgm)JG;=(%fNS$KmBBV6hMb3LUi zA%3sTJU_`$ee@&DOHutG*FxaU;Xm|%?MDcIl(jZ%S@7>!tdFgK(DE^PqXh(&{*1gq zOL5p`ihn~ND#`ZqwgaZVnnCQlY6Nc_Mk8!wwFPO`H<%&~f??{|Qp2~!$@X4;&~O-~ zQBAOTI{FGN6(e|3yw&dMC3ZU@nORKT_*H6*@P&cNM?@q!j;XIV(Hn3{QV<&&s$+Ti zV_5`dpCTHB6R8@-J{5b{n@XmOX!ztw-*aNg*VqMD9qX*O7i9XdJ8(sAk2}RI1@s2b zexXa3PIKuYyPNTT*`Rw)e8CqpUVPsD<@bZSc$HXP5u)TigvleB)OonQ9I8kP-{nQncoDmf9^`GNLISW=oGW}~`Q4{=`?N*;O zJ9~!t>|#W4n&FD>63B$MWKI`k?g%M!I=So=M3iS6GMPjNDYs-de2mrOmXSA}rPPm)r%_)cFTdr}Wx|T?9TWFXIWw!&L2~1T1!ckIA;sB# zaRX`v@%NmRnNx)!v;+9{A98i&?}B{2!&gv=Wv)n!_*AwBV7(@Ky-vQ;E#*Eoe0|F{ zfwk8#lA|Sy4}bcF_ao{dMeJx6wBO6BWFQ^wzIkVr$Rdu+VvI2p6Lzj2VvB^0`7_N- zpH@0kbK9BUw<*jvH)mbE!qELa*B`KO--B>WJ75ts=iJ0W zLVp`9X@Y*OaP%yW@aXS5r2HVFid@(&*d%Cl{=A z@Syk4&}Z$4Pukk_$iTrJ`SkN@n;h*f6rjY|dwlD_^YZII2hK9B_%`9K4eEVa33(P2)TD zN}!BGUT-cve!%@tytC{!xi5SRitqRbJ}T|rS+C`KkNEr`$G9<`hbtt93?4$iu_KWox;%&|z@VXGyEdvCOs9y~f!Qw381SY}%OKhZt4(kCD()P2o`I^u*@ow0U){ zPtek69@xXJ95n0-8S7u|Uw&6JROMDG;5tzsH0q&Rt$9#2vft-3jA!rRX2rW2G^#yZ zr9CPzWD0Hv_w@>Xh>aNce`Z&bOZthQK4h}=WV~h#$W-1o$ zTBEtlrSn;}ZBYF}r-QYrIeQ0(tolEB(0$fX(wcIz?%1~JyxoT&&;Z#p2O^(W3ro$$ zTT_w6>Z4#Ls6vIyBM-ij^7Z~1zM7ip?T*@bSG%YMur5eVAiH;Z^I%xRY;@6ly}!Q~ z;=Hk9zq{jNw>_eLFEM80g;xFAo+W!^?4VEWL4q5vmTP(C-c+N{;xu#?va4p{F)Y+R zoH#N%L{gKxFNo%5J51@6pt!@v9J<%^iZcBb<=U&B{3i#?r(=*-@yn;L=O?-eY8=f!8BLo3L&VUC8*ycFkG3mYw5O=9NR3U zWX_6`S5AMW7=(^p69};lfOJYER?S(n@~7WiyKB_xulj~&I>l((dZns)E&J0Q`_IG) zF)gAUZNs_=u3kR1XdUfSDd|Q~B5>>SWlcf%H~SHM?EK=9K?%B8ErbcWEqT98vF|-i z?OkE5;!dzdr(vre$aUY_cVC-b*td*_Hqp@~c({v=1r+l+Xn~p6yTMN|8Z*EkH=9zA zSKCf5H50MJ4@!mh*Mow#=GiyQ-FEs0V|^C4m`f_34t4vtbYp4B1X?<{O1a3<(9R^u z%C&vPth$qbsp^-&KFezk{vYd>O_QC~PU1;VDh@8^$@r-ASHz~9;M#H(PUJ>RJy&UT zNUJT>0aZc2t}cHsh{D_78{3}-FZRol3G&B54WTXIVcCJH6}kQt`7c|XuA{^?iTtf(g3k4We}8{60e>t3-?C$DH}jk5DGbh-+}eWefso>Fb;KY1xg%@R6-J_{`&~IlP~4NxW7^p?XjN zs_EaS*I4Vt=^M%|AtQS|-%mrjGYw^86tf_1!*Ll{XjkWQ=p!1-%&T$jJ#eWRTmhTX zXcP))*+hR;T7=HkRu&$tS-CN{{ppa^+^x|v88aSUF-Fl`oY|NH<1%WjjQifre77Aj zBxL8Z`z=|RHJUa(2%%@^gnG0NiM`{KN!{8lRK5d5t% zUG5~?OviDApwYabt3=?b6)l?HmAe9SMf`3#K6yKd?V%INna1lc9eh4D_upRaPL@?+ zEP&o$EgI5hQbUiFZJC%VOpO^zD^iyUOq@>7Qz8X1DLL7aSuoJY;XG+4H(PIlpb`UW{n;dEZmZ5!St!+C3u^ zBK?uy)x#0p&FOt*y2g_QvOc|#bltm+SkKb)>TN4~XYJQao%sv}c)|PSaRH=DBmPZ` z7^Up|?F@v<+}XxebDf1b+lw~5F2-_3^0F13Ypz=(HV(xVHN1RU%eIpug5|T&hurKA zgBwtA_*%aEctN+(^O9B!*`W1h4#=LZKjAB9sPJr|C5C$!*t@#_-fj@8&$GGhRRIAk zvQc3khUZut>incM(qXkG^lH>Tq9wcPObJzuU5$ZF<h?IXzkzE*`0#o4KT^N9wXu7=Ym%#xcYJuGZ}Z}+psm=&2ugHhJr@-1~@bFQX& zJ&2%?5WbP&9byaacCbbRmCrgdD%DHLl3Mey8GJ_>iVd+DLEP=Iq(`;&4zDra{>rkht=i9wD19 z*EvWfjhZI0mSXKy=-A~#7sf?FYH_2s^q_K&+X*sk{?41<1maVl>FPNqr#rFk)ZOyH zc8QDpy-p&?t`a1e3D#~s9*fk004T^#M}|NhXNTX*diXh+X2NYH(Oo->+E`57r{j{)NJ@q1Q%+ z)b~bNOQRD0vqt11!)OcCb zJ*zvK2D2-s;gsDSue%!GB)ad@4fR0GnK)O^xnLbMAUZn!9Ne%vxVQce@iJ8b+1U7U8b9F!gxpr8b~CS-OGx1 zFP`P99+=I&N3-)dZxgu2n;C4|0kd~*v<;FZ1 z_SKJxr@5mBy-Hf~>GK;?J4|~E?U($y{MWK3+s5aN zVvyi&Den!c`sLUwE!NMWKAE#z?gUNC>+9>yH)m&4xGT4XWBM#(!32$2|i+J zRc>*v?{7!+ifTJwhlkj{x^|ahRvwnuih@ttrCMD} zgVm4ZX>ZjhslI`_4lOp$&TV5@A^XwE2yBTKO}LzKggr` ziM)td_ZQ5QAE4St$CM~d)drQ{KXh79Kso2&gbfkjJ2AzEgzTBTzxS2wXNoNf^yS{A zG*K&BtT(cpq&DbbF4${DwgsaAv%#`(q*j!b1=VUNu)q=%1n*vK87D{+Rhr?=+#Sk%ep`M5~85c&8{ZUGh4LrI{JX%zd6arlT zuGC+^Z#pHCZ0Sm{X$AaXrGbyr3!gd$U2ls;LsS*b9^=(D|F2*~c)tC8=SZI{kjfqJ z^V#M83!fB}yS3okc)Xt7&G|0(kMdICgIjs^IAGY40o+QT2c!qrGlBUN_WaeG0$^J4 z&nAZ(>SF2|{t|%qF(4Pi5B-Lb{DeDcuhf6wptHxIH3P;Hk$PJ%PttYXWPci2B3AFN zXIC14!f|mZ-VFh!j*3Itug1x<>*FsK03-mnLy%N%_Nt@;Q^z2UTWBQ}(cL4Y)%26T zA`vt$S4G)*a5?e ze=wOK$faPo!Wa19b-hlbC;V{rkL-vE?TL?RWbn%>sR%aKd_!{e==|X#|8o-qgI@+o zwuAtXCuD?A9pkL49ipr4*<}bof0!&NGXX$oo>M|k0&f+;#+rd{$S0Bf)dZ$?y4tKj zg#yKKBnzNBji5`%6-vB|`re*92KK(SF#*$QzVg0*&O6Chqw<|bcq`cl=t^8m=s(z@g3v+rk5X1@JJO6s6)6yO93R*KP6${@WVhDll4!S%nFblm^vmq z&pkBY3pn)+q@z>UKjMT>9aZ||FBae{$rfgH0xo>&7+n3@VEx*cT~mP7F}OEGInj`T z1xG$`e^CHmNw&zF*G_%Fr;dCm=sbn1MF}!YElLoM)WY~Ws_FG(^3vtw9P-K2>&f16 ziU2-cLbktjve7ml8m*b98KQ)W&ePM{HG2R|9iJGv1o>Z0ijjdPH1_;kbG|45E+G*1 zVf#}IlG6!#d0gS10>YjGmw>H;j<;f!hfkeswU3S@@l*!@2k!(NO*O?@IbiC<$$<<~ z8Y7^5v#5Y}9m*|G-7d7i)KPVR{Nj=B*>w}9x5y`YtE~LE7@GGv5 zJ;yBph|rOq(0!h`|3VTNS6~Aj=eVc;uS{U7+_Exp70`kcskC|z$ip#1#%q29d%+Y3 z`h^@Fh+F+Jv%_yJ zitbnKb+za3pYY%t1Su^C7|+sY3ms7f%#gYN>7PviHvPo}mfC<+B7oaJ$&R@VmDh!y zz~sFFzyyrDlvF)Vk^FySqNYZodvFYDz-r-?i@7WJ=pb4F2fu!bIPO)7?VtZamB53Wcy#3z%Ms8^hS-KiGg8@h$7UgEUJowx;`};EzHpP3bt}% z&l@B`Em8&iKP!+ZXX?gDk(eBoOmrTN0Ohyd*TSB$NkwE3ifP>bd1vfp7wTsM6v`aT zEUaTYQn(#5${9OKxE(Fr4*S@S>CoR}zKzkALt)DyE4=?c+1@7v5rK+)4SusZ7DZOF|Q? zQ^>Qs0VYNfL+#{r)NKY)3<~VQWi+`u!4>zr63VSI zpizQ)%Df2CX>%|SGGqXs8ehqIsF}M=y{+(CL+=t$o+Mx8JA4Aztwa!+1v{1b+sW(k*oJhWRC*c!M@Ws?`1Dgak`Exwg)j%$sM7<);`hvRFAUejgPQa?e zs|PuBvrgc8sQ&7mwoTl=LWXjq)00`rYJ4QO^Gp@6iuRg}suC*{s1K);WKsymJ%(}! zhl^TFll+D3P}E_#vR3b!LWyur!yT6;ZYCgv9bE5=?C+Mv^3mexWdgI-(^L&kW=gug}G@W6<|V1el$ z2gXT_0-$$70I)9+4lJuQ=2C}QO)qPp9Ba6IHeqlaH|vgY1QHfS2_S!h6TmWfya{DT z@g|I4h<6KE3j{j=%Ns1%VTD_LQK@Hr6s5m6!Gdv_=7`HKepw<<0KaFF?m%{!bhqQA z4~sSrUp=Lt%eWU(#&ya?-|Og%l$1@{`>w(%~;6}=^Zl5-}8uB#RPPv1ZUC6 zLWQG|OMi?;=AEg`OJ~s_^Mupa?eZ~wMN@}F&!PdQIIOv#`$shgdHa6%+G+N->fA2F z(b&R*qcNzUK^9_7c7{_4WkL7nE{VI03toa3wu|39#S_5o88Cpg@Cp!xgJCPH2KcZ# zuHi z2LFmiz`vq#_9WwfhX(9${}BySSu3|k4M2iUlnI6;oEpH+N7VRdFuDb%03YpVe2BX= zm&3Ax;vzg3eS*f!zo9YtuV}>mD;hRu^7^-ESpO>;XHVk$w`c%|`)6wK{3|v72@L5i z#kvhFaQ~GZXTU%bZ~5Jo{JRVB5UW|X=CZEj$u7jBEe7s?V*`W-csVS1Mv7cD z+H$qytit+TF2rWa&KiDVn^f{jjM>tf^X!T?-Q2pnyWKPwry zeylaHu*$0^hXQ-p;nyF8R`AhLGczN9K}g&#i9RDH5C*$sh`_>!kB)>2wiu;q^783o z_~^{yxG$12zYiBnN6ObzE&JhcABjV;=W9bi1%a2N2LD*&QXaP_#Zh;Ip+d9lnQCZx zNfb^{wsCC7dKBWb=kip+jbc8!AZDas@>GfY5^|(XFwk&d_9v+P&1%5>IAecZynP=) z&XeK@6_l#+%Yo+(cK7&T04kARV54)W0Olu<{_hvt650W%@SH(K^$O6zfR_$LtL#{-AF}aA! z^f^?3(K$$A=Ep?)-!GPq2x0huy*;M4$`*CZhIL0mDb1wD7M-IG67cD=dl>;E5)Sv_ zr7b`gBpgS8?NMJ2Tg?9-2G$%_0sT@ZyrT|e6M zA_kv=bzRCTzx4H%QbfU zPrOZ2C;n+Y*6~1q^>Hc8@bptB1W>o{+&ugCC=*?v7R%9cN8T82AJyY)Ga$Gb%*shj z|D&22?|(iXr+8Y-(s5yPp<(n#toNNs@wFiqIqI7CfFlQ{z&vpK!HdEdA9#EE(V4f~ z<0RYTj;KW~*bElhHcUJ=N1sAsw`t*{6OoGHHfpCbk~x&- zk2tcAquIw=eNR}eI}Thd0xyTGhHZ^vBy;xAtvo>VKy2`Y0nVx8c+Q@h-AEW~<+xgb z(9Su3F&@W*bM9Ohokv?vKRRUmy%qUsDQ=rP=K=?E4&Ve=*Z;cj*X%UM*$QGa`WB6I z4pG=K4@E|XpTw~JJv+^Rq#3Qv#|xOu-0!LbG6GlT@s!qR>kGN26RA6Hr8s2gox=_+ zbuOD1of|cur2_lZnPkH7z8Xs19*qP4Z17+At#B@vbQg#MJLX|7c~?x|^RNTP#}vk< z4(vgOy&U#%7$#O1FoBgvtM6fX0QqRRkdJ4$SjUZ2+V#A1*n!z6T7Cb)IpJ{uJcD5p za3+~ByomwL0nP%~od34(R)EsSdPHmU>;h3>$2=_S*}66P=~f`|C;X4%2Kp%Qa@a?G z0Zf3rp5rJ?%z&f7dKs*6c`oKd;ZfC5JAoC~Ip;7{0M`D4^XZcUfZ=U(CYdn2ZOCC< z3xR#u`LFwC2Y7HMmluT+IOegKF+Ywj{C$T1e-$(23z%FGvzr(5@!*`8opTO5@bz;A zaM8KiIWc4SXEFQl`t~}P%dZ!R0z2lBm{k!QwuheKKhQ4E^-Nluhzpop5Hq!lVn%gd z%+5N86&J%fF}vv8=v-eboII1vzY(+ls_*j+7if{^x*qJ9$6{vup6Biv{{L0X)c!@x z>M!I&`Mj8&bq*`8!tt{O@E7NJ#{~cvGru#*{2MX*ulmkDCuYhQh++gB^H|L0<)^d% zS$PqzOt|S%!d#; zqoSdfKcY#utA55d|De#7K>V4HS|EC19WdLk8``Oh&EKleLpohwTe;z!r83wH{9(1A zIai*!dFlLa;qJx;_~n#CUgYj*?J${~ETod=V?RV3K_7o3hwwSN%?ANa($zRR;_BGOS*{GvVzXp?RQ~`r; zR0urR3I^S4^sw1m*Bm-1jhaN99Fy7K)o#u5*c~9Gq`GnYApWDAhf!eLOt(XB!&Pk$ zEsxLJ1C1b!-}-qTk&Rm6qy61P-@3QV56EylXWVyoI#qi61R?8d(|39IOI_C?oeKNb zZZ5kJ-Br_}_+BoupIcdr&m8WkA1qGHZLax+c2>Ji3uZ4R2<&|Ke)=6`d3|>KCInx| zt@lQ%cA2NCD^i}|$cWbH&`53`XwE*Ac}Paki9B|(pLu>ac0M+*Ds9Tb@sYOUeeJDm z@zAC9l^VUBDVOrS$6Kozu{)9P+;*6q?=X5Ssno3|ddPe9D$FQt3}^jvh}qlPi>-pkG}y+p2XZUqn+4H72?u+$JWC9h6@BMOxhn}a-+H!XXM|xC85`sAh)Fze!_e=;aj<}4PmJGJ-j#(`I%*xt;?pstEb!9en-CtLJakQcE}cX>l0=K@0=oKi#Uu2D{}rN5#x0*MQiSbvceYorI zLB3}ucW&kXR?70I&QT-2GwSjzr;1T}Or%dj>nUaad_goMSW0?yU5U!@zAY-3Vpsp8 zzB%0Dt=G$bp?_l-hF_|qdIDOrNjvos8CDn2%=Da$uN4LtC=TTEA4MvEgG0#akXo#424Ku-_SpuNVBD#rUXP{*ryND^KZ52Maaj)>my+45P&Nw~Qk6 zbOy|Kn4=I5V~yYA z%J6Q!T!y?ck_&^WI&dfBYyY=NTw9mV^ivfsV0CKL5wV}&{k{6W_KwEucdF{H_u9J-6i@Nkc<>4;~Fqvu)o8g4mgijoRpq zL6pfaLdA|)R(8AY3=ThuJ54#B-@AoRESxOC`sA|`3Tt4nLS@KL^Lx4bXiq~w)ZKig zkZ#*pDF2%1!!@?cSfu&rHIru|gWN4OYw{DR)n3UB}U?O*J;YPCY? zlEqx-MgFFJYWtaJGTleN6O`gmZ{i7>@8O-iN~mm#BU{ z+O3O284j^x&=d0-F(@JYevP(|^$qn*#t11U`%S*fDiA8V`M^NTorV_1(#SFfkZg2f@H;% z>#8&Z3DrC(^VQ|-820!%BVo_bXCV}J!{zJ9m}oqX$45P-dpRnfsgjcXd$wNlILx{< zaY4}4*IUOFK7n&M3zN zL{JX?qxc69DOwf;gd2zVliJuinHt)_ABOPsX;2nSnci-ZUc+Qk!pD*Q8e_0?8OK;#FwYcEVzJN3# zqQ@ZB6zS&wF57~X^7@zI3^c6Iqw=*ot15srPa5$*&JRVNRE#fRCE z`>tBQ%G&%lKbB!mWZIY0y7zJXs0Z=vlDp%peaR<4b!V&Let@|hI1`n?UZgQUu&0_` z%P>Qsid2v#H-ctZLQN@cE%9ydOYShKXzbN42gW`-f$l<|eJJ)+8P*QX%m(Z2-XElY zGIiJ_9yZ8Dv~It95}M{yFb*+{wDwR|D7aPqgU|?_0zUSh?M(B1;g}Y zmqMj555*ZeN^ajDH%0V^?ZEGz#mG+QyA)O9x*^E18!;vnCU9Yrbzm%r$}f{58)%|a z9xR)4rmMX!$kbPJR^uSVDl!ljs?92{(%}f_e$RT#KkJ&$-I&*zGvUTAbJlHKKl{~l z`){^YxfIl?u;SWDCb26S7}n29-Owt&H49<%k;h>8h;XlxCy<}5=uT2?tks9i=)7n>(i2N zSQZ{y)95VrC}44W@KhPuq;i3CbSvFa62XTgztFi2+}<|dgX<%Zw!MtTFY<}?Z9fT` z-i<~B&(Q1v0%M>HH{l{hD&Q|Qj4^3#?k<@w;RtJn#m--?}Ip$&PVas?=}tCjC4mL$+- zBbCUrW!{!?_l#RvLCI5^ouW3pCVFgtBM(C_2w zbv;D&Dzd9DTOQ~P=3akO>gY80vH>?BdESrg3;B1sKQC1;Ep~k`rMxdW5cmB?e)!Yw zE4JlSA`c>;-eG=pAI)0^69EN54}~OO{!0KhB?3c;@yiG^fBP$hUc*%)xR;Z}DCvT$ zbFU*e<7p>Ve~~d5e1P!wHD;3TV3L^aubWt64>1u%N}Olf9oZ8Jr}&L}4v1KG@Xuej zm5R>$eF3EKCh&Nj>%dQKYeQ2TW+vEce5j=PC04ZidDw>9QW8r65kTJxW!QZ{?y>!=~~6*fhN4yd>rh}*ffF%%LH)%&epvP&Mc4RxUQ z#Kh-iFYKjrE`MxY+aM4AASz5TxhY$_);gLz_-PBM!4`JzPkP!c0_@6Re-HZ)K$I7B(#ZntZ| z&H6|4c3Mj`rE$aypjpK1N)En6DIef%qZ2EYG}F{ab|^9CB#6* zFG&W4C|7+sY`$M8*XW^wKFuX#4)Sryge;2P*`xrFEAP8TNidR3|2DdQ^>5Edx4+c2 z`}=o4!e4r({j9I0-?^j=QYAsNJ}%|mjHpttjTb@j**v`B#%lVGc{z7E&;F-zjPuOR z(z0eM0uuQSVD7EMgdURjY+B(&t`C()eZ_+LI1k$zLDX#a!>26sp_|N@wtHXeUbnuV zTfAE#m+WtznzbzbeV0@!l*YI|p5)Uav2W)e&nNwCm3#={jJHHQ?YLXHiZ>pw5W6AC zgjXA5jEJS~ZBHkA+vKtQH&Yx=e{YCrBatSE?W=I}q~h5@{V-VyN4t@~$j?9UONOIJ!O-PCq=DYIRQ-9apZYvvbsFu?u-wyVN3h{;X+Z zM5<%}d3At`7ud6$o<6iNw>31k)mC(}G_=u#5x8ElMW&Vob1(dRAHDsoCz7#qvPSY% z_b-&O4Sw3I=8}*tQ*3n3~jPDpf~_^yp)|1X>yyUf?@s7qKSAU^CkfMvDX=d9#AiZ^~&+ zb5F4K6w@W6PPJS4*G1h|`GpW%XiXWf8A46U7BE`bbmdBnzaQFgDrSg+q-Es@YXpcd zNb0h0Yxu(i%4nBWlw{c|ues83{;{p#f!jEWwQO#!+BSkKqs9g+iH}EwpC3TJZDrXG zY=f=Y0U0i}w~|_Ls+`T=a7BGyAC*6~Vvt0{;Ym(aXh)>Ju-B zd%|!prr%N%!&b6Y83onZK>B4Pb;RR{GxcH)QoGxyXfG_?JGIG(+#iBg* dQ!M$nB`PP03_Onw0Ra{G{~Ay&WNFyw{{Sk3459!4 literal 0 HcmV?d00001 diff --git a/spreadsheet/macrofree/azurespringapps_checklist.ko.xlsx b/spreadsheet/macrofree/azurespringapps_checklist.ko.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..0fc3f011e15eec3b97717fdb510d3a02bc196572 GIT binary patch literal 20393 zcmdUXby$??7dEMs(g>0Y0wPEYD4`%B9g-5#BGN4-2qGcfDJ`OcfP|z{5(82qAT@M% z4b1SpGceTp+x_diuJ7AjXZK;wbIyJ4bD#4(<2tXR3_1o03JMAq%1=TobqTF+c;3M3 zGw_Q5_+?~esAy|tZO5)}ZGF?(;+b5q9PW1xg8Tc@GlQ0@%XFM{-RUDuu2OurLXE^6 zefQi{zJ&}34sis1C2iKIqj%zcRhR8S*d&Qkj4M$q)|EpcdF`^92F=|zmq6k^(>jKH z%0~3Zq_W&?347G@Uv5uPRq%qZ&*YZ)#wOawJmqBGjxk>g_U)~pEw=>~qmXBx1zWKJa-9S{* z&O8x(MR@SyqnlOR7p=pl%sm-D}fx?T&8z08qpfu2-pb!JZIX`2! ze`0K5eDKN%r*1(LWHoS$q#FPCKHc=9bn!J$3!2h^k}8 z!CNqkK}G+nAA?%Hz=3xoAMJ)?A1(3Q`d?5&*YN852~Q(#vE639_&B0_NeH$*G&UCK zywU$a>J5D>roK`wtL|qxbV*^#&?ns-OB-K(ex2!2^ffnf2{2B=2v+h13j8pio3xtf!NK>eq&|jQsDB^``@wUS#Jj(8 zG<5s-^feaHg74}@-#n=Rqnhl!8U@o<>5SjsN@Mq4=PWbx1ru1raX}R{pWeVuT1-C9a7>S#UuhXsN!A~Ux`saAezfwAv zs9Jqdg)ZXg_0^~^m<;5wY?F{E620O3S^Vg_YhcgKD`FB>PevVjXVhfuwsDM&)65xZ zn<_MLJFblBpk%a(hu?pdD8Edw^J0zQn!9`uH5U%uG9$AA+N*`|!7nY#NqYijH#V62 zzcbSdQLffED1L7w5N0CoC zE4*~4-J40TSi)tveqC`QFw`_kcvFeuOU!0UgsC|%$N7ptyg@iZi%53x$^+WH7iro~ z!%P~aNfDjc6(mFm#CdY{0i75ekrIY zbf)Hdwp^xbH|>p_$YrCh*$4Cf1W6C(JYGcROG89y^HgY(oI<=>NALU?v1_?&AW~@Y z{I!95%{l=I`B!_~tDkil`s8yoK15NzPjH+#XZ~>r`@#Azu<6Hn8xi@wwQo4df$R>e z%FWNcBK&soqj@bzBzMW>!&}}@7QEjPQR8)S-6@DJ`(S+2JT647M$~4v`yGs+?Qrdq*_(_@fbf76|zSps4^{Ha_?Yg zs`=)-m5vPki=!!wPhJuKWD1w{oo0R-Ta`!&(cxoT!cN)wW<S7QLzepaiQm|f!$V+U+i2|04sl0;Fp1U& zwQf(!3;iEmgKGCI4=sah{l!cWxI68vcs}OI;4h~3oCH(+2YN;LWS%#nO%Fg zF|e?9WWTx_nHKBEmmeSUSC+Czud***K#O+Kxb84F@jO@gT};BDcb8=kjzeB2OVJJ8 zFM}4YmLG@QjV?=G|7{j6l--#_$|Bx=gP-(Hs$TA;_wqU2_U}Pjjb_5}1DDmRwsm6p zCcZ$~Pak3ZX)nKK@S>nZVWFXr9~@y$R<`DLPmGQ2?bs3jLY!ljgI0C}KcbdaO42s6 zl*?7alHN-bRp{73zZw8 zD)3(;PTGO3ZNjYZm-rF}`$UBQ3<>Qm&qFP@R?082)7%`k68=D&Y$am3_`Gar$Wvnp zQax1dy0X0DQCM|baJqIO(D_TVo}0$-AEDiq-C7G6Y~I%O%gis@TOxw4h1J()&34V4 zTgeWby=RoCK<+T^sJ@#N@kikii$(9K1?)i03cN?vp z#-%(<;b)69mc>q{TM2Wt$xsr{sR&g!=hji-eb>UBJr2lPU+wOKsjH`5&u05j%Ft|I zpCxn?H0fwpHlR(NyqGeu;Kvs;HvqG4>6y+Oge6*q@GZ8iJC;KSJeqpdca0%a{Hz5c zkq-M~Q*ZkJY;M7>&$Lf3HNKQdb{E)&(l>h2TwLu*Er6O;>4-e*-rU?D)Lt0cQh?0Q zKeelb*_ZFyJ|eZ;o!hjl6zI9(nM|ELY3sUcy**sm-dHXPg|dqX%@@qaUNL(!UL?V#NBH?CvWCC=DP_vW-XPX$l9 zWFE*Pj!ADsKW?;#Lg=}R+Wz-%c*doYjPoq5=DEOe4&s=Yc<`S)i?<(jQ$b_&E*h$^>#*v+nF|Alj5 z`O;37p8eLC!v3CpwSdYJUyNsYrOR*keS=<+v1DECWHo02&Cx|?c~?ay=E=7Tif!Kr zDz4_ERZO>wkX*rLilkyJLm}kH3`dt?UYbF7?pSu`s49om zkjH1%M9r@mzE;9R!+$F8?9Ple`W04NdMt`SGjwTUq-mqjEPJiX1%_xuSQMo(y?tjJ zOB7}|GqL(cgF|$E*hd{5Dxfx2qnqj!)B=L{pxc{GVN;_&?D%aBKo|aY$ z4be>5mC{XPQF&c@tegZcax!j@siKAq+A}|~DZS!XQY-G6Up|(Zh8t^EM{JYPUJ}Lx0|yGeh?C7&GM`4)82ekv|JO&MDwl~ENQ#dy|y5EW7K9b zr*Y72n_2j$$Vv?)d*&tM(#Gm~UyR6pv$3>`n>SYSNXUMicrO30-M*cwNqtH?L?lC# zXp1jH{NcoI3UnA>Bv3VSX(=>X>2vj!Irh0R5t;ID5eo4pJvJb&c5rRPC9|S^SJj5h zqKxMTO_C`+yHm{ajgLr-zv>ApsLhPxsY3;5l6e)>{alTV6KUF*74WyD)|f@4Jwerw zwNz<$C7Pr?kCh_9oAG4ORD1`)52VyB#nn&+Q?V;sPH#G|3J6cyr?Bcq`R$sxux!%h zs`aD_n>lD-&FNhK9oaLw4N-X)+(Ld6{^EHzP7WvTQ!rC_9^{;#-SB>E*Q)c|iO+YSLJB?p zW43OKV!pd7g2Lue7fFM=*r%R5PruiuR)G8*X=F;s%pC)}IPhl{Nf(TlIzRuQP^v#P zJvz}n%qdc#k;X&W96>Ws){HOL6h6QGp62Us5luJNu9^Bs)ken5Mimek{JXLich&lp z*!k5i3dY7u(=nHNtDR>>%(lJ{&CkLjww4wY|hir zHjHizQNz95l&WOKe9o%IaaVezMHr<3LFWRd~>_yQ?!;hmrC#l<_6bV z7W^*FLFG%^1$L8`-3FI@poy+dWjm#={GP76W_GYekHWG$)%|W2gRp|?8h+2;gLzH~ zPJEOzS0^^cr6l}*Ck8`1-mPBp-o&t1-cc=k0CsRmj#PC^ChO_hxvf(v6r$FXpC`wZoYubzyD`!_eQ{ggVy6VN+!;z87E{k|e^Z;l^6C9bvD4l%q`z^| zhE~As6W%}rtkT}6k#f8*UyMd%K*ol4#xq$scQd8d6nbrOV*@nNR}Zm-TH5V{d!U<^ zPFW=buKF9jkq!#81RdLFwI`K_yLFG#-BOJd5!2h}JT?~Q9J3%*BExu~$C99j2 z-B#$`>Dd`*nOm>WUJzS#PTI0!HOtO@l1-1GM7{*S1~>;dw;&d-gDN+uKFI|Sw9QD{ zmTvOvVoJLXcA0zhsWp#Xo1Ec=8O!WKs@A@krB}~cTl9$7+t=TD)~Ryy{{X z*{uSRq&J(t*d<|gpOP-V4AN+qWa8-mM5|LPBpk+iTjycQ&4OJ4eJ+~&*=BDAQ7>L= zT)TZyu4iWT4#oT4-f@tnyVIAdYRD>t%c&gXJ{;x;s^0jn)nA&;UbE6xIWhqo|3&@L zqrH+cq*A!a>UZT5UkTq_3Gh;`*Wf8kyU^L$Am|QWX%nQHAN%MM+IW3|u2euza!#)5 zW?QZiX;OAC)KAudRD4R)!$q~Ow?p-7S@f-`nXhAm6!odj53(rji=Mm;_E~h ziVY`rvdeQp&{_|Xp<$1z{T<`4B*X25RVnmtA`wL|mv?sxqzX2Ab~Xk|pu1(-^;1?| z;}AFZC?;c@INeQJJMgZ+_bqOJv6XPy;r5lZExQW3Hfr%Z;5(2eUeU+TA@3+xKfqMD zWyYP>y?GnWR#SpM&)dAi5mSrCYZ|z&5V$r*Sz4|2n$fVg*N%B+mG!=co)BLZ!_Evy zK|ji)X&|9xV>CuOZ;578?)h&KmoSjnPX-F=L7Q|z?Jpk#ww;^Jo+mo_#Xj?B2%){L zxo0ifvtn>VyWfZVLb}aE)(UHXn*rCa-xRD|SC+mmbih-V7#QjSK?Vmm^_}coVEJYH zJCn+7pe%*ked7jy#-;l2O_KyXi_&dqnibT$*5`6Ls>vnlW8oTXA*^w(rKQ5tA|OFK zD1i!*GGCcd2V;!eOS#1v-tRIuFME6ujk%%l!J+?2_rhjZPn^!ut(4wsDg90(x7!s_ z5naArGrg#qk@p*GScB8YgkxwtQ>{zyxivCw2fG)b;SPOX?}@cq3(hpmQ&@d7^m(Zy zrQK;@4fcEjGN}_XmB7JrF}-o3%4upTxRQ9d4ZA9d*zFEbrJpt~+*BR+ z5^n~o3RK<~fHKV=!);o1Rj_dvY+30P_;0$mfz<-E19lPzJTuLJHD~*!gNPA;11q{ zJ6K8Lsu@b%dZdZfpuD`cE|`OZuBv*6i)wV=2ITf2gDUGH$Mr=HhKuzwT!Z=r;&)^> zFF3|xng@v)+L&tQH_Qy+=W0Z`|-9u zGf{pWxg0R$J#0dojwr$A=Y{rNP078*wYeE?Imb_UPB+6H32rau&b4f8I8>|Z)Yp&p zGcP)QTAdYCU{BATGt&9MPHZ#PY&~_=hFLd!rY(xSzs&Z@undWBni5`sc#gtq>Bl^! zczxc~QHBM&5Vi8VGm2CJF-H9b21+eB&nWywJDAVar*$)hX-RbA!CL8X|ov?kh20u79f$c{|Go z$ea5EV-a3q#66#AeTdf~L}?KNSrJ8&00~ZJvdmyk=v_1Tx}UrY|HxIOM_sJPTO`+p z4TOdbUY!lGHgD~j;qtU-O$(xL2tr5VCXWarkHCw()xdzBDF&~tfa47I99J9u{i9+MH~H6dPC{vdOm0&OtxP zTWQV_UVhn!j;J?a<0{4Bdcp=ZlR}MH>s6oFRU@?QX#LF>hgmn%5Vg`Evz7<8m;vi^ zE_>`A@Soo%@dICrD}JW58Txqh1+vcGedy8=z`Bz$RtTATU)ubYZ}X_g)G-RrN1ABJ zJ)tnce~HCbJCAx;j7T8{V9z0gNpK(VbrH4+{*hA8Ah*(e%L7l|!aE1!NO{uNh-9xF zpnbulwN?AloO> zCIi@tWXK>q%m5%U>xe`^^9=O$3`d$LSqmUp!vVlnpdDy_##7BiNjFSi_bBUEK&2vp zb*BlS{lm`bORKnATY-j@4<6tGA)iT7xO^(mkn&MC0`?%mzXhKg(hfhLoSTHvF5ggc^ z3jpMKxQ*+vO`ljWFgFhmMu7txKocO&s6(4h;524YdVH)0uVG+N;LCp>mp2GpdH*+wA5}&i%6ev13!%6>wcnBZX!>(fzMCGEC3Lt8Ut?}UL`t1fIUcA z%K$#&!?}X1@m9B2(=#f-NNKmcTBmo_b^B;a?ul$h9fLiu&PZTgbgcmi%(a*q#>@#j zDoNcoP!eEmCKDubT#`K{U@LOO`>&iw+%|$Tr~z>Uo({#moepe97KLaG;1ceP4RD6M z0E(|j0-KStgoBWSJ9`Ajg}nZOLx8PE*#RKp;jW6|t`067EoAky@U4eU5(DJJ17BOf zT_I`~5v>{s4#7Ega|7-MSVtCrKjnt>*o`{e4WeaX@RkMMILZpxgUkx<12M!scG8Iq z{8d^wU`YMD@1%b}mJ$wJO29hvBcPX~^k*b}kIz%mEFgVgE&T|%upOn}83JrYrhfxo zT;L)N6dw<`djfA9-d!L{z#e2h;67B~KGXn>oKW`v9XRmJis6|ds_~#DttV}J%$l#v zOg7*FHw9zMLwts!;2dmRVM`hn%4wV3*xQVatKd$7c9KkWPrS6FjgZI$`$!VaJTHBSP9~AJ`F}u#-dB@gwYrk#=qeb|fe4 zln{1O2s;v_UE+Zq=?Obkgq;S$judHEabQPw!cG%m_XJ@_hP3;0V0Y<+oesjz8DVz` zX}5P^M}ERiA7S?zVMmU%qq0NrM{&Z=7-1KSumgT$5#YI)Lo2%NeqtNlb);FhXa*xI za}hz#1qR^7&{kGALlZY9lbbM`Tk5D}oBs6V8Mi{anSvjOQUSlq`zza+P_~W`FWjJ0 z_Ei&C54yh=z@b>5TzV{UU z0oyp%xh77RFcUUyvTygPz8ypQEgJmzDiEpvt}m_Sw={$+chvho zsPo5Grj&Ymg^5urxG9jwe6*mB0od_?(~Pm!C@%i4GB^M3YyRE4v$1e$`h%P`Hwo=F zy^g|k?qUOi$6>qw6djxG{(;r6@5X(St$pW@(Xx$e7-=Xzz0!CUPL0L^Ab^^{I;y~9 zKmax3aGF>7R1B`XC)fJ%87tgy^(siKl$Fe1fb5>KYxrhmu5?aLGpJ&`3Q4qH#7}m9n7A0nF(H7}+~N__i2?#TpVa)Mv!u zMHs(7PxR=Ae^dV3Zc%yJbKzP){IQYoIQ<1UPsCFIcmsk7+ZY@K6K0cK8xcthvjvJ1olJV3*p&7FhdUBSL5NQw{z)9D=Mgy0Qz3D@ zpdWpKepqn?jsPzNj_c!tYX?;g{yK&5&>$3rh93>KnbmXmZ$5gx#hM8a5o z?X!k;5{3%~0tR4sNQdCnQ9-nmFlY{7xL_b*gh=s+oP?1mc>se338RIcsEz)A!zfai zDG)D5%iyQjGd_4U#s%tKh<#x=>MZIiWGJLkxrdRHbZzKQ4)_~ zZy#q85bFt@o;3P9Bmb#W+mogHDq^ozq|OO7s; z0vJ!g3v~qifQkRis>#f+i5xAAq1|}F_~*jozpbDmMi215Ff+gK$@kl^a4yfVA71cy z4K*bcttF1#=TJ~#kWgV9*2=u0fbQ)G9m*o-55Yx#LnM{`45i}6V`+p+~k_D!*dgxf%hfTvNw};Mlk%=kOg9n zksGyyE;-RN>C1ik1F!Tt07iVUwE?;~`l-6PO7okAyb z799}p0G$a);4Rl-33kZ@MMG6J-G%R z?%>|eYuJaOyNVHfq#Afy@Nfq$2$U7OVjP?5WLXjJkawl0!1k3B+s}&b8Cst6nc(N) z`STx&?l14(xEy;dx-;(K=+sZ61D`<$k9QcGC@bj+)ga0WggYU+8)wT3xH~8-Bj~kyAmeiF;J66~va-`Q+_C+4LlV9r<0A~- zQSf_lAKg@~(eN2~(V46f9|m|0J1{&-DG_VLhc37{M9<+b=x13k2%F`%b0KzbLXR!wA5J-PbHcJB7+s2p? z4ZxBd!qUdgbga;TwN{FiR{uiD!8@pcw_5U}@PE+BXVj8E|f$9jUde`I!oHwsW9_P_Hs`tQ8S z0wp}f8}Vu07|-$s4|mKP@mbz{PVsgU+uwNmeulTW$GrVB zvlF~ggA%X*J8u*J!Q0uYsGR04>nv~ZaL2rA$9@pcm1-*{^{ z%iHPsb{0Dv>@=KJlrvFc4v7@ zJjL5dY=7hJ?70wkdcK{--g;VZXXhIn>j~cek=ZeC7382q%zx#raOB^4V?C=k+|#^~ zo#hQ4?wB{+v%Gnq;_W21zw!3%jNUX)&9{GGhl4%V8{GJm-r!h|dHZK(CwQX*C0_e? z-p2ofx3g7|In7)2S>E8`j(L+g%Uk#<-cDls8*fc#c{?@V3eRF^J*79zv-1s(^#pJK z$m|4fmqCf7|IXXlJJ6YX$cM9fyK$N~wX?jz!yWT><1B9hr+7Pw?Qgu*pXKe;d@DSQ z9S-({-jXJ-rH+Ic7q>nMeb1sj`B^slftp^{OK8f3F+&_1@tbIW>$pa)M~pOV#A93` z6Q!+zep?A3`8=mN+G;(|eha<9Ka01v;NQLQ_y#WT?SQ$K?m84Zsq>X5EDS<6dp2RU z&r8b7T%9(Tx5lVjmReWz1oZYdx)vs%ZM8Il@Y`?gZ#!4JI8W2A&CicPL7Om>trq-t zh>0F_46@OK-@a*FvDgc-FNdvE!Z_nn*2ZZ_i|k}Xse6Q+1wNV;gQYq za5&Czb!YvXs`F}3%;r?Cp6g-&B;sxTYhCp*M)pO)CG*JEX3zGbyH*?l#0 z?b^qEwsu{S=S_N+mR5Qqvbt}epQ@mxWqM1+P>G_Q-RzBp7_$2Gbhk-i%f)0Nm&xzk z8G0_SjP~#b15-SDh#B-;yzTce@`MM6bcg>8S$^{9S*z1?Nq%N~bzra${-^rq67+Ut zJF2ZE^aN7%w%+@XEv>Iq8|-YP2UT?_32*T17Z*tGXI)ZWcde#R8-``URN0f%C!F%4 zJvxo5ryL}LDHoPLw^wPoSt!AVddWzWwwLTI^jntP)YdO)^f-B#jqQkSQt}AHN^~Dr zEwZyFz|aaon+_U~t3T58+)+!P?DSZ6@KCB)#;}#h?7~zzl#|xd*?nuJYcb90J7kdY&y&TalC3ey-jb4m zc6O^?C(k?2JR9x4!oN6Trno+a@Ap)2uaQ<4b_MonKSgkz>2}gcjG?Q2ZEeV~=X}b7 zf&2bqmPpP3$iY)ScM3{551Sm^9c?dPXsk_vv=5aG3|j8$Zx8H(AW!Y8_aE)gmJL}t zjk2=`<5u_03%d)>?Ut4eP$w_@nbMYQmG5qVJ}oVOt^Va~x7H5Q_i!5?o=X{kS(ZS? z>|ql`eqjw{2R(q>K(RY zj3iJ}iKLlF^gaaPe8r|j*#q+?12YVAyRt^lx}?5~Gs{CZDqqa=KVo2FC!$*%wQU=f zj$e%Qc*ZA6zOJnx!!wb3n@5)SK?B@hNG}L#Ue~ch*QpF1_(QjZ!nav2k*O6h?967;kwkrES;`?R{LKqL3-w;@YV82&1rsHrh4YpZ&kg_F6-=?* z(fWgJSM7^3-5|8;_BHa$6Rn)f8TC)ebQn@BV*{y2JV?(oQ?#nbXSUhWYRv3zS*t>qCBvJ>q2(Pa`d^eh9j_wsm z?1gJtr#164UY$wQs$Tj@M`5eX+;{ z3Du`;;;&!p$@_SYfxe%tS{mHc(ULzcN<8~<1lSz+O zI4nvaw6b`=1h*ro_5?7t$MAX5HEk@Hc6^fj@TA@3o9OOK;NC)g&H61!i#hu7EF_3* z3hOd|ZL0zue^G-0b9D=*PuJDd8G)}~FKD_jcmC=o3wS?SUigJ4VKLR*_ok}heZw|s z)y7Nvj#_nEg7i@q2UsmN~oeKTN0H?3)xMME!fduqCRE_Fb4`yV5zq7M9R(FQz9`@+;a;uy(H4@w&>C``H*$H{?f&)W ziUGkS6ye~Gt71vY5&AyZb^U{3f>-WkzEUqSZsdH4TVow*oI}s2z$ouAUG5qTU3n2O z<`$+Dj;UTwqqERGO8Gt}wyfy!pN)G;1-*Z0+bZu|{PcrZdbso@2be}NF&w`iQ*A$1 z=M}&6Lwd)iO~Q*MT2w$?NLzElDApWDgLsJ@oKby=-Z z?Y_+8bF%^xYiWK%mwLYs_-7H5Y2(^ARuYC3Pct&ii&?cLq_SCoUSrMEp{=ny38slE zh@CS9yR+mI<}bbTHeBeqzOu@165K8=YHiD3PQR3yZ_zFqd0}D;dMPcNRT#2ZQY}?& zTNy1E$nqJD#4TD{seRPb^G7Xo`r$M%f0#K?P%a#Nv((Ps<(aV^;;{&i9);xI zB7og^y+wmXa8s2ihw}PtSbsYGg4*m2Y5XvJo=)cAIK=@a0P^Ji_M3qK5e{1zml55%p8JbjF9tj_V1VM`A6Qb7{ zUm3@LBJ|_$U`jV4Za0WF$Nl=?w+5dBC^jgXCnxY+@F!{K2@Z*VbEyUh4}){EzUrMI z&b}O5nP^t#)VKzI>bebMC775hIZ27Px&Dm?Y>-h->SIe(?vPZAZk^x=(tCs8;rV%P zEu{?T%Er?oV#hD0Bx3^CIs{Ox(q@M4y6OHd1qE(ql@g4-cPwM}=;irYUnQ_h=W$81 zCZ8O~gR7eV9>I3-RBSSLk@j5wp2mk-)+u@o^nzT)Aw1(^Mg}=s>F;|rp9X0p6V7)! zvGqC#brt%-phOd;ggZ=A8=O~qe$q_8f6OH<)}R>Oy8T8uJkzfL3^9(e^;FX=rPL6E zx?P}Qp~C*z^Y9$wBTyqm)+0;BI6Kv~P&LBy;nZ~oe*d3j;)a6`i*HQg6(;jtiz-Rn zQ53mN*^&#B`3Pv+@#iI#mT54JbS^UNFI)0vYx)$tH`IKt$wNU{WF#t5oBO5WF;5hK zBq7%;F!W zJ)IK5PvM)HT%1J#`_@sHNKd5LtE<$oEc$0nyW@*z0f+m&M{1bn<@3D5TiMPsD1OxW zh0j5YZJ@bs562@F09FyOb%LtT&ZK7%9HNywKYZ*FXoSsDmvaq zeF<~wk9KJ6Avy1q^}B%F#_`*H zdb!Kghf+FK5e+_AqMR@_bV-24W9^F&?i9v?NX)W4RjP66mHAAf;0*}GiDXpnnd+CS zK&GrTHFszN|IeF4_ru);G;AV8*erK`bdZa-g6VmO0=mnuzrgBN7QM^hLq{fs-mUzc z?w90xiyu^3G&I#yd%RXl_(SG;a6r~7t^ul61?~A4E%zP|e8PQI;_Nc}qJbnRbuNIm zhVF;r^a~BNh0Y%(40mPv6MtODk9yQ~&c5uL_`R4%SK061#q*UXK*2^az^2YustF=u zKw%Ag`XbsQ(D59F_h5xM3C3F~hU=k~pKvjoN%h`V*2o(T+(UWoL-1CA;H{MXZ!$tD zF#=Ta;^$Ls&fF;!6N0AQ`;;6zmrjqw63MxM8ekNX0T0^21^%sPYy8ZP{U-c1DO|=9 zjT7%~9+9!0Y)%~-=ZD|cR}`);Hh$uAzHED6^lO%$A4G^VX5dZXokn z14o^9pBnE+lmheXkCScEG+20L?y{xwg#O(4O~5+2cI^jSt>v#0S-ZUl>o{R^U+s#F zop4AtP`5wT#?woSY4zE>;Fj43{b|SPj!(+_Fu#}0yPVa!wm}z~CMj;sx*nDx8|WCB zC!9Q3m9ds-Xi(%lJiWj6^BsxMPIVGTrhjLzI5wkI{?3^v3SD}5-Zlexq7V~03JU(g z?1w*9z`)AN96tTugj<;pa1b<92QZn_l$&tlnwI1YKMVQ%iE#?d*5A{n@;o*%HU_G};U}EaG=%23}y7_1^|vmnxC5 z&@sexDt^jKE)9HdpT*%Ve=4u8!C2qjUD{|XD(lf}C}zBGc_eECdVcq@$2?T4!T)r{ zG=vDc8T0UzgzEV`dCZ0eyP@fCugTI2M|CP~S25;rDDL-i~N6ht!d@>bNF=Rq}%0ma1NzSF; zop~En<#zi`qs$_@eBbs(!^#n_`&Vk}+5!W+?q6Cm(KG37>3d#W3aOB0S_jMeHlwQ7 z>ybv&f3}SJdSNwt$FhvSOaS%{jDK3Wxw^JDi-1DD0hD|Bpr8lhJy}+Skn6+ca9(l{ zNaPXOqDWfIq`k|v{6of0V88dR&ZjkUcHzcX#neE{jNE0pAG$V!JHv<-p&{_hmz3g~}aWKC1F50hpu0Yna<8dOj{KmI@|X5h8nl3T9|M;c_*0!8iCJ0N8(Z4zJ#?`)w$p(N zxc*^_d@TpTUeu3X7RMPc^rz2LwNuY~)G#D81n8|=%0RZB5ouvR)Ot^6<4?LY-|F1B zy1GGtTG*x;;``(^_@%POtr4DPf^T-27n{t$!$qn}F&~G#wOXgP-UI(TPlK&j zaV{xyK4;8==i8;LUgBXw!8N+M1h*y3rRB8MUG>~mnnXw$oGy|-ldYpbzn|46jh9JF z8vKUcRjTP>sD*u+=>mDy?cC6dWQw|z{9|0*U#_R(Otjeq*2Ugc|BVt_Xv>hK6UIox z6*OGlbnaYyU;y4=20@sLjCJ`CXLQw_5LpcW)+n)LhB((%>{Nvc@7WTt;OJIp{}tkg zwOsD4dUnDq!%vM?QY3~%pX@`vZ{^zeZ%3f=3bN(`+CfDlLI2+mL<2}g{PhC<(6N6! z9_{SzvyUe`*o%Vl0yY2SZsfzt&Tc>ZkgntHGeG#iJhJPogR_rFIdb6j0Sn>auMbQ) z>*egn@nbKqg#YRV@!|Zem$R4ZBQL1u#1LMNuh?g|o;`eyw^B%*I*QJ2JUh&fH=;c_ zLXI5mXE&c69LJlxq!F9{#~3;5=WJ6R`>B@sYl|w%U;yV3{*C~oV@6F+IU^}*`bsUy$1(+I1E zBf`=ibwIRG@OXx>{NXswY(|lLc(g^B9uxIWnEtw-dv7^Oq4BOdTvhNMoWvEpTCm}x zNYDUK7$_)=%Xl@7&9uRQ-2+vHYZ$T~qW;@5WwRmwzjtKtE>~?vRc-UA%>1=K+tKg;QIVhS8TXDr58qWmG^`pn{ z@eHB9rmx&VH3^*2|8m!)3AT~yZY~Q`On_9Y;Qrzs#$7lMV(dSoOic)tTCnU>#;CsS z(Of%5Vz+7oZdtU}^WSi0WiZyX?banJ#trxtf-S;6`mK1c-$pR9Pc{lkb+#w}NDeBZ zj)IQxfk9{9x)=%ZU}`@7nrmEiT!KMUTrBZId)Wh(5`CV9om@X40V;bZ+PgHLGVye4R@iSumIw03>YllY8z^w zd@_NlTU2N>9(;sdh1Pd`_s^10A%*h|OQhF@`ys4PC#?PihU)q-QQRgEsiQ_hS=0@K zhAmYOgDzWSM4`=rp|$EK!HTQ@b%ON9M^?fEf>HE4cS*b+ zbTh)zP`wVNaKPsuM~WIn0No-$3v{C=QGoUHdulA08DuE;1wHUPD=D_?K*dyd&CP@nXH@?dEp#R+kuW zN`YgKB9deTSybSBN^Hq*B{fF+WHX0uRiwv$^U{&RhshB~qDrX)X%_c|9ciF;dA{U- z{;BZ5ww*8vx-Ihd(4tH%z3uF$L zkW~AtFx?8wFZpGV$e`Q%Sy}vhc4|V^*{|Z8TXyF z`UZ)bMsyx3tbRsg7g-iq+uiZ{*@>A{e`j9DwaJau?DZ11DWkZzpF->pyV#BoR+3k@ zjd?4b_A-eXa(Cpa95(0tc}J2|?&nw9Z_VxIg^f5L_I8LrT%i;=q$?MAM(4}9(^uT` zOg`=n%@MJLx5sjHl*4%>!qgh~byR8l+?3 z`;~tI`kuG4wO2=k+H+m5yZp!)nJ?{<7&f1=2_iT}%ptgD;0!Jdvnl${br-D$db=6A zd={ff@g~SlluwXo!FOl%`TdmnM<7?YnJQCp!00SSO6wn#9Q4N#+&nUWhCNUct@r6; zJnjbxGyl40jjpMn74@+K${p*04knz!f+&**I$r}%up*|&(7l%=2k#P;tVgKiLB_8~ z-lHU;1x&tdwR{c3V#zBui>@BCMu`@(FfjSz4pF8}lG_$)12$12bVEZ$)MKtFM()|y z&{`pPBUg$9|=bhet$`RUoMw0!CIL6xFrFD$+`>1)#6Aj)xL%RCD?Nx zE%c!ww!l8VSWrv)bZ+`Cuk1rx``z5ok}uly`Vs!JEnk}PX!k>@dN8Le*9b6$&?Y~P z69wY(z-%4GA-~t9!cnYLkG%0CT0C`>pD@|*JceWV${i}(*ywI>`S-UTW+a0%!yQ^IyPGdvJ+ZG_E9_=vJ zmJCk3X4J;omw1@-{tRXc$RgKKr6G^du3dNFz

f2hfZy{@vAK*4gXU&L!`*4{N3)yHMyDI@!%J=SS!4E*LyTr61B4*|mZ zs0bZ5wwt~6XZ0#^LRvz5aQQ4S<95A*M5kG722?tmzL05`R^AuZsX6*=kCD1G=>99{ zO*^zyTbl;SQb0$}{dt9w0VTQYeq$br;o~RYB{F8yLN>eC+WnB}5SY7U%ob#uH>d4E z@bi-T+H=kMMWz{Td!FdKhM#3M@7FI(^&x&586M{`3q|bw$!En8$lv<1*5PfLXd`Wj z%D1eN7}r-;3(wjNLy<*$AK-Bs{WK~P@~@_5M(|lOSfW436Hi?i-nVd=80S&?G$7}I zt4NpmK2w^#qL?9cjbZ5)OsK6qjph85U53=>u&5!|E~6eK%k0kk`LrqpLx%Q7nZu4+ zw*_eWbVIpQJJWFP^L5a&<8a2SX5giZrFC1Rw<$L2@nCr>-EqX%Z*g+&6+gjC%4rey>TqkGu<|^FZ+G8 zW@MSSyK$H?o3Z3d(o4d#iaj3dHcqiZ4aou8)q_RwLBx}iPzHLaW ztn}!pXK?ZkFQ=$q5r@i*@qACJ@^VM;P-7canX+onVnvbo@?}X) z?fEz6`(0CODUQYUy35&ZV;mz~DmM6C^>5azTHzYx9m-lJJ}x=X zVcQrs44$-<((0lU&&5Lv;vym^Akhk}Y@bfeo5k}B+WaU2Wto?%; z$U{U*M3N9AF?laH^|@9Ds$@AxTpTZNx25rWtY4tNKU0Tl`QpKBq50TR7kLyOQz9J* zRf>yK@Zd47c%wYm>scSR7?4$VTG#5wu0MPtwaDxJwB~kurQdT|8Az>|7F8m8TW;Xg;%vTw>!k6G4J02k&$`Olflg9AayYtbd+PjN7*S-nP>35Lj;_+nj zH-6m6#$556!Fk81Y?rm4*x200TxhK~Hde}}QE!Bk0Zq6y=QBDb7%~9JoT_} z%F_PFA)2wXV_z2K+{E14GTZ#nQ5oC*7BSk!^x7=KGQ2>sy@S|I32{b}_fD=FC?2ES zE;ys2`vzEd^!WW_M-RK=#bUWzQ(sSRFm^R6i_TOib35H9QiYqC zB0>#y*9mR-vXTm%TbF7l7Y`4O)+Xj=wz|XzrY7P$brRpTJXA6wW)KJ6qE3eX=F&V9 zhBm!ri_pL7-J#;PJZiRSv%5Z2GqucOH)(QnYQ5#AKNp%mm!|+~SOy_6hmz44JB5-8 zuL@{Vlbz}<0-+0@8e`0Em%ZH9<1LG~Bcf$4?f!U^CXb_wMuMq~2eUgm=Z{<14rj+) zjnXO|T2|m6D=f!mq)zp_y>g|Mt;kR@fQP*qZ!2GSq~Moz@13y}9o5R&W1~T$qGhX^2N{j8#ae06SVPF{A%hpjWRyefDb2HlNn#*vfIuZI`IjyGeQ4E7B7tC|i5 zMWebYTlS+ir*c1f+?g%dUvjUV>*-ihDUG)q^Dydl>h!Q*;&I4+6x@h5vEQ?`wZhL> zVkf^uIluZ|JkMCJtm)9KELw>^JG6pob!Mw0qipLD+M?kg?D2$p$#4PFftlsk$b}+L zDv+an#h!`7()M6mPpukhHkI?B5;6VDs+ix#0~rSNTN#TtUbnh!?0zS0&S`#mZ+K zrU&_^<6vd%5I3l8x5zrIaocCfFgx}sYUOlwj>A!7QNybTyoBau{n-QNNsfsX{UQr`WskXnGTOFQ7LJOneb|d7l=a4GUY_TtT0%V2cRV7$qf@RI2*f_;TUU zU57|vsv}o12N;1-IQ-}xPmQH1mSdC55u3Rxi>@NJ{izouy!yR(^HCE5l@^6n7SV6| zV?H-yVo{&4y|LWI`i)TP_8 zu<2PgVQYFYxVFpLMqln#AgNzgX=8IhY-(dYTZxlDLNS1r){}G?yTwGf^k>I?T94hk z7b|Zt6IJyKaba1T+-@XkMFmRgptG~B?vkq0`v}lcr8T~T(p2z)-*))o+?xunR@-CY z;|{8dZOqw4O`FEUZU3cjJkGGQleUdN5i8x5#KSTiICvFW#ZsweE%#-MizCIva}U<^ zKuY4-ojnB`xXfHe$J{sS<85Ag7?X8jDc__yKJjvZ}DDB{>-?A zg$kN^^nvmduCf#xtBMs9751`~HpaDughm;jrrtx4Q)i`5R$*CfROi@Qa4j#dvoc;s z0S!q16<4p|oY;<1S#(G4R8P}pJ)eCRPHIyV-{UeK1(m5h4W|ed(DZoY=1TE<^N)34 zBr}SbmRS@G*s$*zem61{joWV5sJ9QU8&>rf5?HTHDRXU(qZZiBPVBAxbjsV!*wIV0>l_igT29U-^aWmDf zP-%FEBbS(G>~ zIH9_C&U-zMu0mT3>ydytv|TgbN$Z{-pH0;`+v4e z-p2MEry$5OATG$|$nt#={}%hbhGa8Upe(&2f$4oA?&MfaP$DZe7^1ua=BDOPH>by&sC=huyE%zidPq_1z|wts98YpP z=G0P2q1!(Wb1$%w6WcvO62+U325V2ZkwB=2NK~HSh%gCDU3(`OrS0m-=jsS26r-lzL}OVX zKBGEXefu3mIUYl`B7bgxWIcvpPuc0=Zq2cOawE= z>EpftwFI3U3HI3m%+-|uca7rQ&r9lHx6gi3!`CN#0-c1!+~L+De%7wT`CYfZ!-$lR@giXM7*Oqfc)V{MvNpiMf8H{7IVB0=vW*JAwwYljX%9|@Byfhl!SlwBdhm=JtF`d(0$-KS?ue? zMb`euCQ-iFQ7E4t*8@bJ2{IBqbk+f0Ezn9W&;tDJBc1Yh+_)_1$mih*cSa4t77n!x za4i(0ex`h&JN?xJ!k(N3=@*oJq|+vnp8Xw2^Qm5$f%JkKCve}}_qNAHXPBd91|Xc~ z3lPe8Kr3lr4V`pWddhUj(779+xSFq;WYJwWNhtf6gKt3b7z6ix<_$>o0QD}U)hBdT z77^;(0pOz00V?IZ-XTM0$@aMQ+~XE35OwXl(@Zl-LWa(Xd4xjn2!+}bY;{r%^)DVm zhEDs^n?6RZKE}9iu+>Q^9K#v{KKyQ-S02X}0`QO8(vKVF+{Y$l=+wt_AFf3a5QX7W zsv3=)2Tvf|h(^MIE8!r_SrW|`Zj=rp_4vd|5Q9KlOALM5-sdpP7BJ3}_*LNhSAi#K z=D^T-5+OrpNo*WZf0AZqfG;secnAKxa`o`RLuX1@9q9sWfYvlec%`|4hpyUy`wii1 z#4`n}Z+w>3@B{LG+TP3$DsFz#^K;~*>To8q^#i1Q*1R@x%rB%D{Yur;2oL zu<3;D=7dOJjzhv{(8ETc$U&No7wzP)Ziarkg=p_=!d_`|)4&2}8&9M2d)VYi&3zZCj<1Io z?P5#Q@1n(-8}Le`a}<)qAm|VP-R`_MJGBB+&Jh8P>tW*-7}4bh*GM>sb`h8p5E$TW z4sdqrMppJk0SO#%d8%4m@Qw_=wsg6&BVRWG2d2Icv_WRT-|5b@l~}!X-UeX?(LSZe z`Asmya2@YSN~m72t-K#t0dm&Wk#|00K|$@%MG6PF?uPqy2Fw~)#u@vcO@KqkUrf#q zZYc9;XT9u*I_Kz&r`+m2*yQ`bbsF*)-cyMKP3ZrP$rl3*8E3i+FlH{BH-!qoh*SUu z&UdBFMi>D6=}8X{;6NI}_92*U0Q4!_dz!%PvqAv}133q*gz@4&d$5{+$x!u3UhRA* zoC4=X51iWyAX%qdOLM}2|D^=e=Nvvs0}G)W8A$HwDVZ+)@Vc9H&PZ_jA7jXR0Af8k z2KG470kh9U30|iFyp9Th;5@#?MgYWld|<(W*O>z&xX|{0!Hw)A?vLrbesaNK4N2jw z!Romp+5$Cm;pryTGcB6wu-vL7uWBd5%LNm0__lmm+TZz>{!5d40;}rK?3snqzIH??faaV+jTf7Qbd9SSaOVleoa2C z1Fw|eSf-HRUoz=Z)@nsG`_;YrNE^QNt`lihwFi+rGk_MKym6B6b|zz%YlIox`}5?F zBb7h~q;Ceve#b!x(p)3`D2p%mO{B#2sgy`$6Qe>(E}5yj5@aA9_9g8k5_}VrZ6H6b zZ-!cm(zm-blxa0r0_L7{f{JyXnu(|+{REBMh0<)(T|~Cz)qp^`6p-NAyuU8KokiZIi3y?`r#$42?eNCdnP zQVG+^LP!(0gK5|(&lZ9U3jH?J_^Avn$pehkqeXDM)ZeWP?VP=!cB-WNgc9=i00x1N z(}Xoxk|0`>oH?-~&kE2F1QS?-J1eMoua^|Uv!c4vgCLU!mjHq9qf%!EII~b-qNW$#B^+hlN=CFg`FpGqyEeQU` z0_IxY)fN98egawC^yAB#kBAqL?Z+W_7rjpL0_nJh7d#gL%WbL&0b9%6Hhw#p;35}R zG0tyjAxA9wOl_>|Tx5;`%2S5*AmIIYBDp0-=?=UIvFH>;7dJ+ZZP>1kPYM z*7@!uoXZA);dlcA128--IufP{9+=B8NKRll-Z+CH&|2(&8OCpc6Bs0CFg7t*mdO4y z3=?r(C6Yih5|{HD=mbdt6Xu@OfC6q)f{PkRi@#vWzpX+8pgz~olGi>0q!a;9r=`e4 zI`wa%Bmv+r*E<*mQ1AXvPV0T|!>51a>q;c!;JFZu^1z&Gbe;?x+$D|vH7PHe0d_C7 z3?3Lr%K%pX-y)-yTiev}MZ+Z@FYTKlI1ufh>4l%O@vn*1`d2poRXu^Gm-70zY%u>T z8is_ndrg5(;5dmuicHV2) zfsc#X<)b(JPFtzWU0s6cYEIy|fJg{wKP?}GN8zYUuB@#hp~jID(4sRABRS(*DmU z*J{&^WA0pD+D#kSqJWPRPQgp7UXS`3@av>i##K99XbsT;Aoxngt_JoO@8Arci=`Sb zy85zMuxtdtNhgDxvItE7%g(_>Tq5-^fdT0{(UKZLldd!juZpM&eDKL;B;x{Nc%O#4 z;XojA20otuG`YA+Sq_>Vq_+}7z2vSm5s=#fRh|9Mb!M9x^z_&fHVnI%zolmcr&UNqRMFxn^ z>$IRFZI*-0n}6b6n$NLkMJ^hh$Pffs9kfB&zKeVL_J|mbABg2dyOBFz*i2Esp0|S_ z%JzF!&G&Fmx1_qR;W~~q((|H>Gnr_4806}_%ZWy_%zR>@I@OlfHZ%C@JnAGb^XX`_=@%!xf^}5| za&_K8SxwucU$sY{6vZtn&<3+kO$63?)HQX1z;Uqd($ZLf@#$d?4uBkyN2WUtU;`g+ zz|KY3%`Zo-)9yw(&T;z9AAoknd1oDmIpvkOt~+NLYxO#9u;Uf25hl|wt^g-`3FZmX zg*%T8!j;l4jL>o zz#&9t!!6M)*C;jT$5@U2hw1I-i$~fpn1in_=}f1c;0ki!>SEUc=;{vyryR1K{vXWd zn7Et}@YNNSf_b=5=@nMMD)l{6X{}c(kWN6A=jmiL1->)@ACNEB{8#|x*G0S_7|9OA z0zQd@O8_j|%Q|F9{$O*qF@Uvl**Q33nk%eacP_$lmQOG#DVNg;0M`)!XN?rHFZ|bi zH%DMy$an5VUA15_8sr2;_25&#anSf>XkaKCB=@_MCu{J;(K z1>}1LP`WJF`>?t9hndq&nDUx)a5IVk=3aE#zc>e~{-RCmwEuHkxD5RN+V}L8T$*1m z9w5w6#r0}*MVJcDc33G;HxuFxhU-G(>cx;e+v{B`07eenYn@-e0APw z|5}>=!`U-e5(2)uq9ia67umeR3RvP`7Efza1=u&gT}tO)YZLhz<=1MH?s{#yUaif` z&cU^bdxe$1I3GRBCzw)&f7v(xtG?l`^jX(yjDo{F+cy)!IPflK^RN5nbzs-_&FfK{ zKfStdUY|~XzBstagRibs{#E3_)j#c<|HIiOR}xZU(=1$59ozDUvEpul{HQvpWt1_m zt7CR_MQ4{W$QPAmk?4)Lr!9SAEqO&PxlQ=YnoT%cnSVx)3d42_N#$#v1-9j0w*4Nf zTxI2=o6*kZkGKzrm&Vwm$}%>cDoS1tmyZ}2hwUE%zf!KX?cYd?I}+aL+_JmZ=o!_c zb=-0|w=b9BJPiC=v$B1ZT=4#)U7qr?^X`#M*+Pc1O02Tu@f>5r{FXc#TMNn2zPPc^ zacRHvzADMq$kFWLxO1g_SCh3dG1_g*6;eV6q?^v0LR?#SR(C5l^7Crf=_v~jb#`}_ z39Am!(T*Qb+CnMV1RU=s+8&csS;99(djuRleI@UpNgUM?M)Dgb_F#N{Z@p_|?{{kI z&Tl;D@8%5CBYml8Zeb)tW4x3w*@wF`I;z-JoBbU;#+7js&TTr`u@#dHa%^lmW#2Ns zI?9dw&Ms^@OmQSrJe*LsUAN_Xxhz>}ww+NX$G~GgM%>BpyY`DST3b|6)hy~8)#CU0 z&Nr7yjEu5++1N5NMl5)n@Rq3Va0RwGt*z^oRjM2}*hd~Acl<#X|5H?<7c_b2a7Xp) z!CGRpQ?kHr=g`4m1J5B_ML>%41_9IIA=Rd_-E28Sr7g++%izPn5f(Ft#6z-Soe=@& zBI=_*%ecsPeRk$gXsj?ZslfJU)Ym9fl8=1 z$6K4dyKG1OP0l_1zpPspM+1p?>_GIf3p_?VhlaN6Id%@wVZFS@AS2r{C+~&|pU`6m zp%S*JM+Z*DZ$~UfW>_9_9)z~tqva)fI37Wm)jzykdZ?pc20SG*W^`Qq;oc^1cZz3c znq#$HSxIk{xV2}aL;2{!(viCJFunS&Iu1SSAn+7rm5Hr6@Z8MO8{6&eiNTQx^HPQ7 ztynzP!?FDdR;%OHRBLCUO5I~BwEYMk?r$Cbi~VqAz#}xq%Zm;rhdD;E-EDKFj$*0V zgIES-M=M|V*PYCr4_@u}+kfp}W-A&R;mHb>%UB#UUd))W%j@^7D!1iY0iMUHJxm&! zm@{%NuU%FhGA`U-G^;RXD>tapKgd6_v~2Y!8Pq>4)y=j_T<%@e=T=Daad0}&tyX^( z`)II=g!3cG5!%(qn#^X1ExTc%ppa3Z{?lVk%;3j!Kgtf84L(9Y#6jWgO8wPcZ`S#T znXJhwhW#a{*$~h3NvRhoFeo|s3r>!BaW6RN@9y%!JXz=;djGy&tZ;y<4-=~Y6-7u4 zC56V}JyAp1XZ4E_Sx_ES6|881Fq|rR(Bwn8FbW z<}6~46EA&AgZ)EbP#TA=13AEsQ*^J%NuA;m#h$yxqqJT4C8%Y6<~ZHb=O9rtNtfJb zv~S|VDc6rY2a%1(tPdWj>8tui2peZ^zK?QfO?}zHhlt5+fgXKCtd1y!+4+uici0s* z=>03;x7Eu%tG0Y4Z1j!P)24Vy8_goi#pO}qjLEY$w&1NeK60t0ByUz33>qzMV-~{u z^d^XM>C?^WdA?W|`mFoxoAg1`aao)qI!O(M08bQtg?57>)myf3P9a^feMA{*fqkOe zdvxE?b*xtq_(#{t`CQHQbqiUPqnY{qKHkEo7ssdPsNs(a=xD)8p{1^V*ZeM!H18%2 zon3SP;hZ_t(%g;T+V<=ya6$-us2ghUK}{p9I(hmdE^u2R@h?glQTpS zNOD4ZO7K)XbkUJTK=h?IzXyVOQe-TW?EY1Bl{frTQva;^k69LY_OQ>-6A1H7H^|iDEkpFNu!INmLC7+PWp_| zvJo27gm4NyzK)^v&9VSYO(rFUNurLr{T$xmJn@LB=(NN9AFihLP0$^-g33&Iaeg1( z_IbU|oe+aN2cf7P-{}P20)T`$cxnqga6eUwu1@ zO}4n2Ip)Cl7aHN&w9ldh_Y$1VGnep;9=U#^h`;-3xWCLTqR?_fv%7!<{=) zO`(*Vq(I2*6qV`A)h2;I^^AtnLpw4H!;}3dRiYMFheoJAa_P%Hc{a?ctL<2if-KMtW(Q_Gm>>^ivb=n5RHm$UH zH6v&i|9Hc0WxrsYr$gf-3kxiYl1YcFn|k?JRs}lP6C4yjIiQRaW{00RsPq-L`D~>W zqfew;l~6nNvi_*A9pGIHkPOPK~$ElL>Z~o}nRU z_xgd$r#WP~^zluk_;ikaeg(E8lmv^;15h4_4V|O|4frMN6=FCoWmNLx6{Cl#3U0aS znhJIbtOOYOTF-cEGYZPpSVP!9G2QmbK=7oEbW5KJ(X*d3Yh(M>ub9=3+g5I$TPMea zZ7CebBBP~UKPz%erGV5q#XJ2LyQ0#{U3&C;9W~>zE%$>S6_qLL=|${43__&wU^Z>a z^jX16ZWb}stX6!Vk$+oW_EiSHR#bNg*)0;fs(M7Ml;Cl>X3!%pE3fin`{x9Epm>Vm z=KaMrR^vO5NK$C}51*~v_X_OmXU3{#?4MY3V#+3$6wp9Rjj zjE+xV%fjiGEj%3APPGw+@+8X1vuj&wZ=3JN_T*09SwZ3A`^@yAp9n?c*1A~H^pH`T zJyE!IS)6x+kE(#UaSG z?i*koh)d-8d-j-oI9P<|Wu8yO!SMTM6F(c5u>|@p_r%tQrav>o?GFuv<)94D)2ud2 zR5m6WG&NBd-n|`l-~RP|nKa6+kj6bWQ+dJLv^Bf%SRTQ4jytjwy~^IquEAAv{6_b8 z1wtxKW9RtP@|-y2epyf@z8&nli3t*@DX@Ew^4k@O%~zI1p=4LO5Jde2wx|k+0=k_q z&H7dbkrWF8Od|=(LA>F<%j_{4H5cWt*av$*6*tTTc!x@YId7(tZN@i_{p?@W^w0BM zB+B@$HnZZkXr-Cgzky0@^=%=s%y#BW@m(2SdA6fyQ68ehWsdt!>jm7%GdC7_!&bxy zd%$P`riP^BcuIvz%`|DYd!5#+!jZ~BS%fzj^wpZL#O$H^WJ zdv}-7yhG@gdiI3e?Jlk$Y`2u%-CqJ5EuM!`&jR9|l_qNydA=lX_<5(SA!|S@mXq9k z*YZ?tFbmnE$i{Z=T?4jn{Jb|w_1*6hf8NQ%EOve`B7Y)05dHmDPRQ#nc#9GWzNcZY zNf}-|L2(yDheCwXKqShMtoFquhoTGAdlzcxV+Bv(I#kYweIrhgoFVdZ zT1;#3Dbxoy^f>jwI6;d(TnxeI=+JzHb~EiZEU^SrTsqyycNll^uC~M?fqCz0pcUc* z?|VT8{#P~AHZW(P2YO^1^=Z^VrU~-*9|}Kt5YHO$W3vyPZhD>K z`-57eUqvG32QN2}0_RK3^R=y!us5N1vT7sAgq|z*o4#WaK5qNnfz%xtll^7kAobx& zO6&UO-GBrEJ`=i)z$6hLt54ZHprOj7^<+(re4CL!$Ll{nV{`9T#V{s&b@uWhQX1#% zUVE_(p7c$#B;dt1RKQ6P?WFgEA8yw$Hr9t6{(_A42N}^Ds=TRS919+=7Fyl!!$-v__8o?rALuE}k>q5PU_(FNR2lp-G*yA6nXiW4!*(V7#CNvqNfYN;! z$0|_k-P7045GE~Kjh1y!#~<@>D_rfR;+OF^?|RxHOh-b1iUd1#Wq{%~!&?>(~R+d+w+j#JE4mBc9K6kBQQ zFMOIeUxsLugvDtm-uRHI!m$W5z2cd;X(YOek2*8b7cX%muX|&^G~&b%?_?>i1kd;L zX6ZbCrAY;&$9i{M7?eS_KO5&;>G1etqwo@}SpN>HX2qz>i+j~|?LIzTFYuP%sJ`iK z>9;E^-YXZP+87scZ-$nuSH%e>`)U+YdTT9p*QkWOgyZP*__bqwhKd<|K9IcGES(F2e}UR;yO86jr9<1}0N~G7fl!m^j>UqXh$wMZvpVD7hm;5NW4K z(t**tgOwD-+L@9!{rq^U)d@5*E?ZS+X`|F)8ThVtxrOIyl_rnfktYGfs|Fliz%Lhi z{oL5dLfgnfRod1>+guqe;Cks6v06s-gOKmN_pN4KVD;?cmEvzYRg*_Gc&n}%3GZzi zU@9U?E2iHy^}<=A3S9N^V#EV02 zjf!s|Qbz#$BBfmjC7A@r?<0e~V3Tx!p+$nuB7Vx_i~v+z36*K~3Fhtsns}tCc2l3a z@F#M8Pyu;n?l|Zg{nZJO`0S*smeR ziT?U{XXc%nR z|NLGqfKxb%dFVG*KLcClYv9C|PzWH2C zjpM(v6qU9thhOM#OH@J_4tPNr R6ciHh*A3`ep~B#+{{<(3Gx7ic literal 0 HcmV?d00001 diff --git a/spreadsheet/macrofree/checklist.en.master.xlsx b/spreadsheet/macrofree/checklist.en.master.xlsx index 9f5e356904addf6fff409722919d89241f1ac85c..e2c2f14208c0cf10ae826fb642719e545f2f2284 100644 GIT binary patch delta 257166 zcmY)V1x#J*^F0n1DNa&UKdhr)&e#ogWI;7)OhyA^k*xVydQ-tX_z z`+t+2kdS?nd1ls{Su@Y2L<^r z^qV&rNmYul*g#;6qLn`bcHnF19g$Jp5W;Mb&5?o32buYKEeTt#6vod@-8XCWF0&0~ zRsHEsCvNgT6Y8|_;VZ|~?dScXZkmaCl3WQ-(P@jOhY8I$;-Wu%Z(@`~LY8kVP#vJJ zew$igA<3Gp0R5I1Iz%VYgQ&%+~aD9-kb3J%dh=gVLLj9=f(c%SfeK!ZQ{PoVDTA@Ei~QN8P2-+(YH z{q||2+B@`+X7qz3-e72A0uTM&!O7)7b1FYfz2ZvYV^lI$AHvr~mM!bv%Zu;s(97c1 zdLHOcP)r{qVZoVNwe@(1N*8|I(Ddh>q?-;={J@t|`Rg`x?!!aVw(?g{+slbhqu1T< zQZ*M(dbU;{4Zh&=o{O5rvy7+OW-k?B*CQr$iD|{I$Mtq7W%RpRg8HS7qV3`1X3mS8 z7r|DkPciH`2#d|?*s?q9*bTU^eKll}%s*cX;t%lav1Yzr?3G31Dh#V?B@6(1z-`~l z@1YxLaXhfU4}DKk^QB#BJAKEK`um0Pi>r$V(=`q5%(5QMeC`7iC3P+ z-nia+?%ad;&qGNKALyi0W_!}{oOA)LpHJgv=c;8plXgNLlCL>hxIS*yyy~v6D{L1T z&Gi>tSh``2I}cGLODn^1K4yRk$=>7j$(`1>I~xt3dr1~{8h1SK@BE!+)mJO;$)Kf+ zTW7t~Az33dcCTB6xi5C}h4UqPY)@8Rb1e;wmR9Tyaz=;gi(F&Ub1tS8$9MTyjSia` zoH+#R>A2S1bpIOV6-_ei*ZA@fUqhDjLem8{W2h|*a0J>DOeZI zj~xl_#Q2cZ_FGR8Uze{Bis`Wz19M&H<&lGI6EMe-Ih zk0py{r+Cly={KxS6g+^&-kC8B`_%YOLLrZ6UgNiZNOVe`3{~`LGrIX#{fR9O2Z=8_ zp2p_96ki)pGx$4(ATNwBiaKp~{2|?0+5dR|doZRl|Fv7vxZ4-VSQy^&=8kq;@@0>- z^|fw&YMSp7x34cH(;i4XeYuF7Ygwbt^r_jVob|lC^(HTC1a3*5>*x+vvhVET9w!P;m+j!vKZFAof3Rb*;)#hj*@L_x$V1y-iK@LYhR;|F7vs6qu2FEmZ{znPPj3pPUvLke z6>tG-Pww4-oggJKs$MpFlm>pR2BwKG4ZSyG`VTpb5g5OTzrNVp(ca`TtrY1|9d@*L zuqHp3j4tCn7%SmL;UV*5{;-oa8rM?T^Vfj)Ux}^x%7!M^{odg2cUrq*R8}s<1A;DU zKw}IA#Zkzi?~Pge=(bVgi+I!fS*34uJ-Ao^eZ<9e8yUhGxsE1rXdU$-)0zgqwcGo~ z)iuqI5Zbj98J$hqjTgx=TST)CzF;Z&ij?AT2Gu?G^A85MbDHY*K`xJOCFhpv)f-wq z@a)Ic%Z>iwQqvb`lF96|J}o#dDA_LK{77M1`|oafD)fVJ+MS@M2LW$U$I=()GavWvb!__w@cVF(_y@$)Igv zm~!Bn=C)f{<>G2}F@ZAvBERL#D0~uXaw<#uH_{o=p(r-4{%CSPuDxKm!#@wt$Xh?| zFe82$_3im|4_nh(vN1!PT?<=rW=h1iiJrHNeQ!Thb^4OSl_3j6A?dTFP{05j2bR_h zV++n)*-!itXjFFH0RkF%;R1Ls$fTG)l&K0EX6}Z!JGwt`&)QBWyW!WN{KCn7jookr*HWao^3$3)I+Hxo|Ab*^<44^|Dqm>}^^;bgk?CgFVC5df!AJLayoqxfyo_tBWi|?fWqtr zoA9fhUHnwZ{_5%g*7^sM6Sqkpc^0GfxTtdDI341D`~gt7dgC5H&@EoCY*d_bRi6%2 zW!)>{Gs?qqZsFZ(d>oSa6mH0V>1{OUHdzt%83|h>cVH;ss->O1kzFWw8c}zmMrN^Z+iZ*B@l=m=jEDGzGF0u`=?3`|6qIkL1o*M zNB?gf6u`-6xw%wI5|co;EbgMTddthapK^?U;=Bz^_^*K!uHVp(?}!%9+cqMJMSN1- znY#8Y(wXS1jc}F(2R7&5FVHv;j%EzAP2Y>5Oj#b4-ePD$F3%#$KeELB3oQ3vQYvq*vNl^YWX@+nO z2T&V1lR?FHo#9&nH~A|Oe`-)^(k)H+^(X{tl{zIZr@s~Tv@7^#wGwviA4z7(L8!(k zmP;J%uu-*kL6m_$7Z5@G1lImuZ@l^mtEor)--mb?b4ijJPk5UKHGtF~VH_}Zl-OYE zuXobN%vu7+NPml$X82#6`I2Dsev2C<=!hgHSqhUAM92UzPc+sG239UL|!p?6{(dZ}CaM!qphXji+Qd0LR9o~6`Xl0GJt<6|mHSU*Iuk4%y3f0|c zcH4y3-SE7t>XkcTRh6PMBm8gNfP52`5N9*qU`rUy{P7{Rg%RZjdAJ(E5e(5_C5T>! zfr+=LPSKBmkVS+EQSsj=Xpn5DR@cGEmYKHrv$}kDT=>9 z$dVBo#5=Y+!0YF1@s%+r+~8pP{FDuY-DO)ZkJ|jFIR!}lu>M{Od4M1B6AS_gmzwKW zzK#c!#4ny^Fb~lN{d{k`ipeuNA9fm+Yl2GRJ4(PP68kzyJj|By59Ryku#x;U}3op4*9*eEe>#Rr?19ua87TG}0sRwcb!uBQEw(Yd}7gLUt#U}@Zv zn}OHxl@s~;w}=?&;7zeQa;H5^2cyHA*3-rTkF`_MAAzWu_uw=W8Q`wubdN2}noc-? z>fHrTtb@PZ(IYCgtw_w@6|*L|IkdjR{ZtLAx1b5v9;~&p_7QA4&8$egz|}X zd13*hn5#?hZ477_VBAbD`5~gk^)c05r2CHR+EsuUJ!*k&2cQd#RQK4r6qmP`h5^LX2|BVrxiEi3W!M zjPU%?x^Wn7#Fb~{DCUT@L>Gfm?u{{*-W?;~lz@LP&Q;7Y1$^#_5fVenNgG$+E+D#u z9ybkPj}u0umtO7}K3Zm{vxNK-^Z!aEq*DIwq;kl2l6BbTFvFdAQ?TzvjUoe*P;%`7 z!I(tKu%6X!z^0pZA@>9|+R2HNi7g7$Cu}VqxL_+|RFGB($^Wu_icx&SR8wI?tm6$|T%~KZ z*EEvXg9{M|uA_hlKNs2x+5P2f)5>LbbjHixFYGE^7@I#k^Fd7_F=|lwmwtn9H zEcY*F1S(6N#y-#DP#aC2vwBprJ6%U0jHfjvJo;k}v35jK)BU7iZxV=^F(rUm#WRG> z(#n5@)Pto_PwUWb;3ATro)X?rSUeN^+(Nppo+8OKw1yQ<#LsLCxqFV;72jjfLOl zFX671C0@!wi1#RgeeF4!b^J4h<;Oqp3n_U&-VV4C#q2X!G1e)}8fx>X`!2-}PRwN- z1npBS#y2^IIL9#&g-TA_RkE2h=nZoS_Y?9MG2uLEmx)r+co_G8*-`7`fK3SD3Xow* zgvGjd80wmMKZ3*zuO$C*_k!Wf!#b#oEiuhrA%*I%mnl;fnH2X@nG_*j&cy@vCnZ>L zg9X1VnI2pTH_;mZv^M@&va^)&v-D0b*)(BxM@M|=zG|0y-r{=!G^#qgQReP8{Uc!M zVa}{sV|hP4>*$^@rE0)%UHFg&{%vbKcs_qu}&bt|puAVvo z-lI*cBGGjyufZDT(a!nZ#>@)9T(I*{#Tf7e#^iQ)-I=A5a8VGXb}@qA%maT1{Tmp; z690EfgrMjH^zR_hMSRF1wc@`y2RCF=@Xj!I*sY?X=1H)Y8>eCe2V3BKo%=}~tBlL8x!#o-&X#c|GujYxj)&!q+ut5*&<>p9QQ+R*maO?E-cCa*RizzerrbVZbL51{g?v&17ugO#A z<+q%$7PLUTmd^z78VKSwrO(!g4k#w8O47`i%1=7R2blvoaX+`Xp?*_c!_a`hJCp!| z=_2)ZMjLXf37xvNnzUx9!|Z6@L(4Z1yJgZSa%^P1fOuvuA>7rjQ+R&Bfh)MQyU23l zMScpCdc}o4=0vH_s9*b7yCKqpdR{a)rR$`kZtYji29A_kO4B%R6O|sq5Q0O9K{*avuzA%8W=oa&y!Q?4QL)}RcTq7-!U_*bFH*%dqyaV7}c1;*Kq>GGH+bj(_ zQet;;AVA(>`b(s}Y(*uL+f*eJ2$4`BL>dq@9-W3l#aFJF84wKEs9dVY*ReQ150OEC z_qE<7!BR&Jtdl=}9lNk$$I;+p(RQzmlk(P!dq4I>+>&78Q%f;iiX|@>Pg;q9SQ?WX zJ)rnWxo>Mw{9D3ja6U1fJI)uY>ooBf#qnPi`c4w?i;WfnH4g+CA#@5#}F1S2Tg z65q}wzq^-LFRNKKX6TG12DCl{asD-1lR=1|ZgvwB)@9Y=X)oj)7KBGY{IlHEeza6~ z&6qr10oM;ftnz^lf+M0k2aUr+;^F9cZ+!RM8e@?^j&e_1ksxt(vtl@fp)_GatKHxl9%LPgt`WqePN~hM?nJi$I9%0;f zCBZ&?(tS21?3wk}&&i1{J!b8z{xw>-yDJ0LqLao!2~DZi_%yy7xl?8(9az&Xut_QU2_B1ExDknxnKKLnGwHV~ga@v*p^szb^PMne6%uiMU5( zb?C2Z@XB5Qf+pA*jl2P9(L|~mrqAAVcm=htmEhXKblLS-B0#c+Gk zfz-mW{8z(P`$@L~w5?NRj@pZMPOMx`Gd8qmGNKYChQ!l{*fRk86bf~6AwIVNyE6Ij zf8!l%F?6>dyU*8D_5Cu{o33OfvvT1_5z_>Z96*`^hJUYg8*|y$kV^trdS7+j^zr+z z_Fy^7{^~8!s${!-B9KJHU%Z0N;-eSa3ZqjYaP_1^S5j{9pBA2fc{xwY*}&1L_{pwj ztUdw!PHDMUPte<;^$%z8&{WsWjU*fns%c9MlD3P2@4p#d8?UM zj_3>`_A%#41&;-ceC(=L(1NNZg;W zNMqz>V86hlK0YDcLy7pke0xM?&~Q4EoD>j(JXjMg8Y7WT6{W5Afij;5wD=!3GxcyT){$)mp zbv)m4OCeu6H8&!fW`U@e)*!L6?oOtBTB<* z;39tgguwJ7JhKjBhW}$yLi7;=?G_QV)n;CLgY6t@nK` ziiLi}-&7dOVTN0}97H8k|K&4S2C0H$9pwU9POS#JTb06gE>Y_cy0hr>Ab&0Mz$`Qi26;=C;v>SvFVC*V`)Y-Trqhlo#zRbM@a_nRQce zcX>gQvh@hkr)Px+#SpdICha_3t|jayRxn2N*+s7DW6IryG93?;mNMD*UcaZ`XiZt% zbZ+10)h8B&3&#G=Gdj4VV!6EL;vx09&uy=WDk6gS9vVowET9C$In6KSzWzGIyqWW< zyI?&%VV*ITU&eKW{oKDF)qK^biYh5pA3K)A)Zbn+yIHGFn&kirl3}%5XXaB0`X~SD zQp{zflZXdVk=Bnf1TY^^1u%n7eW(#BD-nxvEk)r+gHzO zFP$jM0-lQsDD}7;DoehawI%8WdBXS7XARS9K5xQ>X1BG$@AO!y_s1K2BHQU$zB*pD z-r?MyuT>2qYV}{X(y_naZS%1`FWHQGZNOP-S$V$nU&5W`FL!%=TD-VwrgR-yImx1Z z4BYT}7Fwxf3riGiC%C-eFmxdLX}ud58D|2O547On;i{PaR{;753r21#z$1m}5oXIp z2ze3VUVhY%Q*j-6A3v7z&R(=r?94e;1Rk-!x7;W9QSVAJP*)xJ6}N46{{Dx`fxT$& z!Dl=R+!=Xgn~&Km;0Fsxbv(s;=V# z_G0W%5zWm4NV|~~S(nn1eypRpeqG_`iJw7jA4_xex+De@XMq*A_zfDFjK~5 z7LZZiS@?%}0QrUW&>aCLR>{B(f~aenQ(rb0|D}*YZO=7HVd$99sKz*>x4F-?g6Mxq zlCn@S)cQ0v6e2p@4Rd>@$ryFA`+TMb?aGMTyEIkWXl}V3j8?KuEd3Qt=I`Qq;w*81$z!gs;!+CD527B8RXX z$xWEEQgg8Gbd|fJukXt1il@A*TNG*3hTuTuFK=|CyX^;gZba)hrZe!?o573r|GL_S z!{iC22{pm@7DM?)vMa}y%|D)P_ngc$26DkwvLxiNG{7t$lZR>lf1L~P&)tSg9@+XT zEBShS?YXu%xKXmAMc~DIe{f9^Ra0syk@uoR;vMSNa<7 z^PJaSSOJ%{_}a;3F;0@E2xo>)8+ooKBK_14k&eHa(iihZOzwyeiP_>*sc-ebkv(`V zGd3TK8o$-Xic5Dcc2_rq#`5~Tt1U~_T1iEwk(oAxU&{S}OZ2EVO)h_+>2PsXL_G+x z@>x25yL`#%!aC-X0UVW{RVCYF63x`#sxF~~0bJ;nz|qBb${x>)kn@$C|A#sdlhoF+ zp7Pc|s3VVOO3RN$%3n#!d?MUgSGar)Cw%yYq5L(h&p?+v-W1bu>*PA99d7bAhfSb} zs*xwV81*{A7IkeMw0zZ<<{6!YgldG!If9kqp*`2pOq3%-w{R@4;+hu$q&y~3wP-cM z2?>hMdiQ*)v7NHQBP$x5@4;eXJBKcOwfTv(Qm^ z18FWY^{9H82I+AnGU<8mxrctCEqUsNxS9cd^*MBTyP>xog3st5R?Z?)FFC8E#y9zI zb|S5if^|bjVdPalU7D{r&11VFIbS#VE;eRZl6$IYQo&Xo-!nTQP-hp?xqgyLq0SZ~ zV7{ftPYy!4bzxvJ=#+LB(;Hru^$0NZ_v`0IoEQ<9!!9 z3Vk7pGEYgmk7c`3PB{51xEi5rPYD zZXonW@h+w1#(8C>^Sm#PUM>pQ79`8&V}n7&ytHOFa5x#}&v{3SofGlx(i)YTO#E+u zQO71FaiXUzAqN4mRnogbNqFJ9n>x=0;w#r1F%kkW6|kq;clemU4Z)(Racs?#GtB!R zY~PSd&sVCG`3S2NUGwS6sn~0fsi}%IgK9=VoSgp}n4Zo=q!X#PrqNKDL*23c9^D42 zymnVBCu9#@m#rWepPBhN`?|tgNM$9I01qJ|dG8{+moF-X@Ex}uTO->PT1m zcSx+Il>3Yj3kJ2#uKg8G?OJYg$uP;-d&L8%_&&$mx^N)l)a85<@5!YKNuefKvc|XC zMgmd&4gJ-Wrlzk&;V_HM^7$hxTnXF)3NUa9o;?|lEy?VhPV z_z`vz)pePEyKb5?#eLG~o1JrwwA2g~%YveVAS5^h;}R-7h*awkiI>6SZws*EmN3ko z;s&X)I3eWl@yYEGi28}P(Yh@?dpO6!Qst;1+I60)R$a zz`C7l>Z;h8p$)M^0mTNwnc3qMGk9hkGoLyU9pS>i52taAK>q+9)mgNe~k6WZqU%eSGq84F^kdlY{A;m=_Ni9Z2JmR z&4c^C$7aQK#*>$h+jpNgD3>z!_km6fQT-cgyf)@?!(ZP{G+lmq!oOOWHq`YMuT;%Y zC+IDB=lsc6DW3Wo>oR27?=o{*NBae}G_t0nJH>;P>MqJ#aUXamC6+7Bx-}gq)L*as ze(T>H7wP~B;jE51{Sf+BOnjUEERz^oehS4{gx#H(@y!&wTHhs%sE_?P?H<-)mUaKt zv}(9Kmc?JJtdMSQvPX(rC?tW6kWBT$rz~8B>`QHTA^5A{E%~&6 zY!CTDrLV(@-vPGSapQ9a0$J2t_ARKuot?hCqa=0nPr@G?ufv-082C-xi#pL!E6Lar z-vpl5Jj2yIXK5ljf`%^*$EeCF&8!!i0C9OMHM>HZAlrt0NIyBEIRKZ)z?|J-culEe z=1!T-Sw&9t5tiMV*3QN?KAAB6O~xrT=NNn6?z8wxf%O4-r_rT;i4vjB2+vOuupAzs zHDybGkX{FwH@6&d?AQ|Zjzn}LQ?t+0oX7dzcSU~hbQKOFh=YRxp+x=Lxd8uc6G(c+ zM*J3k_s*!GG00Cu#q4RNl9?=zdB6K_7h6bDzDjg(k|%<@j> zyS91aN1J_&0b>(S29=aZHd7+)T$!Tq4o1K1gIhjBg(5Z;>`w<fF&z!xlC}Q}8vxm-;PVSt>VTgEbtsQ5cD-~YpzSob{$5+N4SYkIqCor2-8>I> ztB)rBxq7`JMgif_O{HmNCDFtMCQbDDE{Ktg?A!8p&)jblE_w}?#^pt2skA4HrH3|F zZ;;Rg=&9c+!JPA_YU7vsQ1MGfTDl6H&OcG*71OtBL5s1j4FSfFdYZGZ$|ouT#cuF8 zyuX(kQ1;s-_{(?fHRtfkBMZc@Wmzmop+TSISJI$z)2L&_37FC7Vg}%gMfe2BFQ7ih zxCyi0l2Dpe*c)ug-t%MZ5g`QuI8_YdNfH$ z*=hxuvD%ekW-q#y?7*x5B@O=<{UtfPD4m{(7FbvI9HV1WW^s;UN4`(-myX!j=MyQ_ z8n#6vSgxJ1BN>d`NFvx=U2Xvmzdi{7373Bxv@C70FMIx0)O%mdeh&m%eio&}4gT|G zX=%yPB-}zQc)RKCY|wE!S$*p(LM=af8*VexO2c5RMrC=_qe%O?J;FFs@t^$L$KD1< zA!roPv>dCuuSMa|B18fDOB)}@pJS!$suPC|GOM<(s(5KTVq}Nj_yP)bOPOi&f(KGQ zh&#Ta{fJ?0_I*6`p&l%k=`>7e#R{U_{|y_{6hm*;Q$t;c7Fe1;n`~HI-}#OlFDuRZ z8w+PNDG!ZGa0NUQS5Z^;3yq_42i%5sTbw6SlS~|`+-{6&Eg<=t4pINcS`yN0t1orW zl;+#?L~#a2iA8(2S7tTczQ(xeBJl1hyB2n5&Zxenw8BK@FY~$ED7Yp--hAhyb{?U! z=3gT7L)XQtL@YV6a+uy!PMG{^`uW3p9hk(kj`4CG6T|y(mcd5sE*M(PLfK~xEC`y+l{iuY*C&7Um zyfDaoTVnL`GO3OmXK%QQdqOC)$?{0j(BwzEG`(b2vTXu>d~pi)O>M)rD=R$CzeF*)BY<`Vk} z8d3Ix=ih=fZjyI({fqVbI=@r z>P%a%3_7OCTLm0FVFz6bpfV18$fJI|sD&8sI)8U7;4gJMQ&y%y@KQg2#Ljerq32SK zEAKJ@mXA$G~TR?sARlT@lnDIR8eAl&=9 z4Fia?#4xL!~;%zGpu!Oz*@kA2q8U1%?hZY*voLkR6{RXnd)=!HKA_0?PFp5GnPGeDMs@ zYrre4xDqppP(}v-43|$n3~Knue9s62sb8BJJfXELEGNjg+08b8!O#!0LAB!QF1y0E zV~vTXASX$b{Si4LWnigRI|Gh%fCqg?(r1r&xQ$u_Ntm27A6O(T4DmXL)3#!t@}=5r z_d<&lrr=%s4O&#~<04-8KzBtjPyViCf1pm5LnS=C!I(&wM9g+2vsNT5y;g*nliz^4 zwR1E!fZPI>i$92&E;haw^>#UYDdl5-vO0-KVAp@aCl^Bu?6!Ir_)qY^LxSJ)mb~r@ zpvCJMqisM2*QJi>pE-Gav+hc9n}8+sAg23GC5{4}&>79YM-fjW`H`ENxKK0T`WC!s zP)B}whIwp%I6JY1cx}sWb^Eh%;BYP@Lp0U>ScO^F>ZL5pWy&q=NNnxp!NqJZdY95; zd6yYWk9b8a$V%yWh4LTL{cIPBm%fCpf?i!4Csqo0Gew<;1q8)j*1zf0Y*R7x5I9Q>wSweRio#IU zI2jp^J9ipeQ!=Bj*3VmweNWt7AN0ztib`7$;p$f#Z==QMvaW4STMVN6{ZtNo=xR*w zDBA9gRf~0iQZFHB1n7;;1BwK9uYpe6i(7qgRMD-c8TaL)POwxtcqudrryHzf1<8|V zm|#{D9?xcNvv^~GT3X@9k%CX`$lbREpxu9IkV*CGq-h0KqMaJ393nHh!Q z<075T89$I4)EE+PkrfTt{~lwnS+VQnEVauPa*7Jl^eJs|jt_G5Ic4xAUP^@kFY-qM zO6qoNTcyfGN`~;KqgtIoP(U?|pYN(h&Q2*lF#9Hf-H9ypUF#rHkEB^iC*)>n+?%8e*-$K#`$qQp2MU<_-prKdW;`}nPqM(uu_ePvk97Z z#zdTvW%YAK8D%QVS^0QaA^@|rKKOm;4U@X($+#)KZ7T0xU9o=48rg+;aZ&{wT`mT3 z-COjUafTsi8<=US)6p^BMzg7mm>mTNP8Uizb=#7kkV!J+DB7#dtjJA>-i;mu-ZdF} zo!MTOO?c97eVwBQvTBdOeBa3H7x>yVl*;TXpG&&@9bFW)86c~}H{x9wGT!8kj6RK( z$IFp34L46b`AM%#02nJIzSkC=VH}MRr)e;JM;F~aB%?Re>_D;ONAWD--xm+9hp4Vp5hD=Q2ahR|8LU8{mrv7sKa?49u*#8a2>E)~uWg zmHUaL9CMIuadWz5=NquBN>W}#N>EbqurNr62owK;a)h*Gsr-aZ%51cIe=6x={}^ka z)F``n7$s9er{{f3O8!?#EtwukD)B-R1Ifg_k$RJ=4-&aD)|Z|LC8_`Q=F_ZFti*t> zGOIjinwSoV(6c2-X$RC>0r?iCz z4Z8h)yL?4Aytk_rYhFQZldPY15`Y)g<3NWs*Mr>xgJ=pqw-53G-PT&h;d{%b%>7R8 zmfVgA2BwmrsQ**z|A=)B$9N+C)0y&@9b>! zzA0fSiv6e}CvhKC&70hZr9#fcY=)sWU2c7C+S^I%Ze3b-p!o#v`IM_G#>)5w(YP&W zs3hnPG_y2CPplo&zL|?7+x{lnv0bmSJk;)Vnp*1hLI5}{Dsf5BYY38YcoHFe^)GwI za)F2Y>0v1)@EXr++fGLA%k%^Srw{b}P>13Ot)CAn1V1s`FF|| zr^aY^Bqe(Sshn%rhyA#z&%LOwWq#t7$t_+Vqf7auj{VM#Bo8H~U4Ah4%kzvIcziP4 zJ?GI6vDu@Ec%BG5)(1@Cn?lY=SSsQECN8Yi;?~qZsUEBlIU69pGqWBbuAUnpo-j`= z?hZl?19$8wB9cnzPX)bCLW^5obcJ-AAY_& ze-{3RJ;M^_SorHmS#aTDbQFS7FZiAdGU%8jzvlwVwP3#L((CPUDCP~E(U|gX?j~Ou zvmVI#tm~d`TR}xVayBQ<#LG46;Vguu-S7(1Y^?ZgZKu4n1-!X>m%hffV83e{MpoXz zr^Fo}Vi$F)b7S@MAWo$|58h?mhwmF^q+ww9c_sVP;bpg8g#NF)gio1XCm{^3&|@M8 z4@@)wD(qI~F$4eb(S)l%8B+M6IY#QG|KCf^4$M49pIocmCkU3k$&1s8pS}vJW5zAS zbF!w$F036Webs)CVtV!^npEJvFO9mhZbuux0#_qzZ?r6OcS(V^yNEv*e9s0^laRx* z#h*83y#xn;OMPX2Hb{T*l@)RaK9k0q*}e4FA}SNvLmO`Tdoo4t1(KjZ!_DlHcXKlj z9LS_p`8O2jR3AA7m~!R(4|3i=?3gp2k~YwL^_XWuAgOQ@45Ccm>_4XW8x2w3CF{ky zdDbj#Bk}LY3-`M3j8{*zqxCXUljf|`HMpQIsZDhZ=ryw$U9JNPT=-uiH55uDg(w_Ow-2(TArjw40cm( zG4prW|LKt&#V-nztjgI`X1~pYrTn@qf~)e)gBd6-%w?LfBsAt?<@Noia`~)Di=8n? zfw5V%N5b}>b~fAof!GBtQfDiO1}l&+PXxwZAz$l7eKL$T9o&McJgg0D7nUiND`>#* z-`9)gOTI^vwau;Y^6e<3V9$w25lJMFN^am|E7;WN-`omew} z>y5+F6!)|15@s%02|MSD=>KFfAd%G}R)8%!C-WsYU3QC}x&UFXa@aA1%1J~*_V1v9Ne)E<{PckIvDvI{l%8u4IZMZJVJ6Fc*-W=mjysKQ+d6r}H zp%YJJ2VHRP7M4Dkkj&*Q>4Ry)(<5!^WjXM{4h)_@DZzBSXC)tG{Ay(jG^NB;BtZot zm&wM}6?N~f85r}n)|hH$f@8XVSfBpIs~ z9AcHsggB>Z0IX+yuvZNec@91%y#C5?^5^$CcuLzg{Wt}MrV=@_5XTxzKpg9vjka<_ zN-`BL#4Uw2j-tVYWIA%5mn<4X%pl(5*pmw9cZe@NFJ_*K@gESf6)nUjS$~H^fWTqy zn2KS-2}+2qAr~(TXv42=@Vv~WoAU&~E$p4JwSW{2LMXbYmAwFmI1tdZFtT*)6p zRVTY`RuY%S=ncP;1~``H=X*NRe!b8ZgDVJZh1UwK(*oT;Z{Xqj>c2Dr{MN1hobp~a#DHj?GM02pv@Z<2%OX_u2-ZDU+$uz`8i%o)~?Xy*wjwi7ahB|0$9%&f}r z5arxVrW^z*{Szq729m^_c4=ALg7F26PK0_4^zU>Mw-tLX2C8{uxVy$j3^`cDVgHto zNm(9hak6&PNCZd&yrLlI(40dP^2KK;9sf-62H<_q@^LqMntH>5!<8DCg#p@JG5J|f zr|0>-lJtsQH=Z!%WuF8Hn4{<=pR&U{csuHFUB~GE@q`T=lfN;`E@uO>S?+*o#&eYp zR!5Jy6x@G!OH%xTch0KJ1i{;#iK7&piR3v_{pcV(Y3amcTIV!!yak7CSf5+sx3$9z z^3$m6$DqX$;6_WmsAhFpv+-*(*OW4wC1MfvoRy*=VxUZd!hC1Xbxg#nbCBLyr)67d zZoY5#fkElY4D(u0Z$C6e?gOgofGhR$@X_R4&r`U&r4JmWPJfg15j(u$;m;FA&KIJ( z%b>Y6bW5!D^`bk1I;@#T#M~X*{I;8aGBRi;rX=_tc=}%^lE?yyeYxARqP~MP=n{eU z4=;JwRl8cGrRasiPSf$n>!yV94sp}Xv@>!yRxf97+|+a>YdIqeTrU{xI&y3^)eK$2 zO@2y6vbwer8-d2!7gBhYCgf2e3kNt1Bl8aYwBKA#|kP`x`Np!iO;2#WxWcXb;rQ%Wxzmoq9 zQ04NyqtJ@=!;F>1DK0t4hZjauImeq#4n39wSzcD|4ZGRVayO9H#(oidzX`&MIbPfZ zU)V#Y2X~krkTn6DkiZE5(9=Ari=kjW?RnSEJ!^$mXd0zON65p!)+9>^*?qpM+9R-7 zT7#CGrf*hJ^FrZ#eXg=u_860YWXdvmOs9Y;5QXEE91wG+9L&3zh)9JBRN3S{pLyuW zdhQrMUU+@VqJRC3N_d~Oce4hK^Lhwy0cpR0A^8{icgca)LKq zoPB_7CpWV#4gO>#E(=vWK_*-|%YolT9kOkEN)C18XZYlty$Jl3y07~m3ZA1X!OxKK z)1x!QLwtluA+KMYt_~Tk%~s_qw8C~+)aye%AFa*2W1Qi*Ldya=l*n%yZ|rZkV_K>KL36rUd$2mb z$afD{oEi=Uq1{E>%^g1L!%YJI&*l%1Pn>}N_aV`1K)6&#aAk^*AZOYQ;^%Z!Zy~zj zj_i?1c?1{8rKsp^u|%{*C-*3zM$kKMHTc4mV{c^+loG-DVMtTYOrFH$rNl=UOC$cFR)Qp z(iwByVGy0WIECTV;nkr!eN#6C|3N?WJBOi{M(^M zZmahK9N%y1lZV{=^p>6X^msr394aqC+?Ve*Qn)2Rf%G>i3$Jf$3^-+KDxoiE2TAW6 zp#ZMlx4=|u%b#OOb)_xSCbB}zPzI#JU2(r~OxGe>cwCbA3mL+N84c?e$D-UmT&O3{ z=S(Al|A)#+i99B#ElU%)-vt=@rqkCr21&H+@{j`Evt z>C{wqUr;Yn?;HD6E327`JTH*wQy)F)@00#}rai`)aZA$Qf(A*slY>&S7JHa&GBEQz zeEu1TmiO!VlJ({}z7A-PFUUc#^)(#oCI04|$fjIBlelS5-hibuX`K%>cb0qg11mX~ z7(tsNL2ax$4Xj>tBJxUFhnHh4U!i4#C+ag8Ov2|;8t%joHc8NIJRM0g#dx=|v*2V* z@*NqK_{ru_GVs|9m>DFgsi?ke#vqGP1#p3*;Ml3~pn?_;3%H=WA)YcS@T;et4pC#L zA3hv^xiNzdc04?`cuE@VKa<6kZ>^MRe7R06ltn$#`c(4g?;^qa`c(5Tr#^--iFBbdWzmHF5?uE=EYlcjPlG*i(9KC2Z01wh4jSLGV9 z{I5T;6b|*$KFp4j$XuGg%nJgh{P$`6W<*~>9a;m=rZ)ca8`m7X4{VPt#Shj8f7c?=pSTe2v;5{(9c zi}^omV!uwe!{BRfO^v{1pk5ZQz&I~ph2Co!vB&6!gx>o@!Tz|{Q3z#pKsDX_(sMu5 zU4aKze2)aXma}5}YSms)|=z(q)B>L{6EVZQ#NUTSt&a^9PeRKj!6?+MSvNo~~u`0A%lKEB&>$ z_JIoC`x)HMKs=z{G#4#Tlsvi(t|8xO(FlsQiz*V!sxmt_|$B$1<@NeD2@ zO>-(h;39hTf*lH*Kd*m85fM_7^pOym2;R_r)!n|Ss?`&y`unj2tb~Rwuer_H(r3hL zZ|61vyNv-93(2-xX~7Mg&N*lk{a8hMI&!1#Z`!eDDa)#k|pvlUT zMr=qua}MF@SrR%b#^eO$beFlYh~L3(#c@!;Rkgu6(0TMTke4lhP({ z&x=fNXBH|i-5Vz#7@~naWzts8q(Aqh|Ctsw$q*m zay3bcDJE!<8(R2PJ|ADEta*M83YJfiP5oMhQebcp*MJ##D*wRm9(R!tRdNMvX9ba~ zq$`dss-2+N3vjbmI$hlCjey-Qhmt)Ycg3OW!yp}6T||jRlKjb!8ng+}CL~9FR}KYo zMZ^^Re&h(4JO~EYoubHKhtA2@RP?XJ`;ns%&GeC1x<8&dSfFvNPi;|0+TYB)d7}6Q zJH7ZsZ|$>&;J}c*9jVwU8W)8%itz#CZaVI^Wzd3dKzJDl;ws4ff)aNyH_JT`K9k^% zZFypY3-Qtg_L0&=W0Cruaq0S*)FX^*E=(=x*{s>b*ssx3?R@{^l8Yb3<&YpQaX-}B zApmiSdnm~N6g~IN5aC9IF@(OUYxFiib5-^9#3tr&x92dAH}oqNf=pfeA^Y%+Y2d)HY!q@rj)NN z@YC`GM6kOs@&isw9l1GusSmhHJFT>;`jAPt9t+k~AM-p=biXIc`7p{tI|pV)HDfN1 zZgGT}jQJrUkza~NELRRfgoJ1ScZxuFRGBeyagqLSmF2VGPwh33ZdK|&P}$BT$6Rp@ z1;$?zV<-*;yvvQR5tO?_L+`o6W4+(ePzC$sJonzNEs7S_r1mJQQCw9yT)wszV9J{P z+f0#K3j(~M(x6w%Aq1D_gty}OFU{`RrcW=(N|?^zCA_0vTEHE;=-vD2>z4=$_^eN$ zU6t4{4XSNcGSNl1GiZeWi!dRDZ3o7avOQh-HA=-L8ml%=xL{^{>MR}MY0EP~KRZt2HFSXeDpi%n%1-?O&vqfNkJiLSIM z0j->8SD2cv?A!P|Y*R+MQ^I0yfLewAJ-omtO}b#x8Xo`m@B^*n;-KM8=#D&m zfR2V0F2?=mB3cF89G16FM7BPk9B~sK!MKyzCF1&3ALimT$4Bygp~a4YcP2u*nY#m9 zZ3H2ud=_{1i*L%q(XCbpK26s~gOPLk+dPX?Kj-01Ap{Ar(U-2NR$&y!o(JPBkLt+n zTR5a-f4=4YL1dznePVk3YHwiuvX6{;0+Xi%rOjaX)5%R`xoeEyUHf<|eJ#$a(dsp1 z*Q@CEmxpCb;l@f201z0Urs%<~&D%aT$sO8sB?EjdM}uOOXkwS4v3W8e1gd(9R%SPP zJ3CnMTi=Nmz25UyC4C=`mQom1vb{ULxo(^`EonWPx~*LoPJ8Q!KYdcRs+(`A53E!B zc`apGN)(ppYNP6?KJ&zPq{Dc;t%AvVF><`mJ)Es4a-&_u4kRJ~?R*KwX}+ASXLj5# zpXliov#A=831>~#ind+(WU+8t@p(>rnnqM9-#M1yIT<=THnlM-7MbsG8*`|3=w8L& z_|$ExT)OIaQ-q#0DXxYfy*+9-Z9tFxB4Qq$Q{tB600PZEX)^?V&~XhZ*~3w7VdeJF z*?DlhK?oi11)g2Dv|>9GF+GXyKguCn0)f-kpPv{%TIsgPE|0~=a-H2+no(T*x^#P4 zUM%zC!9&AA`_;et@oGzBXln>5c|VYCn@3LL6i2R^<-M+gC872>oZBuSIXqzS8TD^4y$-3^DtX1^~z&K&~x`ez&i z-XApw#SD5J1LXgILX+Nh2mrAIjKUfvI>zP=**+z2H@!Irk9t}&E{yrYDtF1SzX@?6 z`i1D~NmE7bhPvEk-h^X0A5MuPu>Y-%&Y%B&YD8 z^|Tg}d7JLj(f4EhE=%WTg<9k72Vu5Y{`eMV(Al;=A@O^r3v`BXYi^)1=*W__YE#Pk z#WM-!|CJDd>jS$ei)!OUx$QDL>^-y-wn;n4v8Ho#V?c(+tT7hxg#g(cdR`P+n^clh zeSSw7nH%1ai$MV=xX}%FPUUbI2aMC<5>7ME-wDn1wM@~`iidTOQqeK{eIU_gazPYE zFIzmJR8OBNP#!6FyoJs2U1n;4(0}51w0Rc)skDR>gqjs0xBiyhZ}s?B<>EFiH9q$U zPm(_^5GKZ0X1#wxQYe+@qrbLlnFvUvy6A1^G3X?q9J6fOeP#~1`SEzF8?1s?)5f?f zkJQMlbTnIJzDZXKlr^7z}KkB|%6_w+U!81yLjQ$(B=^OH-t@zzvy8 zM9Qy9JRyE&tbS6X;Qf^akqM;P;0yixePe|o9`@jtQt~hI_@s3&D@_D8l*~N)FhSTH z^?f-BXj~+9_MGguDvmZ(wiv?^7h!RWzqfWi@u89<+RjZhYo>Uyg;`RS3oDkA0@awi z>s2VamN>1MM>k5Cm3xELO&qQemohvQHo?MN{X~tcY5Z52-GIzg<(_X`b6l**Enp>Xz=y|ok$y+635UvLt8iZ|NYp2?yOLa%~LM6pr7{CoMz_aFSebDmV=lmDR z>;CrcvbQSN>7Y4%hYnPG*0Pg`!f^j-^TjjXhDskc@kZpqD`b~01wvOR0rFeEg$laj z1>y)dq3hCV!rTD@OXHNJj>BiK;Lpwh$7jr!XfikVY-P&T%7GB;&*Hp9>6jBGjdmIyL@@xS z+@G@X#mSjCcU(<{21XS|wpK!MXSdC+=g09wO$Gj&hIf?HfUy9l+PE(W+1sB-j)9UZ zC8?D|uLwv$`AdW(*(jj)xnY4t|#Kq-N3p&BV%N zkQ3!)AyUXus5HRT^RG?7-(`>!55w|ki$x>Ot~Dt^9K04Lf!?=EQCv%|vkCu^?sf6H zt>mi$H+R$Fk9lj<{>YPXpcd~>Cl%&T+Y&m;@9YdR(`SSJM1Lr*+>u4joA8)YXiF8C z&s8J$rjkaA+n1JJcWi_tis3P1!bwGJ=sI8b#%+_z{fh-Q;Qj`e8wB2eN~dRJ8+{?Y zjItWUWwlHx0b(^*6cSePpSW72agT@)OwmBt0p$x*u*PP`kJc9dCt7h zPyxzl2zEu*e>!?n>9Exvwq8Wrw2oMO@NBBRHS->*^|*2l7)KWw=)eq`i&AScppEv< z7 zc8TN!r#5NXg%X{8LVZVI7-=);s+ZBkDiOfv3OOI;X7swUy_iMye-#CAc;83+w#aer zL~dlcZ<05qOTzn%aTu&1;&Sq(I_Ji@?p5ifOX>2F`+b)n<+3ZVWe$&{;S=b5TV$}w zonZrtrzrre?70?ePHOa7aIo%E3GIi+Y`KX+kw0}g(J$K5L8tTp+mcA@Gq$#E>2~|8 z)x%xs8_IP8(u`92M&Qtwb#Bf|I0Ec(hqQtoWD&9lRt%&}*`WW(7D+Ms=JL%q!n(+^oIPj#-~^_5yXi z4{c@^7opDe$6ehutjqW5lZVn6`x*yTZr&NK`0WFE71UTnl;W7Prf$cy%xGkE%(n~t z3WS&iH_cU$V^y&PTfxckpkk~x3ViySCwU96kUp$dr(|E$)BMX;*#iYCoN6*W@ebcAuO@J8CZhSk#- z`IHt({LcFoY_MUt-3I=L7Bsh+*3!#N+JDmmc1p8Y%}2DoRNf2SUA&=tS8%p3TtPYMolcuEtG7+b>K%C;1o6&t&n5K6L)*; zd!;`vJ7VlD3XT|Xze`z?s+X|+h=G+k9{dlpbIn$4`=yIkzcDMin?Uf6Db+o!`b`Cy z&}o{OSxKR2a70Ei_^QVexDe8zrJz{!*!!-E%Z6-nmGG9jmdzsEa@IGKP zAYQXPu^Xc*3_UEZ9{StQ7!rizB4DsVDFTS5EAg7^P$B{?1^zj7f#|>!s;yz0 zj?JKodTl%Q$=g6e^7OPBxm!6e83hU3n>isf1d{f$PCcgbE8;P9(4@A)0lj zDi6_ku?OxXtm||{1NscD`g^907f|o47{6o^8PnaqeBIS} z&!w9#f~*+u1K3~pMgDi2@lThr6h8@iTbK1+@D*DuO$iTX7!AB<=_|XtPdpiXuT6sv z+}EW?Nzlul?>58*!ZW?Lt)2@o^kN=tapYWbme@o>W9uAG#zIEd`&9BWc zotsP?p2qDE+cZ_(NZ$f3;eyD@Nc-WSaORcNm_&%<`fvVL1p*i2QQF!Mz%%p_S3ou7 z;4aBKFGA)?Waw~*dBfNtf_15kkJn?YraIaWQUBt4h-0_SQ)QPM6a{|rOO9az3@cKB zJp3P|*fuZ>Mr;;INbKz>?_2B9ovue3Et>jR)h26Yyp`AL&yj`78} ztXY3gS`8TypzE|$!Xi4Z5M?t|W_v3*Qwp7*_#dV;^0$56+@f(#k}nC7r7}d;uOknZ z&_4@~n8c4>luaM!8FWm?#7*9yasIzRI0%#;D4AU?E1jhV>HfeUp-M(V3vot5r+fCA zAC1lULM{p*;;^2E^pm1A={Xw0=jHiCfl=2@)U&fxU)E0yV0#mhoW6O{cVdUGwHPil z8X;Ydi5r0r_lq7VONBHW)WQ+`p+*O2O8qxGUukVY>-^1ro{Vt_O7V}(dlcqlTMOap zdttb)?kBs1Ob*@9qyOm)c(n)&x;8Z|I;AyA2WSf1!e;+!K#M;YkY5rpKEhRGqnp-# zffkXlI~8Csj;{Mohsb~Zupn=ydRslePHSO1#&!N@K`?w@@19}*o}ciGY@nK52a|ga zWIK~aRm7j-$(^Fh9XbiKEiixKGLJaaE1J^=&T|FybS95Y-PkoV<2e3&CP}-$RG7kl zc-O@R0;pZ8Xs8Q8btabNtkflfzT6dpvroKQahg^D`2_m11JD&k)L#W2Jo)Cp#d9HC z`Jw^eLx7sSiF!Bqm$x>OG%F1K;-2hJh(B$h*-WA>UZVMf)<7|KSz-QB(TV3NnG~D_ z>TN;%8saO%hqq3m#XWotocV*?KTV21`kNP+E;ip$DwcG0OLj6{D_T!v%gFqlVmw4G zY;fgkbOHWb+R1wCE&sbk7oT}q4-2`|s3K7WUaeCd&0>1EIUnFnjeOpMBm-5GX6mx? z+fTwZ+i)F{fUrp+09J8+pJX|wmFzv(Af~#)xlh~^i=Z}=EJoa1qZz2*3uH;4Bu%HZ zqqZVqqMHA~f$*bGzvgsl>>6@{bnu-9aXZHyZ(31`c~XF$)}UBwS3xz^-x@O~)Lv2j zu2fNd1WyzrDS7?dUN6h1Ju$>-DE&7+40(-{OZ5!B^(6vZrf_0M!bGmj%Me)bpiV*- z6sr;GencUc0LfsKrw_m(7)&#r9>K3*I5mo=1RrRnv1@Wqf46vPxXG(@>lBs~Q**lIg{9CYDPrD2frZR)c@? zVcN3=8(Yl~+1R8o(5KELUZC-P5tMB$BGzy4Qz{A_F9^WX8)XOb86_u1H22o^nYbiF zk2z-eUh>!_XE{t__@F)w5vCI|2#fwl{Z#tth;wbFhzVC>3Oy8iP5BQWDdYznh_isI z{Q*aDWX*ndcfuXp!>z^Vu#X+s+9iEkktfOWU#n@1ZMpXzSq+0#w;51?v)u3vEF=M_ z51ut0Nd%Z;Sk9V!aCIzmy#*z+{fN^8M&>ksvS+dCW67;lCO%mTpTfa zfVcjal<}UGTi(s9KBTdSZbF7(pvZqVni-~(&$N}2$6bj{5B#;!I-&(lm`6|oUq#PW z93jIND1~x&wJ7jOfU~f8Bt)_%kf9YiOj^oIX8x&lH!go=c)!FxIdKfd5Q{v%t0Bdx z7nVc6mJQ=CYd}YZmCKj z@$i;=An0{r9CBcTcwrfU*6rkgd?__piwLK0ue@I2g0Chbo zk3CwpYZe;yi#Hb|xZzDZF&<@6J=d&EDs9d{-~3}&q5%oUjxtF`YFkWxZG+$7y6#QJ z`y>KKR{9R`wDo3qZtb};kl;KG5?3hP@Ka;z=Rb7cYa9KLpgb5$U6@Gi?u3QKi5GFU z?6>yRaxwMLf4K+tZiUm8XfTMM;jf^;zBg)Z8$+i^K?&cvR<5`$*Kpm36Wgy}9YPgS z$RH+JZfyy$`{Mn}MT7?J#- z!9weUkXK?TVHzlN7}#p2I_{ek9a#M}1Xm=UTgYjnxlsr#m|^*Fu|G|gXIdbxxK<1f zl(@F6eK-V{VR6FkC}-2b{UE9rN=7`di8*ruQ}=4GL6Sm!EcAiVZ#xO)*PcHZn6I zUD7=-=JDI!ywUZ{XBpPli2}UMvp5>KBBO?oC!rGoM0WL&8+NZVcZw4Wq(#`qj};jE zG;P7N8KlKX>;VI9J#cp0M#@KLvYSIjOf*ZNP4(0;G7enUp5bCNL9v@_jrbsqK3^wN zvd-Es8fPJ6(HLj23JB>y4ECrEBjs6^L78_e^-if`91euItRAXNG`o>Ku~MmeapQ8^ zL!2mEn0BbA{67ix_&u=J9jk(#V$KaZfcS(o;ops(?dD)H;kd^hVhTHjOP9$mp=#G! z1;I=U6nS}}A>!Oi{@{cLPCGr%C8iMy&bM6K8W}4}d|CP9XK>keip7mXx zbagSZL1L1Fv4*JMP?&#``AK1w2*)NC>$v?41Ur33AzEv?xEpA>E7J)Xq z7e?w=dhYwY#QW6+C156!BPr%f$$&h{z)tN?Q^_{kmU4^L8+|HMoiNR~G(Co~vvEb( zA)9Kh<aYo$9{xGya3C^JV~rTe&BEW&^#;k*QHk)W>?`=*H6zs0<;Bb){;W-jgK zxX#C`CPR@k7^JZ8npap1MlF=fNS;!soLrSpL9kg#UQgAD|+Ka z{rAgJHAaq@Dtk&Zjd?;>)P0$C6lU<*>Fs8In13)3^dg*L^-(RP-Hn990v7LK2tkif zFx7o0!%L0eTSudv(wR=x-0W~uf?znvU1VGv6_menVJyX2V+=V`J?UVlt?5;-=p982 z=69F7zla9ZX->bcsL%9m+7fUFe`n+i zOOV*orS9V>`#+BYGYY3K_@n1O@Y9whT)Cv*toCLdjk&xV#EN`wZ87y80gpwEuz1xS z*nT=jLiAWnKmqEy13TT%36EwoloQlgpIzu{AdpS^2pw$eb+Q>>j<~pQY#jMHNNVnY z`K9HlRcx8^1i!LFcp0A4bS;(2&KtZ!yBgOkzK}ub7Qs^kop46D6?{~R7`(pk@2V-C ziN97J|FmVdhBV+=#ErYd3Ls6Vmf|H*_QH|d8_w-$sVOWG2)s5jOb6g$@GR0Xj;i1D zZS$0>D+gDTd{8aN7R`k90lh_%hJmxqqwx<30#1Z-Y(A=)bi0udq@~Q{sA$Mk#H6Wr zKwmR>#nuM(=@^l3uDkDvwxYsnGYP!F^rMEitl#uJ=Mkh~Vjv@4wNO#YqE4YPYnDbw z%eV|mT~XzPB+b1W)-vHCK6A(VHS(-WK!niH9Qu3lQc!N{kM&vFTXoEQXB=&ixqC65h?J~FC^l>8ewr8*m2q6D?~;)! zGKWImzqH>r-Q8APqq56RbuG|dZ5CiDN+eZQRSNX?{AbAU~JV)7Eo+p za9!w_ey+GDJhBEhBu2G*K*1y}oFOH>C1ZBwQ}0|^f=<=l?-#s+t&EnH&1lEces(J5 ztBE^KXh6{5%01$(mbkO?uiLd){BeW5Ox%r;_pRy$ibiHHGxy~;4vR(V`9yIPunc~E zZ?w6TyU?kgi`+DIk(NKqkLu&-W~GFyl%P?}3=I<%P70fL#)ZK(wJ~Z30JV_iMgOqABD)$(OSkRMem^ip`_au$#>fSt7d*d9KW#%XgGU z@StUt9U;;`pB(Sbm}(w|M4pnhWRio;Qx< zmxApJ)GwLB_P?H=60hfj_BI$tuFw!92#V!D+<%MnBCD3P0irw8XEhv4J!`q@F>H{T zHPmUGCiTcA7X!Z>?x?}j*0OvdMHWfE_t6+Qt4I1ITlPN)@YxT)BJL*ymPAwNA zh)Ts?BW+n>*bvYfjHU#ZGSsb?0jVay1~jM$ouH8Mj$uWBp#Yd@%h9z(w~F7CpRMy1 z1#qn@5D-!vXhM$Ahx>h}mm54N4)^O@8&OC$DQ;C>Apb_eEf?Py5!$FoDg5APMl z##qP_lg#1ATwva#on8)|6KOSItzu|80gi2>Xvi6ABpD3nn-CpLJsh0CjMhBva@*t3 zbUds42MoyU4<=1?1lQo;=J;5Td-c|czBhcfVmrA3iy4~tgH!}NgTO8Wn_!nYst!@D!zs% zp5SVU8~H>~O3S4x7d;(cdTkM2K1CW?><={y2ARDWswu!v@XNxz)=+bjzsDrgM~f%h zl#e2h^wx#ao+Gs~2BmbrLo%3!c;?wkTd|r*3sWg49S9 z4o9Z4PR^d1+9J6$X7S(G71=iAuht5_yx=MGbG(+61#DP^Ws^_T7824XnvkYQ*NAcd z&MYM8Md|>Kel8NKpM|oD{n-u(;n^;dFu(?-9%8={>QcKfyzh2ltpBAzvS+SngA5+p z{?se6O`N&(F2-EWAiaH^RU}oB<>+GvXL*1PO|ybwb9nq2l%Ak{0IUvtj!KIpcoLXN zx!cGU;1mK;SG-Mw;MeAI5&`4)QvQr)-yh+AlM_i^#4&Elhaz}jM8&(n_Qg|@6e=t8 zq4^F~-b3wG{?$?;Vz_;WIFv_`Y_^oq$lstX%tf8pm9=AV6|!$}HZSxQB*DfOq{c=r zP&d(l4^meqz-C9-)VBEtOe!bBByM+A2KL=Zp`6j?6=g?+poz9tyr8d**g?%B(m5af z%Vsf8QAqvqURG%`mGNkuZ z^Zw*FD!=_38M`G%p{dNWX5_r);$6*f9BGDj#l#2qVRRriR(g?2e2e9GN{-Y2fu>}- zxF-mjw;*WBZ!s+~&!r26zB2<(DlZ?8KSB>R5c_YeV*=4J@v2!MrjtgdI!r*nYhkN7 zrSxkncF={981iAT;n`13jj)PME5Tc5Y1E{RNj>KtbjWjF>06`c>jI%6!nq-D^T^e9 z+d5ZC%eU-CorWS>u(F0T`=&IbjpAuua1ls&2=uazeCsR0EP?F>E_4 zjZ6=Q1l+KqgxfBqkGAfyKQUy%*u|HRSHiy;4N{Pw@} z*T%2v`9D>ZHY(~(p8BrJfvduJMQm{${GaLpN@;)7a8AZ1=$`~AGICYs2t8Pc>aKMD zOp2WGv67|b#Um-DB)f!59H;O9W1Z0D$BtjMU}4{H4Jv44gs8rF zk%0MO_zbh#K@d}7`23a5zFkVsnsM)l;n*sTSD3zZ4y%X~)*+VSKuaW2sFX_Lw17jH zZvX#I2B?t%_4OAIo6TdnmG%f8I4Y=i2NPrkfNhPHaohV@JUN}QKS33GrMS`pe-=7c z8&5G(49n$T6X?2poE>iK4)NehkqrNnEs&j$7e38a41bypp%hQHy)Q#lH>dN55az^u zFF6AG{U3Q190%kZ%>BlHLw`8hx7V66-E9Q*P;z{5n-VN!k#4Rl&j^o1mR&pQLe~g) z1;Bh@-M!wC_!8qXA7a_73KfF;bQaLB{y=5rC2}3W);|*QEv| zjBe`t&J;rAie1A6|FoIdoBPg>UmC*&@$44AvPO{;YOX$M`2q3Z;nV<90Sb}gwZ`m( z>D}~mC{1z<4TkN?!^ent7@z0YnKf#(&ra zqJ^c4UrJ{sY)OE4X-7M150^@)nJbc1WcyswM}QBbZk`ynDM5!riGYX2EBT;{_kPkN zYpFNT#5!rjwVDNxd5ZgTIfbP(=1BeODf zxq*)k3kW{1tV~wit~l>Q6BOL3QLc=fy3hAeuNsX(4KLRjjS)xSM*;NUab<_uf>Qby z&hOm_yIH(d{i#9CAA#H!3DU~oexdj-FjvS8V`-(*7XPkYq1S7d&EO7ZbSOLo^E#Yc zRl;akTC4B+6Qto4YOM6iO3M=DpDLCV%O5Hiso>=xHSu-JcK}4}uwaB*nF7ClG~20k zbusLsvh)LSi+3#fz{%opi~p*Uhz-P9Ow;T_D9AaBAlyJ@I{)la-)zYN(9c+vD2wa{ zqow=(s~zCPCJeI+Cr1Pd+7&(uvGC)GG34cbn=}f|hMk@`Teq3rtXN765`apZ6z$AD+L7-cCr3VAb7URXIq*^2&Nc&5vv|)K$$*OEaxv+%^gWa;U@7Wjb`nH6$~GE-2c zs-lky)KL0mBdcQvrYDfnzT<}ztlooxNY4%ZuWW*Yo5(XOoRpjk#)Z8C>^*q zuKSjUx2j3vCGQ+oeEZqhrF5}|=?T)-%G~`X{)RKMliytso~vX9;-b z3kwdJJ}cpjOdp&oTj=z+yCLtZ#8oj24GmSm{O%hQLtZi#v{e~IPJpRTmx%hTs7?VB zr5z4H%3c!iPs31gME^+Pqb-QLU_(Rr%8&^S9f*RCFho~pLzSI*)>~N8zN+65T=Wj2 zPR4m^2eIw-ZiDV8@F(DLo872un_Q;!-Mw!XXf-^4D=1hV+39-9d0zlks<{TXIj595 z{u5uge`zppU%ZOD=47n}c5n&zoLra^%Rjdu-=FY=ncS9R%JeMPgUdNzri05pWW(^x zy~g3Ee!sxd1{U37%cvLu5Yr#V^y{^JWQU9K?%6>C_H}w4B9H z?McxRB`R%>i0mGSZR`RlrTc)N$csj6fImIAuS7pueOq=9npBGoN z?X#NifEQtkt5x1~1qf@r+1(f|RG1Uh;1`;~@m9d*L0Aq>Zm=zvUIp8_GUtzuN@X8J z;+UMM8Mczj%nwI#=4pQ-=tzFhJPj9gh#79lB$lFmr1tAL6SxL=K>V&kYz+%TbJkop zU6|wD@2^073H<-XZ1AId{rHK7d0KqajBv)$2(GaA8C+*Ozac4#Y$l^9$0fY9<)jg9l;*9I_Mnk8Tzba+Icj3sggVfT;-wCo|bl z3Nyd-7R^}l*B;Hvx6yCIpR%gyKBMc#^Lz%9Hsv$-4yXL1?ty#vov{;*;S`W1hUsR{ zHacg7O&JcGWo}N^hkANHLS27dH$U_eY-Nr2x1&X`5m`V(rtsZeAgOWtR8YD0d~Mv7 zLxpAW+TGJL<#7CV1lPJYNqJ2Q!=Nsr=YbgCr)d=!Q~0 ziyi=K-MwJI-QpJOt|+N(i(omX?@z#e;Elg|5iWoMmP$lAWpsoST3+0W zk0W35TEzM4H9q{}V!md57&+9|~C+>$DK1oliC5QQ9 zM(d}o^%z%qAC#RZCFN-x;U_u9cH{HA==rzcnVA&DWmoJvQKnJ7VsA6;hmUw2;LdSUjkIo8*jjK=e6@;J?f`j z@F09G0eYWrA=igId3IX9LVq`SeC7e8rQ>0X0>uF5vJu#lCL@Apa z_1jicTRX9Et591t{DSW?4>K@vt+07f*RJNB@}_?Jc1zUs^xgfHc2Mo|eCKYw5YrHJ z1M#bHO{F4vFu-{4@>cs!(2$pvlgWBVn2`!TD+`RA5A}2G03SGBW-6wm$ z-A+@7nr!f~(2NdpTqz$wNlCv?X^je^EV4#vTh7$}T&G0KO5d%jR0VaTdhLjbLbS)W zn|H+qjYw%l*rQQ8+mW6M456%3{wp)w;Y>?RIHXwf)JrMV-UpNmBVHkYV)zkO;sBIC ztr}SY%-~Ka{?j*5xcfEAb*9E8ifgjMFcMch7)&6$2o~L93Q>a)dxoDPKkRACp2?HC zw^-!sGtE}c2*eYL4$PDoY>0^--S?OW>Dt_dLUgwo=rSp-SLKfqY@ z+t2$QtHwu4gcN^&w`R*`GUdAM-LA??_ffu^x_Wjs6Cz<4^Z$!8Wjh3`V5Kk2{t%XR z@t=m2`*I_m=&G(GN|?Om3mAuEIG~EU{s~41(6g@9i*<@$K!65S*+4J0V(Iff?nn18 z96}8hQW>&){j2o~bMmIv@slgYXOw$U>dNS%`pbBq2Q{jG?tD0eI-aAXG9(TP5GmxO-5N42g(IBpl2S6V_N&wV z7t)cxuGOm+>uPmDDyMJUkAqd&;amR=VUH-YvhS83Ce-R$Kt2nYCu*y(SqW| zkqIouo8;O%kl_4_~kYDbhDdCQl;zh2?Aha=|&*nIOUz7o10^V8kV`7dxtKNVLl42uE4(^1~8lbLA=QOnkXQ_ zM*|t;_qeH+Z!R*L{tbsex|Ml`Dn)e#eARy3X2-f_u!7mUIN1E~(*5nfyCqlymxI z+P2qP`o^_pBPOH|RJcEjiN-fee-Uu!6pgI-s6(O3UxFp>$jB}!aaAA z^{A3=X}!7(LS2W;ZR3RmUxN^#+_lzDe)a5`_tZoMmygJ>9Pbe>q|hSch+Z}CaWo}+ zR2OwwGBv$Fodj*6LNlgorHga8p|QwI)d0WP&5q>y10wd#yOk+$smL)*K4<&S2>c6I zzj=3-sb>xIY>*zM zaESIwAOEMZ&33W|_r|gk#w9?h=ZbL{)5CkXVSPGUzoz|aqLe_w-Qx}iQKwE7oMamE zM5_34+F^k#!B8#j2K4J@P_3%UgSS4XxUM=%GlL4WS_!qN(RiPoAFa1}5jx|*6_tqI zX^`3h{jWJnJb9r3aqj7VnIe6IX99oUeh(^|nd#;j_r$06bH4ws&sJTz+V?di07vw{ zdJ-)?eQ+CO-yq07BtQ~5aYyIQ()q!F_rqd>E4>ByF*JL2jF+FjZbiG<+uDy?rL-9Ha77x}1smU+phUWNN<0A;k<(Pi0p6k|`=FfIXZ{ zI_aH7(E)LNmJ?m~KZ+aa#xc=Y1Af2-$2 z;3w+;l4U)ROF{0r+&}}|Od%BZ@QC5>y);2zw9yAvR2 zaCdiiKe)RlxVyV+a1R{Zf(CaE&Yb(+%+35^(X3vZ+Fjk%RrP&UJL|C#lL!3YMYof_ zTrZ{TJ`-;|_=s!^>>T_+2UjPixgB3#^h0HRmv+M%2^wpXYvTSV2Z!vaUBcO37cibo zmOu-D#DQsSwES^wG7|<{)T*K>!X*?7`_H3R+kEyeq~FaWdK}E@|cPKod!7 zk!2QIO2bxrs)m{)aiYcR;hDCiK5tD4?P*#!K;!REX*K*d8DZ7{b zgvw@)?QYLTOIL+je4J`4F$XSouVaJHM0r?F5B$Hc0bk;`A;#^BI-~6O%S%2cLhN&C z&#O|3w8v(Tg~GtJ&c!#fV3C`3$;jYPsUegb?Rg6^sp#X7NAU!~(6(X#xc?3 zfd%W_k$OF!t`WL1@e<+lk@t7XHesvp+qii3ca zC-AkQvoz0;J|5%ZpEDi`l`^vYLswDc5>Gy75gq>$FF9skRJCDQ;TH$f$9|W? z#T>WO5b#7m#Qz2%dE1O6g-^@uU;1Ie&%3%n>)UeDe|$<}=q)5XVdvt8%5pKvPexvJ zCgH}H`aK$#PJg6*((I8rSOJBUJodInvP5fm-Zvw6o$VUEa}SxcrXsTP~u*j^(<7*Riopa|iy807ueau>%IC zlmVX~l&(ovtcYMsl;1D^i9J-YM9KkReL%t7&BVJ*%ks8bAW{;9zjiPJXl=MMQ$^Kp z1oqjNK)*dsmLs8P@6i62s*&HPwIF;~Zy_FtTn0Gg#8ChS*sHb$AV_h2jSR5Rb)Uel ztp(sFupIHsk#hfe{*gjr>e;teyBr|N3ownpgcMG_3J3jj#85p`u9kl2LgyI1P`U9% z`%2|vr3*!q_nHHE8P6vKZhrR(MH-uekDl=QzeFJDH^$*yutrcHknsQ(94(Ju4atG) zsl>gwbuDgaPslt0mb-6X1=X;KQCBYZo;9N#NJ!J*o))Xr(Yv|T)dM6hX}99KUdmG+ zReOjx|KTI?eOKzyvv5W+4{}I%5oSJSNiPI&*X$XlMPGMK<{@Z~z4Dds^nKfEj>`_l z-(UOve;k3V`>&_qXif_3voWqb_(-0@a_~1f0e&j)Po70Ix5tXSF|7J=>z)i&qzR8( zJz2FggB~R4Tud$GW4FqSc)R|?LU<`CYMG_eOzh;Xx2@Fpwn>G zv@d^o+n9Hi4b%0UvB zJ{MqwK+Dda@UZng!`02X@{M@4OSnK^-@<-JzFob{#mLA{s)A1Mjw6hW~1 zEJf-L#c`ID&?&3REE3*WVzh=EgNk({%8)83U6(GK;<7CR8V()*mncQBC&=L`A4POz zheUwR)C-To^n1HoEE6;r;GGdmu##F`!`lm|p_;4kVR@q; zA)+U0hIYN_|8jKJ+-lbXbxI)LQaM!!O6*Nldh03ovKoIu>>dbEdfS4}*05DM!49&Y zPgR;_u1I%5Sm^;d8Iu5gTw}KtO7`>rW0)WU=C6IT(hgOcx+s&|(r5t~5HNxep6chs z`*uhW35d_r@By-;eiyR`eh_)|0kspr{3Mn8j+KeoJWdNo>+Ok=*?6+?*cT#){G7cW z!dvULzBFkOI3D@dLT?XamDyamRc#rlG9Qbqp#PlA!A$K zt$ooZ7%;}6Vh5oEMvmP7y7^(A%Y-{Kqhu=4)F{%kP)9LpCG?(jY>Fm$iD2}yn{6YRrm_dCP~^@IQ1fVClw zXrbLcW|6gl9?C@Z(EvT3>voLL@xkS?AzLBZ8Q`BS4vU&KceooPlxukV*jN>1;WgcM zQ90lD9a~ME<@bbI;OOos+PdVk(DWa%e{p>nA|*7QoYWRcuS_T+u&9uzQMghNBd~iy z6=$scWWqxD2!xy548O~fegbf}Zqb6%SyxkLWsy4B1C1c24-20n&(Y*cZUFz;IOXU8 z^N+q+(}y2jg-GCy)erDxlgTYGav||jcx9vVwk3#Rx?Ih#8{@M7nW*@`hYaSYAcCj* zGznO9Fz8HXD)p&8vqjwA$Tpv*iyla@v!w9_g*+js7-G()@j)oJ%jz3P?3x4xW$ z!rGWmKMfwwC4CsqBUc)1zPMB;AGf)A>WY=0o%<|EX}nI1bkThZ6-2~SoY3I_#w{jk z#QFcp;RZq^T!nc@X++$>j!aA-_6H=JSIIMYo+2C`Bf(J~~ zi2pD7v~O5F=F55dVnUCn`88gQ^ipxHf1FOhkU3b)r$%X@9|8 z6M`#4DCpWf(V6oG8N;&$npZbuLBEi3E=gwNquw5^ivid`=>Lg5h);Mxvm@={Lj8ib z&`dCB<_Y=i=1Ley>Ht-@z9f$LlLn-T3K4f?$MaABFV5QBB>@X02o?zcgacGZcp}Sg zyDs+1cJOJjOL!rY!8b`yO}ocNsiqC%%vX1bpK0V-R0+nYBdmS>xnZR$j=jwvxtF7O zS>MY6r`OBir=Y6Zf={r)Px}#0hA~Gh8pn^_00XXP{@P8ub1FQy3u$8I4m`|jqh_5^ z*4qFj97k=6yR1v#sHrx^Y9{y&MdIM8p3Be`5t}6lZlJ%RpV3lFp^9$%zpn~Rd zKQ$2uMwp&eM18?8`Ga4$_|t6D6UBjp3Z7pwYf2lssko(uOPV4t-M>Ant@ODx>N}9g z-4!JtX7bP_btGqJ3IW0_(Qh>q`?ab@_h07km`7BB4j1B&ZotuphyBCsfiMku$Goif z>wE9tAptkuKw@~l#DHrj?Q~PYrm`a>HnvX$24+cYFKxrr+N;gJ2_4 zsF$QoBJjI~WW}L%8>T58@eQ&|fnT9>WpYg8O!uEX&$_qDoE_ltGf>=ghu47HMq~QR z!P!Z*doHZm=!znkB`jwJm3|w{l#i>=wNw2Jyryb)+|Ii+vNl*`ekph_(|VOHaL+2N)(96RpK@?U>sT!nq5!zWN(!aKcT#g z=G)Cq#||F$v={D*F)XEC;%0L!CSQ8BhM9Oald6qtI@h|^R-&4RR(t_{i>TGm2QD-( zTj@3j6rB0@1&t=pqJ)|mIx9U^waKe8Y@i7f4-UQHr!?}P=5uT^$8$k%0_%FM>M$cxcb^#Ag7yA5NfIsjD?XgbFtBDze>Ogiy}?3R7dAkG@_3sU~lW{{KZmcmv&d- zES&60zmWbW3Ky#QjrgaN60kwF@?iUi;>NsUPjj%}cK0KD3Gp1UxNK#Ox%pIP>Z)3B z#SaKH^p|#{B=4N}!#+vaf>#?|6l35MBc}Sbejb#2%J77DyK(0z?8@o*;4Ad0hC6@ufhkrH_+w8jz-*OJmF7O>_Fp#=Zi*O(sY_*dwU#;` zt11?vj?H_ei~Q$gJXIge?Qfe)Qw@nX&$zFTssS0b_nW_K_Om?72vnX|%0$*EE@a&r z4fwokr@gj$p{JTvS*j!`6Uy7|Op9I|HASm6)L!qD{BB37(q-Lx^e6PmANblobX)Ub z7&{?(I%2>I^wDiY%0r?dAbDzEcjZiBs>2FcC}G0O)ojSBN6LwJ#Ykkdp}9e4LB)a7 zr-1*GN)e2Gur9Y5kseedivO&!Ak}0prci50weQ$f0zWu!w_kzaJ-ey9bHWTOSmF9P z%=9U2aO=DZJD<_~dtcZ7ygl{Tj3cj=e}jl$7m-z3ShC(yvh3h2um~^<){z&@U@W}Nvlec>zNHs z{GyxDQ@^2+kvtsdc^HvY*8xhWM@%QXIWsi0_-TGmFrjCX_h2+wKOX@fRN1IK`sT|FusUzm4TCi& zKdD_%e^COQq7%_U*jui z9o>*sHC8eDaU(K-r~Gxm9lK}{5vP+v*`G?7Rgb)&NkLu$P&4`aO@=kHEUiWWtdnA5Z5WHmqGyG3=zK z2qNjTr3 zg*aY=$PNAcJ3)tA{oK_YK|R9%Dgu>FmjNJ@ACC3 zkzqX~OOOgsCcjLZX18w)XDHPA7YmT~cNZd~wlnBmvp?K8gcaO7Z2-=}T%`bLPt%FB z{Euq$6(pku=fxlyd0L?8hI!%jXMDa5n~TD?JHjQ|2%nxsQuc9~*yWKp)EY0K9vonj z519Fsuq~)TT&iU737-2itZ`-zMdTyH5 zsfvVnq&B3L7QuKK3?ScL_YmW&>G<+D+&K~isyU_|ThkXMN0qB2_?z##kYzi%5&QzL z#?hggR*CLdc>6wmuo&+8xp-%4V@ScpYBuQk^Js&atvWqV{uO?KREX`D+lbrGgEvg~ z{+N2)NNx^%lt2V)M935~$x$si%pkhvrwUw?+a8`S$Kp8l;(h*}99Ep)lU&TFat( z^z=z4WO*Uw&w)O0%~t))do0jw6p3&@EgIehC!snMGlhukZtd#2a#GIVzVed%3YU|GFP;RG@|L&FM4^hy!?nArn^Fa`0CTH>t+Yo zv5k%?h3-K4=MeT&GF!vVTv64Ty;&l1Zs!Y&7HIaYl%X^C&gi$?P^%vyJ}k7jM-)_# z6{uhI_Gh0G-UUyl&)lcj8KvC^XS~ z;MX9t@=TPP=5r@2=j2UrwR8@t)xuv=jOoX{iji>3Xb_Mh2lH-q#m!P5x?IVvBBJ*c z|E($eWTilf`zDo0wEv>#F?v3%T;WjZ@KS%bsfAHVD8`I2l^6@a$bkW#n`~edz)61> z2E3G^O}WV@lZbu^jmZlq6^(y~ShgjCC09aqwXxbY~~=+q#dkt6Na z$dnHg@Gp28-CQV31L$4B7k$|S^)QrLX!g7C>>r7*4Xf|h$6$$r8q%KI1ww=vp2Z(TVo# zM~jsE2{rD7JP0a}w5rm3G%zB(Q&CA`53kF}L!8gk)V+U55{e}&y$X|4L7ipER=N(i zFuymrSPBCyU~5_%;^{LbYbChP1g%eBodK`YN!*jAaoW?>FYZk&DrK%DyDM^cZ9vHq z=p_C58iP~L3B?OvQVTkeQCXr-oPubr2tw`XHR#Lc%&x+d&fa&;saD0Cn|Onsb0~+W zkE$o#U2pr}o@G?x7BJ=g#P+wi6GCATVvbF=&bf|JI6(=gc7>0T&KtiZE}scxCTnq~e4{q$W;5-Hsgo?7IUg3ht&y8I{4zAA94y33B+Y<^~PN8Y30 z`6fur``!J0N9LPrX7K0F73x;zwOiEJ{K}meMOoTcG+B(G4^Dt~3(v%L_MiJXpO`=& z5Zf(&JYXPTI=9=P4vJZI2olEnU<|SFa zZ76z079`t#P>igBix|#Za-z~pb^@+#+3WLOA9ykEH|uMyW~?$=E+!N}?+p8a3}vcU zPYM7lqGYgTWcjtFh^~X5sbFEvL1`Cl5>3a3o|MN(PwopfT}|bg$I2BDmOtX{+*^G& zUZQo%<5vtSYp_h@i$8nWpESF@dF)ZgQ&WIJtF?iGxx*E0uQEM( zD$hL0p{bvksy;Ads)x1JvHb*(K2?1XR}-hd@g|mJl$l7nVgzaFnv3Eu1TsT;P#vP< zs{e%|gU)m6*j^F`WX5@6H^f~8RgD;Kl9j`=_!t@bNES&43lDf~NdU9O; zF>DW<8(#aT@d3|z<$^=QT|f2lDqL9U=x^()Q*#Cf^xhWs8)mPLO9cLigB%64k*Z<8 z)J3&5sz9!o*6T$?pAAI+bpOQEg6veUClzrv-ZdH}&Qu89?hF^|IuvEeWs*ATg>}s{ z&ah{Q0>EASe<{(*oMon$L}UK(N2?~jN{hpMAeAwHgHyPA>B>k-ZY$pmODpm`iT}nq zS9rA$&MIIH&mNw6VhVE61cFp1VV}oZNqUjYE~5ad?NjWZC1LNC4LbwvT01feMHHKZ z>g5gYYNP`16Z5`YD4A1{tRe@)8-N`OmK~u0WT|FxqzYhZghK5uS=SsY6{Nq8%lGyy zO?>WZukWLfn{p3Wh=Djjn+fO$=kTViJ>w@7wsU#yG+(omAqi9XvQNt=)75+rEw*$7 z93B|!XhmP@4#hp%{GtoO+39FanC*u3!kL6>|8>Ven$~GG+%{@aRYSpq1R$9qk0UzX z?%@7wy8f)rcZUiqgTC?#$JSWfoeH>ii-W#$Q5%aYYf)=>bKNb89{R6cx4gEjsOeSI z)AVch%GVRJM^4;F`>D#feCV|55NcTISnIEsc0mS4p4R+`e5NeXCw8IHDBvrRS0~yW zTm^TP_&6Zr_z3vMYwWo8*sXllsXf_u%~#dA1|vtT`f52Mq28(T{jK%3EZ$|8=uSv} zd)@TY+GT-QR;SdcIdP{WDsBVHHzq%aQHyqTTO1s=sN0(uGwJVak={bgCvB)~9^+x? zxD9`mJJ6n!@cAY23l~_qSrh~wlqvS7?X2LgONfL(&#Q^dRy~Brg9EfwC%w1Z#Z;ts z!Ph$AgNOMiJh7?5FJV(g2BV4%d|yp7N_N78j-@SAlI`C`1G2tR&%QhVQANdx2li~3 z*V48|watqH|3kxnxZPFr$opVHcFfZ*OH{?KT2V3ATZ>(rCVd1UR{jrMi@1`4cCnG)(i#Cj55A| zl;dy%-`Ku_8-AJ-*MtQ-H{-4{H{f5jht(0?71__lr*tSyD-5s!9~vX))-C0lg(8Pd zcjqx^fWF#4%Pm9XyNYW{ottXoD}N0y4*5D0V=E)&UDm2m=}E$`Eo~kq`*q`D8ZuN5 z?Qe4T_gdSncaQb1Jy&U$di+^4Q-Ub23DF$QXusJ*^EraLX9)xdw%CG7`R3egW4~md_XLhU)uV?9W)Mh-A--1<67#+5G;kN+@*)?h?Ptx0zK8%E@vQ z=s1@3R9l4yGg{{YP>|r}Q2lzGO;{c``U`h08|3Z5iPaC1xJP?cCh#A?iPbQ0A>-0y z1DR}PL}L{#8xDYKF6N4U%Ct^*#2-%*XnU{;8{wEu^sh5cfp>niS3p{xT$lyG1b!~y zF3E6r+I4eb&~Bale(gjMHB-*u5j7yq%R@5Kbtc<#%g&o*)={`CvthZGU2)5nlDTC3 zz*b#uQ$)eU?fB6zSnQgA)4kkbYRsp8HO1gF0ImFFSqAh_#(}5l)~Z$#nypwKyc9-M znWScb78g{4z^y^jND!ve|Rly@)!CYJXCSiv_r;BBmN_Q%~@JkCU69=|t(G zRkJGf(CNL_D_&Sp|5A21V*cK}^^2i9<%ya`ELF{`RXE2tgHXJr`Y5B*vf+SffYW16 zBBK*wX(asIXlz%+s3XI_n_Zi&%(x)!5MYZpIw`riwtq&nw- z=_xS-Y?8~ZqAk4_o7^H-<7@>~*ZNJKy0kcpC)Rv^t&Mo|d_C(Yg~$$KaV6;FLu%=$ z5`<9Hsh@|Hko&?8x|N88e80GLySk-13>ffNx`o==eSH-@p*+h4d=>@$ps8ja*+KF_ z4dSL4TpZ_kWlYiEto7&+GaK6fH$<5iKF1HWwC~hLwryI7wn1 zYZv$1nTra#>U?)RFuAaxZQz#>J9Jl0Sae8eX=m3gc0LsCdpCUEeEMUw)G^P>fJZQi zlec_6g*_b(L8#>DNiQhnyJQoQopueS{3Q_Zb-CpD+FxjBA>JpuUdwD@ndFot^9S() zk)DxC;ilb*jLTUHSyATO0t|mweta`sd2x;EN~J0xx=H0vg7F%M5@dvJh2YNcsQ!bi z<(+=&^a>Ug&C>cbjRbb|$*SZ0Oc?v7Yna#hRTb&na2~RqX=;_H^hHjk! zadW1A1|cWU1<|*D7&RBsj(!H>f1Z!4qK*lEiMi-Elrer(FB0t^pJa|^MBJfuB-Igb z>p}Y)_vp^egCvBNwfCwGV~wN37vdU zE`HHsJ%qC=`Y^i2(%ij91W-?v{%(te*+GLQL+h2*Sao4fFbnasW5qCGZA=~l$0%Ow z5{|p_&#wgJjtx?UAFaNnN8Byq(K`>20Q9&qpd=EHH-zhnkj?zo1>biV1ouzH?W8)g zva&5cyq$~jB}g9@a#jSTg&@PlHK-L%>d@O6wuaOsc?dLXhrL+%kO4vc^P%2zruq6I z$ae+NA>J5F3(=1G`r?RpJCs$00wz#F_q6C)`{bX&p7QxKZa$~Ezq>;jTP-!&DazgLxlIhjwLI9;32enq(O zm7Lv#PJr@;#0sIR$YP-W_^!HS?&4!Ao!+R2g33?GzKplK0yWuDEj#UKO*U6fw`WTK zG=@1lJlA?w6KixpO7M5qWbC7gbo6otsI}rCwPJm$jLquIccEp~IVhy>Sa_si-UOwN zb`5;Y13<4iiQ_H=jYEkxK4$U-uNB6M37$AjsAT#!QUHbSN%;-f$WDWe?CScav4q}O z+>fYHd&5rgI7zOzo-^A4om_&mJlfSYRl<5|nz+x>Me|w}#^Uw?{Gbg!rc&pz)^3hl zH0zJr*q{UjdFK5KY+)z66w-uW!*H3?#7|3-Aih25ECCTdD?_MzcXU3K$Z;P?$)JRl zn|u3Oz|DhL3rT=_x3iEs-s$38aa8+R$17fejOpimYciPRGf2(I=Qq0FVvSlWFDsbi zp}Hj#@1&jH%s)5PVc=nR>*XJ8F4CD4=IYg3R}h78Fd@Rfnmqn8h3Rg1CbLe?`xTyI z&9B2srxu7qJ3U0`d6Ng!67%Lv9xUs1`L(){5Ab=jtOyu93CLUV3E&kYC0f=nqx!w; zS}Ioj=v2A3nNslLsuExG6WM>lWXCCaXOy;(gY&2iN3taM$a%uDVV!MYKW$FJc>*C_ z=WE+K8~I+^93!&$9}UJB8{XGTS_>@!SuN}*E5$S~p4~{Fr~du4zm}*ZHwUoJ_LS%> zJN`I!6n?xsc65m8M+I!t@NCHpi7~(UemIqIIER;2CF;3Z1jADhBs=N?$8cQ@$DHcl z9&Mmg|4Ry)Fwd^A?qk59pjGyH259N^Sa|I-^U%!uAP($1DUAgiP|`&kL1jt5tU2TX z8EG`=+=)keY=piScazY{I|XpnmIcq%S$iDBVpA4=F;>cqK|0F8&pOT3df2JM`OUSp z0&>4IC+<9qNYO}<-uvzc#$h3L$t0+yriG_0Dt=S zYTjjM>@w|^{Ct(;YTyMRpKZ0{hi-&1xv+h^JU1Ktv7;$BU_KBA?FkUPV7p&+Q9#>M zbZ@*X95bFnz>WTj8!17d%SiCscrF4x`al8`+f2Yjf-Sho-Don3Z=Z2=oHmn6O;3Du zJs?`*FE@D#MX=uTmSU(N3tGP<)|SUTUtK0v#6n;K zQ~UsWlAVCv6q_JV(&CL9$hmChY_fTzrB2|W3`hjnyHZ)G-Y7noONxU`SjF-L)c;X) zUx6#~jme%kgJ>kt z4EyU5qlp&MNMZpK{-N8zPKu;eHnlX?rv+@?_5W9JneMZ*_(w8IhwhNZ=|_^Wzb|M_ zVPb2m&9rFA^(48^S6*#cWkrz|ev32_xfwQpC72qAn+pBeicjZaLFG~8{-hi5yR1(u zyTe^U3Qe$SNx=W3(7hpM2}~?oFEM*@R|v@w*0o;YmdAd!Vj>-fj|r{+@Zdns$F7hy z&%4zVVaDaQz(XS$#tJ=9=^AdwprY?2Wx^5tz6^7MzFE`E?W#{N9a;t4RQ1?GsXUDx z6|UZkMmlySDpi8Cx?@89TqqRamXjyIzEXJc3mGGGGw=FltnAtGQQ@z6oCE0P>-Out z8|8`Ab6OmQJcaHd6)8cj3%;&D=;h46I<-fbiiYoM#FC-QZ^R!&=`~48At@Vost|&| z1KrYG5|^YgB<%m0@$Y#<0e?s2NN<<4+@m-v_ltGKnN<-rKnMI=18e9)O7KNw{I_m& zZn<1I^9sUuVVHwTlZw5#j_ROIL0h7uSPSUZF!<76H?Iafq=US7=L&sZ0$SYsU4I~^ zccWb!!3BuZ)nkx{V#y|r>+u#wN*0VL*cR)#tonzX(I-tz5*U(B%KX0thTR(f6)1MQ z3s9OF3n;QrbN0uarrS8S;^`GMF_ z_`ldlh^3&k*$V|#YRXM-w4kkfe%{wK)&=}zQWn+^``a8f*@fjVT{Zxcy@;2Es@{&o zSjUFh;$dM@B;J^A_)+%)!ExGVj*!T6lK6J{1=0C&63_Am0NAh3LLtY{VaLunvmV^A zwWzQFtX>o1jD59|>1Kkr7UuM0-aV>Y&6lpNpvABj)7+}p)L8ol9ayMr(6lL5IKOK{ zLd<-Ta$CpHWSmibhYOJOf4#kUGV12TtV}(YSPCN+=$Btm=H|ab`9sz@IF2rqRw6#i zKVMqNjcqA6ChVI>vzaa5rW0EXjgK^*!t2ue@fZlw%7e0< z;Y-x-exgMNHH6lYUREILx4_Sa(=SC@Q5j!n)?#ancR@%0qt7Yy3%WI0uHF;21OzKLJihdDD?Yvy7QW6c$* z)$nMt9SZ)B6C$Nky%^>1;)-08x+<*=}FAvj}bPE)`u$gf8Z zq$I2a_{K__@8PRp|GxSfVHeIAXP4SayyumRawcC2ed-SHjSmS7cs~^V+B*8@S>*n3 z*C7{R;Olh*Vt!xgY@!n^Gb+#2#p2R|dG1M|iI@FsAFvFGALoNBZkVXtMcx$S z*+9TL42-yvu>OgsK{4D$z)HOk;gp4AL}#q-xEzXb9b%?N#6qH~l!8;7`}Bhl+liC> zZ{VnUT8;re=U>5IM?os;%pbNy0JzTe;;i@^ zOm2T{Wo5^DRlilz?Vk@UaLKt*P||6JOsbR|x5Vmmp1b{KPMBV>>tptF<+oP{!TKu* z<+E$wkpp67^kvc z)oB9UO-`vQ#2T&)do|$lbA{gyzG@95j!VKvtCdYvRR93)R{gjaX$F1uBsHFK?*5BtQtm?XLC`EjtOye3Wy z*)5FnwdV;S8JEFs*$`8;U{uoau}mNO(MdSKQ}15cwUZjor?W}_{toi#OOK1hZKXGF z5IpzF(1`YzCW3{qZd}F3603_lhT8pS#Ynfn#20CccgNn^*WuxTLQN; zaEK*%%22mZ%IjS-SD>0>#jrE07W#g2N2pE#K@eKjH`VQ zrvI+F$_&|n!*jFm7H<2^234$*DI~NTEpjYpRiehxgDCEj3{$9L9lk*9;tfLDI+WL~ z^46$ug^?>#YFkNb5BDV8yjAN&RbwRfM=!JR%dPq2@A2o6yPb+m{+cI7LAT-Llb@0R z1S21|-UrF?7urLt0nDix(Pi0Ne^ZkPea?;~c-xT5cm=eD+)K!~JZrR>DbxmI*xNC5 zXh!#4(m7H$^x;aG(qjK#&AaNCsl{ee3(fo$8$$NXPR-gAA}?UKhafSWBYHEeW27KwtA1#V>kRgxB+}FKTuBR zm&EH*Jy##(uTAqeFO$SfyQRu3h&vOoagR~Jy>jrc!4$y|!=TbE2|8v?rPQGP{umk} z@})@+3I?Wyzx3#kD#3jH7m85t6mV0X$b&<&6RIG=hAR&;2DSJb0QhlG^^yo>SO|1I zm!kUzDOcDcnfj4pPuo5aWE7v@9`Ng&OB+5^?yTES3SMN#QmmvmaBJUR9cZF}#=2M%e0f*lcdE3)akMn^$OVNB!N!EJGkK-Vp>&D1 zB0cd2iv?+Pd%OuT(y>T($d_)>&I#JbhrlsNNvq@-=R|9jl!L z0zBhR^?P4QMEQo-l-Et+YJBTkOxN7_A<%f@fSw5&pmV{F_&%B4^!fuRWhA(r>f6#RAX!s%>V>aH6zkJsQcgZ zvR|}{P3=fnG^t3aJ0cV1(h#WI#97*<$iHu6_QRwjP=|=K#Jw`c79>z<5!ID3(Wf1n z4ai_j5AZ0+=5$ERATnY6bp&B51S1WvDX4@Nl}pFb`E8+Be^>xVx2noUGOyM~;>1G7g;Gbsr|<&=>k zmBQ~>zj6g`si#V*{#i1@ooym0bhUMJ8z{7yi>@$xs7!+w%r4MM4jAJGY}R~pY{&oW z9u%F7O(l`iaTjK(NJ(-CLmx5CWhTZ-7ZvX59+G9(U=?YB?QDh%Qpf_%aH{r@_G;o7 zRr?&<2c9%GK;VY#LmMGVlz+;XG$im9o`<;0EOqHnKl;sf1GK0zE@>Lu$XWjK-)gP%hE(PAa9r6nPSTNPs+SEN0w8Kq3192GloeF2rFFKLmn0?ABc`%j;e1>pju$LPPyK&zm<%C@d>&~~b zrf!Ao&0EW@;aTM}vcZb246NF68vdG`5ef4<~J+xE>l z_%{_jQv++kr@Yl4FqX$yTJWhG_)YD&l*QkPFEHcc?rgUqpj%K91i#6MG+8|tJJ#5a z<8=pY$ZiLI0eNJ`)_g8Sljk7k>oANO#h%2<4G$7ZMa|94u_1NS8u2ay5PBu^t1V;2 zU0iU=twEJ`5H*SIANcx?oUeRSRB;I=B+x(srsiPft`Qr=t$O>RYcoA7xHSMToB)8pjK#{ww(qzSt$ zy76KE_B*gl`*So0UMtDMtXy7MMg2HLwRQF(stk?>RxTA^NeO}M7wi{uhKl)WuVH=E zgGscwdT-W`58OOYKkl&!!nO@Rjs?c@W+>-s5sCa+1flUU0i)rR<&Lkij(&uADk- zT2pD;)-8MFoH{|3E10@dY3SB1Z8%N|kDQejZZ#)XHX)lCQS``u9&;Tq8jXK% z#eu_|jL(mW)?lRb$Ag?#{^cX41b}cwbN?dnxY+(Xbq2_&BMD8lU`L+;$j;8Cz|(XgYw&5l*$tT%)1YuK;@mYHn9&6A_S==)fS53L{kPXLM^WSjj( zL&iR20=*|JDYqfQO3uFIR3l&2y)~3FC-+`B>Phx&=Wh21d?=SYrUdUKtwx<_Be;}I zgV~P8`|hkK()i(EFUhpFiPU*9@Yn8ToZ1_giVR_C8{O1qVK;>)bpNL!Ub6+7a7R*V z7q_+CpatbG8xOOQd>l>T@c?IKn4F3E(g-<}pWINfYcw`jVH!l!$hcNlRVGVa0pKAR z7?g`{i!hOzNDdn3MKiBL_Zk;Zgpn`e(}DJ97$I@Uy;i8cuC(Z3hkmzQrjY zFvKVK3HMjy#^6iCioJTKj$eQR<$$j&$OHMv(+v%<(FpT9uhRH;hUsSF)Yb*p$?F|l zgKSs(KMFm04Bzelj1c!?kFl7llxy+F@n`f z;WRCW$~`lPHRaF>PwYN@0B^j1ObW|pUGNQ5^gct~x6>U*UzA`om+A|HPWdYPRXXFi zD2TsO(U_CD|D|F5v_<>boPyK_kfd)W)uyE3roR2katt>ji2td=`Uz2S zx8dJw_kL5FYbw{J)7#U^-&H#?)%~`npwrW915jq<>i2e{YGgjA83_fPoR0>wh|SLn zQGweqs}3_Yu7>~W^&g0$&tmPB5l@42K4SPnGf>nvfcSs+0H6e8;1)~%NXt1*8o?!} z>&OQq?3g){B|Rc%y6q`kI6EI1_>0jc{HW?F{xw+o`5oPJA`{S751ridBBTF?JB+g?D^^W+eW!gB0MIQmtqo)k7wtdE26zlRAnt9_7{&#qI z?nBvIQlCd8OQiLS)nKK;0}|Jt4NiAD0KEK5@P6v6JM{5N;gVi@QHDlNchz$l)sQ$# zZ;~EgXk@Yk?|<7(Q129Er6_Lt;#!MBwhah5W7Ycmx2JENIT(X}83P&iYdIZmLT&h8 zE=(0DFoxZfMr?;A`U`2@qv9nWt+EV+yRB>!f88}lS z(sH1fCSY%ER2T>Qp1oqVq4o;Jcyq$g6%3Y&SU2#&{+Wnqf6rXo_vNJpV7U1-!y28+13kAql`!Sls`pZ5mK@4|rZd#`H|tc>F|+ z{&6e4f@xPPyO?p(oE-;N3DK(_nYyCwzEQlW_+r{EX(x#GZ*t|Mk^*{a4pl@32S#>j z*wbcY#4$53hF(D;`NdH@clK8#a|#z2|NXK36<(@A+V>@E%(~KQJ=c~57 za0CC>E2K{xs`$RDu!D;oTz$0$J-+_!zMN9?7Vd(;_NL88)4H2SadcQ_*>8Xn*SdVF z{<&jhvb2iQKhx;1f&P*I!_-xWRkb~B=?0}6>5w>dgLF5NO3I;2q+?4^-J_Pb`*dgq;4v(}bjFD^EPJIQ-z{ff4>OOFFj$lwZR(N%+d zW8>R*n{uAgG99CvSz#7#mZ3HZYcAP}`E944;w3!5E)m&i{B6R3&4A3#Va?YC)~2z$ zAy)mj<#{u0KBcm>vgB^9!KUWO+&*o-aLz0i6-c^0xdH{j2ov%}#J>+YEqBK=LrLk- zD%9V8N-&^l&(V9V?}tfp%@1f+C{u~0DZ@i?`8d5a%UUwc63k5VXrS{juA4TL?d$LJbMTHdkV7f^y8&rfP%JLM zx#nSZ-}ZhEFCJDS^loZ!Q=ITUx8*b(Gika#r9*^es1I$E7pmO@uhY>yO5F(RL~+82sA-jlq+ ztzwd=rH=V7RgO@O9L32g72(8sGL|{Fwo;tcu~78d5!zml8G~=w&K#q^R1V*s`Ug^LZt{c7NI&d>4{qx#{onb^Ri@j>hmdWl5@e zCarIz#II?%jAN2l5aqsMUx^Y6Ja8>Z$&Y$?#=^MifIJXva%>?blBws;bn8l77}K7c=uKhP}2)*jzB zybL`Q_6Oz-2^8i7;t>Fa$yQPz6lEdBpga$F1RCTiUnW zv&~7}8iKD$u-yyVjMt^^F;G;Kdvo;cUx!J|KaOvBYk=U~^dkc*;>vgw_1#QYvW#nR zzK$ynHUe|X^HjeDo1}8xFQ#-zjCjY${p+@$b$H;J*BSg?vwS$dES`tT7QlS*IDf1H;*WeU^{Mj8~!QksmX6#`EUA_JXFb zRHh}50`D6mm;!nYog)hSg4$){;gzWa7eii&$|hjU1CMS5iSx|$qp)k?f@p%NgE!KV z9pcI?((MIhQT1{rRz_9KyWhx_j%rKBr&~^9jV8OiH^(!M=2&z$Zl~+O6${$3xUaXK zMU)ng=Oa8{@`7^eo{p^bVkNoDApZW{^;^!k&p^ZD*N$Ar%N*om7Ps79)f2^7rm7#4 z?#h5*pvslH)d=D*)qeS~iSp%KXQj<`YSeA>(iqGqLM!5Z zVb}QhMiX@vy%lE0ERPjK-%h7X3J)r_1ZtE@la_MXDQ+$9yms{-hqpWyUI#54=B=L2 zB@d&XPyw8W&gSoI$|)dJ-@i?)79bxCG=PDCh1>=FpqsCN4^J~8Tvb=uWcLS9R*N<~ z>8LIJ@R?xAc|K=#%~Gz7HS(p>;p>rwkMlUZg0Id<3@;gldwJtq$;}DnVg>}L)=o!hI)_ zvE9O>MM#J5#IY}+axf2UZpJ1D)-~ij>hE8!4RKzsJbHsz&Nx-Jx5Tc5UhelfRns^B zrr7!n*LpvNSN0`Ir28QSMQJ^KD_xVhn!fb+ z=VJzykO@a+?r&WJXa2PO&18QW;4)^}CH>9{Z^5ympYw=Xp>7>IlaHun*O$FF{NfB3 z^nw4Gm*LV=-{|CBqPRr1T197KrXTl{RMiFbd)OTGm7uL`>`@n_ z_*I?Dq%Ow`Jw)8XKi}AO==0LxmRX;A~+~}WJeXLAqvr)kfSw@13 z+=Nnu9-NoF!ibUeYaUvfMjk{U8WlUJgw7G~7fpG-u4yk*)G)Ky#9*5OZ!j9|?7vRbjOKp`!Ge$Kc(fZU&n^V zoV}dvm#ZkeJpR?S_D*CK;km*CJ{kQPvuGAZt-pW6L0$u(^(>1ywrkrx^2?TS0&-&T zMCO!c4Bt1JVyc7}wASyc;zPK;-f2C{-FjM5-~GrvG7T|=`=D6-^0)c%pRGTyxcH3s zW%ahVGOa0tcvkG_%a=m&TW^tFvrABmKq)UKpM9Dr_eY3dHLWIDQ|q@hUFjpr0W72@ z3}7bnu(D=U_8FY7rStxzk}yS<(l`J0KhVfwv-)GY7@){DDD!j=$8l7gb zvl{$w(ixb{w#~Vn2x*a?Xe;G) z8aT@+e8f&zp#!$-gB}X=@J8)M4^{YnEo0kSE>SW-R)1%GoFU&9h~6aVh&lyxrDl`8 zgbU0Pg=~K782=NpML&f-ZXy4?!@#3&Wy1T&I_EG?4v3PW-QwNnx^q@JP7&Yab2Qpd z+)qcn?g$oRxXom_s};bSE&P@8r6yD(wl|^lR0mDnOfw}!HM3A?vv}~%nfycY)<39$ zf9SsF+zkp_=nw23mS0fVvP)Ja*A;f>PN%+@4>+WiucvofOZCnhFwd`}+4b$_Mcit% zUEU_^Wsqv@Fv?(*W*I$@+%i`Xjcm643z`#R%o*@=KYJsEbV?{@Q73Saf!dJ_t<$M0 za*$J=D5Ay@Z)NMQ1r6AD#v~j;{FkghM3Sdx7-Ed{QjLC$%y;0yf94c9^lI5Z8Vh?( zdS;XUKJ{};essQ%G!iEn1S|f5@#>et5XXF*h^raFfj+UTO*}r5XGMZ)lZ@w=13+fAA{!CSB_Lyev7R`JO*BRWt@gm-^&FniTc8wVlakEfMa*Df+Ps&E2QB0rQN zs4yA})gZmfx0|AsrP3tdj2#p}B;W3Ya50n`6@SW~c!hBgaG7lB!wn`5TbvuHw5P|e z!ui;ooM8k*XLxH8QJB?jRC=)3rC2uLD6>zxpe*`{D0smG{NA9PU*$7j{b))!1K}sv!)~&8Nv53woX_lS!Ua=^120rgFusK>BuU~V+Jz-l#K@67Dun9O`H0H5H{fAL+ zo++k&Nap&5Y$<;lYMr5>u9os*9obJac8lhXKq(HZc;;1>kwY>U!qY0nI+NA#;hw+^ z6Pjc|N{lVg`D95^AJ3I>3`5gRQOL3ntI{Vtt6;uDmrmg}ZDMNOeu!xuH}g{h_)i{T zomHs&aF_h~2S|w~`Tzbs<3E2d`c7)gt~`E$=v-5iIF%9|c-MsUKJ%-JAW|`pASXXE z)Rqc$f@FCD_*ycG|ChF@a%DfKw+W+DC_?f@h=T7VO4e)fmwSk( zKdl_+Nta%sx!PT;bWmL0>`~NlBD%iGkkKhw?P#S;d8^$1nvut0mK?mE_b&wDc0R^n zNA<|nJaz)1a!aY|kNKjf;m3UPvP?M@0IEa+T?j?~Do7bs{*?}sQSq5PwdeNFygMsC zMksd(Gxx|VKDBlDG z^k}~)O@!_7jIoXQbtqJ&qA0+qGq+dMzBRxgtPViC8s9`u%k}nNtqEjbJ=RdI7UdUa z3N{QWII9;{1)t{M7k@w+{M=Suy8NDB@|JIcZ2!ajQE3b5(dB%J)P4gh5+k|qS0++v z<;qc>^I8+0kEl?A55#SHAfsoTpkF)>7}HFNmDfrS2zA2l+f+$-j`xB?;k)Xq498Vl z1VxL#5G6bU=-P<0L!>fyC>2nYpb&%Kj+pzA`*}ah_iOn@%exoseCqLm_xJl8!aJ*5 zx{F+lVg$@&%2)~f>-0ox{Cn1$BmaZ!66qNmoCNS|C2sN(iS#tF@=)5a?#!J{Rv-@p z{o*gpmLUdpqdd9NX-5nymY&l?UD?1K$Om=h=6BMclH%}ysLcbkZuw2F-QPzP%Sq&I&b-_4U}eoV z>OXpEefxQ%ewi=tbaH-9?MR2wxI=|AW&)tN1VbAkha$c+*0@_JZ(EaB@~D`kRqeZM z?p=G8^RiI!Fo)l3tOA#;$%H+viHt|7O5y*GaTx(8H)G?JHGohl;eD|p0}6FjUg(}4 zPMMSv!z4!z{~NvQ5H(Dk+$Z&N%!)7aBKKl+<~J+X3G-2BUzi&KvC&}DSZ}>+Hs$g* zS@BFQ_|n}^-T6Jgkf=xHTr%6`-nz=!O4Q~DAl3PeXaD5s^7`Ci-4Ywm7J(ue0ynYy ziqIGq!v3D~0hk|2=uZZ-MY`2)DA=caGtVzQG2{JRh(IwgHGm3C1GbcQ(^2b;&k?sS z#yMbNn?<kqPV4l9FYT4kg| zusv{>8-190ykQ5;EqlR~eH~kxGfK~|ru)=PWVefliLcknKkA;j=0Thu&e(Gi*Sq-= zMmKJ2lM`SyQBt@~Wp}$hd8fLqVtvrGe&-itWi5G225))$^I@n%{D;qFJF!XE;abhZtshyOI;O>njZbD=WbDHx2z|=5y z)4^@2+AP6rSXejpbrd~|eV0vL9eA({hw&G-HQt=4!VsOjnd0z_Ft>k!07Ph1nNTE^ z$ZNXh9O2kxv5JoRyRXdiP`l!3Ea|M?jWhkWzut!Rxk1J3aiQIeR%&)3klcuG3~^k{!9p&mxjfwRSduWwhoESkbW2vr>Oi`|v7l z^E&_Cb=&RrGbTLC3pBRKq&3|b+x|qj&dEDVk_QXz&~})a~rXi&@AMq$yuCfH%u)&Ch~Ie+f4kR z-O2rx;u9X!-oQnOT>;)}BeXvR3sw)xp^N4B^cgiv`!3hCumSO#!~L z^X1HBN0CI$Z(F%e)>(8*o>c-Ovn%*pi-&IO59JH>!$&t7WE(K!zAE`QZ^@sN|0xbA zIY%Q2DYRiNeouT&Kl@TGOE)jZO&TD((s>8YC}B zkq+GeVq$5A_z6O%+{s{^Y@_4+|C3S1$}+;rtc{=JnivWzRWhpi{T=j#Ob;`X*I^#S*ynhPIH4BuAP9x;sMV= z48Mt|&#Yae_gD_}&Z(pEH%bCnz%Pfdn1+}#_s5G|!la`Sqo#*-={H|8u}<*sUyjL( zrVh_zc#_tuRDZ77gY{f2j1xNKj28++!ed_th0-u{zq)6h0!wFeP`zh~1(o1B^eYq0 zZizg_gAZBc)&%dm=ihCL5K8g<5}A$Js8zl>%3tw~uAMD0d8h{rb8P{(rk?fzTWr-$ za@M8qZ3>nR3*?tg!@Ztsy=iJl{@1Y6m)%~JsSzc<>kYyRhQAieE6yI6uP0u7^X`8y z$&DxZ0Zex#pHd@~A5LRjfK6t`owQ7a@Xp9ypi_vL;h&P5n!try_4e&=3!S2YkKMZm zO8M*Jq_z+BhCr^ZVIsw_u)olD@X~T3i2G8q3AL`IxIwTEsa0^hj(_3(>94nOOKDj4 z(!!XhP9om;!v&-NRC^Z%nH006K;HP2XDPC}d7PZSqo?61F)?T*UG>^A|R6tCk4p-050 z38Au|5Zu6&O5~hYpTPV}D3t@q&kF)uFj9Zu$eDl}P)upC%#^Wv%*gs`BPlMoD9{6Z zpVrQ!$7`Ll`%fTd+(bZ!mJjrZFK(=Qd&=$YJwAKG&m$yk;mwz&qLp#kgTVISwo_22 zL>aaTo=*q1c7;tGxq^)KMv&Ta=2i*#GNBRP^C+OB92v2V3jQusF&12`__@GR+Ju!V zR@+!somkrVO&HCf?+y#P&tCwpo~znt_w8&@08KgrJRnzsPD9mOpF;y3?BfGbdqks| z4RsuFb;V&jeO(n1%Rfa3-WSGz^eaE2Qe@+5^|V06! zdnWLldVh`DO`ePAEh>$M7D!9wGRvC$d1!=FdI8{q%Ub64mD(=&zLikOM>_2~Y$xqm zHtazEz2SiTEZ5=uEoPyWwe`$=(?Or1;T>X$l5r{;$^4J|IR7I~;6H^j(J1321(iab z;>MN{T)~sXmY)l_$65hEs?n`w0V#NNFSmIm`3HJ@t*)mVc~RUf{ASW4>h2^MM`*k2 zewDeSFwHUQ^u(MM-Q3teZE$hU0skL!rZs@lr{r28J*&*bdjXbm_1A165^^E3ud2T0 z3!!}j@=*66ZM0N=KbfCWA2U0wkv!Xcl$r`#dW#bWUlm8uIDVVa}FoYQuin%YI0n?hF!4*r>8(`6r#_9Wd7W z7Uv}wIj)xg!O>2W)eh~J8wu$LAV85rEEiQnS7YQrnUJe;YVb+N5 zFy$jpCH$Wa3-B^0BRaPlp;Zp@k8W-y2^Oy6{h&a;LZTO3KWP+dlyyrb4@KKcp;ek; zO+qW!f2%ZuKgfSbwo&{DfExZBwrn7)7%kF5iUjaFYSX3~Ufj%!I#S>rs^J~(YMHG| z5HvU>Cs(1fKbS1MR533~e}%O00eV@%px4=*UxW*;>%}iM4S{yyPSoY==f}L;uOI7O zUC)+7>>tSM1oexr9B0Ibr=0+i)+3(|1!hxW6{10#?$FN9c!4jA4UKp1bx#@)dR4B$ zv${c}6^sy-C(rb=c--OM``qE;qdK9LT+IyI`&8+CRxv)HY-^9Sw+#(ALkp}p4f~m7 zjy|`sn7zdKtR(bzq{sDxnJdR+s7jaeLD$C}On+|Cnx4*mARD=0Chi;Q&4NPJ*S3YU zsg^o}WBrfMG%Q6)7IHwfQk2KL+BzOUqL*b9NVn0%GUG?(@M(CrpL{GmH?G$nR)9)3kI`gJ(IPn*k}>gc3fVC4_{F_YMep$Up@K!Ue#CPaAgecftkXKB5KaXy*|FQE#SF<$a*Wx|>Bxf&Nh104(6t zVX9mnosxI2ui9Qp0~2W%WlM?Ec2WG^i`=}9w2`g6eD>0&gqv4h-QgqBkbfgJbMOmJ zRBAA;7{tmhtK2O0SRi6Q6Oj5Upd{OAO$^XihT_5%?1N1H25RObO7Ph&C0M7(9`b=^ z{(T~~Z6$M`NWW&H;YZ;t5zphb5rb%_5m&5*eTk#nrR+fI9-ik>E+i*Dwkz#R$#<9r z^YkBw$9*ow*2Bhs|3nTZ2T^F{RvB~uTiAm$(kYGeBLCEG<*XP7R3zdR?*-`UM8t&# zvKz}0_gcPvh56(D3#jA?5H;3zht=6_hZPji*|YF>IG*RaZbP%nUn1CX+C>K9QC7Fp zA86jr^HO|iBW>f0GA73$yOks#-5iHnAd_}Qk2GjlU?3@P_C=~1B!FcEhiS-9225ul zMW-<-5I?P(e*AUqfrT75X!yw$$$2G6X_ZGvX~x;DEOM0=adM&D(y_SrG&pjhHTME? zqgVs1aRwLS!2fDhxy*;YR{OWUP>2IR+(URCuUb{W&pBhe4y%&{uFTrB402AvbI}Ix zKr{fAsm{W6^FUHt>)!9>3-{{+1ce$w_8)Ifxp0oaKgn?0suv2DXdRGdAFkK(MJJ8N zFi6O&DR2~}gocd=BgE3@|CN9r2*qaK14WYRZ#I?R1`oDoD5H$l&|GlwGn(qL?*gD+ zqX3L2O5k6Vn4P_pn5|IlU$88>E+LgRG2s`AvhPY=YWBYFz#A6I(w`*Po)pIA)b->O zo<}n3Ao1iY3Dohxd)__1X4(qf7kNW`kSg?|WM*-UkI*t)lUMYt^L) zxJ}ZxXn<4p_X$BfE11NXM^`YZp4k#}#as%TFl^iVuJDr&*HewfV$=I*s(HoZaV_bD zWW}8Q^SB2P7K!1N)dR*c{in!y_=6;9kkEgU)OS$4NK6;BH*( za3<;=X-UxC%0*v5(Chi$!T23TH4qyl$7vJbz%fcU+&=zivSASQ_7jH3u)|Y_oeJOx zKzq+PJfC|K#=Naa|B(=>ULaoJ^k~P5X!`z1S3#qmG}Iu{L4Tqihuwax;yWE`bgLDW zH~Zf+=!ddq`bt>>SKT9j@x@(S&R0>rn}V;)5=bd388G4k&`Ai>v#UBl4qVWh`K1e5 zl_@&7kFYaxN;8k@yEC_SMl4?>UU9(J&n1KkW@S}OFqt1a_6h&nZ-|Jk?~ANF>Weha zuApf}$8VwuNy;`=J@vsfe_@y2+}QhXFKGj?%S2E$=e12nm#9LyR*(r)>Eypl(^})G4kXCNd4a|0X4$ z!?#%(8Zcn98iXEa@YnE*iW{5O`JqLs+g@YsBOEnY=$5@ zy^MVI7I7OMJOwHVj4<0p6e5|1?fVlPCkcU|8Yr{$B9|n{Fq-FJ%EiuW7zccjltiJX zYsgLimKsQPTF8$6SJg2@cvj%w`c&ZKqbiu@UGwJs?o>Bby?wwS-05tk@u|75UOuWl zydN9#WO}!GdaRO1W_EHlYv#jEyO?q>V1S zszebiw}@JxY9)i*pYGE&ftNjY-W=;(B3@Ne17PUF+#gl|>KOJYKNu)8^jmsRwwZbS zkR@RQ_)WSjdFH*db?N1d_q@5ks%PIJ5So9OZhW*;AUWb|FkM;9tzGKM4Vg~XuMiz>0=(wvRpw74=ExxT z#0Nw#psPCtbK;If(fp@-ljf*?UW6zn>>3QM$ zVMijGE6VaT4?Dm2j|Dh~j^*%PkmBaG^N+Q;03v8!QMKU?gD8LWhyOHQbSf75O+gZ% zk!V0u31t*VOntasohwRWH*38QWc(Dyaup9=fPY_7Ln>5}jf1$MEv~g|I%$;;AYKc? zl6uPNhpCJD%V8M9T$VI(*;=FdV$|4Re}&c36e`Wl&iaKK;j{Y+9*uivGSXI?Uo9!S zN6HuIz$>S)q%AlXrX^9=zKxqOf(KMf_V7ew|BS(3b07a8g(j4yK`_;Xh+`)3uQg(D z{iL{KVhd;r@M!T0xwGG-f;oOz%HFGNnh?H*`>+0@)_D1>`sxVWbNginlJFvzkxq3(Dyrz3t9wus`ZzJT%n-kuu^WjI+G)1 zu-{{|u)!V21#OaDCIFX7db2w`#Wsk-l;bTo&uq)>FAV>6CB+|;2 zp@hW-bQ?o^%&i#p>4=Q31Vl&!ok2X6_KvAg!&5$()Ym66A6V{xJo@+gbzv{!?2RhKk30s_?WP zkR3jCy)JFFd>0q3dnXlkU&70TwaTSYwUDo0*Q0M0UUq}*{<=|f|0mRqUBeZsvj+gd zw@YVZCf4`EV`#9XbK#h6f>?WTO^%I)HcP_OzKp>w@t33e0+ZPUa|(`}WQl3)0#y!Im5kcW z=zNIr1o~4zzh0moUOSQjQlX@&&p2^6are%Rj#eZ*B!qL~A`5Bh4LOeQ;=b~(Vw}Ks z6OZd+!PV9E78rKXZo%THQzgLi*syTv;S59~5MeBWar^Sv+k+yRwT9#{@Ds0}d zbCzlqo@QLTS1j1Iek3WF={sbx-@irJM;%)`YOZ0=?nHO0)dhYz*xZAz=X&Che2#$6HadOCJ4fP6RHiPj#GPjDWb#ABd^ zn99yM5fXE_f6|;Pvfeo;kslzB(B%#62#v~SOtXhbbjT)bg>QqjbO~pSyP1I6Eu$CqZ6*-Cjf93(jZAmP-gMcbE~Q$EStSG{Q* zjo#rZPN3m(4tA6D)AX~Vie(7XCDo$JUXE8XQv5py85g>M?%1Q?5aa9u4VOc?R5TB7 z1fIh}X8gx{wid}dCVRFK#pLTwX;4B+RSMg`>VVUjnc26p0=}cujhH@k_s3>#sZl3Q zv3kPu9%m(Y7TvekWw%Gr`X#tihwy*(OYlWS#m23%u};wrB;E7FCUm^n5%wQT>js+u zq7&}p@Gl&}O3@lyx1H za8p|3$b6<4Ev`^m772M1trTY~Iwy4*#yGW1PHA8LSK+2lPG%7Ht{2SQXfJr;{T4Xubv<#m397>k4VJGmp;uvalZXe4Eq_s}lo?HOz87-)U75bg zUirFw5vB5wy_yBpqWrrs%)E%4-CKqdU&Qjm%K<6Xc@7Ej#!nb1))p)H`aWIcG%d@S zcZVPRd&QPeNc!Rgua!_N?R5#X0XNP1+;5kryvO>O(#aXx#P7IT9;+{IX7q(-B~M0s zr?3gN74WB&6^wFNd_!vCDd(+H!US+$#1KV<6v&A~Xe48FP~{IOVTc^|yAa3K(4^$kivNYmK&||Q8+}|=apAC^FM?HnWn98%O z`VA@(z%Hfo<-7J?KknuqI`~vh+uVL&9N8u;&v$z*MLdS{PRR2)n<_)d*7U!IhZXjy z4|1}v#g|cj?ww-z3`++Y3n|Ro?rd`Etnk^6o>SbjvOg-0z31^wYKJ%Y{<&Sj2$szk zr5T>`*hI?O6eA?XzCShKYa)#thnz{Kbn}{Y2;jSeq`3Mtb^B>O;0->!@U4T;Mzb0v zwG$icVxwgXoe_(%`c`{7N1IU3Uw10ctE{3xI=VW+)R$6TV+mDH? zG_W|?+SA>wOUt@qP8d8U2`cos{LEDS$U5b7S?e}zXWi>)fhDglcHVO@eyRd&_+Qhw z7(N15O9({M@l6oAhoB71C9@a5XAmwL&=l`5Xh+uyYPrkSqL1T=O+!A&Yj&z*%j*Sm zB&J%ozcX6HdWxur6Vwl}VV|na4*l4jzBG9etYL-ud7!xj(j{@pn%=7BHr2yzm(O9h z)s?H(wvf3T#uQ!(0>3>mv~b6!o4$*MUPe^5cwcAvxF%zv(^dI)7#B*o>cFGB_8HpYHID=FJqRQ5Tx5|aft9sDrCi-L~+)YvgbHbD+bHh@QG{eV=0 zHbzzvl+*x+kKlxKhN{#6H$B_vABF5vU}V2<=-msf7X7++sheAxJ8>o`(?7NzLo~D> z=E_3>?-^QW@8fQ)``_NsXLhwpH6fXoK#0J1N1)9Qg zwzkEDXmsz0Xez4fO>u9~x4v=K_w&PD2jXjYF->npgf2-CdA3!WYJ?@NJUNEGEHP=1f)(etOk4a!MpT(;|f*3Uj3ls@D;u+C33P6e}RG|E6O1!~YiTAD)Z}4#P z22JHm26y>hP|k20;er&Q?IpnfT7`1AJK}ewK)*P0UpIb=fR!L)<3y!FwZfgnOXWh% zbJU*KK%(MHR;hf`dDX4W#x^!Tzx}e#&@aP@G)!04b9Hg~bhq~i{ZwuEBhS~A&LVIl z@|2>nCTF19Fs>N4gxojgX_TL_n>0fbQdDm^vDJFwBLknO0B|1w)ZEl3&iD{S{x!uQ zz>3ugao<66j3_#YK%lGh#%mid^&?_QWrOxg%HB2QY}i3Ytv%!PqqEhBnf)#-49YDc zhOIe$wRVIGLrvYN5LQ$#5$0BG)-*|~0p@6$ha`Y@d+^}-JW#aZ@zN>2(L3)&p{SJQ z@_kWmFOcbB(RFoTCSsL3BCVuB$gM<>UBDQgS^%<2r79}U^Xr*E^xX)L(J72&7*Nl# zESgl*OaMRNRI3wm|Lt09Ia8fHyD4IvMzCR%?Ls>+qjV0fc|2GTOWboizsyxy?Mz%q zcOa$7tO?{zduNu28CaD(f@~KW0&nc&-+K^cH|vY5udn;_?J)!b)Xrye8x7H)*%p=N zu0b{}Q#T&zPqKe080fWjCzyV4mbKLlE{pe{w>^lV-RyI{+{&>6`#Dz+(YbC`lmC6x%0R#9MHJ?#?ReU-^6n4wpzWHq>$=sMDu{j~WkYIV+q!0YC; z$38J0b@{>7N#l_s|L827gzKeN1!;@Lbc;x8_7w)2rSLH}C!5E)>x=$#gUso^PqU-b zUi4(dSoH)v-KAlIXQdZmpq1^dbFe9k6h&kX$I8C9Q?oC3>9Rx8XH*zmXp_r3jbvvf z<7sXw9c{6EU7e};09_X3N%f;g@{fT2F+$D`Px2Mer-+pctO&SkWW>Lm+WABh}6WwZtA5&u}>*8 zg71UQ(^T7UJp+`kkZrVcF0TiU!i%r zC2}lQFG2*0tDd{z!@+&~J3)iVD^d+8bb1=wmtasnHNi}y z;cb80UCrV07qJrhS;o$;8@rXvdIu1AHS(>{t3wx(x-tGTifUU6GBL}lMXw5=c;sH6 zd027Vi~km%tOL4)!CD&0x=^q6qQNi$|DBeR9yisR+~fSFLr||~v`=q^EBovRgM-C6 zc5ZSc_T7EOwd zhbYT?qb60AfzKf2%Lfo4iH4e$g3;Kk2vd>B)RA7b;0(+N(-)ER2p2?2_UJHl|Fz-w z^Lg-Dd3clJ?ZNV5(mb;xg<{}irBruZPmWyUjqEr@YO`MTClRJ`RG}Ra`7SKPGfI0` z3(AsEGIuKKQVy=I_$+Y%dus!;sTvGzyprZtQ75DCE_sbBN27v_b0L~g^qpbLSnGE0 zJP#E7OV4p!n9qI2mWUlM*T}?ARjaoB(>@ZS32rYHZ3d%g*NI=#Fs4rwpb! zyDu3$W3E`q>R{jg)!bkWLl*r9N%V!eJz-n_{Z+@K0X*83H0ki!qk`vP&I)>L85e%Wxgk#7Sb!jNk}n_|1*~;JPHgFNu|6h z3OxlWnJ9~svv+>%1tQosC||@fIcY09r(UVJ3>$gjKE?dRu`Zdaz4ct^#H2NP^O~&^ zo(9nhg@Ekjj-?8Y=1VS70W(bb>s{vTUsQT7z$4hzpGSIWReWzeSh`xgFrR1w#2DZiKXLD?^|CORtgSW-0HozIQjaXTYHxV~kWjuj>Zp z0WToL-e}9euCEv#ORt_2H6Y`)&WEq{*Uyo6tj;mE(0xe6zQrDj5Y6z-E}7M)Wernw zclAp1lHI>ev~No-t;g=mBKO(OenaMa&PBMo)91y{f3ac<2KIWvWOD9VLm zc|76D&8@<`lyQZ;xo%sh0Aj)u&AAehNMVgf>u<@wFz28pVDe2tZ!njZ9|m;Jd<_qtMb2#U;%U|tTj&l@ND8l*7} zy(VUx-Sx%T`>HQoF+y)cl{IV&<=a`w*3S$3u%0$KaY8)oP`*vt#fG8$Zy%64ZQC*J z`n*928t>_%pVfK=24dV9R6d`TWE*=w6&e;~r+c^+ndqQd=U=W?KoWMRPcW$9==!E% zevsnA^;Q(NY*W8_hA}BQ;^QW0B85#{z=?1NVw}e*6Fs6cz=st`qpl!Dn8aS3peUCb zjEC06EFVY#eE`VAc_KB|aS4IbJ?ac7sVTgKDR^f>ITT{>g|i1m9|5})R*NnR;IW+F zVxu_d8uV{yUEXl_4`Mm*6)Ck)c&^=a`{mqs*?0V&n75BDYX0#h&YtBU3AieQAL6nZ zHakKJ7IaEJfV`;X4AHdOv=7}7$fLp2d)@Htzc z>SFS4b@>x~@3AB=p5oYqB5Wfq;2B){(*z&9 zBX3VJq*(24blWmGl+cZe7;Rxc+Y*}iD6m!OL)O;9{mLEqnoG;YV$aAUcKOraywJbF z6^+rg@Zk6A&^Rx_TXa`hxzl>1y2rHjQKP%fa@gV0Z-~bcn{Mzq=P!gRxnWW| z?o+8eFlJmTzan6@iCnC!%`vk3l`dg}u^7Qz@>{neDoy#v!94jq;L#lV)DylFKl0)f z!>k|Ojma0VHeNUepSUtE{1lQQC~WN_PD`z=UXD0LOa40cSx6q9+nBEeJ_>53p8mk< zXsMuWIiDWcCP75g;eL7luxX%GYfrNu=Wj@2Z{P*WdVgG{-%@_&gLKvH^^!9S-1FQcTgs5CLSc1>2yxj3{xWEnyQE+ID3#Zh{*~5 zYdkZ=d!JyARnPBjNTodY|uTT?=_&`lC2T(R| zk3NKbebYGyhy@NfUNo`byxuj<)lIxPb?@`yIZEzoHf{av3Nc=04|eY({Yf^dqtz@= z^RqVHIng{-QvO$fR($1KdbPnjWDU&I$fq~S-;*CD8)gBn&{rvY=lzy^SZ21oLv7=b zJyGGkJViE-*W0}xw=EXnDGcGMc?Ze2yUTgE1J?{It@i+?po%{r8S(!Hx^!<*Q{PXx zPSf=x9rpWWgmvZ+{P8Zo4W7pB`fJ6oNb`mL1~hzpkD7zusDNIm!A$kCsa@pu6H0&f zhAyv#+$kWbN%OuJ`sH~3$~c6o@Xztl@p5>#DvSNbu-H#4_hOv-<>?+yG}Jd2zFe8L zQP&ZMKec=3WquEZCB@PCk&W8T^9KLqlF_RUw%q4w7bD)L7eMv2QMnw+uJGMoevZ?U zVv4{PA((vC-sOL-XeyFsN$MiNBb9FRmv%%FH2 zkXn(=pcJ|Ym8^%Lcp(k=btJ0qIB;})#_UmYiITm{Yl@6tzjM8Ln28~kCVC3_8<@iJ zF@_XoP(&_BC6Ki|L5TeyNCXXVL5}m(7X}P*m8|9dlVXe4<30ADf3!~Sdv*(+cXW;( zrUUIuE~h=@VAfjSYs^bmk5_H!3qs$*hwh{fdDd3F>2L7K`l0Dd0TI6<=ZO>-b+Dy0 z=43c&HjxvVc}foVKo^Kku{heHKph*Eg?mO#%DSDwDD}mY=cLDTiLTErrAxvrbCd1D zp$AnieAPc`TsWdEZinYOzGwryjkGsbG54U~7R!*^=bS$_u!)GMFIC?=M0>WZYa-md ze6T>&=Z|5vlBzc{{%GsE1@BU`pSp6hdg0i_iG$^WU}`EfU#b`Ezc9GNlP3|6%hSqO zmohB#AvtOz>`E5%G=_AOn!i&fC>!$|L{Y)Yz*4=?SoXsJgIqPbvw;Rss{WW0*yTm@ zB>xu+`eaV_PGg{x&5m=)EpdUFl5Tv@IcC8~8{V13QQdloZ*~HMXISmBOeSR$uwbfR#ozM_}qC?X5IrMzW?UIZ4;&rA$v-J91qYr4> z2>;~;1bx(`2j6SETza1xtx5g&Eusr+iwLQIUrTgf&5zMx^mU_6ay?gycAd#lHXaWE zKHXF#V!(VdnY4iYnu<8Ci;FJUQZaH2NEVWRPy0r?lM6GXjKflhCO=>%+)Ov;Bkca} z1}Nh1Nu{mr@#MQ3F1qQSY9~eB%wMDm3`%DnN^O2p<$=0HIv(@xlVZ zgn#PfFU>^Q;P%fRx zJ+laZ22ktkNGg1)p$tumoMqDg-ZdM&v{hV+wsZiAs_ocXdMF=OE|RDawXJjcZQ82x zn6%uvrM!Sz=fCm40%Pfc?`D_sz1TETU%q!GQj|CLUWE4)oRD}*RK&^LEJJXmS}QWi zum7X!tHSD9mTm(z!zIB?eRh`(FF zX!nJ$9o)>JPQIT%PT?@*eHqo+obOMLX%oeFPOW?PqXMX#m!ha+*Tbnhjv82& zq|qW!KHJvd6>N2w^_>A~wD_OF(6-q)C$#OAOa$a%*7#<(w6V~ZYO#r zV`)*D#FVI%(2H3k+d9=T7mk?-@ZkP)!wJ}7s@-Q&={K09rmg4_X5C~GRT#0L=F=l< z+pA`n8^_zKZXZ;73fR8>4U--j7+C&hvpi_|I?I%9Mn>?qB<64mv7<8{J1&j<%A`d2 zGdCbE-Z<2-wIpPNim0wgzIR)aa?{Ig8uE4tcA%sCKX-f=VUHIFXCG8*;YOr^N)+h@ z*eSG{I0@BxF^(?E+HC4mua?E z#`JndbKmC|LZ!iBc(Q;T0Yj9qounRz}SHjOa<Y4=`Y=XlN692oRzC7SjZ|5|HehOZLkoQp0(sK66|L(C-M?%-TCfK#NBJL(?$`jr} zMU{o`-uCJ$*i!v|v*7wB~Cu*kLFuj z`KgQzqYsKsN94CYC9_WCUTS4cnaJr;);lD76JpS*g5*3{%s=y&o!}#A{+9a_R54-J z#m2@l?u8a{BEnXb2EdRCSOvtJw2wb{fP4*T+<$$|4twi9yNZZD$kojArRW^7hfSyg z&+OUfK=ixJ58s%NfkRz;0-N8Zi}V$slZb+wO6~>wvHimOu4eD0ru{qLMcOh8_GxI| zPoO)KkMCf9Wqip*BA~S-r6hD16fOHfKp}?_%L2rj{Rl4k*oWo=O+f$;_dlHp;0L?Y zS~_}t!Z-%M04sa=&h7J^&+{E%;k_ouxeIyFYwe8Qpa5Hepi8(ULbG1UxA2;;m1D}Z zK+TyZx)9WHTEP9AxV^W-azQv}@%p%O+BZTl>|ma{vR{~e(12Lr@R*wtt0q9WTarv) z=!jEF)Huz5qG(UA$EYYCpD;xC5&hq+op~x(C--=|0u<;Y0NuhW78$(fwJLa^H>E|P z(3cE<++PJ)78=N2NRM1{3tv~?L$0>M_osd&Q{};>K=@s?K=#z@`PCyq%SQfEF?G#^ zlV_j;Z|QmCF8N`{f-%)ILidtMU9er4_5rJF$08uQLh(Zl?Iwy`Xg*19d>n<8!$)C4 ziTrp;3Z4fnplgTn-wedFK%`xGo=m5Tnl_U!MdopY{u;fFwOn|rQ<~I-GEplyYwa8_ zBSW*6NqB78{Yi$Y-I)Km+|Tj3|LmC;vwYr^5M3X?6n^BV3C(yQlbrLM`b(7P1RN+v z)l@CO^y%jcsair9RH20T3d3Lwvmv;lF@P$W>qt>51Y+~TV_LtYe8?hK*34vNYNyN|W2fGMEYDgRq{j*W}k}-~C5RKRvP?nEt4yEWm zk~Ne|>1)0{qdo)o(0Wg5$oHS?(wey<10abh}q|%g8{^gua*|2i0nhTYXk=r<#;1w3Ks5wOe6> z4=#N8Z}O_`-Uw2NCP*PQi4R8FHWPhGZJK_=(o4gw)eUF1A>0RGtkBBeop(fx2kGha zUQs`@&|L!S1X3*a7#7l2#r`y1n~tuU!#8JuW;wRYea$H6s8TpCPcQzP+>=aB(BDYozc@@5e26Nx zU_~`?#eyTnd9g78-O2a475_?MAAt9WrG@VWk^%?JY%P5B9A>ytrFCCo4TqR7u)o?3LQmPFnpzQ?XajDj3B8%=4T4f3R=Q~Q@swuuNrM7hle!|VJ}z4Wt#3^$i}aQrSL=HR zTvvrH9tOBw$2ZzQy%VNXY)#t-yxuins2|&LfknN1)qL>zt-r0Z1=ioa=IO*G=)soa zxh?nX-LK+FBGx*%69?!|(zxOohk`w^jYFf=L_7AC*Z|hRT??WUoeaj0pTT z6=i|{-6(GoK$4CqM=I3U(mnHG>=?j}{xp3?TVY7KboPT5)sN@2Y-5q*ZlX(B%pz0Q z9jTs|I0JPJuW(ztn^|Z5p~-X~Jbm5K_-ZAc?c!*k$G@akRQM{)3Gmr~FyNm5P=I4i zNIQ@9ZA%@*Pr>;%&1LU^2{jG~SppJyVj6?NRq?bb1;$q0aqNa6#+}BkFnj9%@-L=@ zwf%Kd#|}SLF@wMBj?z>iQ$bZT^6_-_V`_bm?Y1FPh0w6Qxq5W9x#V`OSyUobgKMGs z%?^uEHu2^}zor{?jx{Ur^}&4=k*3d-_j9Ao>*0zt|2kvLsg1PWm?5gq6ydlE%sF(M_r{t(e3{I9vR zjej>snFqe5*N+>Z&CwpJ=vA1f{^!n6?L4utB!L3NsRbL1fuz?~7Sup5o)Hkea?gY0 z_-nuh_;#STkAKTz_KCT}%T}|5%T{8gN!|2}X_z27*;-Yn=F(&`BjO4oh?4=c`+nrt zA zSTfWO6Bh5O94ehF&ZtnaIL}6~widfOD!cSOHN!ToTh{zz_pJjjyT)WQpgVrNiM_($ z$^1~;X?@y|d3gvXPmf5F|3sG`hOF>`xByL9lH4yTly!vv3!0wzJV}(j5Mu>{JaEX0 zsDyST`LLcU`-$$~+7P*;J7fiSuO83|t%O(JgX0l#M40GBrzAY_T`#zNoc`5^4geNsp zP5qWL@!dt_S^+7bVw8M<)?6HAM)4|1oPmednJ}OVSv!t4n|u>pDqoy&pX#awIy~jC z-{o>IB5&h12ayI%&{M6Z+D!MO2HXXYA37N0C==Mi59f~~j1jh#!B;~VThbqqblDu# zeCOWo=BTdd6xp!_@@WIbG4+bj`eez&v*jTKX4Mh^xRNi$`afbsC&Nk9sKn6v)zpQ| z3J8vU=@kDx%TSX+63CzLmj%V3V>Q2QY7il6W$BC5uzQ#L05k5t#%WwTJ3nT$G&njs zI`(`wpDx=G9Km(o6%|6D^^|_R+VveN<$cXbnqdb=ed>;LomPY83CEJL`t_Lr0T5rE zI}`Nwj#lLaoU_IwEYp~EwEsj4>WR+3VK)C~Y`^Db%!JZWPzE{Xq?`LJnUp|4B0+rZJ_U+}+DmSsk4WW!q2G zjE)JN91l*be?}%<_LJs+O$~s0b6VVVD!F^vf=U$}zLf=+=#9`#6bBSw0 z43We;D#Z1_JWjjko?B|U9UgTq9ow1GoYf%Fyh3F35xgu|d6XBF;yZcZdAgf*J+^t^ zOurtjU6kACWW1fRggr=7rjPzv7GX)s9~ge38LN|b*OnxacbNgA`rp2wRPFVVZ3Vy# zT`3-M%8ztR2Z9#Tzgf{pPJivxF$2i`B&iXMzL|D~x-9=PaNxOHhWco{#QeLY+w z&qq%>1?yl^F4CtJ?(VEEl;8>$4}o6~U3UA#J*O{DSs(mbTZKfJj3{cr=0R123ThCI zpen)w@b~5aWVdSRQ(r?q%Q-`*ht~v?REdfyPjc=l4G})4cl-QRmSjG31xG+c~yEg`PXY8})ys(#I?YgA(ZM5GsC602B{UeNpB?=M`CoInq;9 zBr#mkG8cj|im>ALKMJx-C~@V}s?@vk^il-AD zi2FpM6V6lIH$q4A-dh1yY>8$z{<7ZXD&8@vjb3m<7x>+0Ur)jxoqt~en`^gNF zCF)cVxo3oG>%#q-GgUV_e%tD>JiJMAu4VUe0NAUk%@WyoeP2^+i6Swqn~=~&^-Vx^ zDZEcnSRC~Wpek&t%KRZfZ+p`P&cQuippDJ`o7_GZ_D@wG*VL+Ft{?C$ z_|RP7lRzEuFc4~#X>Bt?$I+byz&SN-Ya%cFAax5RW6tbN6sVkC!p&1ac&vN!58n*w z%%L(C1(o;?^Wyle&Phg|_yR%3&2!(6BOxq-m%jEA_LRA^_$iaexHV?OkzZyGnmkLt zI+zRn)e4zDMXnlb=oISVTMWe+3$()rdM*+TBz8s9_!H^`^0tT57Z{X_iRY89xXWjJ zb{Qgvb4n0W8hU~Dr2BOFZ=8rByCKkV_8P$a|C9?`L34a3Ljup{oZS8fMZ*u?&WJKs z;`QTs@Ka>92?Sod^Vh2{++ZE6zK5d;Bplc^VboQLcNSr53jp#sVxb7!mfE`Gcs7_q z^7w1@;t7raqE3BqVj4ZDBJh7kExuj=efRdC?@B>}j9TE=!z%?@==W0Kmpw41h}W|Y z>Rj_{cg#<)ZL;n`%;BJU5L4sqaiV>zCZ>EdZ97T}D8DnwFGv5F+NYikYB5 zO2I1;EPR3Mzxk3O5m#uUR_0c3^Sv-?7nElRs60;=RZZOh1D4iHG0H@LlO<6?V)V9j z?o1}NpxI019dM6q(z;V!N7SO1j+HR}T842f^%P&og`>u~)COzJW^61xK1K)B8a)H} zQX~jTQ=X!Uqk)c};SZ~YqN)7}wV(u=;e8!z#PdT$83!qzgekK_i^SpNhik`@g3U7S z8!%`;P5reQ`3-@VvzO=}-I>8&diXPoyues==m7MGx5w^J^F2>x!+wpA>zyjE<3(o0E;>7cq%_t$)D$7i0hzb zuPvq&(#d=3sbBqEY{tsN^DM2f4!5P>4z>0E_gK3HJ5HUfR_)#C-n-I=pT^uDMvQYi z;e~w{iO`a|zS8>3=>}$Xs^uN01cj3D8wrZm7>k?Xpi+#C2+}1B)&U~#KqLMe2>=x= zH7O)W<9QL^Dr)XdBsA@6uh+)kN^YQt?j|H4n&6hs)7xC3+a@m$ zq@r0&!(DFcM%C9+je_8A-P#se*UG2%@mMrACotJS4w-^1F)S&$}aZcE}&wg;z_gzEKQSc9xg7pKxPqan#E2C zMB7_%zbGqb^S&z)oXTR_4F25k(@^Uj3}CGELLb+gaZMIWyEmfNeT>Hu`HU~4xjr`U z#+nzFqTFZ}kt$zmcHMkOpmn}WsAV2}IG=9r*>^1M$k%?h@6$|D$v;{540P(1zWXq{ zBQpgS?b0ZJ2)j|bCd&V$One5#B$F<$hvX!29*ON;bSGnbq~ABBA)NnlgQ~N>yo~^n zX)IoTgw!s`AMwW)(Z_j5ON9?;s6r&MMj_;o z(pxzN=+^4n1vBPY6yMj0?SPj=GP`0z(jR`7l9Z6Mkojmk-}rIf=itV2$532zsgc2x*@*R+9VZLWY`Kz!z z1TLaEz>O#YOJ5zksL#ao{Ul^D0^^(cJe2(khXSaG6uhO`Cr!+j;v$%ebYS^1+iILe z+?dp6Qlz@2I1yluJlbY00Z{%x)OHcKZ*FrH=C|Pq1L=(35%dg4lmxlKO9I<&DoOB; z+J4~Sfi*JpuemPoY!%;j?G!=gO3VbAYgh(ku4lAkH*H=-u84Yl*4COMf*eaY<*sJ1 z11U+EB8|LTl=bUvqqUQMe}=I&7pHJI5}4JNh?wm>DJ%7Q9lvd$#-8EI~%O)I30z9`zD= zzO!Xi^#gCPul&Q+gEYXrez@&f2%!9dsH=4DE*B`fj{sZ+l^Q{JxDh`q71g#+lQnq& zHhUAysb?W*$X`iHCbl_V68AYkk|_CtB%zQU)FW3)5_6c^u3uksv3Gl`T)6m|#O<2J z{_IZUNMrv1<^g$()X6rmU*Pw$iN^nI1c>4fwijx@EgBX?#U;NA{Q+)3+V~M7S&b@v zfqXZG(D%E5^5bX9_b8QAU*pQc8-GJ?p=}tFnyYUXFj4dYEucaNqiJ1pyfu*SZ%JP?OvS{yZ6bXXm0;YdXxp%Ti zwMCDkbI?=}H^QYZFwnaS5C3~}6Jl8=~le}I+Y5OrjyS`*`p-bJl5JwV7B z1{(P+_FLQnrmQ{@`NZY5hWh=k2jkm)jtZ4=n9hEi0Iz9)|n$JCK6M;%c>^qp6~Zd2tZ5>ln0n&;!? zL8|14yJZXBND$G>qHJE2K+LPqAK*q5dW1mx{6p;!9CDD09Fp&&Ae9U8Shwk6FCX&7 zM={5fZCR3kH5G$*ohACVn=NV{Y{o^P$FGhQOfAYquynk0QbdskZ5OGi7fi9l|! z%iXR(MHtJpN$Qab$mA;ow}E$=B6`>joLAX8nir8yX>v|Jh4@L|r# zAqa|XDCr(ek@&J}Kc64vH9OzWUA^@RKY69;|JBS?AYSi52WPJ+0^Lu9M1^oeObBAB zH6ls$1Lv^o+srUP<(uzU8iA7!Zs@nQ{)#T=XUABsdpxbb#a|vEUr`$$@pUl6R31Ct zEH2RH^#~|v@vW~-entG^3!<<^Sutg=FMfx}f+&@s0L?S9O#-i$Or?d9;M@N^6}Dji z`6(uNn`8h5y>nA|rnXzkVkKT(iWvQ%E8=zdSHukRG=(i2up;WrSNslvWl70rsCB6d zCPjGa(3})z2gxuo8u#-pje%dLRGa=-Y985-a4NphSAjiq` zGZ*9s9BpY?rQaiX*}RJuR_`Fws9^ft7(}uo+ct=Y_27H5pV`cg>mz@63HA#p{TM4o zmGbo1NY0z-C~F+1ia}v0jsWvv5{H25xUvF8FRL#TKn~Ppeq_aQB!KS{I>|0Nz`st_Y2g)MFE1XrXujsLb1qJrm~&fw9{R<_^VO?yKZ>6X4#@E} zK&VpStrh>``Q_~k4}8g_*Ay%2Wvu-zX|^;{DL21gwm~N$h9dxGDzh^%$G@e^(9Eiesa0#4=jIF z8Uc|XqyR+|r64aL2{*J0uzs0^totdpMr1h2U&kSo-*7FDZ=;^aPpx~@8dD0Fl}7&~ zn+3ClYhC3=f73Dhqpy}z0kp`Fa(ADY5_cV6`l;B_8KX?nyYO|Y`e@4qYLcsD5G(5N zc>~n+2;~p>FeHL?X|fy1->ad}_Cxn|M`TA^WzfYmMb?VF0fGy7$L9qGrO_KBU(Ej# zm|?}Dn&7oFn(_jZFk*+3B}(ArMU6=}NR}4YcNO#{zpB3bL8OGS=Ke(RRzMbVPuWBD z^eV1l{n0b}SB45l+l_tP>$&*;>8ZG*PF+>j@9BEER0A1_(fa0=#MK}9Gdvp7B4HGII>J7_llFy4RQJ3282pq&$upx7ihY8|WoA2mzYtFEu-~%72_)-4 z$iJbIgo!Jf!PPA~4og30Zi=J&Vw8HFhbya>nC8<{U^|QXjl)xrmMO^k-}f@LUK2Gg zYVZB=S*$*})fu=@6e&2)hkZq)+Xw2gy06wKyevKPOYnl*cV#YS93e|*d+=_06hEdl zo0W{D4F4u(OD2~}mI{Jm#l_MT`~w?~ro0o`lk_w-IRk2&=-d)%tj2Qj{Ud{JeM00z z6AjziVA4TY=iA**TlQ#?M|# z8b+i|fP#T@u|tqC$8Y{nwpv>mhw*|lLD=&{2)_FvGM0Bn*)#cXCtFJ8xf2a zUs2gMSCF;D$oQUMvJgsIQwQ$A^@fVZcxR=xgEUdikn&IEVWD{N&W^oqY`pDN<6Wj; znr?l2vaD_e2KJhUv%d}%e-fwR2Jn6o7D64aW3}v!6sq|zGFtddmvssK0Wj$rD2P!k zObNV1-(OqZa7l4Hki)C;v^uW7+X>0|!nZlnpdtT9$_(-Dk*Xf5C=PwKnDJP}3W5tM4&`m{m?(sT4W z<=$%EtL2wnw&zfH+22T2#b>&N`C%@FZ?%*oo}|o4qdicpsMwl4e_%t>l9#s1`?JZ} zN6*iR9JU3D^x7p{*k?x8sym*am(ih2^#87Yw1WN~D4Ove(CVjzpS+(2&g33XW^wy* zQy+eWOk!Z=(yRmGUSH>& zJ6~f?48#$PYpOu;$lMkM+X57iz{dJO@yKA0%AfWr?V;Cxu$2l{b;p$uwHzC5n0`QD z9FGfi!;DUx1d*osWjVn` z6{y0?k6o*_Kq))xo3&0TMtV0ZxbC#>y945pv9(^xF|%G0u} z-FUFr?VPX@2z2B)n2hc1c^3#?CSzh~l1@3P^`1kI@dI~SiM{hBs5>i;_PP#?2;wte z-p@fsqLHo}eHe2k&WeKCa&Tf>8lT_gcw(ktx(|>KsF?)G^gbVkhTlM{A0wZZG)x{| zYP^5sG6%5b;xX2)LZd>e31=JbF-m)K+x$&S#qXg!fh=P1*KYASL4AQVQGN0P2VCx&$S%EFXa&wXG_46k{hPF7m#{U(pn^`x^pj#v4FWsu+ASUKWyKd_Rw3Bu{-j zgD(yiKmh%q-p~dBo_8H}sM#wJNq6UP>BS}oJAABpks@nu1TdN? ze4$byvCx_18f+z>#GNgOG-j5v{PufT;F=PUIUc~~sL4{a+xDE9a>ED{`~=vipwz@i zpe27T`j`d3FW40N1B8f4fe^Y!L3Vo&Vx24WXjE|T$68h6M}}Pw*wm;K(VRa~^?)h- z&BCeweG3NJdb>n33jCS?-nckIig(}v;y7cn@fDZsVg~7gt*xxRn zyR;;Xbg9hC=KsEb_c#R?GhMfi;CrFQcqdRAa{S$G@rMDoFxFU~r~nQz0!^Z`5SWNo zH~l&2U&i}OS}ft*DtS|6m-9<3#U7RD%B8YPUZ5kWPlaRc$02S6iQG*DVtq4L&}f=W z?ix{zK%C|3y*b+zX~Bgz^DMi)k*mKCony?zVTelFEw3dXBAew{4zp2y5Q2A)S>%g6WWel2nu2VW&^ z3jG1XF@r#esN_WNXquXU?@gJ5PQuAmtRwF+n)6|vjShBV+L-x3qyNT*bN8rzc%6)X zP;%ftPY!ff-i?yJb{Z7@O>5d9~(|*b5*2rD? z{{7kfZ5G4-adRaM3~95NE%;QQ7!Rz8LQ3c^gHl%|;NjVjH8m67&YQk9_z(0v3`TE| z)qJJFExcCUYxIMZPOBubW7P;0`rO!6ZR-GV(4lWV|DSCK(e?e{@7)J6^I&ozf)wux zBH2}xP~Knh&O%u*(gW+gcfC0e%6xM==!ewnss6&qp@q2X%5Elg$M5O-mhvEHz;04U z&1hY#Pd_;uC5_7m)~F4EyqQsBa6TjMay*y`c@XLFnW1cG4}y=SEq!p}f(RHbxMot~ z2T?G5VEM#<&p5AMHpKF=kP8=zX&@eNM3@9bklbt#2~Ig$PQS;A!TEFcOhQ%s+7lvoi_d* zAM-moci5v>#E&Pc`9239#OPq6024bK;l(=_&U~_|GbY5Ery>%ZOTV>&@8L=`MPVru zVW!Mq*>D`QFeinw@(verF#8NA!?Fkc_&W)Oo}=W=8P}*Psl*h!Et4A^!u! zIKJU95b}oB$*z&l^)w8L7b9?=_RGh+i9#9^O@=4zPR_X_dH=tULx4UG@t==>h?Qx3 z64W?aB?C;n##&^YbJkyu&5_usd0y7iA%|vVUSLYStRA~}3qOEu#Arc@E+{yYxo;ch zls$csJV~L=bPP9+i$sxT7sibF1FVOiQ1WtBnmGrCV|VG0)D9lf*z)75I#G?}UCT8; z5~TRVMgBWSgi|JnadQ*Na6x$*!00;^z?Kgys3DFzHkiv+3_Y`QGyjI4Sz&`|WE9Jh zz6m+vi?e=#dtLU0w;4K>7!BGq+RFFgK%Ws?E8NzRt{LVJbWipM^I{5-Gj%%PU_2O& zB-nOF2YC)YhwsZBP<_W<%HD?&!TcM4^0I=cg=wOw*LWT7KjKT z(K=jLAE7!pS9q9|##nOGTdlN$buy0MR}1lm-%5jO!}2>Zg_IKXk`~CBsZuV_$xm<7AiFiGHyzt=*o!@0h$nSp5RlqEuu7@|LpgH zf2fd;0eHZtHckMv;r{}os6I%}N3bOC$2;cUsGT)UE6b&QTw6sE2I`MQCczttIbfOo zErAMyLgutm!YS>ce_sbnRQV}ty`y9teQq+_c5_qPd*m4vk@x$f+Ux$79?d*sr*v2M zUgFKN%>0O2>)YcGwvOw|4fDk(cOBpqL&qKAgn}_M9AwfM6lr0QN&f)r=g%mHhG@-p zn@{$3v1}3v0dga;nmc9JiE=R{!~FNR)1xqC#D7()SR^7WOd})wPe@1ZMUyU`F#1Ho zb$qT&NO5RPlaoEVR$YOAi%v!Udf&5oD|E#Z$y-7M%}UWQP;77Jy9fsTLCFZPPK*0(Z_lwCK6GmH zcA@>vh+xYB36>D6_7~E1xS?;w^94r+7d{DJXUTE-0hGqeKpQt4C^=}-&s zEM-nT+ip%ZFKsTCc(M7-tJ~sS=rA{sI*A_EP@z;L29%wh{k;4*zQ-OUfVlIeJ@}Xr zS7WC)iRzM`aq-pymF!|?iiF&uNuE3{{DM`RzR3?(FzJU|!h#9~-I&u~4>%|hbsRpv z#lAl@{0tv|KG0_}IQ)eipdHk>vX-KeE0Tt4y6H%AtS6h_ct~%68*}^h+dvK%qYbC2 z(rYpU(@2K>bhemzB60fc%taD(-RZNYsIfo}9b!lyCf^@mCBZ_CHbtRo>x{BjzW46& zJglu0ELZ&$m9|^$Xn$DtU#3dbRut_&OjSfc9yAcrXTq1`@ZHdRYRJWKyCz^Kwk&z) zryReZA_1{T`I+NvInTz6D|o2F`lhgr;ZOz8M&cWoX_VI~|zF zzCL{IpLuv)D&xBB2e#i{HQEy2wnx|3UT$GYoG62Y#ibP*Ffe--cPzu>YA%HS0G;$$ z9|W6*tM>+}_E^qDT!zwD6&p?%oCIj#VG8qgN(|h?>gf}i$zN{*Q6)0gXA)E602u?W zLk1Zmp6M1zFqYYg;AKGy8AHWXK_NkXyXQ^ewi)*PwbzW&<{HBuLL4@B$q=)<32Dp_ zZZtoMGg-ZSG=Sd8t-aQ|UHkcE5JxkaWKT3RD`6GV52l-bB0l^FkfE8XEm=rp*hXnR zL$Ku8O!gw9Sq$r|{hlF@1*2uVR@+zIOT*;_qJ-->kSByIC-ACx)0LSCXM4uh6Xg$t zEBvD4L!hbA|BTi&ET{%ypa1zg6}4v&x^<=IUK74iJC`4AU$NfbJf7=B?$?Fd%x_Ju zyiQ2e&n`LwnBZ~fXN+Duk^VhqLi>(j#mS>o@ z$#CW8PE8dJVV=36)(yQnm2rMiJB+qE7R)MvINP7>JyHHZxWNFOFJXWFIffjSYCIZS zocvZ538iKq?wK&rR+VUivsD+J;osk3b*MLRq4w!g(<=MxmY7xcl)raH{Yd5r!s0z= zqLVxrs6%EcE~jD<6QtIh$iinE0!#Jzz#;a1@zs;Pc5dqrkRm4CXwmL%?~*_MxSVdE z1440UngX7>v(gmxNX#e^@0=z-CD&4-(79-a7+;Okjq&tjUi<;pHyqSw2hxP@uzY`t z6%zgSZ9}Rn{;1uwD=Kk%vXB@n+B85|iW2zmQGGZ;TNvR;jF;N7gIAY)>|Dq1wdPcd9P+7&`DJ>2EFup+>1 z^6BpmeSZgi@e6#RZVFk1*60K*sNjl9dV<2Tj5prsD1H+-GXQGgY7V|{$&(IW8A46Ju%?8 zRARoyyUE7{_pSdFy&`iESSRHV3*K8@ZZCC_S$10G7I1b}iZ6I$ieq$s9HcxdON9tK}JN(TN+qD0^i)kbSKQ!ITSgvb_^DX%oE{iP#VdzIYUfZJ2e|6{XF6-clF~h0i4h-NFD@+M6zFHq9 z^CV+eUnF|n3?OZRx=9zt6KuS4hXqN!7$O$WC{ya-+(sW~6HJW&te}?x z3PEj|2I?e8&nQ)osFsG~1Tc`C>Zau~X3JTU>+=G&RD(k{y6Lea@DSP1FyO6U5m>y= zB$;Ok8uv$r1<%mA0ZOj*I7ErF${skl1W3L^VNUx1-cG?Z576BF@6=R`$m{1KqZ#B< zNS7&rn!Wc>+V&e;N(-XKMDJLhjqn8eQ+tJV zarPq#;^_yoiD%isk8cq|ZA0^q;M`=#?E@&?IlsT>#9_$`$nvAzn$(U%$ z=XsiZO4q195PGbqBepZQk=2}Lz;A>oF@Pg$)Lf?R+zGqLIv3$7rPHO);xpROq&zkz zrl{g#Rgs?#AUG)$2wF17rEdU|&h{uElyvrEScL5|?AI)}xa6-~i4xdrQ7ez?O_vmu zI}9X3zWt#B8t`|2LNsSk9hYcWT|8DO6fP-I8fGKyXzw)$Z#~fGzdQG2PSZZfa&3MQ zl(vYzMb%2iVYSNpP?|p5uhozT$_Fl;M)+Zb>nU;Ej22Vo&F(x$U|GM8|B`!U!ADxg zbHP8mySX^??m;{n0^J@Ruy{qVN5l)DsBh&Fm-2=T+J6(}p=yRfame-lj{kY+H|930 z_vEkCpi(b`iOCiYv)M1r&$w*2ZqxFwg;j={O?3y%nkZXMicTGG!ZPIChs{%8w0)-U;&wh zpG|DrD|P(W_LqU9#-K5t!;Yaa6`icgX*;;g8t4)^)QJ|6)61fHZ2FBJH8!TH_<)gu z5Y#kMY3iImV4K29Xu3ro#YJ=BiD5!bl^Pm-!TD8fqcH^gUQCn7WEWN%HTU023^CCt zQfcj2(gOC(1mv6x!0n?wEWhL$_QFjQM*adi_~JRCyXl>WB)<9n&MJ8k`mO0DxtH%a z4<5^!Pr1gPEzyr16kfD?IxAmiv4ck3V zZ--NHd+mxn9FB@G=D2Z|wd+24K3I8b=hN&tQ35oqR+=TRBa4f#=M(2horj(EmDhSe z^w0H&&(U#|aCrUD4dBVB28yM+kdX zs8Lv_{#KEYpm61}xQXQ@9(k%06+L&ae?dw7-MYioP2y(?J)FAze&?A=v3(qYhZj9y z&%A20rG+@S2fflEh`oY^9XM)Px%&C813o5-L0FL~ZPzuz{Q^ttqKQ+<>0n#{(VI+U z#ZP`=&ygtwEeE@&Og4u!Sqhen^-G#=+PO{Rp@T_vF_iDS)I3ypBJixo7TsiGOjfr| zS8AH~Fff&+P?7Kcn!Z>V2~2v7-)DAnZ)=+_btYKC=byp`wnMT&uWRceghj8Qu|*vq zhp9EZz6>@@eV?nyncXdOuy+D<=Ey0o(J`8_koIXsyTI&uLEXCH5b0Zf4o~TPm`pyq zSwbmVdP3uC{d5z);vv-iSIb5`f;-I?JWfax!pQ_@jLxlRB*$1}QDvMC$AKh)APvo>#`i_uhBz7H3Dtt!qb_ zZHsfgcEl+xogXTPb|8#fBWU7S7CTHHGyFT__t5;gNIhfx5dGustx3lx>Q#!Nquqk3%HFE_|v^Lhc zg-cY-=~^KVowZD+z5&Z;3FGX-XIsF-so4X|Yx$vga_A;`ai_z4PiH zGTR*w6I7Z!S#Ay!N|wK{<|W%mySeUIXehhT;^xoRvvuJ}n#rcy{7hf&>ABY@Yafhx zYItl=^kNy{`GA&O|KqHasHT_x?ai2 zu-df5)9v89|FL?HD`{;VZd@J=x zCYzxaLH;xR89VT7jeb*pdY`2X@#Au9)D#XGHs8r5IUn^p7b71bDu z{>e*18P5@2LfTB}UoP)c?JXp)1T!q9!k*vrtgzTPE-9?ZAWl*TFOYj+w8XvkctaPb z{Ty1?+H=^&PtK5;xu`b!96)%*AVL9bJ%vBFI;Z%W^mgG){9=~*df z(+<9Jti*jlLbt}C*-ujTXBV0Vr1u$~J7EFbr8P0xLr_#>1$&WK1vuGLE zUlRemAuq7W*aJW1rtkL5zwR=6nVjfIXJ!`maeUEci3V~7e(rJ=-_3SBshPR!7#1QO zV=o6@kd=@1iq?sQ{kV-filwJZCfDs42ti ziIe>p#m^t(flz^#$uftG`n%Fh@0nQm31^@;=ux_edS+hSh3*$k=CpnY`IDIf{$xeTq8(bv;YbAqV`O*Ip0^Up&vBioBpOOmouYno;vEB~ zb$OYS_;ZAZNPYumVN#8aWK1Z|0kxj1@Q3cG&*KDo=GuZ{hoP*YWi3(#2FEUFST%s} zf9v1Y<*d&+j>?iEuG({{gC_{E#~&iQeIBvx8J~`NUfTp6Avx|Z8yeWCnst=h$a4(J zvOHQ!P+v;UId&gQMZ@Am03*(AA@bD97A~A23@uYkSKH`NHLHc^scXiUMVHmYHTvwh z!|4jY*bW6_frrs0QcT~+pgVv7;(O}`cu#W}*7PRs*3GKL4T5_B#G=d7{P7+pO3c9_k+a)GX^d`vDgjO5j*Y2r0-|rsQY>@|YCJ7t=Edmrj zyotXoJBYrDzw}c@uD)@}}SVS*!733c}zVKmTdhWpgpS_flBX|@yv6GMp*x$&s zzytdV`0x}o0LeN|{zsRPkNFr!i=6e=mY6Q|NkhlIj}Mm1l-j>rTG|>FG`QQc^rK^6 zZqZ(bSyEr`Bq^^7!z02}_PC3=Je*3h8%}=H+h3s!rsH1cq>Q0yF&^~(Kc>Dq zE()i4Sh~BryFt23x5`BR>F)0CM!MfqfA81lubI!W$L;RK&g{gd z>_sq7KCZMSZnh6%B#gTsJ=eC7rjMbcai-!}I$@ec@p}#W0xSk^VyCoLORpDckt5j~?s~qmP9pSt#3IB1 zPB_Y$*c>AQWd?CvT)`W!&X^-T9nS9&9C3h{8e+O4 zt+$8>kO=BOOZ~F_Y@l$g-B-i~)3ueOM412PeNQdXf@Ytvf9Yx_&ZC7HeOm%^JxIR& zkc~%KZtLU8v_C_kVN-{a(}1S)=H&`hnl6`p*u?M3xGl9v3VNv~3SK0WC_R)H{U9C& z;u2DfiZ?ZWXsgDlfotC{VB^kb&e`EX{39%YMkA*z8b;b@9+X;ICwPW=OTPLe4*bf` z|0foYgxA*(Z1gzu4aB9{ch zTIpeGXw(BHvd&{;!E6)<9;ob$hD3*$2|^aHA&XIX;;TP04Q(6jyB9B)1?zEBci8++ zL`1P%ev{#MyWm;(Yc^mpXj{H0Tnvz;<87&I(8Hgjf|~i_PwQb(>SP}$XW@Ey`kq7Sv0>FI9hub2})9q2}_lPR6BtfB-%P7(C#_u^L6w;qp|pb!UKHeqChWJXZv)(hR7JRG9mfM?9rE(!cS z_5V*d%O^dP>BQRl3wF+*K_YXv!A`A;H};cz?(`p>VV?uULFUDggS zhUD`;maE>MYofK&*Ac{FwC95al#`| znn55?KS+-Zpw033Y(pmekUFU7QkiY(7PWR7=l#g57esbqxv?$%hyrI-1R%F%E+sWz{8L#xG4Ue% zF1Eli3s7j@a&}9qpQ)9gHZv3wIGg9`0Dfe44l6n?oX` zqL*S(-V%f84md@(aC~igeB@$2AK#y~;aK&(fvAoUM2xa6(pY)SmW8meG_q6LlaLm7 zmE+nq1?RiDxC>s?|Ie-5$&>oZ53uYQf8%Z9;TU|&^)KeW$xMz0H7AqM-S4WzmH0kC z?`ESJi7*5e8_gNvRf;k3h|ii@*86j<{ijZTfBE3uEX2pGhZk*>@1wGGEu4#u>%Nau z!;d*~5@mprQ0_eo`8ga6^QC1reL|0;&-1=!DU&2~e82eA{c+SbCHTarz5@>Rf%>3S znzkXapP21w~3>t-Oml=D+02x@#Wz}oiBtgrJGL8y!kD>B}%B%q-QXqH) zDNS1L{!UA0g7OVC zEhfl%8&(eJcM;bHdfDc=1Vex?l8qzi8%ifrL8fK@`3WDUrn*@_W@f|b7Ep7j>Cig6 zsp>G3X_oXA>8AmnFO$ctJ{U-sT*fi$%u%9n45BZmRn8&<&1}HPXf=)rm_8eLr?zD> zJ04lbJ{0^6rr1?7;K)qDx9c8p^wB;sjRMfPLUi(3iKJ65QWIn`5;QWsC{3HI%J3vmLIx>L$SKmnuw7Ci8aDFOs4Mb2QIr$a}HY z(&_)*7c)oM`4l^Haph*{V$+UER^cJjzSVrA)Y_MS83N-Jmqy7Mhk~y{YFfc0x%ZVKzR~gpF%wyOH)l9=Mnvvw@Q(veI?KF|&K` zq}Fu@P`nbSoPMeJ+t%XV*h(=Ao#IDtcjg@{8j_Jy^3=)czdI`%v2dRR9Y@o8c%7;G zrZt1GohSHHF<^$>zVmL{UAe5L$-I>fQSZK255tZDPX0}8C~Vo(eKk9Lv4Gm8Jt|{8 zLE{6njejuLd8WD=MeD5B{LSb&4GwcpVZ6s}2}Vr!OS{n8s`zS;=%mE%K-<&x-s(+W z33q?6;(`^slV1rjWE3c*qDCn>X>D4y)$M0B&)vagaJ-<{F z9+0tqZ(jsx`=IUDG~+nflMqN%6c>l?Omu~hiY8~>g#spuqgaw;ai7*mRRTL zuo8U#`@40Z5A+GYyTP^24dw;)d(mYg(z=po1ep7yu^L=Z(mN|PX8GyP_Fn#vLSQ=B ztUDY3JpX%xm`J@J$#3ab&&G5TwjaB0LG{n==}vu_fZ|9sV}L*sY17ij&^7;JW>J+- zBr&1>Xo#q=3TsM4)r~w9ataPMgKX*XlAuFR-evY(k(qu*yc?V>*9iMO!mltUh)q^u zd9mcdI${Q|kr#n6gt%oTN6-+-|I9AcU}CD{SNTLn&eU^d2zq0d0%)ANpQ6imvjMnW zGeRV%zY^Z=s)Yv3gP8LR*;7ebc*jaqO%>aAYI!w4@&$zW1SScP3{z!!kUae~ar*+y zz|B+O{G|x6?sh0Bjj7W#e6jB=UsKu~QP&t>N{iQBKkH@XMN?O>dPfp0HN_Hd?v9SF z>sj(Xi%qnpg(qHCAJe;Qa|~MbuZSRZ2CC!0sOp1DM^j|+s`O~bLBV12j^m;bef7#R z#2(Hc&_{6sU^4nWFQzOsQM)W(GQxvqwgrgSzirq0y=_Dl z8I$|yR%pGS{VAzCid=(jfB%Z?d|al6GWxySqF~L^cj4Nd#hCx<9sL4hn$D%s9+-s* z4U{~y($2Rs_gJ^OKztgL`C@0~U*TofcYvBC;!*WH!4i!zvb}SIq16v>uPNoWj}2h5 zfNr+aO6FKTC}!jWRc^TXl0|8HzI2euRHnugf3ziCDo0wPsA`tG-8bSSUZN%k7;MaT z+QZ4x>XTcKjzzCzj>-S001nkrWZVGMlu2nL9tW6{7$s_dNd@pDG6}O)_>9lnjN|Ll zIL}>WJzalmV|LyP@%=V3=o1#?9It>)LihEh@;reAwqr_S8Vxf-t+A@>AF~$p!A!5Q zDlkCig)y9iCSXBe+*oKI%uHlZ3$@>A%QF@eN*jEWmF}PHFkTy}-dP68{FWU?R6#&o zjibsFLCp*1q1zZmpp`(=g-X*(I?W-Q-SRV4sb1kVQ%>avpRyTMSa;EL(k;nZo#iq| z{E);~C4&6|hRH)R_2@{O{v{4$l7EZ=C}>IR`NK#?o#7|NLCz63`!^VPt4CL2$$VgAst~0#BU5J^+$Blcowl(~3QP8@m$z zisEifo|d+yC73U$)<$<406#UvAIOJu5mDTXZEt-H<4HaRu{0Q}_9;fUtt7ABMFSv2c*_|B8uQOIshQZ8Ys(I2DWJY0 zs$mu0Kf0lc{xs014vkv+qO(Gz(aBKDrb_H#kJ%nm7!rXM-F%6XzD-m{`tEGm4+_oE zo2*9T7@5|&GGgP$#uDwff!S~~wXW`EWxm6LlpobgU#&U5%2&}5#{jBTaU$u*?7m=S zj#RLXY7k}^-#C7mrNI5T?$X72$DV9yGWbjy3@I`E8B53zTOcftw*DI(@mSSAHltJg zYJB5Q{pGhv(vCetR?Gw6x04Z=riu)R&gw{9kuhL)v}o@HXETfnH&W9sA6tl@&GYHY}<9i##l{n9*qg_yWQ-g(e()X zHUPT{TclJwZ&%QV)O*9CafAVTt#JKU$h&sHl#9-WRp=htm^&y|*`)8x{?rUzgg;LHOtf z;E4IJAV6Bco3{LpBe&|eIu!`ZD(u}BLr%64hKg6VU&ju~9VNbXE42394Jlqlf~}Zt zL#bDDi=2-fe^zQrR_T1aunry+dyLJrN@JP$hW@Q>Lvr@z;0D|uX$oSUBnG9;34sjD zTDR^-lH|z7L+e7kB@5pYK-aX7y2;QI%fR4jiVb5ln9i50REze1c5b#Kjdu zNK)BW*2Lpnv4}(xD7n6-Ztaf|`LID=C~svZ}T5&mF&yTR(E|w7DXL z2hDQ7^`_jZ*3yAYMd#10wIK^Z&Q{-d+SfGS0MKr{(=45Enl{vG=P!1BSbuiU@7$?x zwi{3LtC60Iuv3D7i`E{P{#Fy%c9#>_hpT53xRSw>gO*T^%72V}?)TLR#2tOVxuf+? zLTUQ^B_x1h_Eq1$?e)%5Fe=aHR!Sd&fgjt0Nr@cs`y7L?e<^i21^|*4Cs#Y{=gz4n zVgzyy8bB1>>*1jt1MChu4mHELpir2Ktd{QMU-MSXF=95w4qZ&ST#`9n-V<*)S&}S7 z{FMoAD5{A(bisJ6?H!n?W5oZQk7C}KWp^AZ<-Z9k1|lfcj@V}`+jS43vBuMjEswn0;Xd)PlW=WGGUALX<-@Va*Ce-Jo zPG?ufQ#9p9tEAQ1g7d{82ZydR0plPK1 z@U{oNC_*;sVJ4i=ECS%9o(eS{^{EkwzNq}@1$`H3=Ysj^>{je##;FvuyDc#gVkWey zY@|InqJ4SLrv--qc1A;`MNq1<60(~YF)<*G*xhk!oLcg?L`}=%u@dQ;b)+z|v%c59 z71AHSfimNAcW&x)6by9=4UM>R3|fE~>ZXSfQjGX3*nr>F@q;2?F>e6Ws-Od8kzHi> zEh8~-cq+kU^od=hI_CrQwNMxS(9SP$mc^zqg=hS_cg>TGYiH+2y)CwxHsw<-8RJUI z>eXvp3DSV1TvbX6^q_CwW(soA+0zOBnvGPD`yc!=2yWmUW<-n-8;Lyffap9#TrG#%D~7+{DMFv1JHG0}SoFaRyTlJVGm{US#VDg}f${G(w6|su&-- zx1JXVX#d(IusrNX+XKY_CDL!uQzilC(wbtGOrE4~AAgaK1jj-o8EZlk;{A{9_?ejf z=uLirmNV5_k`zBX7Z#Y4r@r0LaG3O*)j-tvQ`qvXw4W;MhiD!LW zwqQsbSy})`=1h;HLJE>wUhVG)SXzL1rVz5*BjgOgnwAmzN60lg``DJJc9kz4rJ})y zce)FlV4-~fE?M5^!ni#OW6a1XSmjz--pf%7(op{C&hm~Br=?3|n-rrNV{$dtA5eqR zUbf4zG8}rJuOv33)psKz0aYYaGWJFJ)6VSZtLoyrSQ~Qvy_d_;?MVK1xU%`BA7`Zm}wo*r>0(hvF;F#YNmVyQPzO z;l3PK;gZ#}Prp8|0AMojb1e|l;TLLUdqPzeC1!~6BxvJHpsC=)vX~^a{zL)cqT~pl z*qj^=fd=4$iWu9U16{1cDF#0BKpkOV7L%3W8sUs6{X%q(#2QhNq#(j6MrcXd!2BO} zO1Y+0ezVLI0kKmg+^Q!F@-03+4kBnmLg9meOZP!CLbCbp8h%t{3P#>oHCc!#;Kq>?NgNG@ zY}m<$BaPdkS`7!mnZzGA#T+J--;eO@8m@6VKo3zFY0pxbi86 z-2Fej2WqB+`Cqc(&hn`_nD~Jg88}hC!CYtGBgPI5#qnsc4i#k#2skGiG#$M>d|+|j zZP4e;HImo}YhW2w?>TDiTd@QPR5Msgbj#L;iJ|B*AG!{W2hL z;LvAsbP$V?_7F4yRg5k~*j~n%ziJ?@x|z{=;QrNCQKAc?&%C8dE8DP7lRLpZdvy+g z5*rN`US>_`1wxJvYT<+yvGh-#S;>Wbj%MrTeAv7JRUL4+G6B_Uj;3+j3X1!5(D&!UQal|NX1G+;ZF){)BT~%Ye4jqMdI*db z2bIsKgn148j$pLPSk=nTOb#^?Fdw_|gIl=82C;}s8OdgD;X#&_0Qrw%~8I~KB4g&y}u1$F}xn&YjD6ig1J1A|J|5xDL5kJGy9NnIkFClOd;q;o=t}htQqNmZzN|c{C%^0RR7vJYPt#@;xcWr>p`Y%4yzQ zA&F(-r3gEFV=0LM<`EKE#jUGZ6Y@(|zZWLENaP9suWG&U$I92%FZFLe)s_8{bLo?i;=E4lW#GLr z1fY$kMpi=CPR_oQ(hQEA_zfTk^^ss*XIZue_G7o-BZzC!gfO}UQ6UflLvyoxs8k)8 z|MzsKm^{oa154GrVw@zK9EO`DTgsy0+c8JY6ITGg^d5T$_&Lx}!{=c9X*)Z;J4<}# zIs1_)>DebLb*1wUyvxXC{1VP=?2?@LkE&aJYJQ!naoYN1WiV+7f03 zw+ajB_EF9%>r>%fA9s%(pLTxO(dN}FDc*^TYDS&rdT(_?KRDjN>n4@>R>fDtmW`2J zli)=?y8xGJ5J7$eu(4ifNE`wdh=wrJ&OC{v*g^7Sv&vzBXGgcRgaCGk9|U(t)Bo6! zorg}i#hm(IsI@Gsk*HU<@FOD>N`7;VK72M&mek|| z{9vah8PwipXD0|ja>V3ng#80LR2Bk6j5)^93^IJmT@$pJlUJg84GyYX8AC9rv|}m5 z)`PxP{WCtK$ zbPCn$?iu#pineX*C;{A+N-fNFGjml)pz?P%bKHG*Y_r3A`?4$!Ab7bDsf&IBY&1g3 z8uoLVd~km@eZPZ&=7qzFZdbk#a=(eWIqI>Rd4FmHH!pG^aG&jBVkgM@&2+n+1j~7 zSV+!mrUc38@C)pUuLySv(g8G24uKxzAFvVNAo8x+L>p3OXSe*q1?+Ib8N0u_yR{f` znD*|9YL9L+fcc*d)pPT1H9%g*JGlp~OU?cg|(KRH+=l)pk$i2r3WqZnc7eW zP(bvFq~N&WpK7;0ICeZu*2W%WThyZe0$Q_?Mz9Q^Bf+{cKLK&S}Q_QPd^pX{sGbV1! z9$O9<=%sm@Bh&tN2@0AK_kduBIn)l4xMru5mRP=mJnT|0-Jy&vAecO9qxbOe$a_XO zbx$>;!Zx>YA-C2KD&BpSipA(c*^y9Rb*}ZHknBHLt6l3HFGu2~rD1v>>$*A*KMXmw}mUOFN=j z{qO|Xt`y8XJLLt~4w88~d9`fURF%%dc;nV_&h+tdM^^Ygl))_OR~(Y=N*wl%IcYk2 z=IA3IDzZacYJJZ-UY)H~*vFu7ywS_5T;izu!6$O!VIarm`8dlg+%vnWD_yIywHYgZ z*#t|)MYP-lBNZMBy4Mzii}F3>Q}sZ92;By_Bx5=^Q3VaK{1RY@A0SpB+Ms3o$3^$o z%3A>=k>1JosBQ8QC?GDnY+`L=;DtlY7M_BGBIo0wGJ5yv9hb$189aM^;Pl1O_H^(< zt?-&}6QDF8!t1Jk|C6)eP1%>v+`l?2e!dFLKre*XfErM2l3Q3F7Afoj%|pP@0Ch_d zz2}PnP-|=6U566S=C!9HJ437^)!L$uq@v+upIerQj!mbTMnw{G;p{xb-y$=FT}R$; zfgT7*4_>tUopkP~-@^q;I`0ap{gZUAPi)~erk@N|U?k)Lxm}=HMGglqJoZiCL*6&= z4Euj++?bVB{am2{$TaUPN0l~tIGovA#?3qyQ=P^EnT2`KYtCA)tqCj!$o`*OlT6+Q zl!W9pwHA1kzQvxb$#|`~nVnf^6zFWDbaI*Zzrfy#djG%F!9BbPWt~!IN!Suc8?p=^4@r5? z8y-$YFnc@Aye=Me+zTK%hS2n3nYVR`$_hvKk0V2eGT0o`R9=hs>p|HG0|5BKgW>@k zJp0RVVF;ny74F23Cko>gTDb8K&n21aaxhWi#q)G^Wbh^Pvm)o?<;_LA`x*-1pQ1?s3gNm?o9f8KNY+t2vT@z%pFO@5= zB{DqWSQ<&b+*-wehWs)50KfbHL?@Q^tAz@GE-Lg+RWBv!RGS8h(qav&ElWlWIhQ-_ zN-kj^(_(W!s_PcCVxW*>pB5^eA1qfYs-tgSq9*YjOxc!?Z*|OSYb{wcsXWfwOWaIt zGI~PSiN~OLwMi=OXq1-{r5Z>_uN4f_LnO3q?)n!CG(pJ_K3 z2PnpT2Nbg?wfiIva3nJr_0go<54%eo{<{UBI6PKa-9*W4E-`qAUVlss#ng~9wk+`d zD?cS5Ho6^J>~1Xmv;H$})=PV(F20Q}cc}ls7v7Zf+ol_2PZsKKJ-@=0VsFbJMMVNV z_auQ}&QN=2i#{P&ind4L<7-XF1@*x>zq;L0;+xD=%>+5PCCwWvCLhDqRg~Tjr-~&m zvWK}E527sON-dgI+V!y!G{B60B$y~sp|v)^P}v%GgJJ9Z3V%nI?5fV1T6)2W?C!RG zviQQ@6RFMZr=3!v4s-pw0?UG8OWDd@lsGvJ|AWkvi^W8OL*1dVmanf!ajIKr^1Si2 zaW|+^bKQ}#zkxWRHVT~C>Pbm8s1WYaT)m1C9-~hZwGZ!ZtE&MR1Mg%;^gEVe@~0h# zw1Uro_q}+mTPcp7LJ8!MWyxVk>tkv{RT*7Kl3YLR*4y{q4}?bPf^W4qBt82~54!EgxFG|my- zUyVX^JqkQf1=CU?_%e{%LwW9r4IqIK5ugw(m7$Pa6m$OCc*bY_sIYqbJn$r7@dWuh z;_-uKZ|#gzRdHzS6in)uKpi@3#pY_-yBqg7I4appWQVLJY~XTs)nV_?}+%+bpyi?o#=`OMm~&-6AGfRi2VUh*8-FiF12yvMkvt_fMHgn zm2ETxufuL)e7oF5Noc9@e{PXPVQ5yUFr;9Scc<{RHyNxAX;2=?5uteT=P-hoT22Y|=?E74My_KiuE#Q7i zAA)i6&&;ErrC8`D5vx*blP|@bbO*>5Fz?J+qP%3;Jz76iO-@?FQ(5*yZ%xO9K6$V2 z2_KynXUFr@;XyA2@sg@GRcgV~xD`p<=^!a?y0}B}BY4f5zD;dhy?<{_w_MBrjzEH& zNrCy`!@)@geke-LU_3;kttk;#+PebeIkblb=7#a_2w=^%lS)hj_tG z#GhwNd6^k}N1>m~z8mZzcd#pUFNDO~tFMOfYwEZQ@KVBzQAzL22g(CJ#*T9{K;WMO zufKWsa1r|M7f69GefW_%RgX}8fAu9RhOh9ECw!&o^tSklDy7aoG+tPYR6kM!(Ix-d zk0eP<@*GIwvBv}e^3_%#JVdz721hlLMtEQ|y!lpU7C~ESs;I;GCC+Q`og6V(nvRug zkYr|y-WE2oYcZ7$L+5~-kaA2Kz!IjM@fSI?CMG(N9Av6e!R}#h~X1bP(f5)IN$QD2QM2xIc$6b(=$$Eo3;gV=}rvvxY@>p_oXBJAEYiFOI1! z{*AbdyKu2 z*1fBkt#x6A#-E<1nOUB0r57=_vpIRWn0?DQ}GL@F5G3Rotm{7#wqj*wMqjf zl0t-q6bxc0;efuYifaIbh;jsaZLlguR}&q#H}IoVOzRB?l^>&_F^ z#Yf)!vlL9ue`PO&`Ye2;k7SczAW}O^{m6`OK`;fcx?NrMRYG?91$$Qnddg+FLlvcJ zO7B1qk+0n`dtLK_THINnr83TXQ3)>mDKPRS2J6nSc$s=vL{wdG=%YVC9goEO%D3$x zokl z?S>#15Fl-)6(H^Ui;{Oi$ZmS8fSJK$=-nHiRX2w5Y|CKFoDbY##DozN69@deyP$M# zy9hW4{R{(Ia|EHJYT2mki|!|2Gr~8B;@jc@w9|I!5-W)B$A#A4H}Vk|NyCckN>$&x zYkadPX|2OYKX@O!_Cu;jwITA+VVvY_*>w~NlG2T{{!!H=^_rEbmqY(ERH;>uu!gtI^aBCzSLDnAM#zE_7&N)71w8yO;mqZv_Igp_&plfCWMdS2g!~+ z*3A(d(E-ms(MDf~6s;DEO;n+OO331d^!XrE$jF%H+dL`leuu; zRR#O9z&b>BY+&qr{&24isIDt=ANOU@Fp>XqXX3jJFeR_W^Jt3=sCQ$n%IdaX+5yQw zm*?H=%kKUC`pi*PrGIF4Q+xxp>GY67F3Ncl-{(GzvO1dO+}$?TW%};%=C)ENU*fXWu*ZF`aEteRb4L&vtg-yp4iEzp^BNpNQy_fG!D zqC!l|ScqTSy%qo>wf$&c?dXI36&-*sRDBF91&Ek2D$nOz05|UG=IL$KfVx7306gt8 zyJ9%;8{&um*&o_>!RMn9r3?2gqg>EZ4&O6Stuv!@YEb%kcrj_&Fw|I7WlH|j2o!V^ z9@0Gg^a-FL`4Mu)FA&0u7j9SPy!QhW>dy3+XNF&2t{;P4yGLnzZWpzmYx4mx-*Ma} zv+?55N0DX1FJco9@?sNVQU0J|@G{|__jinYB3Q=?azZnxm_1Sw?qyK1jnT1g;oH!N z=X_LK>GWO2Z0ll=pOgWOzmG z4h442n2oc!SS@0+jkbtcg0vNy($+&thL%-7$$6I1zT z1c=xSFxfHBDG}?9;V4hSY7f|CUA4O-Ft_=uIW0AxY`bC#>ntEq}7Oyd;&&8lTJ)-91h5z z3`PLBG9FU&s1yk)`=DK~t52#7Z=w6q?zZrE5>$V{z3ZHU5=r(D!S=5qtS7h2Z&nfJKzzd;SlWAnVSQC1R3|X!$+% z*GW83OD*dyN8EtDk*`GARKt#gc`Ji1?U)^a)MZZ4-$nnEn5hMWD8*}W6IYPLa3))o z$%ZSP*BRiJiq`?fZ0EJ|h|Fe=ZBrvun`}Lxu0~aeRPXYTv-gM9z}zbms~zNiRPDFj zJI;O1|E%o7m)U)j)O;w%NgMN=So)f98NK$^zHQ`V_mUzTASUH#25$TW;Ft_*9@f-E zo6+lPmp~wpVQy8^=xV;JDoY?T}sVdP#fWxTNs$2;S4(pZUHZ?zl$<1bp?5V}^jk(;w`{$%PokETG2vd4~ zIWkw(D{(|q)nh@-&0R__w$(8UkMVBiWJ2p}nof-?khzq4?9l2bNyorN4M9YZ2E2)k z9oVuMJMr^iHV8Ywi$f09WTe9c62hnGMCJ^B z6FWyu>K^r3Ap%FFoU#K5!h*%b>faPE5j&KA;D3-P3lFb>WZX%sUe!Icvm3t^E(hbqEfE{ba4-+>jQ z%LHbWxo~XX8YX$haj3BT9I>;Naz(j)vfL&xmH0H*VH2tZ082|({cOEZJun|iJqU~u)kOCV?ndu>XVq8B z@0oLptLi2$D-1KMjYz=~2A};P0EkN2#{nCb zAROqm>WHNM)#_`#wiI~*NuaK?p&BGtqJrO(s~Du<8V5-*G-O3czKl2FbTBf5ZzJ%- zE#DN)7*c1$)nhGpUSVxy;5zEFZg3&DT*pFBVdc*WX6?5M^n;j$uinUzY7`IMdjs$N zJuIRwi}sVMbYPC~j>0An1z8J(tj8!7d(%@WuQdUN^P&h9~Nou8T zO+QNc0YPC?OkiQH5xw+7x3JkMe=PHhFv+P5heqmmO!fTAl9YixrZOMFfq_R#S6L;$ z+p@~p#7wJzzRvJkS%xlu@%br6)cx6EAs3tJOHXG+V37Ff+NYVNyoHCJ{QWHQ@_}J|$9U4LkneU>2Gyr7#EBexk0`nNfynK4XE&>h;^=;9#na zP!r1)s3Q9q0VWzi?4jga!G>#evBRgFDN@YJpqWzD5mLjAq9ML-Ze!e(v<|Iu2tlL~ zfGFk&VD~73>;A+FnHr0(bg5+Db{L>e5qU&xfJt|(-?Hi8Z7Dd6?k*h~5*Z`4%k=tf z5=a=~9QGyk^D%e18OGg`nXK6uU$uo~$Dsr))6myv+A-=6C~fZ9F8GnFV1X($3S7 z#54?MJ7jZpDeO#DE#cbPYnqSRPJBrZNCMNk`ssTzeAM~YKOWrM!1?K|L=1FUWX1^7 z!7zSpP|1pxquWB%D~7sc72ygGXR-5eG@x1_bLdi<#v}PnzS&N*asw>X ze8bG zBTnacaP`A0U$9%xuIbN{t4`23`Xy3dv<ZU>J_A7|Mj-7KpKPMxEai9u;$p>0GkCED#C|5A2kW)h$2rU0@@ zDt4kn1tf9SWZ+*~061k|s?a>x`AmX10s0F$<GisO6*o?3 ztJ!muC9|ZEPjZ}`HEnNelnnm#lNf}Sy5 zspb!N2!x@jb2eWvBka~yotyokc*Qt+I?rtzWjRA2=Fzq_NQe0%cbli}`w?E!bOCh~ ze-L%_G2R+|2h*5R3>(LNK!CV8iXYih2t^F-mo%n=45ii;G&+B zCZnpjh)0X50o3nOOBIk@-lzMY>Uv+0mHk?^(QQDSa(j{bwq)%mF~liR@0|y6R=!kQ zrh$_fGDUVyZ+KOz+H!Cz3wN6_x0j0Mc4*jxf@gk&U%Y3_y_G8{d>`xU=k#D(M(@Tt zbskKTlRzYq?f0s<7-#%_Y@KCIdv%Vk**V!?9u!de1P~{qUI?Bqc;)|z=^~MyMS-R? z78iC&7=B+)7>+ys2Td7>bF}P2a?xa^LAGzI8YaXRXTl=uVT|Gsj)8YUXaWrr`R~}5 zKi-k1Ek=$JQSFkJZzMpCXwFQ)Nu5E1 zS=U7GXlEq&BLU;0qv*gmjxUY4IP?SLZ0=I!FD$#XD~nL+8$lh7mp#K-oar=YpVY9ViFK zT=2mfm5;9p>Qd%~LJ=82ggGsQ&llENDi13PzmnmC&~Uv`4Ts8BA48xy6ygS0V$gpT zZ`Y&bLZt@7e&-^e&VQ?5JEf%YFruf4I^;4-ta@t7ed;t@5NE}jdHI!wRjJ87~4IC?=-wVEp{~Y^rsDw$YLWE3*na?-E11c1J}=}HQ>cG;O0uD zb?QILRp88z_bL{!cli~&cs`KOgMmq0(uCGHE2McgDDH0OF5QjIrIA7?HkA#_)5Bk@ zd_itn;_J%=*vhrG0E)h^y%iW7pMHN{R9!MvNEO}lF0iReHJ!iSL%%dD73?dyy=VLb zaEq2qgKRv2?wgUcW)mjZvM7TK=KH)?-$u3#ES_!=wV^lF`Tx^LCYqr(UrXkYzenm* z&In?+6ptYmjhYv(cQFZiGJ2z#PByWOuo&U2K!FrUAhH~B_6+Uj&W4y40SdEgH-xvz z`xj`3!%oxO5b%-7a5OC4!uN*vZ@VX9_efErG1S{@Y%xClmYaV7&lwR$V*`WUc<2zX z7iQx~B*fQC#*0)n$fi>kzvb{zHzQNRyAS`d_PgVaH8zc$H#e}~!rMU$aDM!;IC-tx zSOD`igw@1Okl$wPdxcvn;CoK%ur)!K`fzY&si9h1N`nZb3X&l-u<1*;AD-Z^Ju8Hx z>oUyNSw&85zr<-Wsvi~`F&d6^9?i_(UVU76$j)%GkrbfIObN?l#=-vprz$>B$^CjX z1sY}$RtyIFcUn7ae!yZBRFf%=F=4*|D-CKtk5=@5=bOG3S$Q-JhRH>w zk#hws#!Jb2nB>C-7dezOl5&!k=T3sBk3(?5gJGO?cScYhN2*=moBbJ!7Al!g()kVnl3!FC>+XJWyH!O3909=R8Pi- zjC(C?cJOjMSF1n+0}SZ_@;e?Ei>^3hIuGr=9?HV!8&lf@2GsAW}~9Q1aHLb<^C^u6L)bZ33p zjI)f^R#A1P_jGstp!wq`q1RuV$EUiSP#g+b@|`C?(og1YwqAyHJ`oSu{M`Jy#nhwR zy`;7dnD)aU77bka=_j*ZCIxsUI7!whP^9r!pLJ6AVk|E7T;P_zA7v2{Dc#b=H89Um zk3$KQWZ`sFy~fw8A!x(5*15Jp`WaLldX z{jxcN^cmDH)eey$4~O|b(+0R2ZU8iEm9gEPJpQ5cWOdC42)-iPPFG%QGWN_Q`fAR!3S zAq@fwNF&XqJ48Ubr5mKXk?!v9?tEAM>G%DE=iKMnS?27_=k%F7w5#cj+6lh~t&PIO zVrt8TjgpswlUrJ^%Evwz;=8u{36V*Zu^&ubx+9NwECXj+*SsL}Yi8!RCW)p+VSdC{Q*;(mY5m zXp1VynRqu}FbMpxdz_dJURaa4WmNi+%vCTc`=u?*{JpKY`Ywr8vHU`D(VY%b5r404 zgw?gVDz5SYJ@3uU=_b#O8RHfOzpPqT&u7chMU+_w#|@TJ&0*}tdmrN(glY3hKd4=$-E*$P8q~2E1Qmk* zI(-vf#7P|9tQC_rl$35UEAhw0sSP1tR-Bl`O?;V{K8cT-m92i?-mB_bIymQV7)0%f zCX-ys-Gy0F;FS47?@I6r>{qIu74zSqbkTYM%Fq|B)OXM)#G;Md7Qyj!X~JJn$9<3B zs!I7_aYLZPI#&ge&M&(CDW zYrFEUNj=d_wrq$@-^TnW_$)WYqO)tr0r@irfK)dVp{AiSdi2MyFyuB@>RERbadej62 z84w}+H`Grfw)Z}zZuJqi-P z@)FWsGWCo8k`!#poM`0dSjV}?ZxJaE2fe=^xZZU0BFnJ@e!Ga1o}Z`k*ZZ~J*9w&- z)I)wvXu1>d>*pBJEkb?{o8<4P|D~EVu8!vdwCyCkoYl;!Nity0BcqDeUb`om17p z(5StuDBHz(K&cMx@(+rRnJ!@HiYTb^2g3N#n6Das(kaxwxoDiSK_q?2Tkt_j%wSEG zn(CbMJvVdx0h>xf)ZwS^ww#>_Rt0rLk^(_0oa*{oDH|kt`*IHGoAl=-H`hk4!OB?Z z@OTFSwRV{3@7lB30%%B4U$j>l4RmmjkH@L6ldcWEVMEx}dwIhsAZ}v*VHFx;7=S-P zZ=3cwl3nZ@LGq%o06qwm*&HP|q4}I%^v6@p=e>pz5`JU#qY+VH6GQTWW1wobR4K2= z!J=pyo}lvi)tW(!2$z62MvBT>vZG{T?>C0DdqZ`Ma5J7y_sRk;x6x9pk4K&GCYc$8 zWaIWlDpzR&n&VfqFJ2ek9O?p}$WF8AH~J8i`H+Ux_bMCk-*etC3xG|?xtKH z5A|-9xO;w@6zV-$N-vf{00#>R=ZOSkq2Xw0y(6`USd8OTjGN{gpb!U%DMmtJ{_WJO zo*FC))_6tHcSI3iAe!j;X($t{?eUMG<-Cohtm8)E(!9)2V9{=m<=_jLk9vdL{Ub@n zyiih2ZY|k+-krw}yBODb_lqK$iW{h|ifD%T*o4u_+%fad+7qr#-vvyKy|S}U(0-$f zmW-b~+~Ex|6u*cXhXgHUSz4?fk&A!aw@A(;%RI9BQ|wEo%`;eTNVcxqKmTHa)cDlOqkD9q?{HnpQP7w>F z%bOGBJNPIoYA3;~8c{|yAP>_AZ;^aM=qUzRxnw!Pd<4eWi%8~I7YPdt7YE zpszxEk#g@5LgX@a(6WfDVlT=eZ$*G#sfwyJ(Bm@qDd!=zWKFHK>3W#|>hm_fM9E71 z)1aNKywFN)=7{#j#0RhtwW|2V!-%ppw_Fs3kGd3$+||7QOfpT3^TZ%l`cAxIvBP*_ zW(L-wb#7wqzab?|%_a8}6MXpCe%Q#sl|9Kh z+GyZlucQ8R>LeY;Km7xW370IHC9^tPJ39jNuH#|{t;S}nZi3t3gk-S{upJ-%E|Uc1 zb1tJAplnBhCTy``fpVzDE9@Iwb#Pleqc;|$X1kF+iflhYE)D&~d{HiI)6cAx9kK;- z8|jx`iPa;UWxdW>hOF4es3Jc7O@UjFN(qmuLlZSYCul=xrR;T2C@k)usADZEp_u{r z)&khaIXt*0dh@l`5PU&ur{pM9Q8ZybwA6->RN(GXJvmx?$)r#pH z{4fKx$_6|aNY{$2^>Y)3gmRkrfkONmzKuEIsgfiGVctL{&7)vZO;hsbeY#!sfaF{Z z3%RR9F38P2i@%G<8C6xeOOC?y=p1M+yM1guXB8D&CDG;KLeA4}V z+Pv|$dgfDil2%Pv_FXlfo4lM%DJ?Daw3CvzyP6V2ef)ludqI8N=6D7O_Q#i^e5e}W zTPr5xm^(8}k>FfnrnC#}jKcg6qJ{#mkuD{oFd-17xIBH0^goC$%joFAO)dE!()&aV zo2FEfX)SrkZ9OFxsoTO_tgPXMF1Jiy37krHsR2=%Zok#D%2Ai58q?d=raxSK-w0qiNm_=+XC3o^YQmG^|vS^0>>kXRC4x>P`y_y zRnjZrgDI39$p;MyOHJVR2nx-SI744V?0ND^5do0!j74PH0NI z8BJs7TEA#wjXkf1W&~cQ?UJ8dN<=zA#3U`_qT?gu}uBnv>;VZ7L*kCShdlXI$FpWg8dd`Ev#8nDol)5djqe~PF zRRkPw?K&OQy%6?E=4`CehL)j-jm@ulRq;&Vv0+h8Nd&#G5Fj&b^f1kmq8f-G4G`(k zm^SgX?Rme{o)N;mPWZySiM|7Ky98p(v?pf1UGj^Z4Bk%HvV9KQpTT6Tq&dW}xbPtI zbp}f>*h@CEzA{I&6vsJT>}539_f{|1?HN)Xm_pq(7v3wj6RRxn86{&-a6Bv+96D+! zc06STx!le$13M$eXN7g0Ug>Me4#2Vk!&^j)SWCldZ>X>Ud$;Z=iGLe94P}+kcips92{SPI^$msJj@-ps{n%>;YnB8R zQB9(-qw!^=lLv_1h9uWI9L@IGn+iC)uL_KbfXO=cG}%2vxX9bsU1pZNdVEc7{-`n7 z;k%o8X)Je0M0dO+$#HG3=i)q&OD8CT%?^7Q?5v1e)>CB)x%-tAkp-%ry!8|Jfs$T;kzp^<_*oiSjbf%3CH&Np@eR<~|kVNp4g>aKK$e|6*<2ZVQyEXYL= zr)1&wbolmqk2gQC9YvB7l#h25Th}z?aK;tqL9s9;O8@=iN zs$@#Ww$LGqZemoM@5KLvy|vUQTHx96U0LDfWXY-BUCnK^WS|Jlc!jQN_VF3kCoAUb z%~Ecu_Ne2_Y!0#lfmo!*qNvzChh*exA7)KE>kjEvt<%*{7wS$_n>|t*HS7z(Ci_vb zdvU;nht|WzgX>N9=S0Wu?a0`OBfk6GM?JOJH}2@~vx=1-NEe?8=z6zO9$lsxw3 zgfEeR6ano7#*Z0q*D!wA;XXT9#`xhQJ`93>>FOa^vCv`)g~~Bx2gHV&I(G%r1tyVy z0XBQoi38FU{}wiu14$5PDHy|=N1xNX8ih-TPJ~S@o#{N5x^NUxSi;lXf}Go;5=c(I z&nY1x-wuA?JIQA_!?BV#Ra=f9CcSWV`1DDw_I_!iDr%nmvbMG#>Q>OPhD&|)RX|6c z&Q@XYA_#N|@PnuKF!ZgKnT;&FlbDmirn>uhOqZvg8wM8Le5uSn^SlBtK$jW+go{Ez zzeId8$s9ULXE52*6xFP=9!RxnXpQR1;wO})6qc@r*l=n@|4AiT{Px~(#QY>c0-TE{=^rd=?7YR^~l2-h;Pl9}#QS1O`yhWfDAxXNoM?4)Xvb&4hlUU9l=A`FxH<~&2bo$TWd9Ya?kW6SM40@b!5!-tUR0?;_%7XmaX{%cJ^=yep7?U zFoP((HI4Ur9B$S|(zYmkK3r&<8_qp7r6{=YFEQ#o;#^5>aRZDZ|0T(fS3$TtUzk=I z8{^7(H#<8tKJ=U#v`-D4>H&7tLTQJu^B)^wXNu%2zqp%*4%JbYxU@B$MUOVPEalAx z%cYxV_x-G-ykIC$!M-$5#v65IGItwFbbvCuiBxk(z32lA3;SeV4-S#&VQCxIDC-3T zAINvbhoh-t!d+gd@0o5BWy>bsFOO0tJ!9aR~z_VH2v z_ICrupR{X8dPk{8x~AM&q+O{}QOuYUjO{q_XMsCn1+@Xcl@Tjg<6=IsjmgW>`hZeI zuf{{0bgZN+V-n}Zp5ZYJ{8CAQDoeLfKP_90t_du$GY&NO2nM+?#OW zRUny&M?=(7_yYwN1ONT<-TeyLTVQFP`BC8M=xr+cP`1%b$w3&=d=o1{`Tg!2VcZ}f zD~Y-ba;;h6vBomw7O(UGkN1hDK`bD{|0MoEfIM4vG@``bwRbUY4$H_fAWZeJ3f*mN zZq*Z<8nfYeGazgkI6fD9g>L<1t9kJuMW_y+!^w3tksSfvQ2z}5+M^Nxzu#T5R4neq z!d@uc!oH=~ybCpn=suAJR1y$!^+re|)?yAdov68Q=lNP6p;Sw65>D>RQlKjK73M=4 zoeh^~oqWmT+VNZ`;4bCw6olT}xPa>~I~MZ)GxQepirh!5pW5X|peRWc{)D zdysIrvd^LBI61dVT?Cow{n14J&5}0>&+1StUmG+Zu)Ia0J<`ZlEImtfW@pHhBy1@$ zVsqAZyJmi&u7f+EMC>(lVj~k-w@Ic~QZyD}NoRg5IRTHjACW7dCgJ)ypINM)(9`c_ z?UT7sMcy4@py`5d`XhlKLrEXm>U0GDrM1dy>1mF9-iUa8I!-@UKFS*fHq{fJ^4eq^6SekEddYv@N=G!P zb6Ypg@Wnw`C$`}}$|TVEF8H2L52e9*ZlJ|XBu$~xO0RZ_Ei1{Qe&vNBN%OTqQ`G z%oE%0O`Dhee=L6o4e#jUZ~tQXh2g%{{Ud3C+4|~>Er34aLpXbfXq?;+zp@Pxp@p0G ztZ8V7OG0~LxFnLryNz-CGj%t|b43iNbj^tzN%oh*1_5>zfalqZb7uFp)brnF1|Q41 zYfLEQ#NMWBtdrnvtiB)-c_?&nTSLzUzGI{G?FWTG@;A+qn zRql8;c89*yq=`#BK)7%~^)aJIrFml0zn>+fA|*$#Y{odqYmR#=pw)*+aPwuMiq889 z{ha%p=|`+o9jl`m4$LO!8N z{Xp*8>W?k@A&bx2hWd8uVZ3e0hkayj>MFySigNfw-742a_6~kQ7wCL%ePEuE)gN)j=G&VNsvcm8sL1$_;~Nm;u5KJo z7KGzdYz~*+SVB`t`m@rvPHm6m23bw*U3yj?<&O?uQqoTGvRq4etix3=n%Z0pi(~+- z_oEXV`5p)kYZ?y{M_d}7WcO=~wyT~#8M(il8@#TUidReuKiDm74T!N1Wc`mMZ#V6Q3~#Gt!{uteCf zoJS+@2r#oN!~*+E#N#6OK$o*ik_00{@dMH9R~6R*ozL0?Hgd!;uYNBE4G6l<^ra`n zLYuED=>CdY{96pH5r-P4zsWNM$K|;MI+L~%G|X_@(4qhJ8*Ynt9MS}j+7w8QkLHS1 z;Jk#fBMQQ}%G;a1kiAwW3(iqhJq&G{A)7ms>$T7UXpkHf&D`p?>Kj?!p)INEkbQ4b zH!qMiURnx~@v7S_H{D)XT7iIRY#xLAwlG*T5_;q9z}z= zb+e4@bQ;MHOvzi99w2V}-|n=7UTo>$f6d%)>_W>E3pTP0Y`2Qmj9Xt71`7kzZc151 zZeF~nvqY)|ySG22V@dDU3Q|USW{^y-I?BK*znoszRgEM^T-+&qo?2S@T<2%$lf(3= z;fe9Q6>uTW>t$lse%3xP@`(e7L0D%0%{v52--PrX{F+xN&pXhFt93x%X-PcC)@;1x zvd0N7kJI`TKrH5YIv&Y~v{u!tYrLjN>HTEt-#8@U#{E zSSdq>yov0pv{1dzz=&KcE97|p^51S%u(r;4@U?WVB`2EsUI70}1-QkbS3FV20XhG| zb%I4|PTIbRV~8Bs(OH^_8Y(i%3mtJJX0O> ztsWPm9yko+)c7qiS6u{5M@;Yq5Q(u$3OYrk$v0rYPg?GMYrFsRt!)y!s%VitLY~FhG*T9#uB2AimGn5A-iL{@fzyn2x%xJ??CIlr zjr_SxM7XAyPOWVrbN`wefb@ow&QQcQphU?+=5~5vuuJ>nv135r0^&+%$gYd(xItpI z6Qt&%KjAO1avkZ2>oJbcbAuO7c99i3Wibs8Pg~e;XUh_so5UG2hC<)iCiU6f<{t5% zMtt0GJf?bTyMAtbg!AYyT9o(o>qPIqu{(+oDTHO$-wyDrrA}#Ru@u$2#21Jp)j4dOYVt0y zR4b|abPVoqY@7eiCS*JFnVs8F$(^5emA3W~{aoIFG`|r=W#(y*SHXnC*L8TWQ1EO^~A;n%J0xuYpIQC|^{c)K_0vRdAG% z(r4K#)dc^oS?IIsPbayLLG$^_jm#&s;~_=;b5h%x3%@ismJkj?@_mIUEg3?x8?pT< z(r{in6+UryFHSC5DPXbl{>?`3r0U#2O0duWlbdnS_PQRv{VyJrfAR3PQ}Y)OLNWN$ z+3AdU3qcQ-)G62Rw)&9EggkP+q~`ZKg>I3BSJ15kWFa6tmr8nnIz$=o1|c?If6_{4 z`@88|d-OJtpAk6Lw5wo3OwYo81Q__~``6Ki1@^zZdGvct)4OPXAIVlZAH>s*bs|M< zk`W4A$A#{1U}g^3cUXBMoUI1!eOhtGH+v z>XRGeo}}Oda+uNB#>r_|{Axl^ZwO z(`Q|d1jPKxQW%40)>9>TZXjgsebn18ayDPOp;;+$om1{#u`Yy4#1oYX278AJ-1L`4 z(sRo5r2k8x^zpxs0u0K7%C87n1v0OrB8=pIIgEXQUY`s-g~e0@vP(%Sb;&dX*IcSu z`h(=Z*(@Uco-zo0w4T~20Ng<6T0_*^V|g3F3ZX;1{sD?0mUHATyJ>S|qW}cW6ua&u zlf$(JtbZ0nu&iC+25&Q&&UGPt&E$y+HB{}kfdKWWetFzbe!OK8E^4ja;Z9lZ{t(B6KX2L%s9yrS=M`e6 zGwL&2Xtz@f_8xC<=dJX^Kn6L->|kuW+G*t0&JqC({(;BMF>3*pd{I ztbFt!PTll9EqGh7@Ypi7AGwA8CG4t+^zm_pZ>|XWbMCXg4oN0;R~jpIi)Glyh-8gN zouYl_V7D5pU(&{FF*@RN>8$8qS|KS*T5O6!r$)#d$e#gM&E@T|3wipPbfyIeNz ze!YBikuIqLif+-j#sFWJ$vS{r9NPQ>AXy(O8A$5>`1EGHH9kK?HFo%hA??MWl(XNR z?UjYQ;?c_=^v}s6wrq#8ffUE<=6Hy!?EjK@?{uiG&J99r3j1hFSwtY`ZZbk`cp1pA zC=AQ2iB0My)Ow~{B4_HiwK zmE^tHqJcE^C2NuG=TrAer>nFJMfOZmk!(hbvtvp23nwxTF!Q9Bb+VEq`>_sDq6B2Y zrpe7Umh+Bc_R)?G*Jq9FU+8zpTvJqmrPfJOpy?^(?D=DyP^{`hx0b3)?HS(byVFjp zi&&ABBjDjr0HtirHXwrX2I9&XB7?FosA0E~JDcL*yk|UK#BCuCu7W>n9AZ;q3^E;a zP7y-}qy3XK_AJ=!8$9?iI#>HQ6sY%Z)9cgQiLKin%jBrQwB=Zi8`FCX_+5KcIwP%| zccM3%d}XEk$E<8R`OkjLjN<^z=1P(er877-{%F7DA{cU}HMO&p+h49YkkbO9vDeXH zo6enD47FY<$ncvqER*`M^t64pbKOidAH4;)`~Ov6?&_%gs9M$r{$b@(b(F?Xk0+FV zCzkL&t|`(pB+N77X#PJNlB)6eu{7Ol(tW>Iu16G9LTaG3KC8w zoGIrs@222Vcb@_$4~04-Ld=c^X;%Gct(JNcx#;*nmyR znM~MLM$`r?{y?MDszk3^j}PGVgsFfRBq8X&eoGDl^|#*zKT>uye6+k$-{Xy2XWf9& zi@Ek@sEkRNIO?NG%XNoR1)j+m6!*dm9(*FV(%#c_dF`MB+!_cg6dm#o`*~Yka_gx# zlgEV=M2UX9o(p(-e9_(V)3-L7>=qb2{GBBkftT9$uE3~+lG=tLPDerXWkGjNL1H!0 zq)8insVLeT*!~LJ-(Ve1afM0|GUmT}B^*DZj}=L5wdW1s)6 zsr3Tr6P|WlRp$Ok@f|X3P7MoaKKXRpWQrOdq+M-SDD84c$QDq1_ejU9es>!>;v%>X zpqn&zzU2KK{o-g z|Dg`H`M}e%)$b*5FX=%wEdhpH{j-XS)i@&Klww;kO*-B^Q*$&pna>Ve(=JyHItfn? z!2HpZ$y3!W(#~!0;v)(0JCH!J!C(QS_@Y>2u(Z6a@q}6-?C@_b6FJ+bjMAkuZ7$Pu zQY789-nF_EBlZ>l7vX>rlyL9v`hyl1pIBnPMv$3?aLMC4$ob+#f z&2@H9ZkSa6oUs9X>bKVN^2ZEh9O$3ar_4aFd87E)L<`Mw=5gqRuuh^a+0hkb%6}Mu z+y-DntG%q!;LnkT-sft%Rwo*FZ;C?g!4-Delv0^eN?#x!Rsa-*ZFN66iM|UW1Jr}> zBcEEyssUxwpSPwIu~8*CypKhvwv5w+O0tXQYVeldX2JVs(dOzLCOBbA4 zA)i-2AjN_vp$VbIW9cWMDS?+QJDxzRU#mzjDTy^AY@=sXs8&6J#vVe7@{F+HA_nfV z&r`Sh9$+R42ZMT^7#U@++SKFHP6nEJvVRhYZ&pQJlYjhV;8)T7L&We>v0)njchnj?U1~)LIo`*Y;zTw@p9bH(&nt|<-_76e}yUItlq+D&Yc(phvF)HyHC_?L#Fi$4356-%r7q`SATj-N!5lP%D*nfBmut8=5hrs-bJ@Io|AeW1o^Ed%W zKAEOB$zejcrV4x_w(T1n>(-|hmj+2N|A7YGk*;*P4I3W<8iTf$8uT>`eB-N*JVAqv zX$qNxm$D_0Ge}ZZAe`_1u(GokD~^+HNE^;2%w=DT>&-7<&L{ZL_30jnDOosHEY z7rwN_v}$#>dT#mX^ikkf&Wn(?*SjLHysPwQkxfP+D?#=UH&fd(Q@nHhG5!!oD@+Mp zhSN@qV)+c@W7NNRy0s+v99Vwb_KLumb!VT9U?G7+G`i;q{fLj}(wm$Ej4n(hXBSqpH3fOea~X+_e&LZmQAV7gGWdxIFoaEc_162SgMzQ;9xi06hL^ zk2BKnPy4d)!v$Snd}4e~R`hR7AwEfYg4WWodUcx*KQIs)|J%1zl3~UMwrz=-%!jDm z5$S7M(C5f+Z_nPg1&@f#Ku(;YH_vmi%;K^cO|%>6MT?x5oo3IM{!9sJ*93kC;6t4& zg~v=_#*URjjDQL;m_ai-5WG}ZeC&QenihkfEzrV%{cIco*bH#6k z38F@7X@6K1+J>)d`GG?u2uOuoGT_mXxvlpiNv((w%VP;2=CaSFQBsR^cH1UA%5% z(@wGN3aq9I?sxH$&$~>yyY`wBoBbcLw}G?8-vJK^Zcbra1ziC~PN7&*IWkf&Lp3L) z@E$PJb`{s19CuQK(I4h4jAd~6%CENaO`x*ce;RxmWQ?O5SDvvy0&*48>v|s0d6Tc4 zGQMAceKjHYwY145rE14_*wrwn9F#Wcdk$-@V!fZu-f5JFnYoJzG#{vF9N}Am+=|?A z9%@#ZaDR)hx(zO)U`Qu2gmh>Ye$g*8>? zjbU2$9~KHoa3NR-fndS?!j~q5swtRCEk`hKMm@-jxkh`)qyV7_4t-*;cSH;^^_U1~ z`cv2=9@OwNWmlts5U>#rW~izLwigMQWz7;wPpURIRH7^1no4nM<(1kuu+e`Ih}dIO zTk#`cgh0T?7rJfDx@tF?mfLkcud*Bd!Y!fXg}&k~qiK<9mi9GhveSWIu4e!g#3}t7 za{(O$-!U?Qz$UIy0{TX}nXHI(f>)JSUD}Hnv~gnI`k3K?;4K2XhhdYHqn|%5ap(FS zSDw)XhX}r^a(iIg4nJ~A<*aT zf1o%3U1RIwyFoxvEQe1A^(MM`|Hy=}Or+sx(bstTnQ+-Lu0gN1lQ~fOHpwz8vvLMk zwn^7iLFNabG#2g!cc{Bhs-Bn-{*JV|d>eh`B&*R%k{i%J#q669>hrxUtb+NF4y)=}=?mj`-Mi|HK|!+_`x>6iYm9axdhZ`hSqZ$mO?JcQU98DVIXX zuP}4Fkh)qMAJ2}WU5e~1eAN=3aQ+Y`dUT5A5&NgQKh^cI;FxJPm{7=_c_h)={?X^; zApf?zssHH_Z_CtJ>`}z<6~igQ(nD%*4WN5B+k~t9g50xIFoJRp#gr+|kMC?>(A13v z#>CZ&499OvijqePh8XdmJ@9xD$S^q|S2ARFdei}7mGdzX-?TH` zVyEhW@&pQE2B^ldjdqXYE%S>rXHB|cA}}YNEDZh1@Da)+ySc%GYh~rPg38>04L7@@ zLFA59;!Bni=w0E$^mezB@af&>yCD->`)1G2o3F7-P%5e;p!R1OfMMf63dsY5g9`$E+|ch%S|C2LU(B*8?oVJcxIsCqBf zO>anR*n-~^BfnD7<4?*mA5>9;;fWtdMG?O7F9Si2`MI=VyG?`CI3gVI^@XOyT-8{l ze`^Nv%vp@=6c*Q0^m`=ETt#nk<*MfZE&lPZ2@sAT90-`5=T#(K9_JOZyD$m+N(B)x-5@)-EeEM(lmQ(=?J$r+yh;per zP6JQi*fi-tVB__`;~Uib6LKCj-MOUkU3&2{@6F8Ns|rq|=>nl~DJOJ=?7aCNxIxP- zApL5$oJ4%9{PxV^`oil#UQx*(?WF4)8&8$% z9o<&Vi9=SycrL#aU8wwELHuMmbV&#SR*v;wwfLafcX&qWr;vb|HZ9XcgB0Eqvmx2N zYFT;tuN?Wx7bJ+UgHQT>f8@Cro9L@&#H4}{wx6$b2zcMrnlW?~-AzR03PtW^bSKRC z&30VD7`9cazD8dZ?5lj^@L{;sKf^P@QX4)>n_Jo9Am7;MM^OKRO&oynJA|zVzkzUs zB?%!bYzD7de9@YoZD>*MlqGQ<-cnS!v%=HC#35E3t+G-4v%_xHuvn6K{z&w$KaMcr z5tlj*+J2e6dhEsP4+G58xBi<(r+rSHfc14qYQ}R?*Y_bO3X-Ug9XtSyv(4w}qw)qZ4(9yRg?U&|C>LtW1TR05 zJ%4o_B6Wf|Fk#OEt3Z9b;vjV8I4PofGEF?oUX&g=_L*^gck9}&m#0C#%(ZZt(l#7M zgf&OT74hqrZY$;uy=Z}p#q=fWhMTp4<~!BFqK?$s=_)k#m8oih!U=!HF&Q)3-5D*w zW}5zcR&rru#bf;=bdA~;nO|MCSpk3D(Z!tlNzMEQdd8ylL7dm8ge{8XI=o@;T|I{J ztMG{;UO%U=C08FS8TT-Ct>%o*U2jyu@6G7HWAba}R|V!@9ZYC|4oa#m>aijU+Ns9! zC^pfb4L1F*@rq!8?+78e5=jUFR`$(bm6o7kbVC&xq$JLS3aosU&}1?cz!IH|`!z85 zufOMm{wlydjHSOx>2e$WnZYt%qeK7>WsvptMYI$*KoRJ*8dQQ_+NDIqdqJ8J$}(rG zv)FgkBBb|eU2Fb_V{wAgHlaA{aqZw^NzKwrf=?60>e9U4fk4MqHk#ktYrEeSLo6Y@ zfcKdd$QKg$hIf@QZ&GA&b_<+&;R}P#=LL-f`>49?Xu~DG!I~LfY7^W2S3KSN%r>>% z7RLyQ5VYH%Hfq7UGMbN?9(Y&0#`Ljos%=#(n+4uaOnZ&fZz6w`m-qD$*oV>^<4h1^ z0=(QSNqeQrVxr=1P&{=8<1SrQxeB#+t&a`r8~vLnB)T5y%b!$DCI<3hOq&Z1wkPKU zHl<~_%jbfGv=g)j`zsdjm3q4)IeP{ki&Tfqn_`yqy>ffqMG!%W;9YHE8ZNU!x-Y8a z^2@)MUK~z-S<>`*O_+glZcEurU<+VEv>FN>+9o)MqKVxv_HE7?#D-i-x2fP|RPoQc zAmWf%@YJ#K$j)Sn!x?xY!z1vqww{(*vQ(>|I!G&?RYFc?b z+^fl9Gt?sc^yQt8PMBQuOt~D;PkFgysSBPA=oYnnbGfM)ZLCrm_oAt1Ly3G#xyACW zp(^Wh#fG6$a!k87LJ$L3J>*wCDHQTRl-xPN<1eQOXR7_{G&RpTAuPVXv(2BzS^9EH z3^ydEP(C1kIh66AO39E3uz^6V1_H5MF?`R4Pj-T>CzHygqr`%NUa(CbNTS^yaGv)e z)GzHeIdfyj7ckiBUktYYX_>>^GRUlOnubJi)Hc&USP5z}35ASAjoC^(F_~+V*;VhM z%|xubQ4=M>7XLu)4rzZBDE;VW04eNA)x9tlrB2*W(~2HpziW35ckaz3B#9!-eK>J4 zn*4TjWvG7DklzPxIYIg1S>1$ECRDr)&Bs|sc}xD=@8ME^^}7+Ocp9Il#*m6YyNtE5 z!K7W79f~1t>(#LAC|X?p0aO-=;P*=VP^|y8A^?#0G+1|nCwX4h`W!RMBH`%eh+c7YYf>-EuykJFPr*be$tiS*l9Z^OW~n{CBTgSv zd}Y=d1D7fAl$y&2RioomVyEstf&@l@#9@Lvx+&&=jh(I}H0(`mQPML&rh5b%+pa4( z(kWwxeJL{^E+51?`|MiEdWgG4>tOp+lh^p&ZXb*`Z*kH4? zEgWW(`O_d}x1$E2hV2JApD2+|z!GkQ|NL)o4Ie)5^?VJbJrLs6MDyNuSH6pLTO?wGvhzPj+}ew)`BB0T-4%*|@^f=w6&DHKAwB3t4_ zVNfDn70L0w)uO?lH^>^}VLla4NSZ{4`5G?D1nmhbTw5=;GmxGb~L1=xf`@Iq~L*}9xt zYg!k%S9?i(nsr9<8f!sLavqf7= zuF={La^p+!1Z^!^Ctd?d?zafa?Pd%MLnW4@4Wm;1KdbeYXqzAM6Q_gMYEK^x)JYG? zssb7hWsQn}{(Q$3py^GQ;35+vI7KwLs%45_Z@cm58uFZIb`On*iv zwsZ$_OX~3{NE$~E|2rgl)0M}UPUUseqR22ji(7>Dkvzxq0jsr>}_tvt8Njd%Kl718h$4 zq~EtNiau{T(>_lGQ1vJ91ozzw5cgkqT4{*3edf8Dw}{>-?Q7TQw_o8U-E7&a_M(2w zbmGmEy>*gJd??nQB2(RPw9VFPdBi*i>$;UyWkpw*n)hAMs8)BpiiPnn+QPxE!H`7n zBs=+4+5r;Q(`!bC!ng*+wc1&Qe#GdyY>WPCWXjXG)@97;H0a6@WAX9H8u--hxLh;2 zo*ri46R`TPzA1hX9-#Zpf%0I4ROaPtBhuhST&nx=pq)Xm3{Vo zj!O||Ivc5N?|KQ?i7`HIHy=8IKK8T#`{H7TIouPs1Scxdp>4m~s$3XkB)Lab-b(z; zRpW4Gcqz#}{LBYS8{V`gbjz~K*0oCl9~s=j?Ft#T@{bYaa-Nq9^{tb}k-FASxe%GE-mn;xdSVRA0!?h%Tgb6dbRecH2ZQ%jEzR%leWDC) zWhyxb@n~~1>L?;iZRK`pHn5d($`*X+TydW_<=I0PNt;c<44PswQtaP%=UHxlojCmo#M@3OsNw71#! zJl!{;!j*)X`E_&}v;yxuq^B6C(|BX@g(>EcSXoEm5F|0Z%(&+xuKhU2x7sF`BP-NC=$E6Mz-H z-}YDMz675LtgM&6$NLxoqVe6>V*WW$!nm8sw4G+jNcZS@sKw91s1jD;7oCHeLL7^_S{&(Es-OKJu7Fqqs z%MVkOsQSfzZR)fd#CFWV^)R?=5hZ3p+S`1$+4HT=%=f%*USun1hp#{v7vo~H`_6O@ zfA&H!x(&%&OJlz=g7u`i=aeFo}j)^XvTbG0ZCv8ti{GK%!o9B+Z*Z$w) zx0JMp>*;;lfq>OR4!`A|u(MXa)ag@YDZ=5hZ_Hvf7R_uS3sJt?gW{Ze9%??<2O22r z%coIn&_Zr)d9NKEv(+VD#aSjBE(_tWHnST={DR1A{-+>!W7ea4x?S!ss7bDJu~tXW zxBx0qGMPl<|C*SRM0UYX#)_jD+8!`e!I>KQ0ufuv@tppXx{I zII4KF0u($r*e9w1nx*KpM&3^T7mmtD^GS!E|I43`>?w*tW_1x_zm3ra3b}jNsT~_; zk3f7$c$CEvV)~HN@?qQxkcxxdr<;WU6T125Z?Y)GX--EaKQAgEqW%+}VlqeVRMEuU zft8}$_wJs(cR@~&l8;GqPN+k}s-(r#1}C;XhZI!Xc$m|zgE`Z8agf}4td}X{ha3}p zASB#s>0}6NaTeEw8+Pa>Gx~X&vwfpx4%iZrV5+W-+5%XK?W?ON{6D6yG9b#XX{(@w zgoJb`lF}euA|TQY(%s#XH`3kRh?JCcEG^B_-Mw_j(tNAF@_c_`^~_FOGjq+HLlOL1 zKv6mO_|J2mCXEt1%`A0C(QZ=Zk>E4yGFl~F5~XbQeohun;^sx9vMmi2X|YVX-dl0S zgQAR3fwCW`{fAUdYK2(W=0Zl{CSHO~ihwlT;Vq%;jR(NjDAz7Bka?P4}NrJ?s-r0#fO0#DTK(Z!qcP zCBdfaOCSj`!dL>_co8j6)Vew^`5p?1_HeXjW2`STJ9-GZp@GEhn>=-r<@}omjF4-N z?=M-LWEt18xApaNSODd3$U1F=Ux82A@#{IDS05ECC(|FKzu5cU{+ z;XgNE$6!AR3^NF3hxe(C?W4jtjO^G48!gBi&@ot~TncLW4vaAH>Pmk8{l*UJz^iZn zdt)aB&Bp{QaDL|-DolR%_D!s8)Te^-!_V*+RW;-i9>IpyV`qBo@u(*O>;T!R(M!m> zZx~kKSX@`C14~xm!XS(n-Tuy*WwPq~P3lE(pCL&-KjRdOPxZhsST|{d0iW>+2eLh5 z#?$WDM^xDVwGrQmKMYeoYMA7r(cPWQT~6B4-Vn9Bm^^>fx|@zoBv!X!n!q80C{1Xd z2$w(a<>-Pwp6LtRxNhumze*4|8A$FcJ!stCy?T8s>l2n%OulvVGs~UmbY88OiL!L0 zFW*n9t%xoPeyVj3y87hI;Ek;=%gJA132=vct&0tUpTo!DU9mDc&*48eDjDSEu~Xf( z&k*s%g0;Qq)$lKBii%Ihj0gs0*2nk)E*}S(*B5luWR07(JxJiQ{Iy^ z38))rDPCaM`*kO!ib+hS8nP;LP8U)8f>PJJoe8^c9*Fd%3}Wygkc*ts*eigf9}CD= z%~Icge<9Q>5Ot(^PtG7m1v$Geo#boYwsrtf?mK-s}<Y%b*|C6uKQGaV-yZ-VcW zbHljWhi$o|T%*gZ&kS5K8Z%&(-1y{hvTd=!v17RpU_6i@u{Gz1^~1XAjR)V`&r9o0 zWezUg{g$w6z8|%_E`{2-z{cFFe_WkM(`qZ#gif}aHYZa#yxf-h7f#+q@ zDZ~e>Tt3#_tu#Y4`F#pL=&BTravnPCKQ4ZeZn0fJ2YeH5B-KFk`B%N9R#x(b)TDK( zP8;=raHrbtf}-^}yDJDz+u2ro9G#Kx_6y@HtJ>akxn|}H=;{|T$Go3Nrsuakhh(lC z8R}bpP|wz!(qaQUiyw=*Z+Jy(A6M)VU0Hs_54oVzud^QX-LT_X>15Xk)6Ldj-F@}; z?}oCz^ORtU&MGAjyRP$GSsr@RYlH|McHoQ~QHIjrnXgW5ZwHkjKfBC(m1$F5)hfQw z?NaFJi}s=N=SHXKhYe>=)6zFPuM~AtH81n$6Aj<4mlk-zJssz`yviK832knvnW*;- z@@{DVMAY(CWSgtY=yA-~k1!O0y(WgKGcpN#e&xv%iqkp6rGbV>E@=$b!617aLnmM$ zxWzWUDS^w@=p&LP5ygM;LB5&kdoCtB=lkjX6mbOnD8gc-PuH8rXWW6G-jAow61h?G zdSEj_OXq<%$BpNnFDcjVL!1m3!{BB%)=5j)Z{+T_WCf=;>Pb%Hrn7CaBkHwp`uOqN zg$^M0v`IJkdAkHXYlHBBp$cNcNgECwnE28V*9E-t3h^_})iU@*Zy-BqI>Wa2VPoU! zZr6dDXM_C7?%AE>H1XL6>ob@{qPI!z#H)9bs0UXS+h4yCtLBXUa;`r*>MT}KLLIY{ zus?i+c+l6Np>EwY=YA1SFq?{EmA%nAMjY-Qlh*T|2!Le@^`50)`KMKJDExB?D5gYy zSRHkdJG)@CtS+&3vPI};o#z41m#>=4?ALc8W5|Tg(uBjDwQKm=fChL z;@$r>w)4t8@kbCsz-Q9nuJK&@tGD-4U-la=avPOB93OM|OoJ#$I`*|JjyIgZDHZ_L zg|kyLM9J?9Gg`77loQesBgp#4YCR#g!QfUJmVnIe@>-i;-Wy;A`fkM>$dh2T_N3LP z$Ld5Kfw-&K_z!ehL#QmMUebqpqDo)T$Jtp|chNi3n&YX&8>W=e$tW{P- z@U*@yQ)qocS;U?J6ABDAV0fXLdSyl)Gl)5ci_5y~U#HU+v>rQM%^F|V^viC*1*bEK zSQPSP5KY?SUqd?5V$3s^V2^pm)@qCdTIJ{QI7H?8GG|;cX&XH#e~Qmp2#7~1Aq>YU z@x80lJ~l7x9qe%~nrMWAj(?8NF36@5k3ee3v<2nyEOe5RtPza6^3@6LmwR^c{!lVB)<{l4q(h2E@9%@kREY`0eFumCY zb+fAk+WqP*?|HV;6Gt3uOQUe~JY6GA{UIYot$O=pC4H(N zLIsgAPvxp!1SP|b0WXioT;35`YdWH}nf1G~?=6ktJFb37Oq5K^az3exlg#i;<+iuk z2EWd)AXC3Ol4KZxYkmO^X_p*0)91qKMrMRvm0wb|3V+P$_+VonyrHat)cY5XAE$Hl z9{I6hFni%icRbSL9INHwfKTnrv)##=e9N6P?dt=)Xh|smP-CmjpCn#bM{aeDn$-v# zR-GYIl(KId6JB4Ky;;3xSKRHv{S|LU;dvm>&cSvA{9C~HjtQ}a8^Gfz7TK0Wvx~%ErZ4Qrwck8$`SDwim}L$BA{-mOLF`q=ZkbTnGWn|Eit>Qj$3| zl#ROp9nM|`43d1<#53oY9voYIAnF?7*V@C^%!6<8Tkn0vr+)0J&y$zGHZIAD_;L7? zCWVaYm?~{r^1iYJv1&d}-4h7KVObGi@%3pk;G9CA1JfQyy72lg zM60&wO|BRHyrip!BY{un+Ue-1<9_H3e0|VVVA9ue_wG~WzpfK>y5o=jm7@P-M=ECC zaHY>mx>_F%g-XcjYOIy$74^rTi8ISDnJVMdM)k7v8~)NTtFzRbm$Z!Ja~ z0&r4Y##a_A7Yd87FpG*gSoYr+(8Ljp^6f9}I9>{28)*%8xbSTY9!)VNP5jNBdT`P^ zb)3Z;n3Y;OJQzfROq@QEkIB$KLXMT_jf)tcgCootQYt zUx$VMEmNaP5PKTBtZ&YYg(Pdfv6H}~YmSphoBwJ&Mw;5(B_3Tfd~G`pW!=Dr2_zr;txBI@)Y6_{@SpaUk;?P@t?)ZVpVg#nz}h;KqVbWRTzzD zq5?_GXC!0=&SyiHeQU*&CDzU1GjknwqFfHXhgMrpzQKa~zIK|LgdB=^c{)R7)1^I<^9??%^RDqe7dLWHm+Lj=v&dU^$pCO`2yBn%X5zH6 zesZXs>uZw&M_1KcakF_0Y3M;gMSO0B=kRB!G296|aISt%Dlm%Ke2Hm?>OY-$yh`9Y zFd4%oFqIC#G~*t|C4g@4N%HHG!f@-VDFrc3wB&I9GkWElEyQ|r_Q4%D+P$XE)c^ES z>Xr)AODaq+8|Dm#bDy;%in{i9FcQY?7D%Ghr3W_oXEg1l_RPMFgcYS1UYXGLXMnC3 zj2Z7PPDk%HruS>7hlJgpv#;;6cL7VJlSaHu87OzH6Lj1?Ms|{CE{WSGct02ee~~$3 ziRQNrSD0?al7)Yuc*~b}POKX1S5BpV&NTj@ADv^8ahQI_VfsmOH;Av94uKGSSUQr3 z?kLN6*21m9HE*gt+I=NcCE$?2pj2439}^Iw*Kf+jjdtC!uLMXg+V*o!Qpi9KblhOB zX-^9|-~}(bpa8fOTG;C%GLjlkQAJjZe+@Vtdxi6g027&Y$*K?;kAQo7ONY3}Fv*{x;ta=Yw_CAR4Q7Gq%xr{Gj<5JHGzNTsO?kzNiO zIXji*kBtkQ&wMcgjl-f8REj@;!$Xq0n_1Z|ADjbz3!tuij3|f6Uk;OhrL$YuT4S!3 zT$||HRF-itF1xYhN^LuuL6sS_I0N~`S2|9)ND{WXlXw_ORla%xATnNcVc1H@<)%EF z3X4GE-cS2^M0H~SlPyHL9G~>WzSw}3|JNXmDs?k#*7su$*AwFz8AF3Oc6ezlxRL3o zg@^<=v6ofTqv?=0ijxjIfL?IjCtYxrXmws_97T1Ks)vnV?B-?ZwsB>~1FmTcwmVsV)`~DaIO-*!~T>TXMg+$~-y-VbUpqBWe z^zcRE&j%wT;_>#keSpbya&GcrzoCZl@!FIOoY7;AI#-NlXR%SZSCfa#rypi!APUVFH;}=M{#LwS z;OT2E05`16ixZ<=TMueE%zuXV>@C2r-yI>kT6cCsR;g zLcg3tkD0^_p2wOE``kgtIoWogMP{0ZKwN^7&};}`(ZB-n(&HVCvk=zuB;fwUzu7ld zzd3BHLMey+JT&@XiXho-ej#>oQzEv4u?Fy6+T@-cxbDb%sTtc;j5hBB4$W+ek@JkJ z;FzAxKp=FBaXOVwaoxV&DmcCA`APgoSxsF(HEE~a2V0!PT0zcPN;6W^G#W8z!Ze%Dun8rJ%)njITPTsU5 z_O+-qMVt1z4Cd}`bGV$i43sBsKlxz(@An*haGAJxg6}y94apBYt9(WC{mqSd#7j&W zbgb{l8UhLF+E-2hd`s62$-j&vSi5=TcE@_;rqQTTi`Rd^yu5437Lax z|9*u78>w!Q)HKgV#KMXOU4HO3WFC6uRC{cqjO$2*5ip*X-1xb)X@nu0N!v)d+Y3Jnf0r4O$#mD+ufI%jX{%mm1og06a1&OGiTm+Z5efWfAy zpq*c*(Aith95+u;HuGgy6&ANE%LM{q#U^=5HuJ@X{^6i;i@?^?AVRJ(*(^Ih0d$A^ z1OF(*oa0|iwu(ePex4|If~G+^*b+%f1f2Bewysvm(BJ$astlrwTKCeVal!)y-7W4)s#M$ZmJLGua}NEbKF{A8d)e z`PlD{^|2q!me_cj?&m9>^ysk(xb2T~DH#eFRhr;#S?5uKKEm-=E*UjDO1jS(V6hRv zG1B9v#x+$;{r=`iOy=fbGc0ZkY8tb&!25$3eTqIzRiK1zY9vNg;7?IQ7pB^*T&|j| zd&{dNQXYzo5wAt=J~&G3CM)~_r|$TcS7muF{Y_U_(SON1$E_#>Rx|%DYPNCY)>qILREah{$)udrr-IX#s4G`BLOs|c78)&!| zo8KEfQrkYaK4qNLa8w#7QFg1#!>TWMyUFUo!B*nr|E8RWM96cFuqEoopc9?lXjqK> zmwsnyoQ3}eLugn`uaYhKH|pGWV9t{UQ#4|2H4~9G3ElFq-n6; zIk8rdPdXhE<~-_kn~B9rurKz#b!AEd`xL`myaOV8H716Wk^zXbr*z%%mhfWKMUnit z7NLt~N@xq)C|O15nLFA`vV)U^Jh;|WgDB+bpfCjHTI{5nsa0GGSTT4pxBNOI193ao zb-GUZ3H-ZjW(o>dlhZ&EI4R@J-m>|uRbPU^EoGIbLbpN9+~8fk=F6H29!mjDO{L*5 zl6c?^PwB2_R|5$Y$Cw@B-P1tw2jIfH8nnDz8oid!yhlQmmXy5NPyMtzvm&kX@8z&Z z!ft}kPxfG+c>s>Dt8NWihms8>u#)UzxI?vzmCZJsG-f<}Z-CU6-jYKy!4jRp*?*n` zW64Rv&C*p;hSv3+g-X9apm}t=zFQ~{g}}FbbkjC}$MTuB;NFjYSMnR!HTu0kr5w=D zK8tApdd}3*)rdkcix7jsKa~ip8b3Vxc=06k@F_~$GHlS48bYNko|2;Xe6@Yb^9gVN~7nEeN>mdgPvY%2Vx-fO7xQ8B*Uo zIndH%=KpC~ z=W1gghqOTHojmE0F8D#b89Y`m*DJ@ZYPfUH|G5)t(L(mQxAC|0T34>Z2!;W*GzmEX zp_t!)`j_&C_<@>E^-3oT9|uad&NoZn92r9Rp*JE;Ql+T$s=`Uh{6 z?W^E-OOW3kceWEw*4pzO8*HLh8^c11P=AxYWk|i{y*2%_Hzo-h5iOc3?dkiliFgu1 z2}hok9Vm?X^x3~wLT8oa6o(h~`ip}tTJ*9Rz-_%+Msqlj{%zUJRC+j-@2yY3 z0vj8&i;9xsqgNeAiN}UJAHK)m=4BGk<2ln64%21|>4w#2d=_Lgu1Apy}zLZxbwJnn*NL&(0_g2~}!O*tjWvDGl*ZRL}zTZ+5Q( zVp#gOR4TBXl1iC-JK2s?OR0WY{7Ish1ivgE`%gc4W@P@AO%O5kFejb2@8_xTnu|0Z zHUO(;^$(Km~g)%V=RuG-N(P8hLl$4rt<$`()wWLr?NRoO~MRO4H@oBv@ zI=hx8cDmA@9a8}!xPQ7{wJWT`{%E;(PYc1HGP=5>MU8gaqVJKptwulJRze%Sxb{Vs z3S!cRU*NAPsV7OeL2&i@C`AunbE+Dl=;3r56Sl=JNaN3>*M`kRHl+TPdE&moi2pe_D`}cSa*>JrGlW zu@j{vutY&+UPvN)se9C#F2lDe8avg3pYMMn8;$()>NHpGU1rl|R%TNeNan#nlDB`n z{Yx^fboyNYT@%T{Y%6<3SijPgg~^%I&pu0Ai{qiB(2B+ehdLL#nl7Mt97mFib<#+v z#S}~C!=uS7*4M96!G*2ouxsfeus_Zm||O;diyx# zC^?GZ`lMk2i7Nk9%8&W9=-nx`U`BZUSn{Yw-O~3ZwPy#808f>XfEZA>>kbSkiNshq z4Hs=LRAm6)?bJ1stts162`2aLr8B?U$C{3U3htMoo31v zWMmp0*it29|1`u96Uo@B=>B08Ic4l7(t@d%4s7*@hHHWDT3p{EMLtvh_?9xf7v3q1 z|F7)$n(Zd6dLb!{56c85@o+o`n-U|s1v>G=ST@k5cBNPLGOB6e#lPaPFd_vRZ*#Qdv6AQ3%` zFyvluunAiaJIqav=mn*Z$)7g(DLl$IKRn^*_%GFm{eoFFQ1roi616qT2sDv9*?|3lY( zK7LqW^TPtWf=4B_?AlP4;9Bl8sKP~oOFxvV6xO@8ihO?B;tAf~wuuTQ zaAx#~0*RPP=dQVE4b@?Tpv(jRVZtrR01hA40IUXaxsNsgOjQzIHbVrEr#Lry+0d*( z4t#6^vR2>E-Y)hKbH(zr%&Qxf(RfZF-p9lpIsdYMr|N{w>H)` zYFcf=(*JDscfT0K+>fK1Os{8B9dC_MwjqE1P9=!kfk>`hI(5)c1O#!y(og=+rQ7*{ zWO`T1WSCF0GApFA9#M3ZPOnf=NheFs?Qh#|jS_V3d4f2wFqEuIQ1lT}YNe=Y${U7_K0_#8i$ZT5Q^#o}?|DmBGEW_bAv-+5Fd1~<} z=?hbm-yc__C(*$viL*HJ(p^^j0DL4D*+LeOwu?&8Wk_9sfcRj)eV}+=k(_?6-Aww- zS)#>2!qids#YXJN{4P6H;-ux}-LjL=IfU#gV)o$DN{OB3Rc{QPc`W@mAa6V59DT`8 zG&a@N*wgvE{~Ynee)r%^5+zY`=udLRfnyTH)%9l3L*!Ng-mYJMrTYF&s31Kda4N!H zH@a1pA+hB#oSWp(KTjuU_aYI*<--z$RjwUg5-(~C`+~JkNc}Xs+;-{nvRB?$JQhHF zoF_VJYF~0^Ki35HIZsP=cO8LQ#Q@=tReG2WaCN&G^j?A5QF+DJ$ieZXk~ zsE*0##PdQilh&MK^t&IvdCMAKH-jr>H;mk3y`+ep8#nAIy^QcSI*_c3NYV44BQ>;| zrz&h#aZEpf%>2?aTK6GoPFZQRy%X5U;J*I4h@R|fcCy7a_pN91FP+8SwW;AdTo)*~ zp&^iZ?TW`}pfQ{y8Vl@*iIhs=*pVW?5CGqwU3iZGp2>1pW{VLvS1X<6pbw}1aNV&KPnK`ot&)?u>>jPQFU;+H^ ze?jI3?|TT-CtT)NX;=lHIt|Gn@<6{|sRm24ogbHqZc3iXebeq)TFq8h3xDyIO<=}i{z0adqF`h-cFc)>+l{c;C zpLIVK2IX?UXZ{1(?O1hKUEY{7h>K#p7`S2-;Nf%LV2GAUv&ic%Kc^lWvr3($9Sz=BGUTm(0`Zx%V-?9I;}2(P+H?;${eXc0sQ_ zv}>&jD=XHmSc#z~qm$};;5h4Dje{Y+-R2sQy#jPmh7|VlV~L0{5uwbp%|F$(E!}VS zx1%gC+R#(0v<-;!J}!7J@HQv1DIsLxZK_8xU*{v@2k6vyd!%_I`G{DB(TPssFo36e z4+8tU;r%?6a76WPskD+<$LAr@q@dZhoz|WbY5Evz^qPvs33Ka+!EGFU#BlRzE(Dp* zrN5H}rcPKoYwbXJhMUinHz(sAEwIJU0UU0T$ZIFYvMkSq85&TTz&`O1cAT{VtsR5D zt+r=+2&_*6KGMRcrAoY?yzwDV_9YrOJ3`a`I6D3~*6h>9peFR6^4R zdQ{as_!Tz)2>EBy`(-vqtYtPDjZ;06tx?iOX1Zy-kY{q62Dv|N?b1X)L?k;Gs~=3- zRb<>&jcES-VOwqKXtryWb-ga>IXgiOj{^G&%wYJfPEZ`v9ifh6O%Ll3M_RB0` zQdz>JT7*e;2b1cSFW5@x&ImcCxu=H1OhQzATN2YTzH_=!V{aRd%HdJfl$Cfvv351% z{8PB9%jy|R4jT!c&MyR$4S@apsR8f5W}272^NSjI$&}vzZJ@#^oRz?fAVt4GK1SOV zp1xgn*gtr1j4-z^YB!Q!U^%s#S;6LeSd!Xj!idLXnPEw72Kp-M6+gzpFR)bOdFrR# z0LHDWMGfLR`Til0SnJhDkz`>r#eBk{HLLMmFL1LsDQ&`Dl-BOC?rVE3N`G*7=$lIb zT4w&y*@(DbMdf4mr;MB?_Az6AHm>(f(HytrDTaBQj2=a_JY}1Pz~>8+$L6pCPximG zw$CR^?@1{eR){;BM#DL>FG*iCpLE=Odz3rf)pU2A-jHk+f#68_gz4-S5L55D{b6)4 zIji9eDTsE>Oe=KFu5V({t;i|@FCu>03h=+4-wv<;Vy_@RxjYMe?bmESTbNkzvbvs@ z7D#jg_wM=ozq}H#wlYqEZ6^Jmv~Qq@}1|0Rvnpq>-TKZ2ydIEI8Lo)?R!bNo499}dx$Y6(Cx zP_Y~EIDNg>gPgpmC)4DWW$)aFSSkwh>^|@QMp6HDtD9MO_xff@8LzGSgjrqE4P^>HZ^m(&b;SV4Q&=DnMppo?=BrCoE4X zo*2s*d(`2)H%){oneY$f0D>>|q6rj(!U?u#)d1XVvF5eK0loU5lC#951u(Vs8iM-s z!Vqb8YS5QxAl9vBzG`*^9U3<5f95(*p%TxwC6$23chkMQpMRS{yRVlGpKYWuo0&jm zZ}gKHHiU7(w>Lt9fHD19&C%?{F;tppZ&-r2p0$0r&*tl<+0)+!;O&hbkVR|X)~JWo z)<~l@C!D>Esxvbuy=+Y&)S{8TDH#;GxfwUjMT=bD zd-(qOxJa6t(tYxPWQhz;+n(GbeX}|BR%)gsIiEj66=a={^sS+4ZA@nUK?8LpDTAgb zJa4IiNi#B6D(<~P*lWdO53c|1eT1AudXU`eHZk$j+H=RE$?-Zu&eEyiS|+9=aru%t zP=H&6q6-01a!^g`d@*|=&)z|dVVUb_VWhdC(UN#vzD(CAf=SLzNRKeVZ>v~Xbqd4U ztvN7;sRJTwmdF9`#Og`Ay`LoTmf-v7Yj9%j>iKC866FJ{ggQ6(W+d8}Y^2sz6qIDX zXu_c#?-gc=U80lVxXSnOSTfve@gd8lHuRf7dD_c1A^_1A>^tXK&E4wtAGj8}d8r*s zdJ(7`n5fwA5$edlXSUuh$z?(lNChJ}TM zq{HVM-3Vlj57kcP{2;z<)!W@qb=VF-6HR|u2cgR(xo*=PjObjnaxT0txxG{J;J|XN z%LSpLuDyjW8XE!fi}S!l$y5qylfeFdjoaB(Ey7*bdjcrQ(0z>QyFV=RO@wJB{HO_% zP&Q2sb#&&bh{h0udMqay`5&_EQd}`xNv>PEaz>g<|#& zanS_V!y&=4v+mW`B0K1HTBkx+*7_0HiQ%gY7$1XsOo;xtR@9ShTcnSxn9st@t-14J zE#HM?x`UN4LKbKehDd0b2p$OV7c{OW8po0*L@EcHpIWO9FrvH*fZz~p4T+)cM}6H& zS285I@H1_(_F}Uje4^bdzRmh~F@9yLU~Nky()C$x&dsO}Xvvqx&B?i%&!TYl*)!&; zcc$p@F}KBa!bz{Z&$g{ZNL}q4`gXF*v12F9#jz(n>Q&AIy<2(rPg(+5l6wC};y0bQ zusIZlU)J#q3LxtpJ%E@IEwJGtAG{z)aNSx5ui)~42pBn{>o9Oyw>=9Fr`EV8!H{DB z<;Gbe1yf6M#o)*bBscjZ5zG^&tvs4(Z8p4r-L#2luK@QLLfw!m7w*g_a9J+TvkbO! z7;avJCcNw2#36O6th#`lh$4$z`$QY6s{<+X{_ouAT3Sepyas{$XdS{M6t7c}k>5nuIQsY-9YGl_b2{2ra4SGYY^O3h{dG4YPKp?VpGtj@pLEIe`^E_FJ> zYl9tPV(QxSFeGdZK)v=oGo||cRG-%LOlL>PID}k-XibH!VW+ANyPia66S-#I@}TaA z$>Z-F^3y36+)u-iBZUnXH#8Izk>9NRW~p&rz6zZZtIls}38Xh857fy#9WLvpiE=n_ zM-N1P@v;43MvZL6_?8zvw0nYw`>o9$A=b;ca=3AJcG8u=ro3f{ zL26SVv*4H636qP7%;O{_c&t159iuT8Lp9+TduXNgaWI7J0 zmhsEi`vjaxo4a1Nnx}mX?CCj`91g;G;vEdL=ZhDLyX5M=I`2Dhv@wN+5Hm0hAhEA1 zoRfj>yJLc#$@o5I1C>oeXytPtko%#*k3kn zG3hY)&)nm2oZ>>AD2j2;OT!B|=#v#%>{RAT(0*_ZmF|dCY<@y2+1d|+`^hbgH=UbN zaitiHQS*CdR45c&7Gt5jLEYJlbPRl`tB0yI9j z$NS&D^IVp6MCcVfm(cC~ zFDlj;V;~$zksxE9*2d{Rty%&Cf)tnI+1fj|+)ZJXKO&U)W9tJ{(;EGa zJl`C&ng>%OGvKm612y;VSHahCls)uqu?8*+NkF-0yk3=1mJp7w$F1$A+^6(I7FUyGde}nzh%1lrhp^;D(wR}`#q92MO>hV zXz(}c-dExc)ZpUji<#hJxyQ#Lf0qUY6%pO!bg`RZLEg1s>1UkXDl*wo-f=Goe}5Z} zQ-Zvsy;LapvQfsqzj=2fA_LfMGD60*5yp2P%N_G5j}Dj!8k4gAUiT)K*Gil$dP^O0 zHkiJT`9$DDV&wgV@eOAjRr{W5Wpn_}C4Z9n?rDCf{86c92YcU#HJewek*iE-^ExDm zHIgPz1&&2lsKRaZ8GASEw=Sd3BIVS}#>-!D{oVUQr6W9}<3Z*E+#ySI`8&%4 zc|j!5^1b4cspdCct&8OJVYja*yXrYgl3MlLoJE}l*Z@i6=gI4pPV$yGiz@jXeqN;a z(}T6nZ&w3mD@<|<_Wkg5sHW%obiC|gm$1A_z9E|C@Ev1Di7FMi&GVv3Y*D2fOD+Gl zCu94gzn%raK|A@N;cbsdm$h>F2O1@h7-(dMDb@>O)KMzxXT!oC{WQPhG1%e~s>sja z0!jF6JE?;1ej1O+u1bdA}=EN4WZMppntnA ztDE)~UEs$`{^?E2V5>MD`R>pEt-hgxlTX0_ckoX)Usc9>sW^JiELDsw$9^E-#K=&b z!)RP{M{Ub#01dEA5h-2u$EiDq^7u4v#S=<-j@r*t{+fi53|C>M)`e1*ViJ0FVm0IU z%vUH-b{QK40D11Ds&p){OuC*?GClE`rVcSw50lT+ao(A z%=nz|^A(?7wv`%?txRR}OwZ>hBkXGoV(yl~!`VH2r?T$|-CWs^>O|Wy(W3P9dcMS4 z0vdFJhhuEl`R3w2(B;GfnNL&px_$+R`XcHx#5dIo3qxZ|%Fv-(j0V^s$0KRxrKUFj7Q zeo@fk%&UzKEw1x`!9`Q&XTsP&+r7Zj4#@;0v~7lD**rWz&z&#*J>iDAu()P~oBaY< zgC6qvImH+k5m?y?q#-?#YualCVz2D|r8-F|r@~iIS{hf*gRfw^YrPC!(qV~%b)c{? zG%^wwFtf=FcqV*5%&EgzP00GGcIQssJL^&BD$%nDdkv~mWJZj*P`l;97(jL{DB-!- zm#`SzlesH4z?!z&A0@O)@Xto(v)9=HU0m6RwW7W#Xw`ZjI=@6)YIMKHn_#<#Fo`og zU1YyrVym2xXAE${k8G(K#S;|O?T@oTS7|S;i9TPY2I1$J!Fx{H3>vqqt(Ay=tyBzGDBp;WkP7u8%}d8Jf4g!Bw;e`TA0>e-5ZQ@RogWK)g)CJL03w@pwgx$sQv@iOVp zPude)7`(~R{bVkgR$hhs=82x@CSK@TG@s`dPyPPj|MU~S|JZT>3(iu*<6v;z+r1B` z`J3wQ`9dYxh8RA=FUxGLRMNo+=}IaN)~Z=c=b4t2V_g&L^CK|o(V1hpQL+`30ic|% zRZczGHz@zBoyL$Jc7zy9G@TndJZ%_KKckE?OG*`jt<^W21q!&%+n7v z!qPm+G=!IVx^ukCC4uJd^MPKk3~&T0A}p4!{qKaiUjQ>scNVA#hvShtB~Wb(evq z7~9{RC9M=2XXmn7kCDx@fEdALgv&XsAW?nu8hJA3(>1OVw;n;PEL%^oj8*mhQ2E;j+3Rk4Bn zJGk1H>E|JmPcXLm)h|5PLO2Fcw=}O}K1fe>!5Z59?!LOuaZ(@r<%XnHjBWk?UJk?#2Ant~-rjG6whM!YQnB zML$GjeBrX*+d6B3<~_atH}?9$m)!562b+3DQ~+kfvBaLAv zrzS$}m=D%j8dP2=<`Aye1%6OP)K0!uYxuM|pwM9(S;!Qz3u$k_eK?oPts&tW_5+ng zQTs4id$d)lG@!(18XoeaAsRCB!RIJ5sW_yLvE*u}Uze(Xo^~U&Px;seSKW4wwA#6X z?%Gk=1Z&dyE!$*4qR@mxf*I?pTy@wVYN)B+?Z-KUo>!h}y;Rc%@?vwZ2!CANjj!?< zeyCX0J;ZX?QIALyz(<3v9>Ox;#%hrfLua+dv)N-z0U&k5kRjEJJ)yVlB}@3*<@{P3 zqNKr?_9pH);bnWz!m7NOi5NdY@2@eV{6Fs0pd5n~HYA z!mHGGqdCR7xH(8_=5=xclg^~?GOl~~HBroLEn64TLQP>SC9nW@X3kyLlk78OqK~Tu zq+`jW5P$s4RG&cH4*YnM)rLU&pq0qonE)H^L&g&TO zb4{SRAKd>D#i3&KW-A{w-`{#V9J^{zV|{|eer;$rsUfcC%@QJGu){z*$tjR*J#MsvA~J zppNKx3{GeM*1@)wnnLwP?Jw3Fg__ji4cp-h1BJm#FE0Hst#~K1H@^pp?Eet=EhD73 zXOKu=k%3hEZZdm2*@dD{HSj6#|;8L8TRpv)6mBZVI5}I)+_(b@PuE zVpI6~(jkRV^!Yh^cB8N5+~&i@Jy7cs(!J>0`?4A0a63M8f$k6iPtcv7%p|Jz5{&Zn zwl7JOH2RCZ=FCa!dMtg0-9_I{;YM#i>at9(Zg{;2caiQ1jdsDH?BFf;iDRIwc+if< z?3;=?D$0u5E6V!#g0lv5=Jbwnb&ylL8Qb$%{A;V^ghh^iOVA2#v*7`di#Gj=jgTEqjJQKU5EGnw!EXJNIM zbT^Jhe_}nd4;am`V1$aDmX?K&KbZ z&GIva1UN9 zowj%Oi2fkxF?~ss=>WuxZ)bP3jcUMXkz_iN_Dj_aA^h42vo>HJP;Gtttbc!TRoPRA z^jX69#vV?bKZP?vMe&p#Sh*bUM6oZ_xw`kuE{q@^24k&x~V0Ria->F$=!BPCtZ-7O{ECEeZKotM7wUiJ6k z`~JbYo4a7`y=P`WGiT4ta|BrfzDrJg@ZD;@z9Hl<9}$=+hCtDFS74koTGp1{r-9DE zxE>O9`PKLRAyA|noH$;4x9{LPHT|p;V)O`#I1?9!LeS`*Rd8{I3fVOpWY@>YDFHl* zp+MPW?aGN2cu1oqXvcb@9v@QxM5oHaO5+^0wGSM7H5avv5S{l;x;LlS0)<*m#nT6m zumv_HFwJz`HIU$>^3c#0@o(rx7t&6L;;TUfWjzG?To>w7pMc|M)2lCI;!7q^r924! z(TnUpO$hmmXXJ=G^43_!@YR4I2kn3o*E+=;6nhQLqeUWg)s{zBF& zPSGmfP*c}8S<1WgTxFMs)3Vgy2r6We!_nai>Wf7NpWch3Xe|`7XS0AIIw4hG#vuCx zX1v2n09W@0?&P|;3E!}7<7oBSg85aCxoon;+}fAY8aHnFqWRvKKIclCi9J=v zE8Dx%tpVI)~uJ7~*)eGlhR5Es_GIk3S^NnZM5%@P(&A2TpF;CAx z3p7I2gU9HOeN*#EWmkOG7qC}jJG|V9V?KW$q$2c12RcLJdKlHUS5;-0t{t2Y>Kd+* zpwM7{VRm^C-MXr&l^nCL?W(mAtr(cF%cHvpxx%Sdlo}Q6A2;B&2E1vB6~SU zCTlFGone~hj=MP<*)wmPUk8X-c=WdF;F6W0DES8s(Fs-OjAmO*Im$$L+Ut}=j)@94 zf?GlFr7rzy5qveNw}uTE*Sd1Bo}DkHdrs{2?;I@E6<67>Vcu!K8K(ldy#dOeras}T zUYOj5(e#AE^(6b@^yozDf6ApaF5(?ja($z?)z3&xxPmd9a_mjD?e_VtYbo4@Yl@%S zxw^NdDv@!~GaNq585A`^{;lqA_&(a=%_U`bp6Dd}Lm#H4N|KiZ)>3H^-MprijG3)U z0G3fmD)axfY^1zA|8e9QZyQ zk?i6?3)xo&)yPE)dWDRM+km-v9hSQTYiw_%_5${<~Dl_bX6cx1O@wwrB5gg97m?DobyWz5rNReySf>O3PX zXLEqgt!$`{9VpeAThT?T8=2Tw<*+eLda6D4IDdb(SYIpvUHgIJq{_Xu4OS$J{gQIwr!LW zLX}mj<{JLlhY{_Uf^y-znUPp9#LE@0pdvRri!11MesS&q(y$F0U z)EHkm-FAI_^2EDikVk)hrbBI`T0NN2sD3o5;}F$}2+m12xxN1Go!9OvP_lJ@w@r=@ z)dApUu_Pz(#Tqb1(>!tZNPf82D6h!@P5LxwD$5VAM~ zm3gm&*G2vFd^U|{q=ysx`HV-obH)iE_cXKuU$Xg34DxC&*o_gA(XLF4{rH++&OFrC zwT`r4QCOudZA!T^-*!eO0V)HgO-snVM^1$DTed%!m1#Lv8prsh@9x|Et+kh1lR&{^ zp6hOKnI=b-&Buv@f!ag^Skh-x+Y1r_*ce@AN7g!&7)R#$=~{bZe(Ggi=Js+NJeACH zlrLET=Y1(y2eHGm?dhuRwZ6G2pKy_D;8ajbIoBz;)Vqof-$S<*Kn+)qc4Z;HFn$zi zN{skB;_poEN@ECtq(=|jByRkJMN)W5Pq(AUpjO~Lds;kB43?iW>LlhM7Z!lPhMnD< zsX8@6oj{eH!d%*>jqQmpsQ?stF+tQMx`}!}Imp^@De1UP%B=+{#7dkd>KEnx81D63 z3c|SRm$!UU+a1k5D-}v3WpAgMIM{oe5Ou+zzv=OBgeOXW#Y@hohEQuO$yX8-7>5WY z@A9ixd22w^8%u1k_t`*y#}bk4L>O##cgIS?ah0AH)G_}R`l_g~lq(~C7F`fgEtC^N z9S)1KywYwmAjc-105rgSBWdG>h4t=}ON+?leR@YV((`we?tNZVclo0z#*H1*zazrT zD%+L-?UTG*odk@awQSC&0Ts%Bk0&H>ml?bOK@0~woTksFoxd2g_a0K+cB=@+>t6=i z#Gv;iZA8ckN&LsPRUfz(fED7&rIzL5QG4|01;9=gRvEe2rl^(1EaJ`LLU^fHP3scT z47ru_&;6QMx0XvI9va7j`Iem53=ONzIfcXG3Aasg$zWR{doZJ~`IQJLV0@w^HAq2e zrY0%2xc`j=atzo0ntM`;Jj#HnW6=lH@;v+CM?;yho|G&AEq~YG?`Xs}IFlAUn-25{ z74}Zq4M56|vp;T*2Ng4y`50Oc^nu(pD%cG5WY8r3HhIIT@yU!4_k0LPQj3=h)?AY( zwQz$fy|o$h`^n(Ao#)n}$J2Zl4#by;gC^-Wssw*;3eLPVY|c%V?4Me$xqL_~0ne1y z)nnumOPf~4r7f=FLo(+X(9#b;R{B6=vzC2*zf+k5mHU}Y4;H94CtCE0z45O03EX-> zsi6FHzBRD}+~WOC*z3&^z)R%y+%*fWhfB1isp-NEl}eKk;8*k)EYxSi(T?5hU^rKJ zuXh;C7~@L1G+Ks!&*sA~N|E{BowvReO5$Y?X|#dCAbHz+)mb2p=*}vYbdJa-k7GOO zi5?8XaZkYW*6bgWIznOADZ8o#Z$*uOimXx@O@8CS9;=KMj zSiD>3k`0U(DW~ux$2{NQ{|A1>L+}|K*=c>!4`NuW5~0 zwp5flkyL0rUi9cAG{q$6%JSdPu=1q-+gqw=V}@8F%m&p&)L3}&k!95ef&lxx)@Xvo zV`Dkwo6NozvtLoYa}fG16sL@zc2# zu~1C=cW3p^hT10C+v%3j=K#@z9VN-w|l~!NKDG9We&l$_;}%=y(MU znAQ%)5&}V{Qk-s#+q)IGNL`0aZ^%0Si$Y+Seg?q70vo7n6-w5g&>RT{r$g0F`O*lYi`_tj}b_+@h?U-*Te$y_rmIp5o_1>tjtklHHU{c z+^men6%ZTw9Dee#+I_Btmv)RT=FwVd(c;jlHpyD9iI{F3N}hTwzkmGdBx_X!t5m>6 zVk;$5>f6`r_$}&S_1z|S+usrJO|W#}Q-k24Xh)Ew>Wxt$gfFBQOAwPn!e4LwGmj3c z?k4^-%-UW?9;}K-S(MgXc>8{MIJnyGe(;>O%dY1Uf6C`G))dmNOy7*rvrN*DAhzV8 zg1L$VoW!g~dDt`{wV}U1w_Y3$iI%n=^kL(!+TIG9rJ5<00M_A+*fO-L=f;&w2h^Z% zn;&G6zkUIcfl{LE(7#Wz+XPXQ7T3RFEvf9)LVAo#GqUf}Eu&+Sg^zp+JOnGgk-F+vZ z)BH-$#w~7C7htX?)HUa+3!F!0{5#Suuv#zFA2}0Q<9s=$>>XM9!{=L3oNhTRzm%2m zb0I+sQ8gj&2MG0{6aOibKQYD)y?5=L?0H~YPmKZU4R^l4yYq^XQN;pxzK2_;WxS5) zBwhAWX$wCMW-gyi_zHsO z8ZuSw#T72Z9p~6fdW18wZKogGWZg051mTj?Y}peAYhV)~t-tyUQ2$1_HL0dB>ijrW zUi2O#G$KU6r2-$a~|Rj(PacLem|{OwUu-k zks@N^n_+2bYSy?`sm2i|Qb%E~TZ4>B=2vHxcuNjr0q4d<977Mm-6lYvRz1f{<9w(A zskp81uP5K4@GmZ(DibZ)cPE8e8g>q@Hdlb;430Nejt%J)MEGa596Al3Ui(E(MHP#E z19hkX8KN&O@)2@j4I6&B*B9eFg;7rzgT1c=EUZBrJMmUAtjVF=O5-1leYXTG`BaSS zOu!C~!oQpb>@^5u@Ln8G%2qk+nr8>Z@29~O4eiPS0o#f*WHQQ&{YXfPLj!!L;3J@B zSC}N9Mz=A{ckZw&*)dhLa7m-thCab_R>6ws_Ed0C;p0%~Xo%5eq9dXWXi{UU)&H^L zh#2tYsjrtWvsCQ`bf1DB%$wC$vmuGV#|__C?IN(yuRP>P+8`g>86V{(Dg{VQeT8o9 zgP(#Npi9KYzZ$A-UqOYx=M(ePMpV?Kt|p!|S^>1xpFIxiociqPhd+ z3FFX(!YA%hC#0$A((odDwamyFx$dE=Mv7B6RCwIq%)~G@=~DawfbCuH1gg^*mtT#( z23+S3>L1s{6`@(F_|CN0Pl4lJ$gKr42E}Jw5R)3F($)j{xnwz4td~a~1`GvMSOz9*#|RKhc3yY+ z+NjW!L%F1#;y0_nv)?b@8+%xb9)HlZ+VMqFbkQuYf4ycRAetQioxgvld6s~eP=4UEd;+I$YFE5%{EN<2e>G^+adbptB z5bM+P8?HL@*;yhp1H6XpkHCjormm}#YxAptCyx6)Yvse5dn-qm+?}K{GlhCU3)oD* zL`fd79m*;uVvyjYelUWNS=2V?I|!OT?N69r7&Sj-^XGv6|@2#VXkHX1_nioAapmCFEkY09B^WQPb~JUj;kcEw_+0kRUO_K+tj z4XHIdy90E~bTF>;qR&P)+9H3uS|VQJEEJ|<*MgJQHmljrH0>9G$tC(V9EGP_ubWC9 zLPsZ7e-;x=B>KFk$(U(q&_+#iGRWED@$E%tA|CZv%dRodxDlLXeB8rCI5B5pptJcvuLiZX*c8QtGdah1S> z1wx_Bek2tIcZSG4p+ZKT7c&(gXy_RouL}R^^udfPee(Q6k5Xme(jg5rstdQHJoJ1#7;X$)KiaTMuU(Gx;(3_M)#Lr=w3~R2QLJhR zD?wuRQ?;%6iG0{BAohBHD(1&2zAPk9rGq`VGb8CCKFgou2(wN=ZG+lWJblf@^uqCA zz7s>@Y))+c8(g{~4`6Z0=Dqg`QL6ZV~2%0Fzr}%yJZ!EhHFL@fU6AO|3l(&S2 zEnoCt8mQ(@pl>b-8=K-+@9U+6Wb*TkgaT0rK8l$>8sYUa27d+jWGDgBF85$2(x;=q zlGzXSHsR?5or2gpX0D|_xYgeb$JLS#(1BgREr381eQM&00(}p+ZQp)|Sh5%Igm5dN zx>j1mQAM*~Bk5 zpKr)(JKhZEi^@L8sWm$ThfEm6x&HwVYhYq?Hs)G1QSK_lp|T`)Z0K*32T;ud5o3ct z%Pu)h6n!)!G|53aW2ND4wzbPd1BskqVQW~2eqT4on&=apa~atjN2*eWD|73?N3{Tf zd4Z*;-nO9@Yg4EVJz>yGOO~D8cp$>@wLIpr2cYzLtaS7sRoFRJ4-NmsU{Wm9-)`*6;GHXfs_XB++=dABb^Gxcg!$11*)CaO4qtnoRu1yg#$-7 zKyHr0k%@&rEv!gSj9S!ZW{9TQe#S126|k%jnPoIgpq2TG9)s!>@M2*o@8lipQV2PE z!17O;rPf=uSZ5^p5lmuQ$st%Kz)vUGyS1ybKCfb(93q^ZewflCiAd4gaqI&J%pP8HJES$m-A>WmRNNH4AWp_(<7I|<%vGzfwM>U1Mg zq^9CcNX+mrO3b9*x)0(aE06M@mOrflazX*?=&1{7Tj0Hs1Hh2DRr6_Q2Y9?Y0K6V9 zx4|Ib@v+D8E**Gq0&h{GX6NZhqss8xp{`@Vu8B}03wf-Q{DypN{}x2-g!lR4chV>H zS^3tdRKeUvy`qQ8WBtXmzZM0_5I|1Y`Zvf43)M#eROV@iUIO_H+oSd1-%rqCb>IE( z5j}WMWD%|AH?Nzqi5)_YNKL*v9(_3tNH(jjdR(!>eIqfJeiCkB-ysnYmAt)-j*6Ag zof?7=P5L+ykS6LMLIUw~8cJ=bPlcBoEDNvAe6WlCh<}%+!FJ~|vi$yjS}O+q=Il9) z|Kv{u{3hoA@OuOj^iVVUKXH~is;bE{w_KN2)|`y6v+LCIEmJS%QG7Rr<*ttdRtcH(UDzl-$D3N zHS<3TE}FYvOfZP783)4 z*@t?*7FdfdArzfw`4PPE_+uir9+1*$)2bijrYRC}8Dlv<*fEjHauO<}1MhK+fuCF_ zmPq($-#4D)bstfb@QCjAvyel}pR1YY)|c*6TfDVm$n<56cX`tb?gX?6=dI2QG*`Cm z&3zr+WX%QxQQ3|H0E4qJ6SEHS)IoBpLb5i33o11#)uyimO?DavQ**J3frz*n`s;sAqd;|Uc27!y!U{&D(oUt~r@?bw94=Du@h``zSn zl5r)9{ipnccb~`s-35R2kWbNQW{_?O8fg%#Xbu^Ud(v8%5s{0xqJKvSUm@jX5vChS z*{9gpH8E|NmHrTON$RxVlC?MMof=-mYyv72h-My& zNn}~J221v4RBeolgB7lb&=SqXI=N4aD0kvnhn^asi7WjS(GHbXWo)B5BN^b!J`kU zqS$u2q5xmsh4g(AT)h*Vx-3FoIENY}O5pY|=kA>>9S(8Ss~hxaRaBRU zZ}Gq8x>DsM0|#hMIJjQ_8gkV>NdiTW&uI-65s*IJj~bH6Yu-@t6lkoI4_ zArKZ?QKceeT}}LgukZG(976kP+SF2f!cRNxhkSHZvyss{sB%AaRnAp912)L~A>-n) zY(10iykK6fa{pxU2(!t{j ze;%SE?+}GOl0D!JV^?J96^+*8_^anIHe4r*+zWC4wD&Eeb{F884H`mar-ol6UzHy( zd&}Ed*}qDx$ZJ!jxQ_j#r5GRa-{83zzy3iY)7Jm4`{e&JvH*4J_prKvm9CA`#tS{) z;!Tg)Rf!11x0-aCv$_JWrOlSDOPatuHC1y+Uyhu6+$&RVA`Dz7H07+n(_Jql6?v|j zQwffkR|+AfpTNrU!qaIQj3Nv2CI&)UjjG0f_l~Pr2GN!nCWfa#Zs{v+7deNUh5VQU z{dAQ4KYOg;cmvr4d$DQ6E?3PrxEOZNF&FGe;3n$p$~H2d``H zJ($H{HU3lv^Y;*Fg>p3{tnD_vLuh_~`RP62`|-va4{qoM?@_zMWIxyVwmhNSl{$aQ~@8!PX;lF8{gDVPE0TmRg_OeuQA%jV7dybQuT3;U(wOX4+`(?2(qejl{3IR za|t6IEFGJ%p)OzQ7&zvj3pCTL;v%1D+G@Quh&eA>HxD`h@#o%^MNC zV8b*Qp`p$%Fd|!`{Vi{?4BDQ7rLBUmjou5PExdTM{ikuzHsn66w6u1}D{JaT)$*)T zoMbja4?+R{cBD>%=wm|zy6|s0;4;U#cC6EwrBC^-y`H|s$@(HqD>3iszeQMa;2u4RxKI&G+^84R^{N#PP$$i}-+?&yctS6;DB-8EIId#4(O zZtclrMbOuurcc?;`#+jf)`K&@GsROsP4b9fV<|07*2ede#P>{ctQ-BYTcI8XH8^kJ zS>cqnwcQ#j-9$dgiN8dFyrRN$((F`U{iO+@5G^kJH?9lQOklMnUyur3yEA;BNGnJ|0Jq2GWgDXO5MDZrm)z-fL;Q*F^h0c{h zih)mE2ZU-+n4otsJ2cy3H9vlT~`1fbMnY49#eV56i< zVCM+*g5@Y$0(UOH+$e~=i-=+P+OW$)yWTWNQyhRXc=?=Zcd6^SB$sW!w2S5K@08L? z31Fyyl?KMmKr|+n5HE8Rtv0HvzQ>AoU1S-#b!1NdXGC6ImfAjZO@4Y8KA%Re4-lQn z2~kP`^ran9w^M>{Biw!}WJ#WaXkGT_yn0(1A3J1!?2!G*dl{WP@}JB|mhzhjz<}ya zY)m%HUA{CNGDEdaDT-DX*Mf%#1@2YqSB|Brf5;DazaW~)gH%t3{$W~y)cjU5`NZqK zX3#@z%3>U)J0gaus-i?hqof9~FBsvW7{ZnHrJ*k%Iq#`C-1dJJ>qsd}!lys-Kb}Gk z%a&za0nf>yr1iA10L*?+;#crwED9~SF(Uma-i$J#cq7e^qN&fY^dEZB1=lycws(Z@ zoVv9x6zh#eFU4{1h}d>uqTY(S-Zt906Gz{^Du%%roDwtx{*SizOI6PlM50rFB$`D_ z;k=v`zeqLY^~O-19S6dRePEF}DCFTeoGaGbn&CeOZl;|)a6&t9tVFQX(C`#+*)EL8 z*B(ld`hNVcG`ttLL6XrSo^e!b&re>ByTaD~l_8?)2yo%|%fip=OP6-a=X;Y3*U0cOZ9Vmsn3iY^-^M!Ao8{y#Vka7VS@!&~eYTxDXd>%mje?U( zflWKl0_RavgCnaeyXmIgpY-NmN9HTH-s5&{Bsp5Y;KS?s*XyKcfXUEKrQMO?;(gvv z9q5^fz-_Ee;YM||l?n774B&4&aKtQ4;&wedT}DTgF3Gf4T^rP{F@?9u9un;?n9k@It>a8{7IDK2`}{cjgd5oN zO27H8$oR=Ih6j9caFTJ~{hD}2ebG}^^yaUmfT=y)HA%*fct$wlrBjvua!f(ZaluPY zG&{BJjzlr?rBe!JIPCWSkI8lQlBgq|7rLWI`J5{M;ti409r**%J^3(q>W9U2+JRrJ zT34N6N~up%nN%j`iia)9zcHL(4fG={y6TtRm@EFB1)}cX+UR;HEboEj;IDYD;}{p; z*wcz!=+|Ap1hs|rFDBzikhgUv7(Pqn)HcFUGR?>Ek3<4oF_GMF&_lx@0^u9PB%*aW zQq9fWDSYyhJkXIY0QsZ;=Gyz+-1qQuISXi=ZMGyQmcIUaW8HM0$LQ>x z+B|W2v`cM8Z;Y63&-5hH+XbN^9PZw0HVBze`6^61vTr@3X(-hrA4|IjGeJx_$;b!nk|?+~5>Bm|-+{M)@=w(}j=PGSog>u< zN%+2&aB4yhX78SNsQ*SW_JP-%<_NvKe~RHv7SAVbjr5jS&6() z=~2q_*(1=0cuyh;yPa$vkSZ)tX57YFoOYJDkb%m|N>hDObAcFEmB);KVP51T*FneP zYGHn+DZrd=94zxjG*Z?gx3C@V+${A{03-Bp=hSfSb(Rc%+J`*97SMtPU>FOFf@+Tw>_`_>viWUrSiD=J?8(2eb; zmM4>NY7{uM(Ru$-?mc3kl6-Jt*enn6aMb}CI!Uk8dvsX}{k@NH3_+Qq^$MZobm!+x21nWKBNx)vEM7xqvS$ehD>l!qcWA*>7rA->=!iP>eBaj8TUe4nT`kia0hSP}l0{an#rTYMhdsY!%RU7~7En{uaZzm?($ z`IG9s^NQH|e_4-bqC{RkwVz5*vYAv%nZy5l4D_*qb)n+3fQu=ujJKTHyxR zog32ed$n@iumUf_z8?2xhLtQTayj3)Y{MiKtyArk`dd=V*d8Ou4hEM8;w_$atj6KQ zHL%o22H0VrlK9eSA5w<{UyuK{_h2zXtkzdMfA-$>XYXf-bo;%@=I5^ zk)wL*i(|{8dr*zaK9aiyNLC_QUWJe=n8_-wzqqr9g=197O4QYn&TzumM^&|-ts!(A z&z=RKs2#U!=Zwh<>-W3hOvK_Bd$5gB4G=~o0Myq<`w@_;xQ9~Q4QkPs!VI)O}b z)hH?6)VJKB1 zO_)@>@HXaD4EY7=L!lE!7?Q*d%czopFZ!c;?=}&tpMb!+8aoYhoMfz#Al@de^bfoX zNkAoUk>-uVeelWz&-YG7&W(4M5iPFkc{(#nF zGDsN_iVMjZG~mFt4m_NfKPE<|vo#G8rlFZsHLUFf+n2S2v;CwX{jc^S>R5^9yhXj6 zp`kR)V~e*3b{Cbwzn(T$Hsc61<<4yQ%=xKK(hscUJaDvsue9zY3g*e-Y%@m+o9}nk-&>Vh7UdE`m0{Ys0l( zDhS9*-m@=v^*K@jRc-$?@UfX^llvNflUt$}6V&3TDaJ;mdNR=KsALbUTSy>-4qn+T`-c;sB;#<=qiH$1mnJ(p|jFNhz!vZ?)U=9XzRu{9%Xb5LQBh%TL8u`Oe1524D^)neI@vT)G!H;+8=>m72d# zz9wE-<`mho%$=V^@hGErQS!;9X(`Jg927f_#CMofJ>Gl6?#%3qMED1oV&9sS*K_&~ zk>gqdt}5?&uQ@l~4XCwk0l9+hi5iBvI-9mkDIigN2pBGM`Xc%N1H-Lj#@R&+##t&- zjM(HzxA3nR?>=v(sUU<~Iv2BjAq*TS^qiLutZFb_vYa%79yqj|w@%28XR2m? zUTbd|zfZd@{N8qXM>k0~< zgtI-dWR^zzE0hv^8AS(p`t{h7c|otim97?x>6$x9fCFzlc{sn~&duXPBOAkQ;@nB|d=R!u1rZ;TQ3oeA5aBZwxWkX#5;d*hk0w#AB>cpoI{? zwf$B9JpkjU$WVwDcB>U#7{B`m)Xg((_j5xO8MJ)d_FRo9(Cb1t5shgBMf%1Q4mEOvheJ=K~j?T zUa0WWvT2=H28U_{zr`C~s+m=`P&W4fYH<{rue0RnZ-@`TYrP!CI#Y3$Tx{PkO+4|h z5-(yWer7Kn2!j;NYY{oyqwyaTv=XFFKmBz9jo&bMmvCzlU)wWZ+Y1a$_=%|HSx;Yl zLC;I6w~kEo>2YfO#zHCo>~ytu87Y@67%4xHVjR691$Dk{R3=FRqTWW?Cqx4tk4x6C zsX9#dcprMNER<<0JUvXbYL&tuS087O4H`atbsCRlzi6u0P1ZAZV^(h5d?TK~x^SL^ zl%gDY8_}+@e`Qy+!C5x`k)4pzCDt}JUMG)9a-CIK7Al_Y_A#O4XVJv1(6@CzMvy@D55b&xdoaJkWAUP1qBZde368u+^c0+I%(PK-}V zWhz%)Yjpe^s~@$FcxcEt{Paux;nYwm0P+ofM%i)RGp!j=@Efj)cDyXA|3gc;mG`cM z-wT|PzEhDKCW&X|WKjf}e@@+$JL(}r+AODw`tAm+i<$5wKhZHa81e=zMt&Cjv| zN{AyOhOcfC#07GwQ?--}7O*F!S5$92#|N5!ht^)C%N#g=7QNO(J-FKGnDr) zu7$eItcEHGQBbpp)O?D){UH&c1j!Q!#FI2k2!6Ucvp?ajLW16hd*!@&^%D6|L{H@! zr%eoM3qq;!^xc%333K&(!8$56pJi=vsyQ$M)Jg}j-3aj$jY;gFv%OT57hh29s zoHkn&?koD|3L0v)=#Hs4^{4G*nAlVny^{w&h>HCQAdPysy3!(O03OGsDh3YSN)qEV z)g0PL9>%y{I$WA}8}mk2?{0}?e*S;DUnZS)n<1J0qkA4w(1grx!pIz zS0|XtHY_-JOEzL-9DM`2wzNIm%XkkdqP@r*Roy1m88QH#6_IXcWL{gWsollYT(40A zf8PCfmrEaC`DS-Jp;*_x;G~Skzk_4wOdjm}hv8(vH+yEjl;}OQl)*t+WAV7S&_>q} z;1jhr7bg3}k=&W&5E5hr9)`|NuEhUvX|xT_firQLjWaPOGD!4WmWqPtH&a>smksoJ zOK>TI9g`Dx_sI;y?p~-XwRU1cVqD;)N#==UoAiVl`ur4r zzEak6cv5{VN8M~8M-A~SQ%R8$MIir0iLd62)fDsI>MM`4=VE)27f4DCY_Mq59Sq=e zbDiDTG@y98YftLMgEMe810^s$yL9e5e810^Dz_(1p_KJE(EPsPCjm9bnnI#PA(X@W zD$W6Bna8hxg7>Q$s#u4k$zqssZ$}sg_5b|acW1cRWj452h*a?Tn-@2a$iq%{#a}L8 zo&d9-7fyP+Pp03(*ffeKJz4cZyWQB^?M7Pj=xrwV`Nn zj{-j&f5nc?mXN-cJ#=J}Feq_A3#F(yDZ#$aN$S3pUeL$Skh&UhIqDds3(C5=afQ$C z0S)XVikpAGfRqm~O63A}F*VGA9_@9DsZ8|2?@@d-ZxU0FRyQ1!o`V}*3LXcgCwvDb zNQ}k8)l9JWPq6KS@5hj@OpzQ*=yYfAEJy67JW>KA!d^N~$@z-B6;27**ZD0BvLh;z zjg)3!{NAu<|0ZJT#SfX4O3SPxbj$!qs}DgCFEA3qDwCKlf_LMVlB>pP@b2Oh`$dS4 z*i{ZbG3Dm}jLd$Tbn|Y8WD^2DNtJs|^9z#rD`U}F=CvJz9;G=a#u(?}==x=?%Ox4x zLyJm7F&r07+dga=l`UJpMvA1bRfQwxGgCUGUPRTF#~WTV6>Y+v2laS#^Z}F74!jU= z$mYxGI6--n_|*C4QD#`4etq2c{8F3xi8Ama@Jz_IJNuW^Lr!m2FA;EUhfMQ~PmI2V z$i)B>G7Ti~!%Oixy89;^u7Nk`LdTP;G}rCSsQSBx0oHJZ z`sUCq)*ZojuiP<*dv2@$2MMT-H`R}9H`Ng1hj>}RtE(T~&X+kUMuEe1t}O<>^RM1? zH*+f~klObSzZ~K{L;@gMLui+6{{s5t#riotxF@7LAz#$|AcS^NlZkbk)2e_rWsL2vDDMt2Qj z82cxeNx8N0tSw}3oe{{EmsLK~-n^lwXLVA^L$;?xa*~4@EA8V}(=uxio<>+|5x#Pqo}4RMu|%z$6mJ|G4-j_^AtQ`FX1^V( z!&!ie$z{vkFuL!tk$R|}_^@!kLm0%pa%*rFAq-8Kvv7~Ik5kst*SfD>OKhWa<;%2g z=X`V4!TS1ih30mz>0?@TBb|9l+sw-4&XmkU<#pg!3cC-wj~2yNCcXLj zwcyjOFd|Evq$B|l#m;5zPQ>>1o)r7Kc1cJ)17ZCddn@kY-0%Mi;L7`#Mp_#+?)@bDPFpGT^sUGv>qARZ22(BbDf zX8|M5&94zy7m0;-9?5RoX8S_WZ{OUziE1Y{L_*pQE7VsPf;0HnB-Oll7}({#THArkz% z`*LWC)?L*hYyXDMoD}vHN7M;3O?=R0QyUNR6uU+m3s@;Sx|5qb@y>ePWHoWa#S1fe zJ>KieMW}CdQYbXY9M&e2;e!IG8 zTO_L_OsUxUFOCzoGj~~C$CqHt@*Lh!!yQ`v#sGsP{e|MeM?||rQed!Y@h&AjRJZv1 zdZ;NTMEdZMt4G$V&OqeS_+^JzIC{R(H^%<{RMCY~?u$z&u49Wdr=U+AQAG-!#$Upn zwFHgy3l{I!1;RZT;unS@-d0nGwAQ5{ot?uVpGORdP6r8YYEVp z*E682oA^?nnSw&<#we&x8TD7nllc7+2b}m1;U&bkp7$1w%o~`x<_>ktvUxAE|3(6k zFIL-nViQRwMU7HmxpphywraQnGyWe_Umev|)BUS}0@5Je-Jo=eba$t8cS;^WI;Fe2 zySux)q`SM}ejok4djDXtIO`l{&+Pi_m>KO@^m0Th`M%OL{Xp(-jP1}M!wmc{<(9zd zv$%%kqb3HGGb~^ymO#J%9G3c4B7xF{sv+5lTJlggF1__yoBfrpdv0CLQrRL|Ogs!# z@pwQ%?N6KrdVsyAu;`gS*=P-85OQ~CKnrLiGgl{`Oe1tzt4jIO1nZ6 zKac}g%A1qpBU32Jl&A3cX8{zFa2)J>9NNApaOO<;&RZ1X%WT?KS&AFfWR%tRmV9ZB zYy-F~;mryLEq>K%=GZvWG7H&*I>|JG;X&bQ0aj>~8F;b=HsaP|0%z2c8LKYe9V1#j zk*;dwcL|?VD55diAc_hzCaF@v4B&s+KdcqPx%YDfb8>tXp=62jSni^yPFJwnSdw9l zP84wRP!;BipYS;ZMD3zM({E%PQY7U50Ahz8(IDQC zBI*u^%N3%XWFs1Qy?J;@%FP7(4E{C|xrl7v;N?TyHHlAuO>TNAE}05o4M&DS>LaHd z`IWh}H15hncbmc{ zxiw!|5P!%E6gRN|OvaGpw-TFyj))_pIe8k~2Ql?CR^>1^tynbIRbypGEMgUK}*9r&b=1sP!9%a?_BHel4pyW0Nv^m>EI-K$NKQAE;~& zg31-2fA)~>@k>84*~`8sU!m#eZ-Ay4#H8lKdlY;tC~-W9y+QJq4CC}>Tx7NHaL8C7 z{{0#fF-E`s&An!UCVE>Fj%w5=g_bW(QX9#Pg)ruzZ8~Z#zR3 zQUF$}XuFgvt%3%$JLLz3$On4QF4HDH&`1B9t#SHK+)>rfcX6AS13FKg!7WAJ7s&w5K5aOZCpaB!zfTiNtNun-GdqoDQnwEwF_wX*5Z zbVKVA@?tP@A-~^Mww2{Zr4#o(+vX7@iR}KdN!|3Y;q&?5(5<+gD&OHc|C7+wAt=2+ zL&vxYLaTK6okSE>?MOO&J4|8GNPP3^0^PyPJtRpUH|7F{^|mkWzy*u|flx{ihCVaX zmkpJ+yTF(*4$~D39|(}2`0Mw*682;!I?ZGzCO+ErSj#L3BRL-yDz2X~(X+c^ zF*PhHUe~78TZ{0i%%wx*2lDY`N0Nt0_l9Ijg|j{M$_lre5!hSPznCKBHyPOooC5pF~-Fiw7g(haNZe522EJpVNe?XzX!f- znlvPPy3YMw!!X=CK?K@w{n?b%z7I=JaZzm0h<$L)6bhK?`7>+v|4N&Sj(fW6%zL`g zh+-C^8>qRpaY#M=M)=B0cKf=YoF!X`N?OwEY+FX!I2LTa5%=KyLg3glI}nIfVM`$O z`)y?tgQ~juygxW@Z_+;2pa{xZND>w+$Nh8zLj$_+kT98XopJnhwqk~dz&gAMLR1pp zy%XQ??Bk6TL_$MtPq6vBAnhCu@iyzs@ix(jgB(aBNh=IWk=vR7IYNRguwA$|W#5dF z_RLP_*bg-H1RMlT`_?s#--(j0mES79=r=*y2ozTMu!V+Ukqj0>lV9$QPYeTaOf%{0 zT#bmk6TT4Pblzq6~b$%PDSr%cZ|>*s6R^oyv*(gA8l?A zS3xxTBA&%$Xc^yNvuD5urO)Vl3Gp`^_YyojgXl6lg8%^pL1GXG1sWP=+<#&|If zI^mT`)<0A`7#_PnvkP=wM;aXhGS3#fIQW>}+hv3vK?c2q!~3f4ZJo76`32(S2>-wM zz`nk#Ke)7`Kg&mkLxL&K{*FNiZ^kWWW#C)bb*LTWf;E0v!jtqoiHKF1qLsr?h-TlI zE7$H6*@vg@vQYr1M^@H)8(yykS2cpN1OFSq5XdD2BLA*HznIeNWiU<(0Aqqs@5&a5 z^8>&r5PU9CvV!jdkw&FMtUYuE;#vSOTp-Na<6q(FlQgb}u05Ow5vdP@^fc;>k8@*4 znh5i2%|;Ks8+do1yWP~xDbP&V49}Na{XXwPdBX!?#$gLh`6P24f$Hjf=hO*kRl>z| z%4Vt4YXQ}ygiYOYE+LiL+U|*3qPaW$1FZRo*-we7coL=p{tNpG0IG01EaK!T45VbC zhS2yN-?YlgwYM-EY=&HCU`q9tAIWu2VwRd<9$}LB1bi z3k3;s(}$ob3T}*j2z@Xm%S{M21aGTsL-CQh88gM4lt~=h{7zir?OfuJ?OU(Z5hTIX zVGe;l;J;j(V6Un_(kMp=)T|CooEhOpfUj&~g=Zh-rVfn?VGx5uRl@G}&DmFp*w7BjiDF2f$8q zMi3v;jq+zV3WsB64hRVR2P*+dMWy5bjCFzT00JUI9Rdbvee)f3Uj?O;DyD1Q9kNao z!5uz{vC?8TB&2^?Q8WJl49y<_BG4JpF~(99hX&>XwqTzONEcTIq*0XS921_y^&HmV z;39Z}T>6fsuRI7E%d!N@^u!PJe-Uz|f)KhXV)%yWT1yZP^1sq%qqQ z!5i@=;^dD3e|5K5#Q!6R2_HdBD2D1O%qoVONUbJfq8+ys3~;nk%qY2Dm1J)AXfZk4 z&{31V7j&HRj(W&HsmS&*X2?VM?bwb#j8gA2jsqo{1)UX13%V zbpfltB!igU9BIcoBGxfU1grYymcfn(LFFKq-HEZxIwE8PihTQTS=&7{lry{e4lA2W z3@W2S!A?xC;3m2^($3SEW~Nk9YD>L7oR5z7kvY0Vxd@=u1bna^EIsn6jJj@b!A!l{ zc@BhIE9NdUT%J(7kFZ%rZ?6qE^$%cQblefx-#1MO^}|WK0t)sG(&_1`5x{}3Xf=RqQ$5iW8Dd!!j-;B zXP>gGGXgj{wxkg({*I)qj+%zE(l6Wu#=w!I${7BUs%){&`<#OGum`;mv|BHn&$UT` z=5ARh8FlKfXfxG17mmZFBib! zPOYyt%&f0KFwGBTL==vEF$(KTMG(Qvi9%0y#*t?&9+jkkN82}L^oOf$eRr{kZH|tt-q9rf?!Gugg-Lwt=2zTnk8^ZIX2?2UvHgyr zql-m|-SJ;%=yl*&?|2^f>I)_b5yE(^8zl@S_md zhHOMRy0gbaXQz_sis8KhXC)I%R5y^=@H_xjn@FD=6~OnWXYT&M8hO*q8W|)u_e6=| ziS(JYCat5HBw-2keC?c?<W1vZK}3%PkTt!8`c`PQeVWQ25yfY+e}9xl7L@W;E|_3!jd9KMksWNjDt z+~3K-xqrh=d~C$mS4Nn5PuYaEX%0HBz}k*0fj02JB6h(JhLLzLn>qtooN55bv4>QV z{*(2R{c_SxvvN`p(Ipx4k$SZ|e7Pj|PuV5xn+L1@_)Q%Xx+SC>F=V`;O(?rN<^D-f z?Sl&H**6`Jyny?=)bG&NTnRFPzhUu1FbdTs#@x39#tX)vXE=TD~1J zRkT>aWWRUFR^5Pe&|d`n72xFRxx?ZT1VsdGAEj+10QxP8NOyV<3)?&4nE1pVtC>dY z)(;gwavHz1doM>{8!w+@*XYj`j_PzE;8da$RIWFFzjRWc7kD9u-L+8UQJP#r^k3Gh zDCbFT4MQQuT_@;?x)1%+`mn>+Hu05(86a2rVS?$;o7_YLzX4WyAFP5*n%rZFc&DRO zZ{pQWY%@#n4^Lden|*41Z}t;}C)j(iaO5vxFn?@aMqx=o?M1(H&2#K6%Dw9yp%gMn zA9FpYh=FB#VfG;dfIP1IlLvSOyhpB9eAt|_l_^ZWbA7)*4pzmKb@UU{Pst`|zYKH; zEvm|RXDuSuCl8t$&gd`B7)Eaq7+7tsx5PMT5E99avvud1Pbx87IE-<=*<)Z4p|qDc6sg}2sB@u4&B|q7g2*Q zl606?UY)H0)j@cTZ@&%x;*ZgzZCfk~ZEur6f6zi@jCJXQi~uv%XZ`$qzn6evS|}tT z!H~f88<7Q)^+MIgV}PqlNZ?oI;AZP|MkPBVEu$pgq^Gj`;03*AMXqh9W5+iJ!6M{5ajl=*x*ngOhqg zTdg`m<~C2=BwN0&#^^1ihjpu%yT4e*&LVHW+zaR+n6GQx6dPrPFh(O)<@`Ov04Kf2 zxrej!RF|zDC5hOLl5VcR&-uZU9?P~^rMIIHt(Pt1*rAa3LDx%@%iX$~vAPHX{%)ych{8X3DEBK&Q3GPK zUGKkSqf{)N(dHJjHT=Y4C@qd!@cmuPDJ*7d`qZ)D3*A9?^qd_)6u3m$SRz5a| zxBYtpbm|zuKrb!URJn1)_Ydn7<2vf_&A7Y9Rw8%y#yGfaF7a-*Rub7Z4T{;XC@M8L z?hG2mT3!j6q>lTF%-VXh96nmuCC|_? zSxe!TR)p5sEadpj%5RED4VsFijVI2te3}>F)VoShieOD>oTcz>O$U^1lF%tQzq+v8 zGsjIqDgL`L)%o_t(u zR#yx#qt!bPOG)W!Uf)s{C-T{kD7?R(qaS4T!?3mVD3ecma6Q9)(b;+g`E zpYC>S)XMEu5oarw9X$Yk6N2@^AZ+hUKM4Cb);{`Gp13AqA zlOfe0ImU8SuK~VK)UYfuW$h#DZ|3v-*HD+*SlE8x{tD0wmfi0*A>Xg<9>hPY;_I4u{eeIR8@5hqLAsK;IS3t@#A7p zz=DJ_@OcJ83QlgXvoz2wt={2?@IE+4WJ)rG;~Pm?ApR$eJ)f9^Ph zgJgEb?!_m4JpcF_^c@;X_YPYg%3xKzj|L&;zBUI~|IGCsyaR0po8*|BF&{?3IC@PR zZuKcO6H#N)xWH*$rq(L!k`7R0XI?4IBA3KkUSJXSbD9o=$Y`T1CAmd;l)mqWyuwl% zywo+ExAtvio?n3NvX~K$(y_xYCgCfLyn=`_`|gNT3Hd*WTC&%~^nIlXgP{D-B-5B7 zW31R~!aEbRieU#kC6{K2tZ8ba0&aTR4inS=X^YIas404QN!pxz{;>&tF^rsnxZfn2 zFpxE74Je$BU@Am44q&;D5D42oOHPjl&y=ObAw__pytRrWjQ}Hi>mMf(0fq@QVe;zxacyi8Ou%O}EcEAyuA$BjFqcfd&^Qsymv=9lVsggsLfwNn~J8MCj~ z9XMvpAKaGs%iVjUReT;TJ6_41G;E;`ev!u%7#l1q__ z+fb>B$qo!MM8ED3mK6)bJ>xyok~PJ zM1mo!T9bE<~EYJgF+sj!{$sw+OHS5OMX8rtwO{QE^4%(C#vLQJH{=3 z!35R3Tm#u5pUm}7-=eGd@jx8G%kl}O-o5Ir`_b#ZO|rGoH)=l=B@Rnik!-~|dQ7}p za1<~l2$Y%XSWv83*r*hYBidDoS5~R zCA<{w@Di_81yFZFV263DW?0KEzJK>DqP`2rX)iFG?p}-4WtjLwJncIvCUKigRWZa7 zxv@|~T^2pr$oDkXIXNPFgs=O4f&@X+V}MaVLm0})zlb4c4{>DD40(h?XERp!k7LS7 z4>VMmlYA+Vw>YKVRthd*V~Wx1D3}dWV{>2>DA<4ZeZd+d%)-&85aV7<2QM7WI#!;I7H8np1AA3uB6oZ{URX}@eLOLGg8FTj6mk$XvFoWZ9eq3!#$qQ&T4^*sxd8|@35fK4>n?s!!5-r z^2koYu|4uZImO0;weg<3pZYe1eMEt`4WeSdaMfEAc zrHI7iz+=GZ>0Km|F-gren*KNoGgiXe8zSLL8q*+8HC zwv(!Df(*UmYNHyYN}y|Ll$Fia0{j2_Ev;CsC@mpq?77YTP%FsLM;8f{q5RTS#iY<= zPCFdUQvtfR{pALp(%@R_{XoL>$k(s-2u9u!Wjfu$sl)I7*tO%X25pdC!|!+(97h-n zh5#vBV+BQ`!1mfqu*f3w`=A`7T&LP=xew>;)yKF2k zU|Xq#HcVn;q2GFm!G~a*@}?FkWaI3~TdI7g5px!odMh+T#ce-`(@*a{cG&fjzoYe1 zD3rfUjPUG*$FcL}Fg7aMP5#G)4RlG~#(%2=#@EjK(HShc=>!;8@4f#&5jC$1=lTR|QCAU*k>#je&%Y#rVxZWXXA>BDxQpqM-*|D>jO6t>)p&-FE+t%=q5h;vrYQ?bP{+wk;R`%JCgqYg} zvDzZGL0asNSmOD?FgV5K)51GcXv6Aiqk_8{{S|lvIE7@A^a(w$q**Ce#3Dv&T*1>b zIhI2}Zj0w4lnoWHq*k@(*0<0_Az&ry zm-qkZ;@&HKK;1X}kFJOR=mJ25r4;)Lg>SDkif+x4b}+V@=pC#1DsEfjMmdEw@mU@< zMb{L&$n}-S-Oi*oD6iJ#B}Hx9IRUdx!8D-^eEz5%VY3&Fh1EMvh6v&%8mr zV*ETbs1d+-;6b4B)8*aJBr=`26f!Ff`z`VCoAjqDB=gVSw8G^vxBxbmXSvy%(tf_I z9PXhv8sf9ZGPCV(WEj(L$3>XdntKP?xcXNb6|VeTKR~Xn6=ENlkjKee?|;~1@2kez zE}!7XI$zDRofmq~#G@k}eKCi0REJ`ysN$W|`^=EwYuOppF0S%(j4QU|8W0>1#OxMC zgE>?rF41r5%;c&;G6&ebOOEDcbh1i2wIYgz#9d=MwSLp^Ri^+GLs2F3e5tnpjbjS= zqV`Vch z1^XDLbQC7F-l$z1-h;CMAItl?Xr-xTq7MBThH2*`440?CVww~g{BL)~x? zL?n+L+8HRdYz@;J%$C^Wt8AEat+b|8so5htx&l>;)1l;Op1xrj=eVmC<0vfZ8W!|T z5+t)q-+C%M8mXj0x3dbT(=FGEw+m?%8>OS0WYHZ8Q1MD1y*qd0?6w_U-4W#@@Ovzsz0vW|Ac*E(9aV#u3H`T4&Re3gX__rRa8>SL_)s;S zQ>KMdr#1`qL|>}oAz8uU4)3TOkEeLo_fBM0C#GH{}jrTbK}zk8q3TqqHfT?v1vOkFWPF5!B{JP6SLw#Ps9H!>`XBj1TZcu)V~)LfqjmiFcXE_A|9N3=?+s*12YT*yChHp5U@b?n1 z&)IYB-c0;vzAxtb8=#RG=WE>Bn-6$?9p*~q452V+KFL)yj*L5ysp$F!2SG$%X@;R7 z5qti+K;M1aH=2d5iIcI4T_*S2Dx5A^p(^n(g~JmiRvFFRyYBCTymQ~x6WjB+d_VZS zEl-5ki>dI{P84g3roHo?%7Y0tyTdpi855@#^|~VhAhUVp=RZiUm@rKG)lBZ{^y0Go zq;dM4?&aKylTzzT@Ez;W<0H+8uRRXaL^+~^)5l4(efYDOsRi4bVUqi=tc!DAX{9-D zx!bu1LosCM=>iT$-)j_m$OzsA>6VP(+{nB0+mRJ_S};BjRt&E|K8!r8Ewt{1H?Avi zvhsP_1N6jSnC(L1Y+%74H8=8I-MOS`3zSdL3Va@b_<20=Gdj~y>*bB2y zF!WAnv~U^!aIT9rWcO#x#Uexes??YXbFqR!dwks6aQU5B(Lpet5tZH_@jbFc%LGm< zpZGExPoOrD|1F`;F$0~ZxBaa|mkTVf@7Km_XFmrY4N-)+j5H8%q<3vCnR$2G#@8a< zHynMrF;qsaS>8s=6fm#3vA%ZFv{_4uP7yk@-t@CJne*PTWVA}E1|lg)WOT}@Osu3G z+?yL0tLa?$J2P3SUwVwac~Zyp!>AVXhcgwsikI1Wn;3v>oBgCH0ndm`b4qzMPAp7V z+8(sw+s*__N^w3Bu&;i|mG7H4Go5zP0fgA0qklRY zZ%}hSD`fjk^f}r?%psaZ*?DU6Kvb_W2C$4WMFQvf73zNd*(s01db9Jb5@AtE)7!O? z!3FVcKpvn?&cP{2{Sm{_GhU`o*P_YhY|ap9>#!0Mt65zqR->Dv>G8AeSHXZCUcGbH z;__VLgSJ}7;p#0G!1bi?Bf?i*z0Q|Hs^&Ywc-B+i$5OxIp>^-FQe6HuK9R2FB#XOJ z`%mCE(1%_7Cka!Nw}Un>1;3_}SnJx|-$w|u1NFxp#i1h}`en!5Zfu|MQ+P95pSMg? z8;=#tc=&uB=_&U_S@TMs!|?GA=ANt!4y4OU8Ink6qXo2r6Ib}5J_HFsn?qv|8aF}k zat>S+!{(@`!PK+2B0_I6w&|NBcbg!R3VvJ&5&=v}m*PB;yjg;NBN1%6x0>Fy;%9(O zS_6cJj8wEGw+S>xhT&8eH|<+1$EKOOr{4R`I&32YDWycz^^qrp?u#@#yX(?OKe`_> z2jh$Or3;F7olJxMK&xe4oqYsHT*GsIdE;+7XdX=a(=f=fHZ(%kY~pOK_{+(3 zX>PucYMu^d;TDb+Ov6pQgS=6%J1WlsHn%)aViX&0>`&U(4*{isSNiyVM_~z|!ON?^ zQtaJRss^s~(baesXWc1po7EcSM2CeVn6&ah<7=N&-qg8lNpju%mZHD0#|vIpF=ug$ zN7g5p(Qw1JU`;=0S&0|k(na7RlK;2wGFs3XtHKlAwgI}!d&GNr=!r=>ih@5jDdOnO z$G>iTNRpMao%C*J4A8Ko%eNA*ORZiG*?Kpgg?qy02QzXIKXdOn~SE3B);TS-klfriRa5{uo2Aq6jf3^82d=C#lW0~?} zyOh)FZB0?sCDro2GwNO+D@fOsVnDjChzcCDRMN+uyQEb0^5;wYU7zWZk7GQGy!RK^ zw~hvd7&>yFko=%w2B(b*(6ed8-R2xxh^Wh9;hji+fd4awlE;SD^$M1qm*!N2q2&b% z0NGdd4Va2FVrQ(YeyN+w@Ks-XCt*8kN*kv^XdeyeZ85LIIiZlbB`fQcK6jLlZ?X!F z8b;D*4JHNp(iLtO!J|_Psl0o`dmhqXpZJ1ShEDP6dY*dcuxBc4pJpFaZ03?3#mMbn zkt@c=UOqhVGqO{x1i`&oW-AF_MjV)y2i%@$Xm5AY%Mg54TWn*c@o9EB6(1v3S5JFd zK7gT`d9;;$yayj1X{BTXpLz^Eor}RyG2%9b1vn|#m2bMS3R-3PGqc%E zUkT72ypvI@CooxDNQ`<~XpDSKJuI7Z@YU}-whqa{q=b=mAL2=`TkN@!;;c$fo_3Di3WUFIhVV^Guz!nyK~xTziEG? zK+Gt=;A~$ic7T6HDCini#3#81rj?gP^}GXxzK1?PL&XEEQE^S!$*xz+zH8+W9~mR78X0P`y#9V{P`&2e3k zrzg=60NQUuBLcC!^tR5-IknHNfrMOj$K{KX!Z@y|17AhY{{d3%<`&DsDBkpo^RYYCBw~=FZgP#XlpJEV=Uyn%-wia300yW56%^8w)7Dl0wcLs#jM6G zlLB=JJ3c@?Q?)sQ)3*-AapZwv0YbC3&X>DRU_ zYEKN`>qI?PUFM5RzT@U>#LqjJ@6PGylkp;oY>7XQO0H-;Hz|F0*9x_FqG+Z|k#iB3 zM47aLM%2EM8Xi7}p{0+aH0i8h?~dTtT>whr-5aSX__<-hFN^!tHc)IFR`%AsaC559 z4?@R{oO!y}hkR{ifSP*418)S?%?uLOt4%P5`a$sBW-Z*&fu_5wf>KP*hpSjKwuW!i zwNUl(na0xi4g|5Qr@nIQ%A;wCowt(YHTdw_B=;H6rg{5CS8WLdK^{_F_!U5WZW2HT zSd9L136=CNmN_@reH-+E5C(e~OEC!t`=hJ0RqUQ3p>=TuuzyZ6Azy8$X8(zM##ie< z6|rH4f;y85ykdp^I>TE}y_0yckyk!mFNHVfPYs_Rx-Z@?DjC8bea;=!KSj9U*XAZv zxEXDu@*bdz~`-jw-9#?R_g!fk@YTrNy#wEHlq*x9gMZG(xtdfR$Q&o24=GyI# z?Pj{u(Nvsro9V*A{5;qk)Itz?4q2|7w(bYlosPo&azzIDfHU=aN-k_EkQ4Y`7*isG z$#PO3JyA4+?lkIG90<`l6hUqwlysb#0a;E6Fk{raq2Lub_d|~MYMuCPGcLqu*`e!# zH~kLyL-J`&H^>ocCzLpXA1&={2o|lUAm)lB9{jZr33IUOw|QzCG_DD}F0Qrqwq@)5 z@#D-0>@cR(m6NQ-&zok-W}YADcaL*9&_>nS;jFi1#aF#X33U2@@^9hWwW4n$0kK@} z;PvChHY!AQXLk7~<0O##jKh26JIC2S57}Ae_=cvhZa3wv_{_B8 zUi1xq%4+<6`}i1nP_sV=TS}~+4iJaKJd*oJf^~#&=tewD*)Kg<2tQX~;9pmi zW;!SC&!Ni>s78xjS25P|Qc~HTEz0j$c98E!H^CHERG+#INH~S3fQ0!pHv~> zB?i5R`qy8rV=avEU5^g(xzA#WiZt7Yl5~fcMF{A*gl6ZOx#0^KcCavCWeb-E?6rhS z0Z1HXve{a`6ufB)-YvFgrxCc27~B?HiX^a7!~!j?tG}2OUayJAp)=6DnXV3xAJXdt zX&vO_ZV$LaN`c{})uMv(M&}#lQJ^f$w(Fwn{uh*`IILLLLq7U^3DeEWKw(l*gU<&O zW*+?F(PqYA-}}9gdvkJrW&W+En@Nk|0I3nH>)hQs7vlSpUk3LjLe-!f60?(B1R4uC zH*GpLLjphUc|};Os@=($6|b2j?|Q5gT|c)(*vo?~5b%Eq2DIuV%Y&2{%Lf`5F_GqJ z?@84dVzg*u33VCM#^`tMO*o8MJ^^Dg!LZ3?uyW70lX4dJ9UZwC?NQuZnfDFS%eP}*v!z#R zVbxE^gVimwW`#wpJv8|DQA^PDturkBaHK&nEJMq-lfzBu$tgX&NDb`1)1<06i7pKIxBw zGTm^{7F%I*_`qMV<{w#BEHNj-R}87jIO@{pGH=);Q!4}68AHj9X}A!|qI*W4!H;bn zLmT&60@{vfR8fYSb5T9g4!iiyIsMlamy8t&!gLc2!gN4wVs%8eM7YQx>_tDVU7LOb z44LFvfPpNPid^F8(Ve40^5j?^HxG z>pcp}Q!L<0%kxuO-Np>QAOC)itV7)3YasZ~zyqyBuhIbmSM#S6$1fJVv&M<#)zH-&- z=X7{UEc#ZN%haWEOT?4nY2}k5@nWM|*jBWQfRu^K*{8s#=hr z`{3lKkaH^}CnozhzeN|j5-oRH96f178|%|8jxNsEtmCs~2HK(&8~e2^-p5l5hykxs zDU?C3)J4Adk`#1vS`_NWu)CR6%0{64vFexo?L$A9==Ndkh;u>J`*W8GhNd^TJXk)3 zTSDzv4(Pejt+{#lv!r85j~7yYDCSd!j3Jd@*Rn0M6mttzH(%LK4PaEvVGoVV71?RI zcc7(svpjg3FF&TdSlTP#6+Tmw8bFrGz(~YkquczEn+X=`1*Nviy*cGA}n@ zKgT>huj z6)_+jf`>0Y)#)&FYsDpQdj)G^c1D{7dzQFTC%6-(iik!9r|BI|=La%n9{_X6tL@{N zXVY6D1*`!-!N0(<9>=~)r={wGAgu-m5t&{S9_rkP2GR$@g*|=8+^vb}7nZ2cWJgB0 zyY1#{C%)4w_O!XlVfDw9JYgzzxvaQD@7xzAeJR}Klj|ZC_L~@ zxRrxyUx%;Xsn-9xqFMH+0}pmrMJq+JsF^1YtaKliYfC=^o|#1CVz)~Byh#RB5`~j} zZL|z!5g{^y1)GGB4gN`z+L2{uv6E8fQ56jf;kjI}q(O7$ZPW5(sEMAWJvml9^Xhw=9JDk9TjziaT%T{q|THAcc?Qd)OA?%~U zd@oa`xFC+Ivnh!Ib5Uat$G}W(SU$qG&RW=Qr}w08yO#@nHa$a3Vve(x+&wV&_;ja& zPjHhFhJ`hiEbgS~xR?^{*H!pn%<|DS0>GV1+PPC!B6uAzzxK^?@q2{oV>bA$b!a z_pSKRpgSfT{E-}lF7*Db-@JKS68>RY4E`fdlB8(!xS{-pum#IZJbv|p(ap=1=SIjy z=T&z}PRcsj*OkvdpZSA#)vXJ6$KsBwz+`|j?M+=vWe%i`C5+psCmO}q;wEj?ydA~Y z{I}4!3GycsbMp$B%E^Rm88X6*Y7d+>k)>N#;$xc9JG)X78H*tsPBxyAi6dimZsfP0 zAX}Vd@F~rw8u>XDhmUI9-cmOqhm0}8xk+p4q^<~4qicg z9vUTxYpw>vp%%6c{Wqynh7}FH*Mo-M=x%Z4gaKBbUz4Hxihfev+(t%UgW|wzzyyJ@ z(N~kyr>a(@vHP@@*F&RSCrvpmAhI@r4KAmxqkM7ob_jH9Q0RzXtD+IOxVu~B#}uM# z>o0J-ugBlE8CgzOoX^X)#m@B!b*zETk)Pk1zp>}S32@zf5oU39Km z8PMcEHgWj=(#U?WPvd-ejn*`=xD_bGy{PA+y2YHFrO z`%fFbJ1`LR(*BGO@4*^+9bKy{Ty*wdFz*mvk6ft8=}GZvu4}nYJ0rp1Yu*q5IxX1A zM{FuPBY0POg>myTKbZ-2bL#O^%JNO4)=<~$8@zvIXHw^!=A_)7Mk}0NUEwmN@y_AP zE<{LsOn6X;wU-^(ja$Da)yqB@ym!*&2Z!90cK2NowUV|fx3tyfIQO3Fd%Tjr*v`9x z{)ILDBZB@}i)wkQs)85V4@DUq=$&PhC|i>B=)*9{9oWCR2&90b33zGGc`JvmJDysR z+F!%8Vr`Hr_oh~9IbFV$e4|y<`jq}aJ7v8!bQ<=Iz6f(I9Q0e*^!=T{h-Y<37s03| z8l-H8H&@8N4%*>KFdf4?VrKAvrIkjjmBhC%Gl1E98Dx5gRjBjLlcgMH@P7Zp-uI){ zoBikQT(`06Lj&$8L|-)+Ghsd*Bof^VTu1`SoL8(I@IG4DE*eNhq|d6D4#At5MYc7~ za0Zj6RdU5Uuja)iHu!iPU--J@c4IHM1Yb8K+WD3u4alV(adwWuIcwH3rldHZ1I6_9_EutW5rpW@se3D|yS)At6GfEVbNeDmy=n z-{2THjNK%@*=wt=`(?R2Z6zsbf6Zx7bI9_lsR-jmZu#(PQa@+gT3Y8T`04wQp-DaZ zWKV3;5*f$3+a(QWEsLwX>_{5&shT$1{hT<#Oq%C(3FL0R@U79T zztyPf@s(v~kg8vTRGpT|VdWyajBlcgni+?U>%L zr}L!ZsRO#yQr0%LwfUIZ#46Xt#fRfr6tR8?sL8_ah~^v zjQ;sY9kcIfR7V4;e%vYOR&hgdM%f96E(_{5YfZTFu#s~s6OJuTxtAgHQu)DjTI^OM zg1D@ve2aXsJ4|JVomMm3A6-nh9%ijU*Wz;BV7&)e7ZsI@;bUxa0PDf>NHgy*kQN7E z&G&H}ZuGZX{OF!D4!d+Sj^%mdkASv*_s_`S}ccLH`f6OCJJz<64Yb1EvO z+|n4n=z#EFuw*>e2>K5*@)wkWn>QiGZeiTS0zYp;5|O5XRN26jYn|u$=v=$nzCPH} za0=Jj?Ac%GpRLH+gD@DWgy#_Cy1HwhV$`MM$r|4Fxt0mai>jSbbw{qY4}gYN0S+9>y-hw6MrPY@kPTb_`vnJ zo^eBPRu>KQ09T9rfYJBFXQ z!)dZJv85%|{*L-a*9VHSNd6kv{ZhCKmTHOWqW+|n=dtCPCBIxdD5ZcxbwY-wDA#sq z;Q4+OnC78=H87*6vEIxtLU33s7@tg`dUX0uvL@`nO93{Wn|MGugsEfok`JhjvAq!Slr&MYA_C&8@==RRiH!lP%PH)=g|L;EiKUisCR zW|x;>nIcpyx`rt-Ea=}9d>p1^pNsOcKr@iU0L=hJD1gAp#lDwPw>rSDuJEj(m5Wl| zL~PQrAnENGv$_DJv{>hr)$4phC6n7y!(b*WGSIWXz~>RFy;0^+Qkk%bh&=6Ea5LEe z2C^GOou_Bn^5%#ALg)O#>4!SB}{`bI&bRd zIz)CDZ!X<^np;)qcb0;&_ejFEzW&&=NH0rgNluI2s5vF=&R8%;&#hZ%CHIRc;wBjUkNazmrNEFi?utJvaPSGs{ToN`} zWQ>zeYH5E@4He-(!r`CZN_8FbZz6|8$ud9Gs;>e5CIomgfCyv1(8zK zGkhq_SOwdua7XRnn8)qlBF=@{IXGSc40cXj-Pga?d1{^aaIfaIc(a43OI$dyx^C*#w=1b`USeLI;cRtUdH+!n)~FPi})V^pj~ksB&05F4D0A^Exc{05`&|>`NsJ(jCkgu@x->eN@c-hMD0sY42S_rxK0 zyR+vkmB?<<6RYv2bX+25h0F>%H5<&E?(@Js`W9T}XLLLY~eK zCd;#s1#VmlQEWl7bp;2{d+xTm_;EDtC5hR%^$D~RsHLDu+sE?n7XD3YKiBY6&8$4_ z{fX z=WNqSXlM)A z^)raHntJmKtQ%Ky-a4aH8Vips6ixq}`NP9p1wU8 zI9Ri!*Z}{RM+~A6Om%HjMCs4yX1j*poa{4!^ZK~HHp~!~(NGIuRcFRRXOD}wZC;3I zS~&HOe6Y#q-S%eIvsrR>RSe_g_Lq`>Z;F*&g(Y91=YCqYK^67|AZ$D717J>pZZGYb zh-myHsN0WajgoJN**>&V{HOu{cuOkm{;2;Pem$yl*ko^MpRA^B(4T$Ri(nnL=TT-<>Mn3QR) zd};q#FVlF>-pg|p{aZqCKo8PTF%9qyUU*`>jd%SFEp5HpAj3^n6Y6RLO$ZefeAGnU z{w+)^O&%T{E--pmq8VRkwZ8O{Qq`QFH<{|x^qnd(Z29}1**;J0=F*q#2xLlE$KXmA z-c2uonnzTp2{)IHOdT}-Qmk!GD~Y3AjbLOeiEt%`1ajCN`jL;9U7u&V=}ak^WMc;$ zRlM{XXv^btW@bT^HDk%ht7BweW5+{}EL0f!%2gRyW9(c8<_@J+WU=E0{=()jX$@oe^66hK;B)Xw&YQmVai2RqsSmh#pBA(A!ZI$I_Mw%F@> zJg!(0V|*ZCs)bJ48CNsmD++Ot*b{p*_D~SGmTnq~Tot9>NMZBR^z$By*Q#uB#;&d|1lI`kl_5pH*$5&-&>>$F&}HJ=7wGQeEAe;5KsQ7Qz?>{aS1G3q*r$S3L>`E`pI6}4LE*nY}73f+(UrE*?+k|qWGy1CsC(X|f z|0P~sLSyaID9H4md_ntTrl}<#ov2~U7huHI^d3T>7sJV2f>4H_FP^Xywf!)ECeXfvHz6Z0aOk0pkkm|z1dM>R7-n=q_$M&={?d&apZjIU{r~hl^fM`k3tNH2XLAT`N;b+x~m5X;P z60Fv;Rj8>{TqW2?6#Ik79yvb&TP=NNhN3M~42_Q$bCwfXV(+(-I5M(Cumi0YE=&MP z2<7Emcre0A{KgG{L&;LWo2wUJH?boZOGpS`ZgU)0NmzH+ViPV)9Y)^99|k^uBuQ1F z3-etz9GdWl19Avd{7lS4S)k8LOL`|JH`L2iY1+*@yx-r4vs{epUUSulKAV}i??4{X z`d3s0Z3Ou)O$=Ghrvk0u@QL%J@uAN)TJe{_xYKp)#%3U}XXKwJi|wL0T3y4XZRl^D zT9N#=ox6s;^lTqea(o@8i`uPUbI{C3V2gLi zSND}!;}W)1sSe_oO{JDQ-4khBrVlFL2+S&1V6dZ?QF&epXh|^aGi$i!+ z7CsaB*Q6F0!NwZy*Y@M2Z^95}Bgjkuo+Tp`UZp71!`W3H8%bu_%OBm* zv-KOQV_De#*lrk*!R`^`L**vn;hwVvvJ^x0?G> ze<00RJIGJIp+oV-yiSGS(swza0@>q>fble8oA^T9`#rbOi5|#+q6jGs zu>nl;oQMe6d&%@F@j-(GyF}*8c03!qA6EogfZS860K0Z0{?f8L6tzfz@juBW=aG( zvf&u#OUfS9Vux-sf>nmSY%@UIts*?*`_qeCjb5fQt#bi?3wT=_!sJ~$KhZQhze`@w zAymtT$vs9(ZGlK%lUwv}OA~Zzz`%XkIp2CoK+=s*$GKTWSTuWPv72`K9oD^3dtrl+ z{pAry0F$Sha>f0kbMe<<6SYtCfy#{4L)LM%`=u-^JHA9|lP}nLxeQSF`eyJ_@bZ4j z6HQ-T&<+1fT+u<6@guu2DC)=wTXN69P<&nsH$Er?jZX^~t*;MOJ2_N)U~(__w;6k- zkEmr52&I*DgdG2IVeU7%Qw{5XP}xfcWAxDpBceP7{5x*cuKZ)p$|1NQF2i-f^OpO) z@s?t?^$C!yJgse(D#K3j9u9S;d@x?McBan3rL+lVHI8`X(eTLxJ$GW22j1bk!?gWJ zVe7f-YO++TC>0b4x9v-f-X?& z_MQ_f`hQm9lolO)bP^3IPZ9YIw_scT<2giWkuO8=x<_DVi?+*9-vV7J;jj0T>>ECz zqb|1N@UC8x0f(!xW-qL2sJxlC0cl>7X*u+A4_A23fO&1v@ zEBd((nw&hd?Z3#Wv#xR&vGk(-rU*g_qXqv_$W59jph1$s)U6B@Zec3JtGIA&_Qq(r z_wOGp+sHjUggTnGurWDslidineZJ`yKL0dZZ2D%sSP%{zjJ#Zo4@DOb94>c82W#WT zvC5*0LZqV|FqP3G_my5VQQeYD9d!T05aOI1A7Al05H3cO;AAv?mlqdXX!)sjRGaI1 z%Zgk}{NePDGhv{-1 zv##RV;yLx2GHG!dlUQH|4qbpgepHwJ4UK5?) zaVbjh=i~o>EdJzfocJ46KkK)@<$wbY0YLr7$ZF=+B?AM>k9YLUNdB0?G!-=Yh}wA8MTNnl0QNkw1OXAVMr=(& z^>N`x?)eByxM6`TA=gKCRo$l)lZIm)l&>aWF=__7j zlc8}7618hk1rSoO@bwj!j=ro*^?TrJi>}QtTA3ik{6PVcEU$ScnFPR z+kignm^rpdmk;LS0#f}epr!wKI~EoRTs!57T&yv)_(mqN9J3De+7Nsj~&;S>h* zU?XsUv<#5GR{SLFYsn|!USJAE?Za)GEoMS&OF8xAKUi0|$*o5e$XLkjd?!EsanvUR zPENL6lf>PuV#o`hFVPL|A6}1Jj&|CxjZPembb{#<0lZw9N zr%zY+OP8RO2e%u8(pI#{W=EebEoJYPF6&8P#rUB9#}m{Jc|9o~S3Q_wG$@v694BfI zGAoBm{@AU6jY2l2U2zoM>?-`2DxIpqqu$dhnY9+>raV*h764mb^eBe}FjR9s@(P6A zQ&AV2kgKHUtt&UrkcuaoY=+*Kz+Zea)}NOG^Cl7Q|fV@j(FCB3ozw7r&lu`W(rxk-AS^v1}n9*Za#>mOc%ZKgJ)>f$$qnh)<|8hYl%uq#2= zWQCf-MdbEy-GF-w4c|?d$5bYGrIb<{@L9Lp7SX~`0D5`e9S{9J>fXvWigwn1My5%p z8p4RoLQsMra2E+kYaPS`e!A*4ifUwmDt+8;O$2yevKjN4T!wfWJUYa%Y6K%lg6rA1n zdHQC&1E7>q#G$|4PNw-EyT&~MA!Har46@O zChLqf4)0G=t(sf}(Pzm22nr1~3RxFF3fPCB z0HdxRu&MZjil|V3tclrinY9iYW7gs06s(u@yi_q?>gsXghlC5CSi4pq9$kQ|=hP$V ze%suV^j*y^(_~rN^A|5e@VFryj&j@(?v}`?;x{S|9j{AuTlk`j#+Ho0*&EABIRP%F z^y40yTPL+eq_%9)rchIEi}s{aRDDG?Ae=}%!~-8UG>9?RB%T@k zC}f1Gh;>vt-CH@~peto{ZD|NOKk(nK26HEVd?TyW-%>meX}o324w6Gf-cWecJHV2xh zW-a)hw9$>w@3aLzQM`WT&7F|n({Ki<0H~`lMs6&zQM<*_{0H!yrR_yLp6tPWKsRq(&mEhU4A~r!X=tBs z_V3Wm%JpR-IS13zfPo#$M?)68d!BBIz-sA-PI_(|L|H~y59p};60L^MHYdAX216V4 zaJZM6h4XG9epJ|HJ2cnyaJ8dlQ3g&FN`+^e09>RMQe~%3r|u!-EVEoF3&Ah?%1t!C z!dL>KpnF#?E8@n!*84ax%ri^p6_Ti+GtF@@ZyI8h+3pO0$cQqh@LjM`?pR@F(eeUw zw1$xqml*P9OAB%V`xn-fS<6eBf{&au$i^IzfR(&x>W5ToKnFE8dWzY^fYci<3Y5qA?csh|3BxLUbx#oyH z4XGr`J?^?Yy;(Gh3;e=R#w1%Hh9Pj$T?--a$}F7CasKpmUK(HL4xqK+lg9U5J#JVi z-(ioWNHAq2H%vMRhL(Zrw4@-aZtO`8Dm47(78x+G$>5JJ%HXF;A~w}rnfGHC!-g>3 z+St^DAO(wKj7_G0^^f3I5Bf^5r-ZQz)9AjtpdM>UW`Vx;O%;2dx5Ci61>*qe+mbp2 z6I;oYnl*618-1keX_@uCY< zmy$OK271DV8H*S2;S%q&>qiU6+qd_tSZ>|DK`Dhcv%41S{{)>V37nQiy4v|?tX7}3 z9?<-jK={6JQg}$CkC+K!rW?0<$Icz>LiWDoZ3Qwv&E+)2HjHwDhieFiHt2ANHvG?S zpmHEP3scBsvY|tBhT7H91?1L#hm4`H-68eYGL;Ln*^jFnHWe%6f+HPWgd7&JSv3^_B{@7xd?FPq`B z2E;}T(q$=6!W&T^R;Q>OgGPh*mJ?#Zh=>H{YqJ9XXbW?+Kcpq=*}!qgAnTg5;@6mi zRm(k*jPAe04)nfD7hegZ!@N^CUJ9cJzoYGe5Wk@$%#hQNA*hNv*Wg64kJ9H9$)JC& z8Sj1n56D_Ey%tU=zY%7Q0chRGcDL$@*5}#6Hi?9An-OboYDBTwXQbU%fBufPEa&ts z(b9ZS!DrotTzD|A)KqcojZ0K@-Rx-P+onUpAy;r3*(fbBPkzQE?leM(hEa9}+)*W~ zw4Nb+z1R`10;;D%MMtO!sTcM;!UuYzJ|;|#4#Pt3cu9^PjDz+UV7xA8CF{~Oqr9C5 z2Os03qu4SwlzxrYIa#Mc)(ifRvL#EziT{>`6JRNB2#a?SN){dKUxZX}Xc$6fVgMr+ zdnWP(HX{@!Q-~(#Qu7J9i(UJLXa{qM(LqzSNXsOEhHY55w|+_5NxSm`JxJXT;k{q5 z{NmvjINp8=4O&EzE=X%O<`y^~6F&MQimw2KlS4vx1Q=4eS?ymN3phXhO&pIvj0hTu zlc!*(L?##8A!Vn8jVCKHjT3>mp{0dKr-q`iOj8oIBo>dr3B_wn+Lk92hyJGz!o{fL z$y)j2KWyF(D*I-PnCdY?YT%7DP?L(SjiH)-{w}x#vzB_tN|giFGdkfF6wM=ngzD#o zM3_FdH{ru)59+5QbF>#S*2U^jph|rrUxFPSEGx$g_`-RzTO;~iN5I425w&$xcm-@s zv2$G{>prGsURxPXyX-a8jgO1WQ3)f#av^vCq##YW5Db||T^L16J0A@JC~JUI?t_gw z9blX&3;#qip%n)=8%Tk%G#&Up zgvlMz2Er9LbU`@Q&I`laTOby%ZQNEgcYi7FcRWho3c8* zRWIA+nm7Td49tG{6+OMAK>~Hli$G+dD2p7!foOFHhk}iHt6_ zL+VJ08_|zIR{%%hIG}=_j7NoM3e}xo%!nMsd&r#%F-HmAAT(FpSbo{X?@@aF=8LPkOLlq+R-fs{JoAfyvomwqaPvHz^(_V4`2Fkx@ zF6vfHuu9)(h`C=F9|rsD?ZR%3ty3D2T=UixlNx9r1%H#yiG0%YcHt$k#S)OEk=9il zmL_zGHo+&NaGYU7hasW>9pO5rNhxDdQAP!PM}s8GGyM^te;G6*H~#saapHLZH2k0A zPii{HmQX&=#u@_)NE@E=p%kJr(MoTNBl1X-?W(^e*F9_kZwt2>rUY~)IbHaC#0H|S zakGaV8pFC|&N>py)(EMsINZo)%^Rq}^b^w`ogve$zi@F@{=ixF`HHipr%6y#{5X9R z@cxEUr)pp1M#GT_){W`XtMQi%fk9p&_X}mpJPkUGFL|0IkRwfa8!-UNkw*P1zVqbR z0P75X%SOwAgW4vILwSiIjF5=9VvL>YH1l70BA<2}v3GL&0Z+hHSG=Zz=)@7=Rn5_8 z2w6jvMO@58zlv8*avah79ZJ2`hjk&@N|3)r9X1!lzHwr9PEVN>7L0bk1lRIgh6OYT5qnL7cZO)W8M8v_%=PdlWUZ1Btmk3$GSfic zmJpGya2ok*2u2zp8;R(1CtPDuo1zUO?38elTJM=02TVs|W}ur){lvD{fvKD}qHD zEGZ^o+I`ouDOzR*7%cz4q6dx>*>Y9-BD8)ItKb@pE}oH;v~%o^)Z zFH{3s#e2H|wWf^-Uk`@Yd!KEVt&LxiJ)?ZDBsQ8~&a54Kb-g^@{D3u~jiULwo5mBi zmiaoimecVM_`!awh3Y-P08i_j9TqIgR6O%F>4hA>h_i8qM^(zL>p!+bfI~pI)5}e$ z7%f1+M)0urSK)w<3sQ;Ud@JzM=v(zv?IC|E@U5KPAUhA!wzIp$cDR>jjZ^r<7w#ov zQtwqko)Y7!(fJ$XrBjwTnQ`Q+M?Ta^4NJvIIbr^soCTZl1h__SM=SVnM1}$XbA_e? zGIPnx{pej_9t^@FbY3_JUg_6Q8(!Te72n^c!!N*M7nGXWpUE>|SqhMm@F-Qk#7)pm z4?3!z++r)kH!~*?BaWgEZLPfMwMq(XrA4~?GdX7yND=WOMifIUT=D$ZLcsMb3S)6S zjg}GWtI$N?U`65dw~KUw`mb#;V_os!EBXnef&%8)5{}-^C0i9f=Q+{lQSXJ_f4E=7 zg?)Xg+^N^P8@C|$kSBp>A|BErsbn^+m~o~=f(jI&a*yIC@`;%)hdR5Txp_o6vbuZS z>ROskE0^P2w2w0=Kdyf7Rg|f};_K>^s1K{-#)g)Kl9J$S(|Qd9-rrKrU2bux*NS*J zw<1**?)A+&1$?C|zUWZA8KYE)TVwOyGc=k9l%ymotH9tgg)Bb}$t6#HGMpC9)QL>klyxQu6qn%|X zZseep0A0nJD-QK4gC=MOKp5ZJd~&-nP%G;TM5kYld&sSQX8LimJ6jztL~qiwripj^ z1p;u=q~xv%er~CE+Q#Kzo+|kH@HvLoS=Hv$c(q;>|IH7#)!N2{isREX(e2QgN`~Y_ z@V$@`s3ppi`FQ_x%0jQROv%+Z6_{x%*UN7z!H4LcddZq}6qZ;;l+mK49J*$O1|c}Z z60Ooca#_b8)c@`jLt)LYzs&*VH{U+gaGzmjn6uxadkgU%f1tDM)cDQ-rYjiR{3ecD z)1zU|qV=`DO%BH!TW*tJ&o=$AoZw0M zgtfL0lD-N=sz3CyUUt=Ln}m9N6EKdpjM4V%qYWIdP~cqwg0}XQe)%P_jT}izb#+6c3qF#WX*qNn16SmD zA2D~K_mgZ1o4*PS1g$Hpze+IJKmz5@vG92EvfMRIL@k962;9{?GM@wmvI1GaK#csm zVIprB{Ui%iPkrj+B!`Vr@mSNDO2$WSfu499kQO0d^z)s_FzWVHkuXy#z!Wg|{<^dD zNgXneDUsSDV^i-U*AHkWoOQIkU4D3r4moo9n=RQ1NjpR3b7MyFm}8;+S#yRqu}qwd z{m#OY7sIIut&wCsb}|2`Wz6ZqZ20UkPxDQV6U zvuFXNEK7u0gqcS>2sK{7iYUGJga*g4MWc-?YTf=h_LUPJ-D>pD2MN_b7!aODEkW1G zF9A0nZa^)|EXsy4>%UU(F^$Q?oqvk+{Z{XZU|ZHkH!Qr>bM~R=Xgvl*kgx!Zx3Swc z&oK&9Bk0~DNgnG%E#FO^)t@ODaB3^p<5D|w1R-6=>r$tr)f91%dXNea(lSeeAo1!)PG&qBo9K8eQvN0-7)H)Vslwv(0zvT z(=Zm;JN4ux%ud(W>pq~V+xi83w$kd_c6+vl*B`OIGb1evIJUO?>z@1$kXUTKuqa2_ zKF7Mj=jXuAO__>0R-}C=8e};XC_?U1<&U{Y;(t{98FZ0E?o;xaQ7g5OSSFvAjO>m+ zftj}yCg4k2im55?8u$ls;y+z1?wELyq?dIOY$>ipi02DHM^fOUV&;svhz^gFn<@Ds z@%Or1l^VukBj9|RXBlggu`(qHK^vmP63*nnU=RwYT|~%D1dpQ=X5>L%R&+1_9^pDj z1=VPIhL&Dlw{cD$BGsE4Oiu#}>vO)-^E7c;cA;W!*TT>`oo?ST)W6_<2h;lFM#jTh z=e`;b!_5ugST9jE4{j#djb0>&K*FXqNn&nj!3Q51z(-nRcT)ZMx7auD0Na#_Rf=1O(;s*QV9&dLXhoy zPpcVVuuz#BP+6z?p!)~Kx1T2q$BHyd#tiY}9|&aG#kTBAp(pA&;%UN&MYz5O^-hl9 z%U^wIUmd^uJI|0NZq%`Tu!1Dw*(Tt;d@VchFu#qi9|8V#Uzg7@rNg)_FBlDw+IxJo zdmY>1=X1Tu^qP_I4GFR#FmKskceB;~6JZJAV(X#~pKwR*(ysu2m*CfYaKZd5(&XNk z!pHRG57ZN0M&#~o_UyH1v1&Z$mxC1t-Y};TUGAvw6rWa*jo``#*n#nfW=De3WmH|)kSRyB2l{vNU^l2gKEm&b`T@Xs*#9E_mgFSG!7#by zb0P47vek861h>;l771H~>>k<-hS0YmXjs@hy?T-3%Yp}>r_8%Y}S^n|Bv zZPLERRhjWT^Bv0r#vYERI>cGO1aJjd!blFBLJfgAunh%cT&u+bheHG0ds7ND>GVON zJM!=L+R}Y3g~8Mkpuh=~7v3pf;W`OYB1EzO%+j5@|6`W@AG7QsS}TJI5m19L14?$X zd^Rk?qTkgI7U>T|xkAp6q%s8Tp6M9O?2a+)NCS(kIGVD*Ei(GM<<&cW_h+RVbHEB&=Rb%3jA+I$)|GmM7dPmEV*#Y7p)8Km!Hd>7Q&G*xHaa4 z9ZIfMSMHA<6$21nB9c}aYiqp0hLO1sPnOz{I^Y+n`hA7{3OG_0(K^#@%^`RN1X7h8 z_xa{_8yvt2(RTs7Iss7qLyqt`T?oOkR3Z) z3N}wz>K~Mpyi|Mcycts0%8;8%9eHyqqXc-i-qo5?X zRHCXCeKdx6jS`KprT1#xa-eL)%;u%zpQYJ;xjG(S*IyHFgMn|iH@l0~)ijhRi5^TC z=wfEzHBaFnd3L@BdigSjd=|=vd$h-gdRkcsT6v@lv7ZbT16#D>YOZNzID~09QQ*@H z)zuD?*9_8vo-FO}g^ch4>`XRSTwaP@We3TjW*kc%b_yLK2$-|N(ydRK z#Osw)kY;t>at}N<+y&FpR4x9=+Tsvgm;Ll40BHwTQv+%#y|CHk`1=d5k~o7loec!k zfEUr;CSGOCa&t3@ezm>um2pz|``@Jn^6t&ojU$>32hs-osqXFeX5+Pe%-RVM+IX?@ z06UBXqqEWgdoVdRBuEPsAXa?|fgY+SJNNl}c#foBX2>=<3KO*XL2kJA|HiNYQ!#lC zI-}J^I-}H~oIy@`qEO2b56t-~vZ&T8#Mw)YyQ3wIZ>RGYz3TbF-n7?L+3%0(`otz4|UVx~+XTg^7PW6fFVj1$?L0gRiul)##KvOZ< z3&*Q@MwZ+1`2BnU;aBGMu&gQI0af)j&_)+|OC~O2y>kw)UU|ujLd=8dy)VA>euP-x zo^nBRW?3}Yy=n54WX>G~O=mL)1NQ6WP2YmXck;!%wo|=ktAb)ANq1^uoN%JU2A_k) zne~PphJ!^c)zeV~$8zd3Itw-#+zo0+m9}D84@zC6%7G{LAIAfO18q~_e`9(5I8mb$ z<5g1={hV)SQBbO3om$2Bg?*R}OV>;=f@efQSxpl$0&sx{==STn7<1pHRcDwo4H3R_ z_v59ZgWu?+uznZN9J2ZPP6{Poj*;d6=V5_+at_SdLO^}muheWL-9z`c_rK-0zMTWb<)(_ z*Ntm?rv){pC>WocA}{G37@V8JTC-dQa(;P*y2ADYi5?76nuER5L}{msID^c@>|v~@ z|6#iP=Fzo}OrNT{Z1+ih25n}TvBQ*#qV=G0#=huzq5gJjjf zW}|2QuCTM54i2}iKyQg%Ak%I<-9#HaECkfDp}Q}ahp=lw2=+9rMU$qyGRju_jp`$80? zw+s@zoJL==bknST43;O-%hl;SlqP*ZxaR!cOs!dZ^i;1>_;I;Z@PK=xvw=g~jqjYr zdFHLovY~qd^gK@3(2bb)Dxr+!?KddB?~MjmE+J!qJxCa&t&*&riPIXwn!slP{O8Wl zMPW_f&2^2W_{toFqZ$^#yo5P{+@|GT7Yos$jvKwS(vR6Zh1Uc4`-M`8u!Z63B!so4 z3fAoe{NbJ~V5KMd9yfhwyli+KAvFv>IpU=kZE%Ay-(W`!LY{!^`mR@RVR|AIu$(W% zy@PT$j{(!sRYHejZO+c4Zg~*NM1YBkn3JTg#dqIzO#b6ekDX?v>bF~E`03pdNdqHK znO%BmAT%-h4Du*2d94n9&{(m))G3*?d$e+IddiHJptL!{`O#^XQ#?ZLt*RwW=1uV? z7sJDFHh(Jgn|d=9pZ10An*V&UL8PoI$;6b^f%pl{U*+V7^~pyl*$#rimV?~&v=Q7& z1Ish3EBYVR>QXz*_XaCl$SL!1957j|8Im*;gf4v(AespPmESO7mNy2E$~4&{4!`cV zJxn@!?De~RA2|X-M#(0Krr}?fuRTnn;)jV+{4i0g%@D=N-U0?$6KD1?CVM$K@2n?P z$eS4U@1ZWQW`pseKbwbsk(@rAO?Pj;7sNiexG}J%xHO3SI z2z<1}$>?6Pp?=;k?HYx7`Ymhx%$znPmH4TDlv_Yxg#!Zx^R z6FhyALc%AwB}v?vX2$#Q36Nv2-*UkbAM%f{LCEJ`am{6ib!E-)LD$t7j1D(ZK>%>5 zzw(kvoqvL07A86)WrC*hy}t;T!wnj^yso+doaq`+ABXY?R8)UAw6gEEeHwI)ncJ@W z#*+gXNbQsK``R^fA1$02;;h|ZFCqx50J_A2P5?@=3TKdF7DmG4DG8?@qO*DNawuEx zIco2t7sA2sbJKZ`kAvKt!sp?Q*S8+k(UGeTl1UwS0p=nT7^goc3>u0j@{R)ZfT3qR zuZQ7`T`*)xi1_tq27=uQaoX{k^rR)P^{1R^0gmM9JnwvtFnpxWCWg6hyAGG|=s5?cUkaEKM}|08kh#My-`SvRekiW_DH|H+(e_$T zTvhXy#P`htN-k%B<0(Gqx4yyo7~(*0ZY!gqsC!n_7A&*-MT%^u1c7>h)q27bN6zA3 zhW#&$&+P_;hpnwbVU42s+*t3Zy;^U+tBf{#duKf!d@Rh)mpgTq9W4{RQR9RiEr{EL zgV~zNjyiGSp?q+!BQ$gfVxk4nW+5ad+J@VMrpS7kA6^OYznRIBi8v{`SvX;qFWLqJ z3x+-6(NY0u0;HdDpl3;)p2cGW{l;Ln7T)x3m4JL02ZC`3Rny<`h{7gQ>)dO!Cwr&C z=6JC-er$6lUaM~P+`kkt)s{SI&MrzSY3UwF5j^g7Sq+GU%1se!3X?I@{TvmswyfzG zHg|x=!&fIzM8VRX=$b29WBQYfkP;6_8)uTsSt`lc?q1yw_~p#dwb;F+zq~_+o3!=Z zkPHe;8FYil*?<4DSjKxO!mmGT-D*E)iqWZIAOB0xGW*H(JU+GdT9drm>0WzJop^8Z zVE$?b_F`qqL-g+JPj9shBw_fpOChTv;Uz$+qo9(yud#FGEL@tzm(6Dgsq!z&FA0pu zPjQnJojAgAG;h~MgF)x6VF3{g6W)AWb;9SrV|Zflf2zlJT@fyf{7-_9MCzlTjBlU5 z{Ywmt?l}8awKV2|U-Enc)PjnTfU^=s<^PpxY!gfuN}6ewNPb|Z`wzPYFfe( z+;;Wnq>L4;1M~Vu*)MeF_J6>3yUH{r25IBW8SQyZB3W8?n7bI(cN|vGy3$D+FVP}) z%KF}!(D2xGqD>N-$f8W(1cep_(%wAc=x(-F6-l|9|Ex~hG@KWlJv@Hq&u}Or$@%l3 zwg5T{W6()?fq?n^#`i<{25?EQb2b(XRw(dlus}(&NGdqtJTB8p(!c%Q&Qu!YtP)YS zvtJF~UWbB$RkqFVJdJ!}AnSK?@tv_1Q^rgqtM`;qij#?CurC`gL#@INIhLsWPzsMAN zD|?t|UWC_*IGY!sMhfS;jcZ1CB1*u_-z%w&GmFn^+`&dR)uCY$jVP8d2_|EM#-!t+ z*raB8$@De~Y%)beJ_QYqkqQ7@_W1G?T1nWoh3yQpIUv{XHSa zrs;u6WPJx;q&wW$ZLu&%mV??<^u~N$Dj^%jc&AE=XuE>pJCqsvSlB$E+2G`cNnrYCe4SHP9$A+QAd_o}ICG1r?&*?al7C|YCuc+xB z9G5&-Ny0}%u%4)qaAzjZ3C*~s1gQJ+CeGJ)GPY%E1Mc?4<=F03YML;Z8qbXWXZX5G zt3@F$mt0TFI2N4rV;Yc7J>bieK#gCB%4eMBV1XaXw9e6)+%>SJ(OEP7|5DKdT@3>7 z8Y7ZRhjO4!>ld|qyvS$Kg~d!moBB#wXNydw zOne@2Z(+B&eL6e$(-$MYXEG5GS|qsAs3jG+uXjvq!NH(_nMbbiMQ5v17mPf2GXnNR zKJ?=W)o7pwADt*|$8ev&5=)FsQnDXDRYf$$bl?X~q3-_`5Dnaq4BT5|P$#7%7*i@>VI~|=(`~k~xyr%EYnor-9h)0>>)4(JFq>VohgZrHy+mQzUrFP4JF zG766_sV(W$L@Sd-WpISecxh`^l?7#y@_*%(d92)dz~vgFh}!P7==SOfqf&UnDJ$*g zlF3{GFqXWvU&vk`36U4|Te!c<=7#EiWcVu}tdYs_SQErdv7>8iN>ci`emvi(<|ORG z)iz6WVD?Q|zNq(D%&K^o}ahMc2A zJ-UM*zK>Z^>TUj3i0;HZITPn*YRCN;nl!lKU18%Z83W2Seo&6SCIy=U@d=EP1Z*uE;4y8ojBfu+tRH~>DFI-bZ)funH5N&6?S{mH5gX zg~U?hqxnw54OnJlk{^sC2iYDQI;U7><4;Ie!^N0zDMZGJTYT>MS%h2Hr_Btzs={hy z%uPWfvd?_`FYC?_^6dijRcA2!Ih!QSRzYp`!#-{XaY2m?qj}VEoRAUu?K`Vh>4qjB z@pmiTiA_9t0g+0Xvn-7}TC3Gn0f^Ob%Y$bbZ7;GbXFn_?gsq^uBfL=y!Xb6sLOcb= zQd9GbmH%4{#KN`w{dafQd*os?u}Yc$;nCD)`;mnuWru3FsA=AnzzlEjwzuVln-by) zmsDcEpDJvhz`8R7%n8!L9f0Pe?5(4ok^hmQO#TMMLg4yAb|!!)P!yEAJjf-FU+7=p zFmin2{O)SNd~X+UvsAG_!w7NsQ5;#Z)eU~>g=A{=aJMzxhd1K?X;fluY;GTcD)y>z zM;M&v>h$EH)nsja=ue%tk8deLd_k33lPhLyog1zikA?VCkU}lr5m4GqkI-=U^W9MQN)&({>@JDfaIsXH)z~ire3h z6t}q8J9PHMMWWmxVe?|Ke~0`Za)U}-Tp;@C~Kj#R_ARk~(qOVQSZ1S!QF zfHmz47_ZB9Hn;plcnTX*xx%TX1ea^0&L`K85nP>b&&=K9gO%On3`{sArS(J(ObA0w z+9{Q`i043;^i&kZW`Sjzk5&_sOQe($6K>f48I)`CFK~OcKuPPVNkeOh4=8`m`v2=D zt=U7)pY6t2FJ+7%d-1_Xsuyr?9o)!IDP>&`Q#DmghK@GwySnUq9JxG#-sLj@HGYkt zlLco1ePHN3?$>z9Qir^QCKt zr4P|`@A4I)4-v}tDJ2NV97qbG{LWFjnMEn^Se7;JoO_LNuGbbqyre%iB=^_mU~MuGT!Wv!-n>GWh>dd+TIt4ywm z(PkRo3B?erkb-0S>9KF5Ojk_-v{@s`V@;rm227ot0LXnboo)v-z^lRzemu zL5krrX^Ju(wctd2{y4x=JOQ6IVR1vleta}1#kykCbw-@VrK5~mZ7%}4g8f)vi?5DZ*yaE7ekX77svZ+csOyBh}Ze(qfPsp52eVdu2eXW zB+`p)xINOCJT=*(mPuiB9#|j5(LsjQ0qz0-UhyH|jT+yTP-W#%5Avn+m(@`Sm{$Hv zsm+&x=~}VHL~!!SK>KnZ$RT`Lu0Sden6z`GcvN?Ht6+`LydF+P@0X=y%bYI^t0?JP zlY5y4q;x)PJDCCk(*;V1f!k*zZ{sd?GzwIMB+r-F8ALZ`k9dVMa*JJW`_EsPwI(8g z>$r85@f5HEl z^f{3i)_6E=K;sHOf?~2;;|gs+S*fp#K1&QWkkm&BKQ6+QpN3W-f{rPIj9V{H!I}^- z<-(Rx|KFTei4<4;TQ{Q`^a)lU!1<3YO(W6E`adW5$HeBH#Jx+_FMGveD7r4IGhkx) zF0r#Y&oSQ~3@$(E>oZh_$}~ylCKu0$i+%cRX^q$JGT?;6oiyBbvOt#Jm}5r^Lc-}R z_fJMG_ksTG90ZpC+$^=WKA{0w;InwKoyQL89B6&u{#%fSyW;kWml$YQ6Q4^R2So9V z5b5=ndSsE>K4KF5rm)BL7`9x)@+LxDuLoV>=J=-)j)*(h+XopHj zL*rQ51LZ3Aug}Y3acv;p+CaQ1eH(e;@#fum>Jq=#PW0KZ?{HE%x*tDZ^mE`(W>Y*_RF1phS|tj(Dn3P?sS89v!paIg{Wc6*`O-ElRhQnF6I9iMU5F!V3@H=XIQ-i(yWrF#kb_P90>+;sb9Qmg4pO$fbeS2l=j0{cE#B0! z^`)RpI^JQlD2y;2uo-SASi$5qA{OQ{*!@wuaQRW?TqpQc)%|Sm3_-9L{vjzY)6L>y zlxpU%_TApMYy4d~3VK?hSD>TXJl5&Cb4BCC(r_~5!!wh4j0Xx<3cwjDw*N)LZnx?dg7l`~{IrjO+iS6rVh=o`>Ym7FU zmzhsJ&Ii0FRc@c*SXZs=4he!H-I3n&+clMDdY)e|jLE#*6hoHp{#}dfd89b?wtVp8 zQ*pZ!&?Qf%{g@$joOD)Jhlr<+P+y8S6sRa>5Y8vq7$%7jCDVL{F)<>iQpbcdkH3Gm znI_&g^B|4;S>1|c8@Du}4o`Pz^DWr|-ImhiYF# zlQMhc;&$>>iz{DjvE4rDg;aeY?RtnFdTAl(8khBe3L+dci?y|4f7G+1clgei zdY8PkH`n-<2U(Ra?lW5=0d&s@`G8Ino=VvjJ}N=PR3T_pm=I-fG09JH&Qu~HO)3gyd& zpewFtsem$ju5NEe$8#UuQO5qF*I^Q~^CNERvGj8-tgq>;L`68KprtU4Zsn#cMaO(D zvF)V-k82|kDkI|dkz1+RTISRnQn07j6_PM)v2Ocf{tbwcXWCYPJ<@{_!jEbAdB$~Y zJQ>FR`#^uf`($z%)(617mMbNM^kKk*eEm-oSPjOvK~getADVnBKPXX5^pKR%Vkg)T zP1Etf8}@qq-(oVLW7zw;a>BcpjTFd=`W89?{W|&;BtjoO8avr=+Wyzzv_ZcBZO=7K zR085oa~^$i-gNNWA=yBhqJ@f%^{5&g5{V*M+8Xo~tmP49NQ!+k#qUz3} z*1kW5exiIIJApJ&2_Il6;X#0#0VeY5tyG8k!xm^ZgWvPEnZPwrLw8&Fy@6FhN0*6r zYsz<(1@D^Bx~X{c`2ub2w!A5pZ@1R@vqc`R%@0vGnl>Kcd(&?Do1{Pq}-)DZtN zoWo3Fi5?=A==tqj`-;pPwjB6dEcsH_*Ol_tAh8&HkKo6nr;1svnx5!mvH1f=27CpB zkxRveHcFFFD#z79n0yh5Dui+J>Ll`#>Ky#U!rBUBo{SYB8^E#HQ&2QC1^x45)epfe z7}cRw3_^MDY0lctu6uYN6KTzRvnAJjnJ*{emIq7#;3e1z(ZcQ*8^|WW*N%m^W2lfc zPqw8mAAC)q$_3zJPPi#=@RBfi8;~9jfpZFwneZYcBs>qCK@K9(Eq~)n?ml|q`y+NE;VU7C4iqm6?iQT zL>cg-pfsY!cX?n&PYf^zDqFt)ICP&dVM1eB+tKe=@2^}@(0-yX%|=)(m_W3~OZ!3n z)1aPZ`ts3GC2{JveIdsb@7$E&Z~d--Ex>!N>rCGcnRVPClC===Pc+>^iRh5TMr9}S z(~_Uvavn6U-E5mWAM|zuo%cx19gwmmcQdz&cCNgi4194Kb7LNSu^eOB?8d()7-Jza z{5j1`hsY!;87tgljppcg{m7SWoR;)e4~O1S<|+Qd;OGCJq%aln`1`^nJOzb?5VEC@01>SkuS`%^}`CapqX@+FW5sn7;& zg;@3oij<|?VM&2uz&WHwccz=bq5Q(du^tJ&fxiy%*=&#ZaUFO^!@EZF^bkzd82=qRpa_x<%tDZM#v{r8*RQ5|sLN=#L0hk( z@zcHawEIeWIIjusei7YL8?W5rS7Y6pGaYAef4J`@=H(ygF+HWAjve2@lOLRz!;)mQ z74%9Pdp4KYi9Zs^2Qywrm(g5> zYiZscI}$IptRH6|v^oMS_jn$(_H#cl(LH@Z0+F>w&c)E;2pE5X|FB6lhl(NGK17$p zi>hfcjB^Vj{!8H{l=&cq=l`Q{TJhU1!P~3l&0pVe)oU@ylwC{>^2L^7DJkA1^gLVD zhkgK@Ez31t3yBoY!F@50??wbeaN+f3ZcHe(USM#`D|$F3RZzV;1S`c5Aea)A4dikv zj34cPDudIq1wuaX&DfJdTw5gisZC$z9x>69C9RjGZ*5DR)PQwaRn}w_oM9YR7ySY8}XfqOaHe^zs7nb z_%?qe2=eAe<~QgN?YJ<(B?~xdH=MKrQ)&#Z=IG6ZAFtxBP*sBXtf4=2wa3a=ZGArO zC%hy?{aIUeVC}>W2sQ`jHo>G4EHvsO3!hd~$91~6#=4r*O?cnK^ZMlzYN812an7g2 z;!~cGK~+T^Gmdh)e11ke@8mx``R4 zdvWc}zP&yR{h~kp>+D=CUwBE00hiaNm8_f&{;F57MI+=Y(+*|E1)`5?9ahE^vm6mc zpNX-=qDWm(G`JM7A?&s>hr$9x^4=5KverVbKWNCk?UfaP(7p092drjFBw{wYt&T^< zd#;K<-MP1dO3j%4!z&FDX+?=?(z|7b(!yiHI6wYjV2 z9Y^AxGKS3!+{%a7TRlai!=j*zyV&fJvUzGzM)85Nb4ih!xhbD!$tevJ86_o0p@(0| zDIy*<72Q1mbkPpzTznJKf7$R;@|U7SsF0`ZVQXPQz>74T3;K@%`ze*`Z?4hi;lfg@ z$}FBO4N(T^3z+m3#jY@q+UVPB4pMkJpS`|nUfZ4LXHbOW*MGX5_)PUE^1_N5wy=K8 zx!L@PoPXquB%#>rhA)%i{9z=a0Ss6ue>1zw-#@$=s;+KL7s*;r*F}QSj_FNfyB8;F zWyr*&d{$^T?)gSDTg5@jqodbv+DOOpRJ))*!5@#-9&mGcUhsBx9U4_>_n`maK+E}J z`}KXPMtLDT=8H6}I8lCXtw+G4qZl>jEovqd-60$U+LJl-QGxSaSAzn^>nI>3qP7G7k{fsTqWiS>E`_x)U+w5szV)WPPiEUW3#q}Bi6S3$9!{~>C=l^(eCL6+n@Y znw(bu>Sy`)5wEH#jPtL%Z>tW4>T)U$EM-joIQlvCwiT3?rm$ zEbo_H^rICQsj*-PU=05%k9pe7KA(x?SPSsoQs8>;y_Ut^OUtM$#{4;gq>k3PM3=cg zek%8MZH~TsGfIr_>?9x|7SW0lZwa>p*cg*1Qf78HMgBunOAv2zRG81*0wEg?}$UiKw!CXYZc>&YmpJS(09l|EWaQRyU{uOmT1gY((QH@L?MS(jPAKTuPgE-ozd!XkisOIFqc zSJL?_jy{V1u!Iu@Yj>fG_YqjM216bFeEtk#tsk$d_hJN&9r9U97%Aur!2_ma=}4aS z&+tRlZj#D3@DpH(SLoAhb+y3=CMwfpInouX->zUuT`&306;v%Yoy^r#6|TAvI! zn)D>=bpaPsu0jW@&K5!hKUmOo@72Y33CVx}8kHen87Lg4lp%r=F@y=-aQlL)$;k|H zK9SQwN(TU3c}l;g(pgv4W`tz^x*SGqGNT+&I;#xoF`#ic3OFD5`vrF z0wX~$SACpov^QfSDQI3M$Tqyd+jV=BcD7hlQn4fw+8=~Lsxz`NzPL2Kd^~QbVmxC< zxBiH%smr+P*#ND7?5iRo%udc}%@YGm5T5unW(C@S7b;J?I1wq%o#fK5bmJWu^;W=V zSOtt0)A$FbV#wweK%rPkZ)FugVYBx~88eM5#}2Si7{(;xxANMFVXDOp(93=5U}!te zD)`G%Pg#p;y61~&K$hy7QJ?;~3UNBn_>;KuG#@z&l*mmT0U@BvRe)R^C%NX?dm&G% z!`YP(r{GF3{M0Ri*k!2SJ5iHZF@z#`Zu3$kS(~iz@@kyuLhmRs zx}_&&hDoGo=f|3J=yZj!W8iSO={;S#qKB+eO;)Y9Z_$^;1+5>9p9_W?OBJF>`%THmfnPdkaqY2o)5xbLo7sB1oZ&v0cSMD zCr}SCaOwKT+%8;G7NWz77`bj$G}N4orFy(?Dkc^^h~(cZNZ?o@l;9L?+~Cl&hke2} ze^NBUiiN7tRG4kdKmQC(P9!0;Qu$oi&nam<+ukY9qO_?dPztlV8y!a23-$`u<%?7O zv~Q;Bj&j>Z;Q{eh4&V;2g#lsww9y7`*hjQpvnR;8EI&ITRZVrcTPv-JSNvZG&iIu~ z55$>%FAXt<@x5;+o_8k=57sVQ3t5xca_vn`QU(!zR;4)qPTC%&@DjTz$RbT?Oz0jk z#uZ^yXv0a}JNiiUD)mf^E58d^%o`Jzm>LtWfS_DPN4V}|0amJFA~A9#Kqu@X{Rt^J1~%T=VvxBVs;x^ zAe=E3o0gvTM&u|eLSc^*o^=+r@hptaEFMs=n`d*Fn$WmI9AG6dnYUHpdky>5d8}3oJ2QPb4(24L`{$})9dB7f(M5;7)F@|92=IOl|JJ}`lWDsZ$*x=zc)ypII3;8SUl^k$ z3|ma$9IYiBG`I7$F5XLNv#*d8{qSs;}m!8)9dgTFpe~dp{a`Nz?;wpIXi;}iKqMhn6%|H#Omc2 ziR30*U(7hdL=hh_{Xf7Z%K=bCH(ti;F}gNHPV3*@>nKk7rJ5lYsxtIkX3e=z0*_RG z4K%(zy#j;#kanA`MfxzSGzg_dI&4a9$GJOpF4TFPp4bpyf}HNtT0un#^N(I{C9_0q zUl7?}p-`0Lh<1Dah!zwINsV7ECPYm{k?lYh*_Ket%E`j#paK)xMJAvFd9#nu{!z<% zF$n3A*{h=f9ef53E;@^rr3oWq3K^*6M0@*kdUB;P6pO-?3I6ir#bfM2Dr#7@2DOakletv=9ZAr44kwCDwk zXj@yG5_T7wz6KZ5kAsj>fIi`pU&o9~5rOY(8ponevwbTvoJoKyYj4I;B)h`Pi}_&2 z;ViMm1enTkKUqY@o$ouH$#Ua-lY673g%jF1lc;gp!SblS{e^nvN*|Tqh|2l+ zQI$CKxl=Op5RInWN|-#q`=44og)Ky4MT+x0Mef6;3fz~UV$re z_5(K;Uv}W^2h#LkH3)GtOrLiOizRy2=p+df2o04aU+KTIn%&lci2kYcPIzo2{tB-jpNtYq^Soe4Qw0!O|-lbLLPTs0>14mZ;{-ZL9~M`1Ja z?+Fe73I%{xugCk+l(w*uQ!2?f90uJ#g!)^9gxyt*DxcHkQAJ`r6W_ig?Rt^Y+AeZ%U2hCSH>nA?4~C-lrP*s0u+ku(!^!q$L$P{J!(Yjsa_x4}@Gv z>?hTyWnLGWq#CpQLlhy*xXZ4y&u{M?LQI;|qS@PvkL61BO3KUvXG<9taX^t}(#Sc| zj%4r6B^czu`2&Zj$j?5*d|mk-cmnct2V8h6=V%9ESa>Q?NiM{wel}zoyTk-c_}(mX z%S3S4RhhQB-!ORL^zQq_+kbf*?`J8l?RhCKkhlFJ30!yQNbm?G9H2RQ8t;6o1H*5@ z26uRJL+B`n0iw6?yb`D59izXgUTA#%-5=mEl1@^gD-IJy;lv(;3>y4te^> zQP$d&DeL~l62ygTk7ZuQl+X%1L0$$L$yvM*9KWDAFheROHN9whQrx1A4!d zg;W+2K_0=s9f>d(N=vFXZcEtN!vSuSD!h{dR+p*XE;%mQz(0?TYG}=0dYOhv?fb@1 zSfn{L1d&trvF2APz0!(IoF3Q5kb*@hNd5DZI8aQxp84$VBs>B`-XJ*|bI^0<&46{C z{75HWdg}$j14i8!aDgwTqz&k43qcu^KXYUm*7+uXjQ`3tb@GFYk*&d3VZZ38R?pz5 zHFbTqY$$?uU^2T1N~(2xibDZ&!}XFVC4|<2^(tiI$>1>3#ND$Lts#|?#I6eZ?Ry%t zgnC8(9dsJHAv!#;{r?MdAPE_K(c}Vzj(-8F%>BZVTp`a@Cr}Eu#&}&s5gR+}q%0j} z#|R6qlpi$!d+Uv`sCWj7OX8Etx5sa;22uF_)bDA3%9qoDq$!WFd4lXBs4DZm*F=tz zuQ@tNDRfVgndbLMT9yP^c2PsCPzgQWs+Mft%YG`HFCGCA!b>IqmFD|Nsq9veb{lWZ zW%)4_4)=2hx`}&C$qGf8+v6MQ6TR$L4R-yc=Fio^%8gC!DX+9ACo>p1cRLRxbdpCq z)`mGUT6n=pV&G&o{#)z4 zzfh2s0AlDvawC0!qXy$HLTeN;IO%i3lM{*qfU6=^O4#oMt5W=r81H2!?@6Vx-|69< zaHGr0NMpszsKZ%DWwhghr@B>Z{{LINz@?-83KNlHiWm*|MV3ni=Y6RTPkm zBL@Q;$Q5cM=e+j&&zP9zo=xu>5MP|B;fRa?NTefr%Jl(%@Ia|TmJ-Rd`sp*&r!_bYK8S7jt=8+b^w=9QbSGM% zYk!KeOQZ&~OeUnX?>1N0A00OEE73bX!-FP~Td-`#PLaTc9@wj!s-e@9(Pk@M1g5Th z;4uhg_RsiK6warwnsShYHOlKa zmGxISC!EGsbV!dom*xX(i<^p$@-TDQ+_KtTUYZwJ8(Hz!uQ$;PMiLD8j&0wbM|^ja zU0YIP$a!iy;8=a_;OA$jx}87P)thZ+{z~z=7Cc^2w}&3=r&2{0AI^t___1b^`C|>i zXI+-d*+lJqh&(G@)nNPNA!TXPR_t=)QzW2w(WvuOA}P*^6!r^1RRaPHa2w)xtx;+d zOy)%AT<4wqFb;=Nb%;fNONTO0^QDvgOk4>XTAtc06q?2+{rl#hey(x_rTVTNeRW+uo)arhc)HK`-D8nA|b72erN);krg7M7AV4(>>%P_HVr0rC)IFF?7lh zpxW5MZ4f=)9xRx!OiF|d3-;b$HqF_ar)RE5H>DS$e+k0{O(PKhO>704Mj#%9#x4z$ zx4}!LH|&TJA|_i?0w<~FPGXE-vNL98%@v0Ge|Zm-_9A3+#GL^wB}izp2z`Hlbk+@I zaSa(%5Hj;>8>U-TkQYM43M8iP`Zj_f>gn6^=~oV;8$@CZ-JiBdNG4h`0uyKZdVP|n zzhG6-ehZTE-g;?fD;7YOCS=fStz~%jH-G$jslZX=RY0ucfV~^0<-N*38E^0FlstKO zsVLARu);X*JSqYFC^3l2Zz^BrU0ov4=3AZK%L^G2vI;AR!6k()20_>3k_OEw_L)XQ z`Ah5+ZQT=V{U%2hc@v=5Gck=-mQ~+WTl(rFDseNXP49r7^czb09XQaT=aMTA&$-x9*O+ewID-M$MA62 zZH{KxOt_$f6&=*KONpVirD~$GlL17%#ZAuE-A&KSmyQCg&6A6Pq)Rzf-WWn#gLV$s zY2#rCjv)^G#Hl@#z#$9bchi5_GzkZ}T_i`JQKr?Eh9U6HGI)C9KcASFDvAppc5<(5bzwv|1 zhK2f`31#>zmVAN+{(xfw!091g3t)5j87DZ>_6CQ?~@y=9L?o)mH|NUG=Z0` z!bhDQo@Gu?N^hOLq$*ukDgHZodm9@+a*clLggh*YRTtk^QUE+4NLAL4lzsNTS9ENR zpON|lT6~HmapqV$-T)S8fC-kQ0xBGAKCA{qH1fQCtss_XEp%!srolSo9Mm$d*r8O6 zoKnle;#9aDF$Z*SVrQ*_?bO<(ft#}s(Mt7nsx??^C`^@?1!OC%5aEH8^cvei>PaH{ zu<#@WiD@=sG?1PpXq6ufQ^mvWYK@)t-``9v4P5UPGH@&1UtvDx7_XlKHa4c!Za)od zk4$tEmQ@?xgz}$iJ+MuyYkEk4n9oQIo>fbq|0w5Uor(DC+ex}UXF8?Vs-`s_4W#f& z5bJO6Zx4Rn(^tu~;s9$75qEZp|52+eYD4cxjL6`iaNf@4hdhL0wt%~NK=w~zg@FXGMg!Mxl zcvl`BR>)Slkk86A?pMSi0nqd5QQgQJxv4n6tnjE#}~jMmM;<}@JFF64Q=eOwQr&b@W2RU@iL%gt#^%Bz_5;+n@O(|G6K)?7sLVQ$r=xt1vy*Pp?*dN1Hq zxKV|XNbV~ZTGh`(V9k+8(W^rc&9@?{g&hazlje-@FDBx#Q`f`v-z;&PzI9b{hpDj$ z+D%t$_b#n5Hyjf2G|+PY=HN#By)e*kq*j)HRIc8yZm@X@=q&9MIbYU%vpnan8T&zB z@b)s_9a-wTy$0zk&izp*1+VU{xRG&H+C(7cU@b}0d)sMbs_|&#rgM<$V>j-Ee07m0e-yiI*uD``dNPvW&0gYq>5+g4M8>1aZ1*MYyYB4M>0b-H>9`=x# zcDbWcP~b_y4QQr@ueywD=(e^^S>;#SqB=dH+6H0Vm~%O)6)rob)FixVSPccqolMIs zIRBaz1eE{{q*0>?EMs0HPF7;qTuUHqeaLSq5(%^fEU67~Lik}~KH1bIT5f_|E*dBNt?yBwjW!;$F`8rg2e_-uj3w7 zaR`=BDEn&nlO^|IO|e5?dvM`!kWXb=L!a=;1r3*4vt4`No>f&PsZQMPM?kWLtOie` zve!|uHAtcA;i@boRca-aj{0TPe1x!`(v(M>=y)_>59toje5GLaJ*L5Cu}VZ{#;w0p z+#CYCjVuuIA%mRbWEJ!wL!A2xehOz`@bF4E1Q$v6CZMP6X@>>@1;b(mQ^fRFG@3hQpUZd2 zCPgVk5M&!w=Bo+OZUjw0S319qeKi?HZ1*1M4mG(FxiFsNdH%|rntz$RHRK2Xv%oNb z43d(I)gXWjky0c394_d$R5T{M)CVR~^l?YHVG&V67C;6@miez&Gm{#Gk}&UvT5a+^ zHp=(Ic&yV?YrSm{$bGt{IYpCUN2jn^{}{&4t`AYIf`wws5Ue$s9_y|X!w0XX^>lww zp273G)EWt~L9>F0;wtIfBwV$Rbctib1bx8RnG8~#Gc{y75(yim^XW)>?Deo}fQzBY z9Alqw@27O1y}l4u3|sD+>QKekFfnEW=fB+tj$53Q8&Q05U{5ui88oW|o&H8W+yM4$ zg+8D?nZpYGE)Al_3(eTT5Q#}dcke_1nr<4r#bcq_o)=MML|G--s*|LZ9o)0eGeR6* zVppjr2Al$4P6Qs1fQff75rmh(igzHS8e=dz=NF`FBaU#2g|QUfAx70C`O!!!mr4pL zjZM(X9x;w=9R5~qyqcXGlv|q>WUC`zPY}3F($EXT-LQlNl(A-V`pk)u9Npz;aJphMl-POAZ+mB8h157YzANFfvO>G$>B zm_zZmay~ixDIE^!fTwivoE6Cze@o{ESG4r>In6uivT3K+GU{}aO{dyu-5NjwJy!ES ze|YvC;1$+Ia5=0=&Lffgp2pI66PHI{P5CVb{OeyKy!v(eTmQ7CLq7*&;Yw!rDH`x> zoZYxWv|6y_lVo_PH}^aF^%J7gAN}~(p)aMa48eDfHBe@u12KH^zq#ikBs%6Cm&=P6 zPR_%x&=d-~P9sd)VVKN$h3_3^$ml*JXP0W+YvDkG9zi)p=-gBc?U8)4CIZR>16-Js z9AvslFlCbFKKge~qs^Nm*k~<>!2gEF8rJHcQ<0MaQ}y4zOphR$FWQ^h+;GqtuYW8} zsQ$(!e8$mAKZn(k`UbbcPQ1et%8d~nZ`-$s^pf35u~xfRK-XES+sdkbF=QrlO;Gny z_zH)97<@s0X=|%*x4JuYmN4~~J1&Pt_4#K$tFp-({GWUo90kRn4glW~d(~hW2)6-U zf>ftxkrb=;5Q9KtNRGeNJ)3JBxLa!w2vRpYABQXD6CF?c{LK>L`HJjhl|Au|Yv)Rh zCuGB+`L$?(CMwd~(*!@sxoF?+Wz%5*D4XT7FZ&HfBD=3Gg$zd4QisRkxRF{&L168X zNA>_gd17d^3=(W060t!$WMik^r5xZ?BhH1_&KrxjB674i)yCL-)&#L#EzUO0Xwig@ z>#K>F@ys!BiyvrS{U;}IYIqTAIMqdjjOr%Ge7q$nQjm->x2wERP~GtRl8 zdb`>qaw61lv80=90=)8f7!6P%*gt@!0np=by*y073v|%HKRhDOJJR@n;I&CzCwsE@ z>(4Q645@B5w3!xgEqmvt=io=AUjX^vYh!io(R*J>^MYLU$vap&ednVHC#u?-V8M%E zhJF5tcH(EQbyR-13v4ss_NJaJ2=qq*4ogu|vpdAIABHq{U~L5hOY2Fa)xEqx+KoA^R&io;0IC zL{36Lfb3Ll()QHGlfN3G%thtY)2`PD0!g_K`Vhm@_gX}I{|Ph#M3tJDjCl8MS>8Hq zbxt!_!Qxhr;uDmx{}KWc%%feGf>8~Cxf_#m82gWv*am~A;NV54R70l}GlD~cryKJeSiJ4b@cY25Voo(U1uhHH6!q{Q+1Vx>OT#C2t5Cs)p~3)%w{n#gBd72K%7 z_yHJMOI~CZTs-FdYH$@?ZRY$EB4WV5!iZe5J((On9PZj|oBmGNf;L107qZ~vUxJp& zHI@eXzqGARS)v)jYeL3`mE|e1a^H*w+@=Uo=D6$Yvr@_j&t&n{qc#VwpzdwT-O=ns zvW7v{=HWXwf_+Rokwo-p)AHLrJ+ArlqCiyds>6{3Lf__`B|vx@(=znebmtW;yi?LO zn4>60+nRmSWM9&!D8U-o&vmbw9P@wB-ILGg@G9+g4U0gbETznnS+&1q(FDh!DAbq_ zth!*3#6L%7&E%0#iZ>H|QNgTs>N9&{S@kbf$R(nPfJ|2eR5+!U(cFA>^(-9* zYNmi?b%AEG%WAFHCWi_@M4-~M14|dIU+jD}39m12`S?vbjvRXKQ6%NZ_{hOtHPk}B z8u8gJ&`g9%cGfO6)IrYx895hDh=gQ75^Xjh&qEb$+5-tUYMNK1ECw|A`ma3)yR>tY zl_OSDNo4pqu3S!M&1_mJs>VH-Q>IPO=61+U$ZC{67?S{4ig2fhnpl27VXE-Pe5%B! zQfNV>SX(jB5Ob|3lhdi@lNPY=jpZGy>%q*1p#*~~V!rtpCSJpU$Lp8(hcdeE8T%-k z@WD!_VRxvL?Yz(h>XZ-zwX)~37~GRu@la!hLN$s_I8_f)p(7UI-Q>-qtj{=Xl;I-e z?OZIx8h=Hm2665HcF@r9`GJ0`$bu>TIkE2_q>2!YBIpq@hIw>UNxnyeb$b`3vgT>D}&T?y|53E8C3A8{|sHyG1 zsp^snG0RBq4-%q}4`$sbC&h=wfCxda4gBB!goBm4iQ@}m6KH>8W%A$m79aSTFBTCI zSyc?9*xPIWHkWXe3IZW-A8)BBEo=Ner2TAD0?BKg>QXm6px@}M7QVO}bra*IZpE2? zpfA9vR|oESZ%U;8JHy8)kdBowAPt+iX_yVp&d6_z5(c#RZzk6Qw;G*s62Ip%(b9lDI zdP0Zwm)7|bhB?-^h}Cn2khat4AQL$tnM*o z`*H$xre=5u#gH$FRKB@^l%=0)%%jWFOP@;o6&AeV#mG95u2OBZna+nJBw(muOdME| zaniA)yT60uq-#WXm%!lpHwcnThJR!Yf*?(05oQu^6t&u>gfaQMrsj|a{ja$Y%xV)g z-nZ?xVDmvWL|>nEBSZ9Eb^zNk0=rTw*s(m#NmUcNS~F0oCpLWQfMYO;+ig9OuMCm0 zlKsA>TO$;X4I%&o(r&4xKZI({gx3!HzgY~Ec`M`tq#alFRtSj%9IH2c-ow?iYYy1~{bM-^C1F)^12#?N*4b&VaUmH{fT|hafA8rrikJevHJhL)+U=+v0RH zhWIprdduV9>cG$RGXy=7GYcqRwVZjlJk)oV`lqpjYcKdt33Fp_B=Wvbc$-U1A%xZa zE;vP*9WQt*re=yf?GE|$>8}tPxj5Z9tU1-m!MMxrYZR=G*RHl3O6-3IP;~~6-YT@L zl_p6{^GO8R-QU{1Zna?^zdaET)%Xw7(jzi=gOy#t*c3?}3>sTaQ}|d6il4NBtE6Ew z*MEmrK@|JY%Z1vMM%4cjKPeK63ICo+E~{qxS@ZxoS?jOh=b|?_M`_+Yx6%}`=%J0Q zF7qooa--xLhy&f0ds~7_oEqVMHna-C0Ul{W=aCyP*%0#Y>vD;`d{z*cbUaUkU7U z99Ia;1=ntwvo1;ouB3hgRU0ZAuolZFq=mbY7-5E@6glHiQnpj>@k zO9v|aEAW5b@)Cdi%tWUt*h9VbH4MOEb3&jN#4}Q;cR6aLD+bs8{%`WB)}5|SIMS?2 z09ozXkBsW>3Rz(tEw_O~ex%e^DUP@lN`a+ZoO!<`)K%8iI;>y`P)9XT@z!n7_~*xg(icbtwV`v&`|u;36rwpaoi_ zcmrQjvbhk$WQ-yulN`#Ex(MMgjD^L3`Y&7JpyUo=%yC81@%F9o$gxhaZ9Cj7DIiB>LQ!?HkiDAK-_ot97SuzaJ$zNq%LD>6>U z8dFIk5-ICTT+fn@Wb}TBEm4Wq&X>m@YPDet25)5+Y5S<9y>?$ejMNqEb|)8uN2JI@ z8W+GYn^}Pw7ho|{>Xc?Flld!0?x>3?`<9bBR4V%+_wnL%B_A#U|KB`Jqauh%`2`(e zxy!o28wsnTCzsRFpt6eVwR#w(FRz{>#~E*#w4RoyGI#7Y{n33*O|B8MWm}tSd%yjH z%04Q|;lavU`>a8}gvGo2@d>y#2BJJG!xbK?Y&a_9nRK{RGwSU=C3s6 ze?L6yS^t#>NgNr~(PbRu3*{N!y~1VWBM*5Uc-VW^ELXw^eYn znfE(J-wHO^-@71fJOZ%PU(jHnc($=3OAE#0|K!=VkR=}yTvgn%H0NG!O2Cp`RWHrB z_w_s34d-d1V6bKIF8ZiZ7qF6OruumKpa9AvE!9*2_wzLKT`}Ityg6dihZSBSTUCgD zB`HNH5-H1L^uy~s&u-!;8!)%O#Wcy?1QJuzKVsqsiRtkAKVk|zt_@aH&D3CA?1W1n zUv|uRCmt=?AW(IDgBCJiIH)b=S>pXx({M+mg@vo+3b{7hV3%7H1%!I#$UIH`jO5=$ zc9@(4yO(8fP;d$P02UZcJgV$l35V^!UtQ9~YJ`g9pzxP{pZTNQ%ffc^2{^6?Kc4|* zkIg1*NLa2wS36F{&Un%4b%r?`#swJa6H2q>K07VT6P5K)Zrr> zzv8!9$1qqlw|klP-(-{k`irV@yR>b${Y*{JOeW6U3zC!|qO|hlb=agMj8y8c3nTef z@Xo*En)1oRxHFosQ`qLK2&Ws}^0tAb50%urf^#!BF)ba%;En&j3$T>!>Gc`85&oSk*He30PQ{+itJae! zhN!49;kHrXf0%m9u(*OQYZQmZ-QC^YA-EIV-Q6WX<1{Wof;%B-(BST_!97TD2u=fE zzcX|1%-?>VK4+i3S5>XrN-*=^F_inuWYT?IwP~t%jW<`b$KT~z+BV~@nB52DqE2T6 zpr%eH0lipq2EL7MZ*k664^IRZ1K)1sp5Q8uJn3hceKW%psQ0;_wQVuiPWO>+y*tTn z8zQe+e5;s1DUq4z-Ty*BGZotzImtrO{c1{SgLrS@^Z={XP;NOqAlzGyn|O#esTjs~ zuS0Y5ikfjIm>-Vff8Bv3`=|WYm~viiXbnGe9Y3+2yYR!o-kD&mBDrIkb{~B-`QO8H zk;7K04Ylf| z7j!5>ur+D5)UgK>ptoVRJN!$z2ooEI{>zKwg6f`NBl6n`m6dSv=d}{CoDhHpi3veb zGOf&-_Q6tOECP;Mhk68RRDb_}{W#93qFaQh1N!I!2>8BQiDAH~?rB1Eg-$0CCwIn3 zDa>~`OEd%*+Xh>{6ThCFaM*@FcF!R+6ABYCFsmmIKZ+p9N%iPmC;%%kjBezPSnDa; z-jxZP;JYTH4U0ya?0pmS19jM^pqh}sT}B_4B`)I!fgIb!%dc?1S&W!#HbdcFQl?XvAJ8OPZ_Th4$*l+%e=H*h7dafni=TM^j;m*c; zW>qms%S!Py{26IoCqd&-a4bvs-8Aw~0^`gZJyMME{{Q&SR^gsI0K{|Y*jmk&_DGJ7ueJpqzjp+e~f%67Iko-Z_b`xb%+eh1H`RW%?&H>p` ztulAjv;7HmPZ`F=sy*Lmar}jTeU4F4e1KZFAS+Wb`?P{aW4g74eu_cLYXDRREf0aF z7ikA5`TviWHRK?62y&r?B&pSWS~ zk9q$DIr07ff-XO~;B5oh86P?RAFCsRx~r&k&J~m*!hDQF1{z3(45MeJZB+6zlHe`Y z|3U2m*6D~95cAff?dB&0wxST&j=+BE{|{{MvKOWO2V1_fxV@6L+iWTSNjiM2zV{4% ztaRudlZ~l7JYeoUzJytYN`ZtCRbON7Iy5Rg$mOL9^FPah+cqkR54sE2AqCGt>69+g*!Os4JvJU%3Ln;;f ze*hvB=i>$BMUoQQBsEx7<&(#M;P;BOxUajY>D}skgMO5a=8Xgb`P??VTw0f54@dUw zTDJPFDo%}WNa+LT1?l!xGtBtfHmJF&%$+j5X|#C#;%vSi0UWTFlfd*UDQ z*Plv9Ig-byYNWF6*W2wTM_`%>h#B+aW%!076u)Y3d%lOv>Qd`|t_`UJ_JsnG@G=7&2aa`AxE|G=)LC zKjLX`-WIOq5wZ7+R_F1t?;90!5{+!_nLyQ(ecAuKIPQRR&bLNyn2l2devuk#hY}j? zIfFKVQSXNK8yy|&9YV>zAS&+vEQ_3g(}Q zK5l74BqI4xE+5As(>_>^N?c>3*u%an8*G0JLtbh3i_C{*rb^9V=QDaqe!@f`bR2kO zLP&wPRWLCqDfo2ch4a4Amo-zBF(ZIIM&1 zDG$$5+mNq|U?j=-Y<<7CX{1~KD9JLaQ;UBippuOysJNjtU*#U|S;I`Ck#@ zo%R^lt2UT(O@?>C^RBVp;)ZHSN!#an4esL$-=qY9_^U@a)|6UJIgSj~99BrGn1v;$nv805;U99FhH*IDPp@$u1n(yBqn$a0S- zn~evhdpvpHBj_)&`!0Z5qi5Y@gMk;xSuok!N9_~8FdWbCN%PESGb{YrCamHt-3IRPLY1~hAo69-yQ&M#H{v@v6{e5H=f*M-ByLl|iwLQQ z)#ifC!p_41=)5ukCMb2BKCEDbdbH3weGy!@fpqq zN$cwjkM~>BaBjJd{2G-u~~1R zJ}vmC`9>baNSWcqDj6*|?=b>oXj&rfvMy^6*25Oii>IARV3@X{GnBbOzP$>c* zx(mRS?5V~LJ4TPr3VnZoz~n{ZDI9$*Vd81uR4Jaxbii$JawG3V-ewVQ(n)|IMGd%g@>_OIm-%&B<(;#r9awy z15c=WG$e>JiJXmUiPuR2g7>*CODLKlEt(Wh2<{cuK`hU++qhOebN3fVE&qN2RYh0c zI{$^a@Qld*^}IPedbzMW4qy{!X!D+S+-4Vie4L5fs`bkV67)Bp^ZHdqVJbLm>U~z@ z+cHQA*T#;qNNNo#2=9u;_U8bSwYYi|KlhqNH)-=NF9d>b_>QY)ct!0%ubHg0uO7jA zwK?HU1T*!o%)K$hJSE=XXq2$2701{o6@II*i=XrQ2}A6`>17`z&0-hJ58`53_pL~q zl8SDY6N!7TFsI|?yp*n_{-K_z3Wk}0VpjHj>QG^x27@)9=J~aKq(vYs5)C!t3PPjB zM3UwQg^fg3V{)8KQsiq;N}1NS?9c2{(ec|FR8ZwKwoFsHH6S0Wu-ro{hmN~CA3Z}V z0`+?p*@#`+`kEl6V@#@niH>&Z2 z{EP1X;}NqH?0^_iao{Jhp;lIG`o7ihL>N)*savTuH7xUHegj+v3#^RD3M@bDMUW@7 zn)E)sO$x}9TG0~MTpcmopHO#K23qbJ72ljCCInh;+!-cecExWr@bUCWr`NbRNX0V> zd+l%{SL5<@gp(&RLhx~rNHLBwCQt{AezlnP^ux?rDDgn_CvYqS-R=74VLr1S1Z$o) z2cctla<&;P2|q7B77%E5rR#eT{OCe-UG$LHJyZ*YjzdhYtN~-sufr{OsN_p-UBQ?Y zH{m1_M_q1RI(QStysG{f)RZ6}89kTu{nV34$b_OeTr2N@JWYICIwt$1s{$6b^5UK#9k=RgI?_TVik&5u>(5Pk!^nwtTc!<@vZ1{x2c~corgf(_ZG6!os zcUs00S`#(X!JL5dcXGFf8C*Ar*0N?iZfqg%$v*)Gm5CD)sEq-C2MQ-Nz- zMH0dM`BKBj8*XUiEMU8c7mcI4=U2UWg7xX@ZvHqx|8dl@MC*d(3VtTH`4%}!es1T% zh#7m8k86H?2}>jQecm|sg5~gl8Ji%Lo?P3pRDa)S!2!IjBP9peDrVB5p(Y4^i;6CH zvKqKwI@h9sdz2!u%Yb7}EJ|OKgpD@0>tNyIeZ;9M=7-SMz?+>~G_~iGS?zHG&s%1} zJ8AU~r}lfyayL)ZvZnYTpTDs_8C{d(wW5Vj-2g~GF*d4H26o6%nic#X%iB4S%R=95 zeM{}LfmY0>NMU4O$R?SmWoC1YC)atH0pjXF^g&SVp=krrhwe#`7~-HMhwgjyKz!YM zCcQ+7k4ig?a{Eya|5q2I@|Fl&7H|Yd{uQ^>(;T~5=pmdL2tTUHvX}IMa)Pd*V_1r8 zx_*L*--}NN)zkiNB!_wC^{5-WV>50-rPk;w2!GdxavqsSX`Mm4aA~9MK)x8L;DZm4 zQ4cd%Xy4%0u}A}coNMOd-m(K-s>x`Gnv)$1aMxgKi{M=wT!an9-&$9>xabj*Au2is zz#F)t^2}~7_%spbbl}kex-jdgJm72yyadV(_IM_33^71o?2tjFLE=6je@!X46lgamgN5Xi(qY>Kylq#h&X(c1`{|I+(tSEXw5!c?W&l z%*Chwm0E}|ctGzu>E^{p!}m)gq2`yLx6T_K>xhkH$2l@}BLk?w$m7~V=KD{VaN_at zDK9{g?=un6kW6!mU9kj?tcq6dS-JdZH;?S7rg*6jvX!9BcZB(zB_v?tQnf;5Q$)2` zo-$ZO$}KJ8pY+n5%h_XWd^~?s+Zxzd4?YhqL$r>xM?hp5!(eg>D<7$S;h_WR3YBH} ztAj=wG_v52U*9q|%R*u7JeeTXa%{gpC(0PmR+@W`t3U1Ecrp!VfQN_gKUa`lt%`lt3&Clgin=6&a^$?Ip{}9k;B%l)&vK(t&3>25g+mxz9QIs zr&<@td_Yq>1Bd9p8+8{8y*>iht|@R}IzDc9B&6S5DieNqApo`Xt?hcNtjXA(7|v;y zrX2sR@XG7yUPr2vRx&l?npYPt`*vfCjI||q?t&ZduTbph7EFP^hodSF4=L9J0;?bc z{Uk*ghT#OaFC$9LzV1EVeB}u5$HEwCB5)Kq$)DMSFELt$LF?cXPqcVO82UIl6!M zNS(k6B#{ZbnzUk6M8-AybpZs!%5`6sW|Sgrm|EUm(;z(H2Q~)QsR8W1;$}u<_rj*! zkL*Uwh|P`5dGP(-BDw^5^@0JHe@fAY{2wkDlao=O9k;t}NsAR8prJlRzL1@iA`he4 z{wsKhaUgvzrDBL7)Q97y+6g1nFaZ!@$_F9BbVxN5%&f4nO)_UGZ<@L@R9>=Z zzmD`Z1lw!m!{l}diUh9UcJ13COU_^Y-Z;{EEYeS6EuvwU{5S$@vSpdA5X|7+5pBeZ zeVGYp{tE`yRc)a#J}-8QiheBoMv3tS(g)E=zJFy~At5|2d^fxqJQeyAFaYTaP~R*} zcAZ5K1AGBH!58j3fArsOp%Hlh$&C8gk7fu-w-3eo_FHXC?!C8-b~bUZ6LIPuCu^rr zCV!`|JiScgcqM+Jk7E)J+jNS!_7gprM~YrUJV!2q7P$ZTNJenEOja^RSSVo%G`rV{ z>EchF1CNGy6(7lXQd?)XdNBL`)*arDBwJ*j&-aGU)!-^i(h0$ zFk^R#CG~9czEUmGrMtuahesBXdR~p{hE($kZo)xU;Qo!+z45I4A9&fU-t%b@Me`5d zgo@)0Uz(q{&nG>vtk&XG`088|v#pwHr>2`fcxB}gpE}{6ZmNq+)iaYFfU1(I^!ZmR z+!n$dqcj3whcPs7Ti}sq{U1Fs33Tbo=LwGB5Zp9THsez{p?lHEFR@9R*RzqElFxZn z9=_tB?P7bh(4bsAw0g)8Xz?mUdYG&k*sa6I8dvD%BGE>_cqGl(NTeG+o$V4Z4t?rs zSG1RtsLWs?)O;J)6sdm{kmAdxM~Qf%A|^iFcoAFN*@$?&GKWI8(Eh<$CE|xlB_c#y zxAw;oW2NQ%p$61k`z-SUCJ#CsRgKn0H?m2Fh@f9c-KCyd`DRB)&4*7mIKImy&yMe- z8LQYfc7^;hrjHFl3(f}l%==dAB5>DMr2*&!^!sIt5Kx0l(7nF zFW_F=Db-DC7x;Fcb z+9&$HhOI3Jz7aS9tB^ivhMZ_4@8FY9lNa#<|H)A2xGae*sSo@PL(CX~r2#uA-knVG zDr}WZ!KS?wtHaFRKPL_)0;~>M(H6MTsJ$+b&0?sY?82#vg48n9MJQy%FUId$zXGPK zva+ysMie7Gtm8!UNWqRA2_asc_0|YX*1yT{W9|8IF@qj~P9cy6uD1l)31$Lz3a<~_ z6^~2Ih3eRK)->__D3xMrli%6E2_<#3_J2^eSmZ-(9S)Wuy|N zBW%Gf2RG>?NC?1#g8x0B@6WpNKV$rD_h{KfNxj_H`*IWT+}ejhqN$Hmx1VypHDn;; z#{BPCewo$h>$bKPqWEi5@_ZNi6dlVUs0o!Cn25b5EBr0g@yVV+V%+bwe>J+V zbNcJ3FtuN=;PjVIzsmm-x8`Z_;Z_! z&F7Dd>QE-Gz;c20m)1~O9_jeVv~1mr@tRoSa2i3JaM(kyD*BQjmBh+CLX%9McvBXs7qG88?+Lqv_=k3o>5w7J(9jK0BWmXS9F7-*9=)ZdOFV z0;q6U&B6RRWdUlQwGj~p{XWeK?)1$_6UW-{^3SWdq%=#V*1mkBZBvie)C1j%XFDRm z)+!waym?mmuFb4Bt1tHHF!C(5R8p~c7i>-465;Bb{0^?x!vXIXizu~>2*+E1Tu)Go zVI1alI5$y^M>}25=R}VJ>v!@sf%NtFaFH*d)(mL4*!Kq}5Y${+>BB1g%bmC-(4X!FgeGkwZRJP6dQ) zN2%0kT9k;qAwwM0CZD-fhW_jn28hvXVJAjy$r8+D$_;Z>VFyYiOlrMQXuSd^GuCTN zzm$>x`&5n{*lvS4gujf3&X_xzJCekk1g)LwxX^VEw!Do8F8o+Se_FcLqTUBqM$HSP zv9VoJv8PSO%P2b4SuO{z5#l1G5HlvmS$FRBMvh|;CZ_@_EUcaX(7)jWokA_WCog!M z(e}Jto(o(ah0MJa{jQ{cTAuh}Z`k{@uh}6|^Wh&_ zE$Sy|knRgOBVPXY!xGzB=LHg2!7IHOn)*Z?Z}^Y9B&OQpf6tbCJZLX)-wJTX(DK>+ zHHY(z{8|S4EG(O2trmkU`Sa<()Wz+1t&1N@5H^fcxFf=;owp$5!xiGh%U#3zYc zM9OIl$vcW&?ow;7zw|vHW&6_AyQ>J%s%u`@P;k80CFx}$25B-ZUtD$F$xLzb0HzVQ zLOT7L;{5RPy+WJou!XObZwVXC_|Dh>za7(7T)7m{iZadJodvL6GOoYC7`kkS7 zBK#{eN2!tn9B(HyxH)!T1usk#7cKP+x#XSk>gUTb6+P`H@M!e%Ug;*Yi_&S-p~;tX znl$3CR4l^D5uC~_#1BZ=7)@!%7@k*Lr1Erwy$}v+E~dxoXFU{lrx(O=M}VyLbfasI zwseg1b}`9a)kJ>6X`SM~gLezH{+yp@@}O3lZ=Y$~ajy&M!0*7=7fD0%LQqLvG3}}6 zn{qon8X6-o^FcEta2&sT`YR{(!}lyEh+dH1nz`xtJ$)#*JVbuZ4hhlryh3s>1^tI4 z#-zc_E$*-HoBefq;GlIEqE0xD-P>h#OuO5Lo7bL3Q_1B-3!0LOPtZ&b#Hp0WAD`lB zsfvFW_tiuQ3o;7g2qHlwMlT6+76yf2?d_vY7yu;$`r=th>AZCH=IEoVhmE_6?CZ&0 z!k_oNepIcstxG{$pBdbN`6OH(Fdw=camaG2sXk8E352c%%y`{IRDXOeu)(dV(QWK1 ztH}me6*VSJkYpsS51VoMki)J*G|70^yw1pfi{trFw(}IvmQ@yN%jgh`f8Bou%Q+4DL@y&&_q@PRMM_`E{K!;H8=81Y+==oUSQGT2~mv`%r%Nr>De*0FZ42s2-1Rgrv&p zIZ1zhk`J{9L(g~M>iAXMEc6nfiba=ywXOthEdErk!7}~*R7HSuTaA^tZxEIixT%NX z-n_Vs?kFaJg@u@OF%s{3nX$~g<5nCR4MvR-70+ba{Rvps@sk zSTj`{gFQxlk$*vbD)mr2;g9k-g%%9^vlLNQmxg`1kdV&GHt_Qse7jpn0>H-@BB}9z zBpn`l3i=Ck1+ukF*HvIw0su!TwQY9N+zLC~r5|4md~Z;Gj`+|)UA*K9RS2#oFnVK@ z6Bh9;5-$|-%!adCP@%-09TNe#XK9)fM6nkl4{c0mf_6NmPoA=`Ri20-TrnJU(||(# zq8i;jT6*`PeRcCBp6mSKZ>%JUmSss(2qjs2SbHz?FX>{4^+;GJ5-5Iy;tzcjA4$tq zN_)G-nuJ1p`=!aC+Iv&cpMDbnk+^o?X|)Bp^qd^+JSWOG?>V32F-pNaEw1FWAbmNF zY}0GiE%VBc`XXFJ-4C2(tPCP}tgM1u^*K%%y#}wk%%EqF*6*R{X0zb^PAjjEy$Okq z2iL?T6X9>BcEmk_&DBriQ4ZZ1SLvY%smY}&UnkotI5y7B5X?SNPGo|yebYa0rhD6$ zH)T=~uyh&6_fPh+`2p*z_uc$Dd(CdE;aH14HmLY5P&47_h|O^-e3qo_Dh%-Fv2*n4 zP1VA?ycPGeh;F)@%WU?z@pE3m(ZXr8qBv=A|5=EZLFYhW`^dC!Iv6xAd%wwQ`j{S# zF^vAkq%+)9P~t&3f+%nq_Tvl&is?~i0F}#OyH2(3&wyWs|4JA019&)cgofHJCzbLd z!60YevRn)tuk+5`?G1kw1;JWffUuYNKg-H^`3ZA;Nt@bq>mD;q2{vkuGS?KjBbibS zM6F0W7%kv`NUKLevdPH2B^^T^52WCZS~#(<`?FZ?66}+d<9zk-cLMCYu?*?u!@qS8 zw+L?<_#aqh$k19Bk~G=4XIAAp%FF5i-1$vxPGQjz(ugRS3L?X%l$ z6oN(wAO8%5&e5tX_BRgQTV@`%`ni+wVHE)Q!hnz?WRUd)J|em}(Kgx!v-r*}M_Gl0 zTvvxkJA-YVoSWO1jyu#^MXRf0>l2=+W^Z+g9}5WY@zo(`B*e{AM`o-hT2{g{<4qhm zUz9?pKvZWX@z;|BELZ#3m>@biZeHw&oY7mSMr%+t_FUKQW}@STMR{!Y{Mwbh$n>z! z4b+b(kf~h!yh1InxLam}88mo;k@|-nW7*NKSoXD%Er`ZL7S0Kd0yD+I|F(+dPMczR)ni?^%qj%Kr$Qb=*aiWm)P&u1eS8GhTaYkk!LPaY|}^s9R~x?ZJe1 zpb{SOgCXosI>~d)NWjRBNUnm+AMoGi_@SGDCJHK7y3Gn}s?$e5ISy?3^9Q_h`&8CD zL@`P4{JRmS!*ncgQIc7T86DC}VmJ7Qoyv9nC>hQ>nnfHk@+H3wD)1Iqx3^Xv5b@%J z0d(%c*G4&0Ea3@r)DWk+z?r~kQD+<$=z+_Pl8&WX zSXdT;Lray^tfPo>hVQHgo_>inSkB!NtJnG7S;E4LVd2|4?>HZi)BE;_@;t!oAFDgT z{qgN>CVS|oj^XEY-z&Y@q2=EOABIBL!5^2B^wd*&Z*ZiNzpfD(7wAwOMryj_=Ulj$ zxY?0)Wg!)?&dz^6=;9Jw5%1GDnGPb`nm7+;f=*IdE0_RH21IZnKw`uYTU~21J)C@i zUc@a?^_V?Q;i$9G{dj*%n8N98^@`V5_Jd`2PiC#itIRXhQw=Xy@cU%zbfOWZx#tCo zqRe_G9{@igH>}oKck*huWb9f>*j@fR`b9-)RW!SVt|_v#zTaWHc6@?JmmBX3e4?Qc zxigL`?8fStJU+}5a9k&iS7O`Y%KJpOvNZ_KasR71emm`b@je+FtO9(Po@bNXX=u)g zN+@yqtbU@*26i?tw#m>hJ$jR&vF)pLi5=~ntO9#2c8X2UnKqqLE6H%i^}&ydz60Q^ zof7l1#G#pFtis?Fc?FN(a)kIdq_hG-GTd=&JNQ>d z<_7)O`|)VLlsqS}|-qq++KT%j!V=9Q&R*^+~`kvx(Yk5~P994gZ;gM)7Ebc2CWV zXog#WnU($%qMWQ9j9hWhNDe9_MrU0#U7kK}547Asn1!|}4nX5BEV}IV|4mY9&5qY| zZn^+qpxxyfyy@0_c?oK9O};y#J&v|k*5)r4p8P13s6YDPAjG!F$kE1r=?q+zXqKxP zzg|E0vozI*UaO65a}?kXn7fxD>V6GI5D0fa+SKvmt$ykdP?6dA&EmSS?UdNcv7YsO z33RLt%po=YOSRY;@b~zGsbDE-ED~`j!x;Aj=TdFtHhb{q?OTa1)W{=uY zKwvQrW^GKJTL65FJ-#D7V_3R~(5pT&Q?&7UL9~!AK!#BD6SfR=@7K-%DJ5ZL1H#wl zv8m-pYO;L%d_aEmEs>KwXUJ8rV9I%nK9D#8S=w`9eOJH>m*CgzljeCB@VWfQ&mVF0 zlFGjjO$EQW7H(6(tTuOeD{L4=I+Z zJV6sOyCf$BZrEvBFh048DFo@X9)dI){dmZ2_zw0$9Nr*pZ+Z|eB=&)C4xTcE^pwY^ zL=JWBoAuG*J+Zki$^`#rZZ6Ua2eRRDB4k&Wgy-#}AaAV}KS6tcj-XB$<&#}>SLMI` z=!k%k6@+iEG*Kz?=K|PzNPXTx0i>(woG>)SogjTbQ9)vW>`Qo3Qu1wWU(;516ZEDC2_!B^}uBL6pmJr>G8#S0L3aQO-kcXHv0Fx!?*d@>X z-~--H57sxTw*#Ka|2h7$!hrI*toVNY`y6b{@d&2At2SiMPt#TQCkeM1m_D^&vxu*L ze@<=3gr|VT9DpCH+h2r|=J$McazUZq)lHLRw%Gdj{qmxsJEySXdKE!x<0|wyT{845 zoaugl6B^CjqtS8)4|7n>Ct&nGk5n||pu!_Rd?YXOuinPFT$g;PfKGW}5mEYmXv>07 zWb5ZHSLHqu*gFX)tSJWK4Zf(dEhgY@Q7wt9&Hy`aTf&jh?(q4gvG+n4+Hkb;yjo9? zXgw{mCWm#MX;8b=TKCC{@||+_9rg!VZ6J~Q;45Sek0Ga3x}qHcd8W{0d%vV=%#(v8 zfs~BF!?XGVae(yZh&bN>;_R=#tjIQT3IUt{Ihs5PCE_QF&E#SJ&C8>tU(eE?U5HG| z++S66v?=KQXpI8td-I`ZE@OD8uz7Y^mk0{!)dA1-7Njz;5Yb%RS16xYF3>)UGFHWW zf|_u3N+q~^ou3Diqi-l2arCgyV2fbPU)d~mrh*DcU>#CvOZuq8M&YpG0;KKJHDT@x zwX;Z@R!@<>J*glOLQLKutI1^BFg&*Hyi&cjOzbEQQ0S9t1mxI+H!iASnx8}2-Av2$ zfRr$?kX!%;PB0&V%!+1hW@UbS-xa;u>|^3i61}cPlYoG;Zy`EQ>h=<}6=4p}f4);- z2WG}9!4AwIo;y_|3c+0A&1usg%^2Wf+4GeX&wRsE9o-zV8`vxg8et|LnJuv=%&xQl zPU~Ha+WYzB(Fj~tP4-8iPT3>;WTe+;-*DLJi-G<6vvT~`GZVTb+%^slmD7gG?A60m zADhy=B_ubRU|r_B`PUO}in9EPPln|}3eq|K%(d44Mtxf3*{{?xTj)5IS8 z*mh&jKBek4tfVQ@|MoXM>H(Hp?U7DE&mIxIa^ZZ}xS zKi}1g*yg)Z-%90B_v}B#aMkYUK|F;I037BWN>HvveOTv7;>83`>TdU+kRX#CQRt-F z*;@v;&7A2p82l?$Uxn?cS>eWAuIus%#7+7chU(=zy^rxbsM)yXYU|uAc@-c5R2Zs| z**bkK$l#OZSfAc!c^S`iDcQ6*eEIY#xF5|YW2f2-jl6^8d+lE!?ZOjn&kvt%Odf#> zar`=ZUmgLpT5B2#yhztCUIGR~GRS;=Lb-w86BY7KC@nhw92Zk)7Gep&o**b&rbP?U zxsJuLg1YCXr=cqJ5jltLU^t6|fFtYT%_n%B5nB}s%r`Az%?>=#s{&m!D;V|-WmWUM ziRn*nU6CWz#_)VW5|8TXmi%;b#dd^cBqz(AqP_KIvq&WSkv-jW+Dt>m1U2Pn=-JR_;7j zQbaebB@6CoK+E5@a+Ih5`r@%u_zo9F-!!IfundU_Sz9c|ZhFr%Wtm~XXYqU3!R@1L zQ7W8A{ceK`JV>LwHc68Ukfv-BKx#^mZCa|i65eMK$Js}L(9<2R5ZJpd?ahhsGI@s& zJFhDQA2HVNvnDPYE_yj7ZtmcfLlHK%<9PHU4Ui&~?BNnRW!TY5d@r zp;1wX34cQ17ugB?tm(;ccyEyRsJhPfry^|8cu-<}od9H896#7?1!ibC)!{} z8|wPQw9FQM5!z@x8_I~WumL&xhNQ@xk*Ug%5I$WqYUc@9{H5csvDPxsFge^TwD8A@ za@GctKTDsX*no%;JBzMzb^PB&!aTfpl2txO!$XJ@?wT3vH0bykPqRM;2#*Vn!;`rK z>?0$T$4bSoyU<;<^2ZRBXsy2B&ZR=tB*3|TmZnJj2I6h0s4g=2?#*l9NzY3JVI^u7 zV1yG~r8wYedVA5r^l`nR6rG@twRYzZRP?~|(Zt*hE5A&ikP@wb$rpyBjq#?6l=1d# zyWoasQHMR<)?()QlB|nete{C51k!42_bw}{Q2UX0xRXcTyr2Ur+i_k{b|Sd&;Ll*| zsOl|k{AM1l1ybE1E3LuMbU1;m6k%f#YSP&wg%j`xx~%dHoa}#i+2`i8uO`Y|3%^@< z?_XqoM2$=+u_7+}Ulj`-ORapb^D1N31(V|5!!K~^wbbfmgkyjg*ozi3x776&H7v(EE>AsqlU@|x?Y(6{hI1(BbjJet_sP$yL+T}6&uK41dM zAajry^cDY=vC3AkZPn0+nlDGY=Dt@T%x=D*M!oYRu<(#SW~vN!uZ?{O)u1AOi60P+ z#kpB0#dOssRP3hStCKp1WD1vsINZQ{uNryMuaZD?n<4dOajh28b#?-GQ|iY%QMky- zK4kPbxk;wVr!2^m)*wHqsiI%f3eT_tg>Yt2A&X~Gqwkx^;&q)%>n^&|OOJC>!(dyY zpss{&^_$zVE5?t&Iq1;1HWe@7f7P`o_l(WB+NvRjWWMe*Vn6d)TOS(N!KkK}x6>aC z#OUWIgB8Bkm56G?L>1BYcr3&-ylqQ znXG|&pT^jq{WL%6!V@6(o5C7P)S|Zs!{z2us^6XX2YIQZo*!eZuRk5Ywiz0 z2{M|t(Oy-^dx}g^R7S11t~JiS5!w^-D^7yXBc<_afRhrE!KrOlws7x}VIhzewxo0b zHZFUrCZN8|B0aaua9%AzFv{e*1B8@i6bvN^P#D?n7t5@)p1_gN|$ONt`mJH$H(dVv$2 zhD47zOJq~vctWf!jF+eYV$-k&3+(@0#?@4LCYkX^MG`L^IP0%DDrhK6W`f+Tq66jJ z{fUeEl91xiz(@6$O+skx?ZtsyD_gjo6kTx%w4atl$E%7S#*5~X>xE)sRAzM*Fv9v7 zFU^o&+t(0A@YQGZ>UpL5jKFwS2}^92T;!X8#Cct0i<81G5S{&x8yO{&bN{6&9WEujz~ci@0B#bEf%Be> zqFbJ){hK{U%UC$?8132ogQy2r3z~CMuCf_TRkb-wfPE33ugd_KEcNYI1b#&b@{}M$6L4w{2vv7X~AKu_3p-I-!0 zmWe0DSl8s+cyuS3_f|3D#xhhqW-BN|1&PR&*5(;QZ(-|=%Pi|@yOp;5 zGqzzjZQQw)FclnX4`+OaEu4N{hBobC)UlVUrXHdS$J}2-)Tr*>f1J4{OV}3|7tU0R zPb%i&k$8;bMh9KVQSA}9D%p?N!f}&pJNL6*270rKX?a67eA7)dQndY~5MUw3PEwf( zrC7Z_KpY+hQ>y)kT418)Z%2K`=mE@L1W-YfAoHBpo~XBb9bYJW)@#X^2(iFwmlB*g z89h??WahoL?Henoq^OD|IX@(G1PV4X^M%kGtY&XRIJA5s7&{MacO$blc0o>nB1%0i zrjQmDViUp%R`Z<-7B55{Kr~KwUVA9HWw{8|XmXk!M`5_iE?7fR$zmHU#>@x3Hm;9d zAmwr#R0(8FSPcl$k3?akVU9R(v3uJhxky#hry(lJz}Wwmv6EG!Y%M20njWYeZCl_O zZqpDyh??)4r%YhXFhJ#MJZdnBj)0n8$90*6BxFZ+A|xVK+!c8PO9l>j^PS3m^54+G zuM0sPy7yXp{CkPwT+_QU>puMW^ZDap_K|}Tpc`>FZK)9dY_=?NA0iwR|#IQ>*4 zWKrEYSkQahg4m@*=&?tbes#~K#2y)MQgxLLK+!8c+8KTWynCQ4jy@-3c+<#hFL+cr zT^@gq-)gyluzDGwwM_=5dqtrDus5*yGpj_fcUM+Z9rm{>`X2qD%$7dc5Bdz1lJ8a% zowi!*HB3kdh3yudS1=|4^U={9>(XY|1b?@J92mbuQG8e;?2X3O3~(rnqDYAIME+{4 zN1OIA0X5jN7l-U&YwrJwwfq*fvmEsy>cO5j>%S-9&WqFwq{>~Ty+5g6dKuld+VR?H zR}>RQFh=}4SeT9Y+#K(0)ihS&f+bAQKs8=TOa}P3>ujB%$i7k@0O69p zdpifE(?g`j(+0@?&Mu4{bPRae3mQS$|5jAE_gWMV()>n+DwwZXAUC=X_ZK%nx_V6D z2674L0Bf*YrM0#VZ@9;Ho_w-VR zlg~ts@p^?tFRSv*Fp8Fkqb-H#pS%$oNXd|~%e02DbJs8yJdfm|nYzj-p?irib8LW{ z&h(o5QB>2OUeU1<%H9pUG2v=>%A%Rv8mwrs8iT_Nt;jOOn%w>Yvn!J}5dsd4%Y`1v zw-()j(MTI0a}0?2HtFHNTxXYtmM^KccOKCR0n#XsFAX8ZCu*Ct-+Ay4GX>JM2?V@; z9&39HwxQt*B=jrp+Zw@ByZ#>b+XH&HcErRh&&&EK$ray4E4>*oPlAwW__O+N6O%@e z7MMyv)939{hH$Qu_Q(SBn;44B3kr6oIe1v*xX2Z0+pdW2q-xDj7>q)v#p$ z`F&=@Y%<;#edy#{V^pDFRm>l0#-F8v@>$>{na%xp{aNpa&APnPOagJjGXo)c7eO71 zF!U!=tP^RW4JkjlcW({+nTkzQFa>*UCZ`Oq3Q7R3|;YR9>q%V72paD7k0?YkQXk04dsB-X4777JV6S- zNB(op_n{a|<>9IL$%UXaNc|=65TE=fH9YlC))wFVEm765)i;c@yBn00?viflT)OM|h>CPbvxJ0zq;xDLC?T=H60)!$C9!lZu*7}v{`b4D zdtdkUy5IZzXJ7BS&YYQN=FB`ZoXf^p=eDG0Jb2wdSlMm(Rbto@9!ejyXYwZx z_#dA}xWv0>bHtH1eIJkHf1yGNDSrhNJ!K5OygE2eAWYvm_*A9 zMoocNd?g>`Ml&6(o_!4LSI&A*(P{Z{&M9{JzZCvM8_|Ocu9_EdK`(v?e*|r%E;Plb z$G1Q6nfMN|mNQO`^`IsX_ih|p3C(TE5R;3lT+)P}sW9kA1(_^idIoWp-{8>e2~y=u z>2!!*1C`Oj{I*Y-Xz1d>pLINT0LM+Mj_X~Ma^2`=4JD?chB9ULO}?a3MQ`gvd0Bpe zv&R#9XQuvyivNxWAROM?*#sFc-khP z^+6+{r`aK{=QG$?XJ0PyP3hBhN09aiKA4@I4!xT>Pti>A9ung7Gl$e%25>OYLf)aF z0#97w>0~OQ+4q)?r9ZR(OF=b!Rz+j(38yrdX(1qO^p-c&W+B)NUN??SE9WG9JYi^f zpFsL^!(ic*hLYCXC*M45Oeoiwq6MV-Q>hK^r2nMhd__KPmpp=~XASUi+&^5uYhmZj zu*Z9ZUDQ%sekZ+C|A$b_n+M>KN_jef6DCb4E5@kO@8uRGxiBaJkbdY5C+sM{56sow z1GL@VHQcu0Ynpo9LBl7>aI#Jl$x?EkSUgeJOs_zdt*F`X`0cFI?d}3WiqPSG9a?{r ziTgP%YzPU=#edCs�r!+>*?B8LTL5ji2aB3md+}NJ?%l=Lm1U^P&Pc-m$%t5pc}u zu)L>Jdos)Gb!Bt8?S{bwoB+pr0WN>WW)?m=>q~CYW>cf)YjVDIKPlB4b<;U*&$|}K z1?HfyRJLl-8Zi&@1>v7EcYo6OGc5_d)x1aF`ByignVp~@+s^7q20tX1=IOx*8gJc+ z(Ox3KI>((GhOC0)rUP7#p?Q@Xq=92f(^e_N`?s0gO>W`kykzfTderv*heFmN)P%<* zoXnOqxL#dQ)Z^OV`L!QAp z`crPWZ69Wtytqo3dw?c~(WfT1b)g!l%w8)$zD=Kknvc@$1jr~3roKfOcuNglnD=}5 z2$VK-&Wwi`dYaRjeBW!+%3q*3rMmdDFT>+*l8B%4@;I4}!%=lf0;6(kubnAYU@6dw zDD}24quS%llKU-fb@y68Z#}+c!?(-vmLeHmb)O4o?3TpmDgzZ0Ul9u1DhGVdKJ zXZlYmQ~ZK_Q@43E@8NxnZ;>VyWpX=1Z??a(HmF;`lEn>ywXC1=da@~yjie&QTaaV#(m>%UAD^Na=*pRhkCCtkF!Za|) zr&)TRx7Ge^iqUG`n9&OKw1c>l*OV*^B3?W*hUgFa9b?tsqhQemz4ELnAHny?{q{B| z8D1ZIlIL`LIQV2N33)5GuW5M)8F=v)Z%?rSZXGm72XM+Guw{~nrhIoP{XJ%R_6PaO zZ@lpKuT|(b>)QXOk|q4DUV9tSh?c@#?w#n%ve+_8;AJF^hKJY5Ea9xLG()34{r-T+ zBb}6WFyOtullw;HiC0UJXVRy(eiYj;{D8N@_$4%xvgx9lFNWvbkh%Mjjs?b=drP_E zz-}j<%R2egDcyU&az0d)Z}wuztBgdZ%Pj;2U+ z3w;>Bd$;YnF8kT2WE6Pt;S{mMMV|KD@P{S0%o>K;U35PCbwxfqzG(TAf);fV`X3Ku z9>98a4^i{V~?%uQRI7-InLQYu+5waLWXR$Wy;QJltds-YBJcJaVxaa|C2i7FR|Nr9n)YW`mBzrWN|1?tu7MH zFK}JKF97NnS(udZ(^S5Z|KXY5t>dky6r$?P;t_hndQ)7s>kads7~c}U>IL+7EMP2ms>0f&ttb`TaG9e4hjsm<#H4i4ew#nU-pyl5DGa z!fbYn_9PNQ^WhI^6s`8m36fvz8qNfDj{g~-z5LWbs&7?Wdbp6i)>&qkbO^n~e`Uih zuO;|Vt*2J&`8;KDj+>Siq3dGs8#1)hTW%lwO&Js4tfcUJ{Qj}a?`_+#5S{=zp9-&TMKs0x z?)uX{H+eR9HKjf!Z$L}*pW6tv(cIy6GptDpS%9BY^?>nQk>X^y>LFsuYJDi(A_;)p?)hg;5qQNhdmA&3r%es` zd-bK1V%}+jW11her+HNpS@2X4bPOs_6@)Yk7_y8*Y$VJ6<_VYCgOa}y>V5a{+sjz{ z{w^Db(FJtjQVbtCwiXCV!IzObxRbjwZ5&OxOPDvFsya&Rg6=FCHJqh(@k-P zQX3rG)25o3&H7uQ1H>IXdlkn-&=Y<~u#`CCKKlTI>6c)&ha~>Q*fg%~l`*a@shfe$ z&;IMSEXIOp9iwW`h_4Z5%eUf!f9boaH$P&gqzgfG+pQ0!$Vz8L%Dmiv679$b$b$Q= z*On&WOI#n7tP1z;1~qfNaA_Xu9%cz)d&v>P_LF|@v*j(FCCryY+FPUNt*c6hcOM{s zEvg0htz#de@!%a<1Y0HsgaOaO9E@XiiE9-!?g zzumeQ?n0^}sZ5$JtbAh}mDuM1nTn8D#CdM9N~@viV)zMO&MAxPJf$b`r*oUTuiRhs z#`t#J&u{_mZJYKGu>_Z}IV7VLqV7F7tEYP|R`*cmNx+W}7alu#X}Ls2{Xa zKWHV6WJfxe4E2H)(&`E20Jo;2N~?~I2!C~J3RR(3{UvvYK|6$mce(K5y_RM!P$Kq; z;%TS**k^GgWgRFbAox#A`fpaUZqc9Vm*NuX=$k8i?d zZKj-h#^5-?0q2<>;}hy5HFB=~(_5x|++7hP6$J!$=B-*1@8PM~t0)?o{ov}y4TuoN z|4Q=)e}wW)ok!h6c1j*9mZB1+*;u9#vR=R{tV>iFW}*Yk;Xe5^JJj$@;Ut*xw)HPv zo^-V3L2{00Y~;$ucm5RH|CBZH!2nvhA%MeMK4-;EE|htolF6cyeebD6MV7*A!uY!m z1o2>Jr*Lpxy^U&J5vg)Tb$(KUDXG!OeS5;WvkBRii7Eomlt4!|24^2en0}h%Ffee? z*C_@r<6i;x23Bc&w^x4hiYU-CB;xD73gKs*DlnK9P@&mP(GXGT48!sRiI%APCTKYn zn=>^2NNAY2W2m|ty<8O<%gVYslAC6AS(ir^lVinL2Z8>)eKIRX#0GeCRKCpS0UFM&a z3Sh$rrZ*}BGTN(}poHba8lKSUC$%o(Y&b!p6Z>KBjGB}?`(V2D12~ttYno$8lgKFF z4LhW-NOfykRDE~`1D;{IneJyd2bO#}|6gVkIawPJgHAQL$UrFM}t(+t$fE=eMp(*=_7fC5Hz@sRLc^|8_rzTV%hks>SrcM$5V zYTMlG9{uxUNLyz}~qag5#Nx=H?JkCfM^ z!3i}jDe=EEmyJF$ot5qpZzBZ~FrPqA`y~NaD`2D|)2ouw7SdT|%Gmf|lG;M*Ohsvv z)lg*@WEn*rq;gVVF|O`j_bdDG(-rz>#y1O%`XNPaqLqN2XF~igmKXfUSf}NjLjnCff^zXR~3YT;G&fKS6WmyWb0FVf?oO zuO3ssOc&ON5ZPHg-~eKMMM9gzO@C_}h$&liWoJ4)zN8M;0USU_vm5{WF8b+$K1SvC z)}cln&WZcL1l->yxpf+017Iw#qcJP{Q;#9Fuj1B>#eG(KqHU7M;>Lr$wqu^e@l0u^ z_r|OU7di<)t^^sn+%Oa#{~I&eA4L8PgI+zh3tH=7X$6=yYyPTNB)AXxPCBTc zHIy6r!&1RpIjD*5U!3%99TF6o2Hjy}SX?HcN7}x94;OsD-v5z#n4y}Lq;&N$*{UF@s7x>m)b-NhSY!DkA|WtCTw zs_-KXqyRYJcp*=zQV+F}$lt$L^h=%a2qo!*b+jBodGQc`W0)nzaB~RM8;wcuR&}5+ zch4<>0PN&!lXO=ZqR|Br+c4n9>Xs^^h>5Dkw&LbXTyWOD(b{#8EiR!_JCU%7iVrb* zz)|^62a+Z6eFlLIovw|)LM9ifmig4e{p5>ruMEtTFtL=jbv*dIZVI#ge2I-XvWr` z#gebhzHNWGKajWM#5!a)x3uGi*gA1NSwNRvTQ3M49$};6TTUF41Gifa=NJI711plc zQJK|;`jf4tMaGy_-r3h193#yNZtJ8iF|7(W%`rhZ4>9iwyE}F6!zw;Q-7zknYDXdh zg&t4BCWL1uWrA}?=QhF;#NoU7jH2c|Uywoy7RaHN0tB{7t-4c{!v?9knmX(>OmIo# zuhV(s3Bxsiy|cu>pwK{zpLixUOPCgM+oc(=*2OEIa$c`DUYAMgRYX96y zIVCABC|Tg$I=(Uuq^^tM5p3qbzEN9~mCsksw9kBEDiiEp|EoC5zU44GY-g0QW5xQ@ zFVS%^=+G?>V%4P;91=99^#J(2#YuF165cn72^lVsz&|=+NdbaeDON@V-+{KZJ7%c% zBQ36+WvD{euKN$HYIwQ*?fOEMC9_jtKYG)MzZ{oZT&-?zI+ffR<8^NjRJ${n)kc{j z4)_F~%my2}hn-)zHJn@TfvCWJa2Y}aR@~o_xhwWy;Iyu0UiJ>U)Ztta*Q0}?QeN3K0)MUo4zmR z{WW`V-t4u)*NHQLwCF#dz)jj`0JY}+G_y&RI8|(WN{sF^3pR!E>#J&BxZVaU+Mh#rE|wG3DBlw@Z1-WioA&%~X zuS-6p$ES#)9aJ|fh6xR6t9JZzk9t0el~9{hcfjT+CV}J4pNRIN4SRzl-|8)iY#O)l1`OzeswN_uUS!?cm=})F)H5RNVjdpDM=dpdqLax~Sz-3Lv8ANpYCCcxr0`t+s503yQQPKt;(s!=pytNG9-Af)qAP&BP37BMw%UU^1XQ$qK<7o zV`hc_y8GQr<(nJSzRW+=pwbN2C)E%Y^*o^|1oV9`3HU)iqyO0j#I&ry)mJ|Q;Ls2* zPwY6u`$GBEgjzPk;`V{uV4vm00qFbvNy6d=@yR@+Lt}MOy_d5oZ7SXt1iU$@hKXA)p@DbBL5zQ<8m$#pdwN-5l$h!EgJ=o3M{R@@&uA zMHLL5cK`>l?o~T9{<;3!*Js&mhXI^m6@4B$tauI<^+O{GF3u$2_34c{wm_>XsSc9S zvU@r@uutae1-kmLqT(TIyIPvR{GonZPN5d4kT%tTs|<4c>aoc+prz$%!sW;La|2ll4lJ5xqLirJnM^(5IZjA*3IOzh-h*vuvvK))%CWw8l1nWV{n{YDkK{(%F+@NUk$N_i$P(dhE1UjFRZ8PkZ) zESa&KMDL#X-+K6B^FWFNdA;0isaCP(K&@V8m@!pMX|(;*moLX!gl{23|cD>LBxp z4wo1y(LpKhz52%=J2aY0-Q|LzWArYK${$&cMCvtgR=#&Mh?EqR!Fz1s@4$=TgkXuXz%r{_c3DPVCNTFYaeqI82(jm_Oq0<4`$apFzRx4 zFOiO|lZ8+;?QU?!Ga?lAE^?FwU(Y|+<%XXRSs;X81LqJYj$dPp)p;P$WYZbhfG0Q2 zVm8qLc5kKe!dO!vV&d{O&Db1XiH9S!hdmp9J=KW=4Y}tky=w`6 ztksSt5e|+kSUesYfEPt-IK)V?4@#kq>N_HM)S62NWkI`;xir4AWc|%qKMe2Ga1!~= z9(G)V7Od8rF6Z^TzQ%Ig-@rIEVqj9&QacI31JqPD;NbvV1Rq^%}3fq%K2fxVSj_{)jQ52F(env42+} zc;66+RgOL0)5F>ih$w<*Njm7e9f)%~tOt7Pngg44S4U9tL!w1D{AGF7{9V@GOzou& zKV=E{W6%+&(qr114Ko@L3Vaq1DfDWf21}!lqsSWMz!sxg#A-i(5m>;pSRR$8%iD5y z&6@_pdetKBIm%nCPO4m#qv?qDv1H6$16)Rv6nuO2I7s!+J^p@ZJ1X%l*29Ak*EdWJ z)HgYGb2@#h?AHRNf>0jqRx`^RATCH%?r7ky94=g*hV0B(5mZO?h2g`MA!0FZhI+UvfsBLG`|+t zgq>IDJrAPV2MXrzf!)^oikW?e?0T`Z$V8u4n^eP`b%e{ezDB)BXi@-2E#ne!(tJkf zuZfqQHe)RDBb*WZyD@1DKTMjc8as^P6^ewAqyQb$_a`EZ8dF;VPMWPuYDFr``&1-h z-tA6d#+Tm)6EFyRX_}<@eZ>c0z#?dkg5JkAy`xtXSk*mgMYPz%Gy!MX#qnt~>@O21 z*7OG&FZpB-q|G#g+L}~0_Q7#i0;XO&hB#)yRMTYcmZ{jskZ z_Sq2YJhmE6XI>(`AUKD3%j{^1z_SzPIP!U5Hul?E7Im3nC*<{LUUOjz^camPkvsRE7}IwgV)_f zy_&18f^iINUrirL?z*p=19Azx)0oLVvz`W+vG9iF!Y=jJrArI4I0ku9+krg!8gTv| zvwWx%Mx4C+D>)~tW8)>I9pf~fpV|4=8Z(1wh9;UJVm(H)y!UMCLve0qQdYhq@5aR5 z{MFT3N!7VjFU@$9ZWAuCY=N%SIT4Vg86Xrmq<>C;g*ESt7cP)o{r(Vjg1waQBzEsj zHqQjvm)S6;<26@K@N2x_G|WgWe|pa18DMl@$9H{mLp7tgUT)HSJaw_1+km<~hq-LI zkT}2Qp7gHkTEgT>Sy^?}p*gKohd=7FXIm=Ok>}ee&?ky68h~Yg_oVB`0%mXN+u3GJ z_wMvWh?;!vt9wKxd}HaBK1ocZ}+jtWqDGqEJ@JbmNPJbk$8sq8YE_ zIZWXp^F7+-=|TXgVna|0rq-zZqH)~ya2qcFO$jwPh%yxcFuQ`OhUIOw6M0cHei~s3 zVJ0X@7413WfAaZTBCI4qwf84PC6)4BR~kxxXR4BzL*%mlI~O9EY~+>?c~CWJw{8E8 z^)X413SlG$Xf(=KV!mryp&e!_pDo1E^L^YbMT5r}t5TWcdVZtuJo+jFMV_$do3y&YwLJl z*Saw7@6X~9LErWMGVXTtRE<$d4AFoPL}&H+8=YWFKolb7BHeyc8BrYHTKW}a#3eHR zJ=1!*N#Tdz1mt3_eKzwmnnQz>_=g#5vu3kw$G0OlmJb1~c!eW^R_p!xIl8{pO*4eQWwOq==z?9 zZh2#QiCQ*evu4ZzMo?0JVO68sw2fB2bhrI2z=uq2i9Y9~!Tx2Ug=!0jr}9I%LPjj_xrEsyPuK7*<93u=(~H zK$TlH60H?F0@czwe)rf}&3)`D6xk_%9Wv=E>JL4>Tz=F3zH^w_Fp4Wdinj;K^<*`0 z=$^ z^%XPmY7Nb=AOD3Gd~y?Y%Vlvp@$>maH#R-y)De(;_goB400wJQ1L~^EWPgeoK91ZN zbTv&*P!Odr%kZ|-Lc6R-l*Y8ugJwBjQZi24h*`KbHtnfoiS#=z*+FbhCT|`{hwYab z0_Uh5`8QDfYjeXqznKl1g~YQ3f+Bp?qrjs;@_F00Qtphyviek1BwE_26aIe0_qC?#>xi@{vk3vv ze^Qyy|8dhUY^w_lZ%1zwJO1?|L-BQz8BgankA2-VRGMGN4fT2m%XJf&axF*exBhG+ zV9?_74@4a*=32d-6v8|=s|%g`Em-AxZgX0m2Cic@WUr;i)Zjh`Y}ZHn6;Kpl12Cs` zipj2U2`faj=8Ef1?8f%vwa%8eWlfY|RFdDRD`R%cvDuPzk{>Va>pMDn*LcG&uB9xu zQ(!@dy15!fw8|DEJ{Nd+c{}L-z>de%#;FEA6ndIWd5Hrh*HJQP>-H0UG}W|obqTY? zk?%@D2RPBIc@L=ECrjU}86kx11rXBaPDy$H8iP%eNq1gs41((u3)gON%=MXvzoi-K z88AFk<`*m-rJc|e0gk6+CE=6>j2M+wv?hrQwXD_D7ak6T>R5g61`F%SW5m6pN0sy~ zrNZ){Q%w}A)@9S{g%!$|R(yw}J`VToIIUm02z7b^)im%=mzbW9v-$vH7Ip44&NsHc z-}@9CUKOrUDEX|=)$j%wm;Um3Deh)Gp`R{U+#N>rB$=X$($f6c{kN=tjPZ&@me|0ip7^m^Sh8xGNP&|nZ$~!p`maD1nffd@I zbUt8bF?UP11S3eljxc9?3I9;QSYBK;mE&??;vBTmJ5@9zLxR5_7e8OGnwlKQ5%YRSBIrth=T=xnb4<>mWLvz*Jas!|9{ z6ESaqWTP()Lh7aFTQZX!mpi%>x1@Eh4)>pLGzJ2xn5-2lCg&Vj!Uhw9Sf{1K0_88N zFVzgag0@tD+6*E-9^JQbZmL-6nOPXt=zFb0{DsEd8eF+b3CfL9P;xVwEgSg@NTiRg z38iFGix!Heve;7Q&f^sDmFrbgZx(^wLuoJzMr|7mD)zkE|!q;+}0 z2zC*L^jRHBvyt@qw7#8F+|;ruDDSRxrUV2Z591#+NZMUY1H{AU`83|>rgGlLmm$8T z-G@gXOP*b{Oa>&~ml~f?O8~pC?!z`ZjlE-ZPB zkmFUhoWKXo5Sb_(Y>YBAz7x1%FA;oL9yNuXGZ4hde%u9~BgTcPwbVqqVtsgqlQ|9_ z4zEeu-WdT-vEI`@8=EJGSJauPlST&i59{Ba%YoHxA_3n4qrW_j`EgO=tyS!?rP>ob zrv+tdyXB1{o?>eqV{$Mh%ZVK@IO3QjY+C#?Q^G~i1T4zE{&YQm7tXR>{=iZ`ug_HS zCL)sSa6FoXURSMbUD%3(;L2Wpf(FQLo@%zFU9=MYK_b{XndSn`eOKd zkRup4&JqG+7VNe5gGDby*XPdgk>4jWqhq2D0?I##7}NbatRNNhT2Ha)D`wxE0#;J~ zTZ%TC)X<3%L>sNPA0~guils5(24%qqWk~^L(W#xPMkryXH_wAkh^46C$%&FBFYZe{ z1pBUtwKF!KmER__X~pbB7Jc2N8P7_c*-e-O6WU%E$0G!upR=78NIe7@MSzSba_zH5 z?LW$WB1>P`x4+3BwgzOf``AK|4FrvxS;bEH#OTIIUwzV--f9pHLp9M*QaQrmXQ4WR z;F1la^ptDng(msYv2ER@I~XgntWZ4O){MJ8`$-`nai#p^pFA&_eO6vKLG+`z3j$K5 zdMk_IUX{_~F~>Z9E^GGl;c_MNmJ{qZ;rc{jQ-gq# zIZwJPS6AqSy-u-rtjUNm;i_+P(iyjpkq`X!xtbOFRA(Msn**ZwHYz==##s)#h1LT3 zeOBJsr2lNjB?GJ@EMi+q$-rpgQx=y-^^6hJG1#wo4{=tIIe4rQZB z)5t8vkgQ7;vWL3UFUeZ)Kh!psp-Z!OiaXow9m_IevcSO^g>a5tS+>ABI?BGZc(;R@ z^^qeMPdLXdCgafcshAg+&7_KB^czZZa&uV0!A2nk;D@b`V-qYa&gZt~agG6FDiiYV zOP+&kaKdR9e;;=hc~_(e1P?tmuWRM4L3~#g7>%f>)%GK?*~x52jl*Ihptb= zyj)VM3f2q8rpS8h%N~4rU*LS8hlrAo2iog@m>lH{DxLmz=KdLqtkX z(th{?bu$jxW#b`Ro9BqKuWp2@Oy>oG^DH9Fql);?{BmJ3N+J-4*@iI%PX6MAQapvd z8Ar6Ja&?Z8DC7<_A7;g~={9uaXGF{>W)nvktZ5VvGbDzvMufDVh8apjV1z1+SRV&H zt3E1{f5AxyJ#ek8q>=#LxM!hmWlbCdl%{YLasR9qPu4Y5N4q%cWyDaDfNS~dF~SxF z)i3M9L4XBl%lwYvZm=_s;jt_?-)j%=~L^U{1l>yZFG3=xOtoy&hC?Xt$I zMpnz}#8Z>C_Avd-`ZbPS^+$HX<^}zaz%)8G*2PT}Gh@B@zlg_rwOD`|_(I!hT4{pt zh=!L{cw2Oh?i^32%CX0FSY7+M0}&l3GdRa?N~Rr0v_J69B?E(5;`{mN1F6((WTWQA z6J~^?elWD7ltpU63Tx&m$J=c-5tFe2QS_WhYA%~cx$cZV4;2>lw~>?>a64eT@1nKY zC^0`ptp12>PRi%(GvJh`Q)2C~K(3eVRsRlLjhZ}sgb#joUg!pG=E?ePUpdtg8A@qy z`m(bM{kuUhxg+1oipSY#=t!hcf9lk8r(uvsjHTX?c=-Ct#{YVC;&(MGC2+01yLY@i zd2+SLK7(-6KlN+E<;xqKdz=y(vyO;pX%<2 z+M>Ah0k6ihox1kVBOKdK)9Yxtq)B_xn1Ca08qC3(XTL}&QgoUQA^?UvbH!zpEYd40 z+uUMAl036sv=%?m(8ja;`Rfaq4W&6h9DLK9yhUQxVfBFb^ALN2uo| z)yX;ZSWL{^*f*+TUzT}9*s?(0B*~t)wT&tFy)qxIOw?tzAx&hGxAZ#GI)^^Oj9_tI@}@!^&NCNO8K$)+lhRhD`VsxY-JfLAGi8cn_yX z#*>!L#O$ml@LshB!_9rwp82=^lmTaibAhDysb{9D@O*X2T%ZSG*TzA-e2jR zN?64Wn9Y14EFV-GZ|PF}y=|9f(zo&Oo}Xjj?-&yr&~|KYBaIn4b7qIk(KewHIKA7D zbGc5D4kO<_DtfS0P3Abf2V0egFLxZr0Zq72iEdeB!}dc|Ri&u;{CA1=hOWnPPl9zA zZ9&JM9L}T=EQ3ln?;rHlaI06dB8y2as{spt{XARyJa@;snM&NhOFV|K)ihV^&UKP< z0_oRGqrJj7(#Ty2aWF1iSY?(|4&6kO7H@4b`1of2m{y!cj-K29WfZTM+fvw0%ml-Q zqHB&rk?vJ5$EaOSrZKZjt@=Et{-L4ARWPU4>cgb~3)e7D6l52pB5L6$YO5pxYzHmb z`L|M7!v*C)n-CkD>XH$m%lIHAF=fvBV;>Y{r{%ZpA4bgPQ&{slN8H%9=_RL)qPzES z)VxuhPJ4TQ)UEtQYrf?o&!!o(O@Hw87Ch3Qj_A!OhVqauM$Es1m16i1 zv$44&hcxz3Vo7Q{(YDL|pO&38e=8YO#pg{wYml;SOSr!UPYkY#fi`;j?>XFGROy-ejtlX} zv$R}q?u1UG)&zNhi-k!rlmQ%19)~uWLtwr{IoIb9>xAm@Jt*{qLwaoU+&8!T1e<8! ze_aRT3b{0h+FXc6&yTlU`#`VC7s$w!E2T_PZq*{jIVzKRl}Mmsp&mHps;*zb+wbu` z?&H1MhVJc7W3KnXn_RD#7doPx!a`0(H!QH4WWGEJIi}-h4ta6F$>roaZ}!>Z!iVZk zD(s?0_j^%)4@)PnI+erg&9LNL8*nXg@_0Gt*B?#kU~uzMN2{jTm8%F&Cp9yxy=~$8 zBAZ-hu27=MmG{V*WcNp%z2J@@&)3&k7|X}l>p_UWpjekm?O6==yfU~dGvw7V)LFc( z{mOCgY8NYa1ylo7w5_O0VRQmCbdb zmw5=F#fjnIG`+fUcG&MUJygHWy{a5)c}~{5W4M|yqlnPe0WRcd6JXbC3ms>oXJVHL z!6CBF*Ti`{JEB06Mfk36_3RPNrQPWo3c9Nm1!=OhWTtjqs4q*HIpkdW^N^xlHuYT- zK{qbbV_qGl<|*75vF-*Mqlu?g$6W>S9+iD2wC`Oczm+nYp}$M|g78T>2=7)iL=~rt zjpFj-gv6)IjN!h(xk9Hu9m8EtM~>pk0A?Oq%_475^cAUJ*$MCO7E4f0KOWCb@Om!Q0;mYpEx}1|$Ed z>;IS>{bO=|!^AH1hDo<$?dA+ie^HON{7|Z|6C*&kq^w!c+-l1Oh6rQrh~d0 zo;FVrSH&5{r+7f_R2{!}Vf3hEO@||J!_w&xxEH_=%C8{JK!w?isz#Gz5gD2K8q8ji zs@g1K-Jl0%M}Hxzii2|$fBJ1ReDhph3_f=?yuD#ZaKjGr#y3p$)@;|q%am7*Z}rdF zZ$of7k9Bco?-`&=?lcor{MItIp6Jbc)%vJMd5+_H|WQ=rAX#7)SS4q-jJ@;*G zMowo_oP0%t$;LbKaTOI1yjV(O^I0M~;o9y-W^HHNRES#FM8E26TG!VkFg|@-kCD^O z6z8j=0jlwiUR*^R1h0Y;FbH>U>&Pb<$)T_if+}BWI8)&UZzFH6%@TbKiDl|;ZUv(+1t0`&n2ls6cM(|V~oJB#{i@4pT`ftIz1+8b7&+rjaW)hUq^O(jOvF`4xZzb$8Hdghy%DX&X<;69 zvnBB&0e_kQ{cctK=f`N{aJQa{LY(t6s{gm~+w>dA=bip%3Re+;k>rk{Z{_-{Ni0vZ zx5Z07=vqTDz)yWCt8Ef+Zi$)q<=%bb(;6@N=+!!^cI?!b2BhQC1vPmHg;7fpMvSR0 zAA$$i2uTs%8^3`}H!$KKV|6jk2>{h>F|wfC0B3e_l8<>2gT`M*4Y#moH3sEAveU^jW@*KH$-br zEZ4|Z;EPzncdo12nAqCXp0)3MrY}QiV(V_;tADT_xWU^0aKjCJ^A9$r_N{&QFbxC~ zH{HPh{=w!OnD`I2+`!NOVCxP1_7B4JyVkyUncfAnwcWtcf3W=q{`m(xZs6WO*m(nQ znE^M6yYzpoeSc!60K)G#knSJszJYxIV2}Qf7lKa=pDqt6n<>N!%6YQqfiVz5cK(q^ zyGrP=ixrw@k!Q78QC&4p^+Na{= zX)&_xd_3t6K*&IsS?)eFqjz9$`lI1h3QGZzbcc|EKR3j}e?<5VQHpFu?dPdkA}`6Z zw@im#Ed1`-YySTMBJlr~X$<_`ehb}4j^4HK=Vj!1_+F*fAw2#0(f=Qbg#SzabSotI z@!hF|r#&3^e@4UqI|Uh}2>-9TC_dJYg$wK5C|8vv2iiLBMp>5?ZIBD2C8&HWSld$5 zt937u*YefC>h`YW8v%11RNrI(ZZcey-(;`^GjL8wg3s9%;PVIgyL6pdT!wVzS==YU zv0$!!NLAjx5cszQ_f7VCKB?(`L^oK77XJV5MBsm0N$co`pf+YU+}{aHkA*bl)+l6cdA81fzvI&y7mPF zLrh+!Te%OJd-c`K*A6q=_!C7YV3A1(X|9d~-=Pib)XxdDqpoc=t z7mPZ!X`7p7>SD1|#PRJ2a;1F@tFxmD=i6Hho5@TNoI!2mKs#JOvFY6>kFznTBsey_ z9hdbN(3T5dQgVyhVIDUMsAX`m%vEEPmXJIn5 zR2)I`E{rS?V1eL^LvWYiPH=aE1$TF67XmB}K{t373m)9v-Ccvbh6D|{yzh7Jckl1c zA2U65s(N~Q&eW;ueoj3jNIo`Di+h^CB;zO~N*ibwOXc&R2J@AyKG}^DGp#9&+86Wj zvZ^sdw(T?fJ-YZniEgW24HqybBgCPDnXU4e#^6tcM86=H+edtsx=J$~VKsiB9&1L! zqKDohIy2a_PeUDC&P`tJ&rW=weX>agoxL)Oy1`43tdfLr8p-DG$PD)q(~(yeFjXra znqv&(w3#zaQ`S%Dq$yy=N9fu`xu%eud$C2Q;0x^p=Y#HZn^HHNVl8vFA!*^rEGq}u z`lOfqP3)}B5C19A#_K?@FGNrPP-!G#*)QSRXdr_cUPzt73f~>Nf-suVatxi-d^M{2 zuvoXfH|K`raUTeNNM+cUr5PwT{&KP2YTfY7bSGD$F&G*7j{Y zQRAq_mF&HvPaOV5D~LBfK0-e&4Qz~?LI&M=Hmd$uI=EpX;GArsFO?rojLFzj^S!_E za(o&Z$->I&Xshj?h7yjv#g%%110VEv1g&#jtw7~0U*0$m{Vdsr{1cof(1HrTtf3Cp zE6yBojyBAvk&H~>sf+XStC3&7PGWe(prLvgzLkq0%W5Q0y=_9z8~wI)ygq8qq12(3 zN@#{|(~EavfW6F<*PB#;fyFquQYjuS#3KO}nHDFKrBsB}p zPEdY?u|R1+41zQ%w>^oL8zD4ItoR`j-u$Eq(iWRUav};A*=tt0HgGU*!pX~1fa@3u z?@lhATtZyk(2-9>0Rh}qt+*CKPz=^QUdg%`PpCdGzJ};cB{vIQx1bH45@oCcBe=S< z!2NB>8bUSYk^I1{T4x7FMKjHY=(trEgt&yVRW^M4gu@blti0;MzZaei!(_`6gjBwL zn$3`D9@S5cT%Esb*|Oj=o(kDm@}VzDJ_KjXE|l`p!Qyztu7BnjQ;Exj25m<*G9Xdq zQ&-U#E0Fv9IZFhd`K2u!jqx;I`wD!F6WaAFQ3D6h76&iZZYB? zbExn==S)F6`s{r(pK`o$WNrx(7|qKj#r{Xk2ikqr=r@H2HgqzZI(BxXlDldjtBBFq zNdGDZwWCjjoREaRC_>EPA5A#t2 zr!p!kIU9pUsh7c&XMN^O8j$`O8KMGd1>(CM(hu}KXt+?kKRF~pI{3JqCg0|Xax{GU zG&;eBmb1Fx$dn=(6nsHLbJ+ZJAM5{>swPK7Y&j{`qeu>L^kcxf`J;snbDY zx>~pKw!HeAN*TT{qdoK6c8dnK+5c`?TRe#Vgn1g*LorcLBw17jbf^2c3PJ81F zq!>q*U~zjFkl4$C9!|sA)6mh&Zg3Q5{3tj&F2OZ?wM6GE$H?(MHFL|G`K$$CyX2uS zme@a%Xq@fTW5vWsg(rdC_v!eItUD6ExkOuS#K=Pu6xu&ItsmyKGAxTc#3q9c>B^Sr zNj#*EkzHs#XJ^-#=PC}p+T|`5A*}!xX4T@MJl~YDy$^`pm6xVuTHW5KHak7SK_rlY zdfdE(AAGR?91sH!dM+@#DxeE&biqTBK$?w6Uu^{;>%0)+5lA#%1HawRph`H87l)A= zHyf_4SSmRwb4LbZetTP|LjSiMLZ_3jU12709VX0pGRa7c15|u|AdS!_VPTn}=O34%qJtkPnVzJ8RPSq8-pwEl_ ztlMgMTOP-`D-53j5}#>XGUcoJ%LRsY7*Q$4J>SbUy|@mrCTrX$VTbQP%mHtPxO9}{ z0fHqbJf1`DUVEs}+V`m+E(7}qS{L6dwn9KOKE5vSIrKQEDZpQla#L{Tw8GT9PW{4SdUqKC* z@z7D&LRuWEe@0Z<(0Td*=?XhM=lC#tYy0CH(E<8iNoHpRrLUb`DBZx*YC^E6aVK4W znS%dM@gp`rf?tJnPs?fXeV;$c2+=h6SA8fG%8bfUnO>(3I!q|AZ+Q(%xP*}s-tfh( z49|avj`J273xCYaEMc1+9?+a67bf1~Q?h~LlH*wqYBUBZ3vr%|LKyN_zT+t2h)uZ@ za71F0!N_>M3#?Rg2?be_Q=n}ZpVt^=j0#OxyA8txfCD3uJbnd?@UWY7_;B;1;dX1( zDfCCk$!YdwbCI(=w#0T3B5RRDz)H(Llj2MF$|$=C9ZPOp@%IXjnYwRyG%iA;aT0jw z>ZdV6fOlb&Hgrh2khop$;GRUM`whoN=CHR{bogj@rp}lKfz~ticvo0|D4MHXM;j^I z^JJz{g1w3?rD68qI3#l*UKlf=f*_yD7>{A3_>0h}vXvbMk9>*;$8=h(4U#Tf5&~la zCMt%&RxO?jrQ0K~IvITYL5sJc-}N2*Y7fZtJ;Dcv*IpO-sbWG=1R7^JxLBE!7pMHMm)h?W>{13NpDO-Ph{c{|=7y`M_P-eAA4|hj-&BNaZOjZE|CUq3wET8Ab2{+In!x_`-r+uVf}n||%tWbg zCA#<$^3U>doAJP3af+Ua@C1OF__DkdfT<6&}-0Gd;E6S1$ z>gbZL3g4=y6}DKH@H~n(gOY(+OM62(@taiz=0bddwf45cRobkRJG5)@yP0&YgHJRXf`r|`@94k`B*H+^9+xw(b7~wid<_ z9rK;g;-iK44v{D*!s2jY8l(^P$fLEr%2y2~%+OpZ`Ov!*zB&%V2*MjStC5dKYQmR4 zaA@a#O!U$blg66b{i)|oYFVaFZ44FNqu=H!Wabq5`oK-XCRLfql2VeBG4jCB_d?+O+Jr` zmhoaP&FQiDM2pv(tlFp3n6;>*4tHQi^l3W*MSl_ce%usTaqPw`v|pkVu#Qw-=;G|{y>URJ z)z(B#ubQ}g->`(;XUaAF#9;pZP-NrlD<`*tX7av=s}KvE67t7YCVf&D(jILu!682~ zUx3io{tk~(f`LF>x($ST&sXbK^OJ6;X*}i8s$h5BgWOy1?y?eOy`BALhMHW1>6!2# zO4WRyspFAHk2-;;d@8u=prrD#7L!1FMwd$Nz2i((QG>D9K02ywjqZkGL@Xqv{)X9iFlC!pJx^Gol_b&zlGXCS~hc3#uhLjt}9p0 zSHKX{VYb7`?-;uJ50{F9lgz#7pX{P3SqgA()p;94g~G;X6aVjC0@t zzzv!uZZI*W5yRbu)w}9xQ)Pk}J9F=KCv(Rt>{}3OQJ?>JrnO!`CYui2fvu4XNXU99 zu2HdNke@-I>*Wp!b{Fd?#`|%p#=!dYd1L$wLs7}QJ#g3QWwDoxnL*WcbmfY5*uS5p z4}qdS;0k-j@MUZBRoaRW6k$w69~O+;&%3ueLAE%BErZF@ronoMDzCeMft;yjWwMGvNTZy-(!W27SkTz85^O`84d=BFYqPAd zTEk_tb*zWve@-`@SsW07erR0FIng74(K}yD;piEJH2q0{PoBS5k<}|}%9U-!kN;72 zz>%V%HlTvaHx4mkx%ORR&0Cjx7NGxS_p}4iQ_T!SesQgTw?HACv39#Gx_zOjRkq;u4M8YHW!dbpOPNhYi`8jlRx_ zRUwL9B)<-EnR7fSJyO1UK=UtgA_ak=2^e*EN!4ltrY0bwK(ditGgv7DfC{<(>KAOB z0pJJu9?1zQKplig~RyNaV2k0yXijvK#wf<%(n7boP<&K%k;y* zsOXTAi|Wt;IK}XHnog6rTqAaYT_((wQ0N4+YmwKCN_}qXvn~gbuJXH`)83ngC$2K# zK1!|VF6c{6_uh&K^s#>}hX@#f|2JS~{0RtrnB+MvYh?|eQ zCZYtU%pTNsS|@D7)RWIg^0pdQOaBm05B4_DN1R$c4h0r?H{E4Ux)e0bt_ESEM|I$i z2C!>NG^?rDPhzkFXTf7BrSC3J%VhO>H8lzc+S6N0jYP`Zu%8jl=-o6ST@kr}kthfi z#hd!%cmnb0oQryG?r&j!CMF~=7gkCmky1E!xg5B%K+e-)TRK@D#d-~da)t0TVjA3E zO(rW}qBp4zKPRAh_|YlI4VIPZmDf8x-4x}D%1~Z$epP9Tj$`h#S#<8_LGgGKtcEII zt7WzsQ!Kf$gIo4BwDe0$q)7{Lv~jG>9#C6b}c|3kx=JvGgZ00jkQUg$%GFEAprPq@}O-J&I9!G4Dm$sX(601W*`d}Q!) z(JGbT5n`DJ=l_NKB>VBKove3rS@K82GnUkDZuU{V{x>0%%Gu#1Z$*ne8Fv$4gXc;F zuDN*_A;W_?OpO_!3}FkxGG`iWPm!J;ZpB?Q5wWFYxW4|*gR|3j)fvrO#ZFs`e9G*S zW`OEg?m?Pb?O$PzNr^=U!I;oP_Hsn?f-3mM;EPqQ zlD9p+spows-8j#f(#b;!{gS<(VAz}Jl&%>x2qKZ8D!>Vb0x1@c7v1*b|j zr4(r$f71X%iJM=0zjAFTo#KN=Ra>3s{M^$fJJAc>?o(O^h{Z#W)1nP$lv-Y$hd=hk zO30Nvv~?m7uS3P$7Y{>(bFu0<)R=&)X;weB!gyKfH`XWNy$h@S@kE|-;ZJ-&nZo>d z&2a|kwEl>*Kwy7Pa^ky(PeW=(hFQJC>t+nJo|x!)YD3`%H{2qhrCGier~+$Ou*pBE ze?&Z3NEzYm@{!L|34EZQ_BSl&BhSh&L`LTIZzm*IWi}Uk-#Ulz1rbcu5 z#^rcIQzm0o%WmOND~<1#uOzPH))D?A#M@7dK#rU8aMkY|3Ca#3OH6Pq!oVFX<8DM! zjE{-7Qo(6VoL^NwMrn zr`HNJ^|k_VK6RHms3`F|sD(4X@iw+0p_H=DD#XexIrfg~O7IX%;l|pXsG*ud4WJa6 zmXl;Y%e>t}bW)2ulnM+Khw+lC$=Iq}yBso89TuRsh4U1M zZyb#|kM@yv)io1oA`2#k?ZM~bpE5yq$T5?)i+&`W^yDq^(69$ZuXvj70G8EXQBF#v zz<>G_#2DL=H`Uc4B(uD7KKalDIx?i5>4dHgQu^;+`GS)o=ccC1s zBpJL_0+NoDXmJwmJx6N1n{VRbneX}_WEo=994w?Mr){d*y)C9h=*HjSb)M!F@+fv8 z*~1A_jwoz3WuzNnwaR1t;fJkpAGez9tTS(W8ARwHM6%h4XpKA{g0@1+mqp*aqQQv7Zh{R#Bx?%tKH?RVNeDaHz~YhC2d z_xWSpoQcA=n5{npuYz)>pybZYTA*x&%i-P476z7%>EfT(8~h=hKi_EoibG+FtlAr` zP2rF{iMgGKnqm@!?88COG%vjTuUjK2V2$lSa8yCvs{OSPsy+7>;(;23xGm!;ooV!g z(rWjVUh!j53#L4-15&fmF+T79VJWuAE{{(3X5D5>iQ`tJZVr*V;fT|Y^I#h%$;X5z z>WklYSG}U%t+MyrE!s`PYnFkDS(vV$53FmCTGejN3wedrYLp_U{jCL5taIxZ^3$Vv zY#clz2JeZMv-;iy)+CKUfaF=Oq2UjkzcO)Y<9fXhXGUNMxil2-LAVz`Y4}mm53I^& zrfNo2%8KTdjNjliUme;9kO^h9@}jKMqsrUF&&)8Ptg_3>H7`fNnKSwGR9qfI&ECqR zr7PJ?)HXdVAM%?nH_4dY?~U9RCz6aDbo^BuM$xF^`bWnEp)%`)pg;b?!%wH861JQ3 za;#AW`BdV?hqZC-FOL*NnR#>DMKpD11%1AsUKLokQ*BelTNqAdV?_J1^)~)SXU3~s zlV@}+t!6zddlD6^12Jj~spE6XI)>&>POA(SDXH|$?eO*KU9}vl*YSu|#nS0-qLV^n zVtqs|5B#f~`GqAa$n4%z`6+9he!&+vdbOcDGwrbtS)$D^1E|&# zq6MXkW3TFP@|S+H^U6WA&Yv7{g<@t4xdpgDViGKMEzOLCcw#KhmK_(^o4 zJX)#MyJ5)OX{yw{fyOM|Ine6WPLO^af&JhD5CMzAmsF1r7AWUBQ~tnaxBvu@PVDOk z!`BZ`iAZ{8^z-B9?(QiI0qKjGq0~%1FDF(ql|9C>Cac5hC;49k+#D28jMYfB+L31C zD2z&8MCym6{Hnf?m)^?_Fvm~+-Y5+;kT%JQePrDF=5=W1isQV@oXzuOEl;O_y8RIl zefAHwE~{}e^d>XduQM=ya3l?8#SM51S@=eCL#wftk~-L($VCyqZPmLZkJTWP;lS(D zAMtc=fNtuWaq#}9g>pq&^PDX|xjJ?1KnKngEnyH@u!m^I@b4;jPG{aPzw{jli@p|q z7U0|F%b%*gL|4I%;_;gI5`fou>~L|emS+2n$0F?y*)3vV-b zMcLW;N}hnWSM4$@l>1$pKuWE+9`ZM?Lu5FDva1JxSP&ZOf(j)nK+7^`#`N#MI*=(R zZwL`1?tmV#E^6jD@EHd%(l+IhY%Dk2^OK&HmMkEFZA4DF862#8kBC?vfA?_;F4*D* z{iwl31ij}$)XR$r;K)k#ax{7spQBhp zb~3@2Rf!&pmct5}Hgh??BuIr;PzZKxKZ>LPXl1*)XG~(;p}G2*vQ=piQU0$d6mRpB zZ_#xJyJsfR5f&PUwF$Oi>6(*jP`cdfhFyJLryjtzU?>#RW6q zKWW%W^xIaLji5gL71At!5ST~NWi*Rh%O`c~m6@cT2|hqD7bFTvyH-z!VCxw zyko-3rV1s=Q-K{@Fz+c9XJi){eE-XKQZyQ*Sdl7Po0F$f5V(bBv|#TPwDhY5JyDx= z=4X{+!B2Su9u+6U^h&)Rsn|mxeUp5PaKi&)@C=X+p`H3BRFx6kIeqAzj}Mc+sS znW2eoEW|~WFqmXHQv&4I1-?fKmN|&NUl>MQdE5SPjoMl9l}n^l@9XLpqM3j8^jaB- z%7j}fAa#cEzkV@L8~%V5tCDf{6x}j+^=imKt#LuMduG7|0h&{~a2&5Nm`*;+jV7%n zB({ph?5fs-XX6|#L9xgMdPsGY18m_lSxQpwaos~=!elG6$Jg@O$xeH295_Z9+~BDB zyG~9G2*R|1EbCXDgfH7wudiU9V1Y~{#2#99-tlsPpZC2dZyB}Mpj)|_WhpI+G3uM~ zVzHMxf#4TxRrSl!ccG>lbj8jZXc^+N)yZp=QzKQIauPP?QG+B^YT`V-CU3P4d1tkg zGUW!8C1Fim^ZZ6pS>+`z=e+%WGt^Vcw3nga1haHVIy>7Bn{iT{HW-5UPc&~xcrR7v zjsty#Uw(p(md?z;#O(<=@^ZACa7OCg_VyRLB1!_0bueY;1dq7!O;4u?B@|CX0b$JFjzqunt6Yw_s-b5qr zSc~AdvRuNqmP)qx{K&9UsP5h&fzRG-;qCMETHC#-gm%*@#xE2j-}ACYT;xQb7bL5O z)Q)Ob-un2f;&<5_Svf@no>kZ~E&Pqy4Xrdmx=V-c@dM-$xnXPq0C7m)o_u$sxkXLl zcvJ^NzG-Y*Zax38A-yt5^|hOYF~=lILbwIPdr{i?U0Z&jJqq1BzhxeRgUt(d$cGb; zFRBXd*HK0B-LNC`Kpv6{V{f5g+30A$xx2%UADP~%{NpU4uYFH;pJCklKG1MhJ zc_@xyQhifuHw3)TUwgEtujO=jBlA;ibIiqj5Llyy;Ry+DC z&wl;yV>I&K>o9FX4|h%~iD@-Gb?M5AL$7xUUz*6i$3@dzEkmtA+akun@J42l2XgL@ zc)P3&r$tWThH&P_P%5~l;b3@adH-h9xaUVwQT13}oG;;i$TvfYWXM3iq|%l)h~%`w z>#`|EDaqa?iT?7mGtYKUU>3ekK+0xagO%UAh)sw?-9EM^vsVbRHF}na9V@ecc?@ zA7Q(ckNG*9&u%1^yxKHo_$>rSI%%IcbR^IB6{H(PNY?Uxv1cyJ1?gqoNgbcfLU`jJ zdla)JQ$cAXDOMQV>96i3vgdZy#^3DTZ9Vg{?#+X#-f>S@rVzjcg4fy1qoY|oiE*U{ zW0=RWB4w0Vtp83{6X%h<^QXn(ef?;Qeulq8s%L}#O!OF|wgQ8V9SnmT!){#(|7z9r z-9mmhwfq!gvgV7*$1;?ZwC{7r=fANGbf2=}W*%r(I(dCfGfAi`DI?UE+Dm=O*!q25 z^n!)VvoYy$Cbn`i%~<3JD86m3b1lad##a zUVP(oW@+ecey6!G`BQ^S;a~pHV`|#+4W`tdZC=2ecV{+7s(99G`k{gLR+si)pYL_` z--7)(=2GE*Zhl$r$yeu6(Mq(=NGj4o_H5PPy>*yj*gp1~OBrG7 zB9(jr97ZEN%w?e=s*#g@3(bw$0~SgL_Gyqj#r*|P6&p5nJ5_O1ar?x5=*=5i4sp>e zZzd_**jRG|}vJEGXA z5C*PmBn(vyumC~C&%WfGaEG4nnd zJgJ|H-8jbhxNKy6Wq#i?OY0sHBR!%rrHHY58!@Yyc}7D}?@*a$hm)a>9D44x#~fjn z6zFO2>RS$}lgfKkyKr9}^z7|~F9LZy1UZ`&H5e!#Z@(3La(*W>IrJZWO(xM;pM6i`f*L}%@2Dme1DFp>>_ec??M5id4ebG6lZ;{ z9de}hsm~09{6L5omHn%Lb%~_-&EMXpp*xc9&myP1$`jAwS&z>$q|_4Wd@0w#MlBKv zoRuE&B%tX60|N^W^wJ(aYbNrGIU5i3PfyD7<4yNoT$?VcnRHcy@?2 z48DBRJJu?-acRj`4dm+*lj4jmsl>a*0}lJ&@AM^No^w=U+XDk5MdEa7dx-4=Z^*vf zr5k2hoaj5!(hcXqjqlW8^rfA|)nRer-XIJS;HxOA9XlmF(d@D&)*syffj@Y{bt?8h+0#47Lm%|tGFHtFCC z*fMAzQuK5KK*4-V5}4edytm zGS^@0refY=&&sZd=eA~A>?nKGfgJZ(mJftfDW#seaH)u5!qI@gTR(9=bZr|kN~^j! zvk9`SX?KM|UxREfx4}ggvP9DneG1039xbUgn(@%VLfvB2jAb1 zmr&?TH7EtY?6Td204tf>S_nAXcHC>ubHL6!zKPk%6FpR}gOQOUr9uq!uCkw}V}b50 zPKCyB4;<@v8?IFw1WWBg%*P#ar} zsU0!xl#$T8SukUguL(Y;fgafQ^6f|3+s&5eH|k45-k4$r3-mq~A&J|c;rYLJYp&k+ zh*Dx&Uf_)zfLOGBsgsfL1IaRGXIhAXzrXtu)rjfxa?j#hrXnNU(1WB97_SCB;;%=x zWr;ZjPqbaBa4dAi1dhq;o{-+g7a92#vfHE~4?sitPYY(K0yy}uNLm#zi}+s=NF8weUlBk9 zp#J}f^fUn?=>Ng`5{$~hFkqRQ0Dh|f+{V7OSI$I5KtQ5FK)`A8n4%o(0Uk`7J!lZKRx{)5HSFO_WxEwyx4*HY5}S68V z$;t7b^Z#S?QBOnSdkG=}0t+$%0?z+<_**Rif}azoud9cng{!M0ho7_4|7%=s;=xh> tY7~!zfI#{`jQ6$wYi#NP8`K8S{C6}bucJYl(Sf1q0O(O^^Z>8={|kLQrwaf8 delta 255641 zcmY)V1yEdT(=`kSNN`CY5D4xL!QI_$a0|iRU3Lf%g1fuJ;2zxFWzb+jgS*Q&=REJ7 z^Z!-5YO1DYs(Pp+HW~kOi;XO$b0S^xh79Z9o5^Z02onZwrjOyDx5r0V~3)vyc zu=V&C=g%%XTV3wXR=D3?X!`Xm#D}~u9(fa$c#mSNVI1{kx&q-M`yopGVzYq_OQ0>; z%EBul*g+ZwBagbOkcn|!$CpXLe%H)x_92VdBu4$(T$56Pv?wfV7668hyv6p0xLVrc z>uQ5b-+AozWvB=Itol#A2?5SH2X{Tc-9`bc5##x_|33h0uVDt^G3cQX9`$Ftwn5-t zv76u~IZD6AO(M~J{RTK}1LBsYV<~UdtF8v}T@p#(b@*qFua2n7(xJ)G#T08S+MfK< zdWC56MI4jo6)o*@|8=dQ$14&TRswW?&_wy-Qn)Ma-Fl?(E05D39>-_9l@fPNUT?ox z`{-73Lb8U_vWOa%2ZY*uv?(#ZjFo=q%Uh6UpdaQ~8x|UQNRj{&w?lr?$FAtuG%%Mh zj(Tf{Vz2G=6?zR4mu6Yn8~dn76|9$7b$h9|=v??*%oskG`8{ZTl!*z&@L{y`3tj)9 zCfaA$GR!6V4Pw`}vpqBMMct?EZs@V($tYz_$OeMJ{Bpi4<;P4`{dADW9u2hH@V{(N zSTZqZ$Ch)-#;gF3F4oVqtc3F_lKa_8O}9F(&$b|pzWGMe%x5|!=1TkPxaw_33JtQw zP*BFni9~fIW_#=rnpuXBP^U!YK5@?cX6`L2(^|p0WTqI8e}lta7W3}}t)V=7Ur(7A zmB#UxKa*ZnhtDmxTlkRrb6#VE5Y4{*DE<|}!MJCWd@^9O1#*3=`}4(C+viDwop7fO zan>^Si+afmNBdlG+WC!%rfrz3F-At4@3(_GKi0WB$)}o~wIzd-rSHY%iwimt<*qi? z+RQe~sf&f%v5JTNAu-llpT}lYP_L?WzQfHle=O+Q^wU{b~`h(^{^Vd*FfVVGr$y9 zDTy>U&GWcPcpK9Y`AGUOLfyU;vfuG!^K@r=og@U5=(9^b%lYOXW{k&l5D?y}-mhhe zbE4kPr?zolE@#Fs!~fE8g)`aQp16Y-{5I7P@4%$n{xpJbU<)vNo-amcX>DGgw5Z}% z5{U!no(Y=ELLI+`oxA-X%-X?EU8ST?w)=Lk*U{k&j62id9U}c3(bkFJIzD%{?9i^_6K4E@6_iqqquzq|XI?)YiIje($t=yxkXY(nSg_g3sl^qL`gM~8?X5cc>iH**aE_+e{9%&$Yt4~TetE_`0$`$MsH<9>Cbae@h4 zyJT$a^NP7|J=WQ_jh|j;Y>;O7Kl%kfK7YJ>iU@XrKY!>T@!J_Z>40?T?y#J`gTn!E zt9rjm!(DpK*tZiOhgCB-Hg&*QMU&dXZ5xOH6lFvGI|;L z>1p#i;w-sRqjeUyqi~#lnAz!vuBH6i+d{dR_trdR@(>5D&2`2VW0@2ovbm0E#uu_- zpND)FU#S$kJGY{iEg&Zo!?mlq$XF53YG*bHjJ2;3HGZHsqKC`yiL*cEC_KTRdCTIf zdp>|*T#Z#wktL`+2l%=du{@M>)|&5S$e8dKvOG%Tw$s(wuYTht9_6(-OpMoW_nZAF z8MwjR=$l6*^hV)wqYW3)J|H!@iq8O{uH#&R&c5YLC^X_z;%_;o_I(e__{uDRQsgW1 zpJ|UQYEu>L#W|0*#l&A8?&gn7oIbUXHq1)Io3-u3NQdj?Jeq?c4#I?Y{riu+MC6Ch zI!JI{KkZ&LI1JF}=X`oja%M6^_4x*ABq(2^13hgIIq6l@Uwy=Q4EyvmrtCHIHt9_Z z_8QK19BD>x3$ocH-Q5Lnc&_>i0A^R+OKr#ZXVjTpE*GucxhC`MLZmNNbOyqb`+~n% zze+P}l6I~8QEy@Z*T55W^|6RrrT+mQG0Go9VExkOnSo{H6QcHST_WeQUh^}C`jqY7 z_M;X@i!ph^42WI%q6{bi1_f2?i*P=SSJ}HrqlnXQWh}$!Mye_-dCdYNk+epw+Oec7;ZL=wNJOY7I38E&-L3*IeYiMTKuUDI)?EGZj*Tb z;qzE>u(^ZC566EV?$I}y0w`khQQDtV(s|shYPjXacFbkW;MwS}2@MC{koLd9t?K+r z2`~OJd*IEdH2F9f0#_DJ0C(4hmr(h+BMO7Yz9&#vJ1<-q?-`jK(~mh-c|-H3F-D)_ z_YbFSCsRG%>oES|l&jZDv%Zias=YN=tT2<3BtqMvR*}NCGnW!&|}JyL*Ig zcClq6MciSoRcu-m@g27Dpo4o6PAr*1?@j!UR81lY9GV*O80p|kz|h-y*4p0Syqn2KciO}!bDv>b8$ZS8tujT|P|)Z@|qi#`1ioR;wp8fy%KeEdJp zs1cFFOedy6Dht4TA(xEOEUxG~;-clV?`Q85Lz3=HJ{0z0-BH-MAG6Hav)O$J$n zVP{?$UK|CS(cN?3?(6QADzU>qJnO2hd6!XMz^B}<>h1yF_BkhQ9FMEcBQoYCRoeT# zq|Vdw{m+)EHQeJKW;$;DS9ve}mB(!Z(QiT-R4ArNpKex(u2z?md`_fz_%_?9AAt#P zrKavx?`}o?{(Ar9j+{~Q>J&3Ct=SISUI;*SY)j_OvT(aZFshdoT{!VIQ-61MN z-!c}c4Z!XG@?NQZUS+$$e-L_pF$w0h5aQnh*c{EQ%E6 zy>_m2zSwxRJjWg0_Aa7FA%oKI5hy)`qidTyc%bfpt>9gm2{_NMNZ{=6;pJtMsAqaGJJ z{mrLl=<~0Mx4-%J!cMZ8+u0s}d;6#LMuwkyVp5HUj70|(?$&;)li&@r9bvg*ZVza` z#jO#Jp$rx0&42mbl4sy^6U+QeV{YDh8~8HCEVzN-d-ms|2jS%=HsEK+Gsyv2Bo`1* zuEiz)Ch*JwDPf;3lcLW~t>eb}Sxf2S!?wWM7N9xmK#737?382!`6Z%4Ou}hety7ZF z6|5KEDo>OdUWws({+YtZnEwaFm{11fz+3Sp{Aat!Qc#cIh_{QV9u}vcLy;5GT&!n+ z{1)bi?SCHkWI1_y8B^4l>Pf6b0F{g&ZiqB!jA427tBjrN}LY!F|h~A}J%i zCzbdt5v{kB7!uW1jP>m6IqbshM<4EHEj&BZhT*i-{*4CycmRPv9--BUs7iFCPGQ1y zar7d2lM)?eR9^B!;vb3-JTo`mne(r~=dZpqD4T?k#i0MW_$m~N@F;iQ2?h4_)ds+h z@zxLC^Q&FYx;U)m_-4YV-=cmyCw7oa|FeDnq?_DG20P&3g$ek>5 zijp``pK{pj8G!joPCKkhp}VOPZ#_xotI{57mRZxr7LAr0MdK4M`{UpvZuYI(&}-|_ zRuQV$kf?tjA$cmKEYt3kl+ij5x*_p%=}zA+*a_sL&I^xZPaW1X71sX{WW}R2XJ;-k zC)hniWzBI7+#C!%4M0~$Y_a%o;yMMWvvII=(#PXQ131F)Z^d0I4i$Yo@Aw$hF2~_7 zNqZvoVFOiUc>S+N6snD)Oi2NCHT>x57CH|wgyu?jW)mqlV`0!3Z1T=_=oi0K-9j@Y z`Zb;IA$cnH2n7lowL{7_0*T=dTO9br9v?2WO%g@p`KWpdf8-A;CjMk{??V6==`0G# zk`H5Y!yg8C_yQ;_7T39BNglH)SR@-fY#D%d-vZM&-H&-b&Y|o|CS|84r~0Y(>hUC- zh(@Q#nA+DH;#l-PzBJ(o23@EK48{#=ADaF4UQ_5q3I~OQN)f(idGJ9UtDW;iz-(Vr^x&Ko>s3&Rk^IT>0 zH@VGcEWe!tr`NLj6*R$rzMTh8y)g||RGp-@ndd^UbpPe1DR4ys7dSpFrCRBO3!BL2 zQVG0-ugqszpI|z~XWJTykF%?TeuK8_vg3m|QwZ@3|tK-TGUUhECgWRIx{nP zYi0%>3#d}&pa}h6NMH@naOAtnaBOj#o4-ZacxeeS&ZUU0AvYr$9N8P?pVhy1?Bg<5 zV$mw*jp@6WW6z>k|^yNV_NGJ=+68DCe>_lVo1~xM+-7z zqYx%5=sz+4=1j}a@!ZqR`P@$FwQLq&r!Re((d0qWs&2g?IMYaZj?=h}*Xf_TQF|XW z8wbcS8EvzdWX}b&YtbzdNMd=EZ3|o@8>U6;6L7%gb%=m1<%jlzo-GrLp|kH;TIp{b zF zd|uAqCpDo?rd?QS2b}WPQOGX-u0; z4G{x(V04OGMW-$T_`9J;$Y z#GxW%K9Te{RB?4CYy%vOI3|$;-6`hZ_{o96I*E9{TIC_?zuvru6_m@aPL1N+-v3{$-BLL{%FQa zKd9k* zOs}S%Zea|K5IRK^bw{1z&>1pNx{Q@qLzNiM`tb&}p0t8TB z2-*Mg@#QDkK1+SoJ{g`gVGMEsE13<{aw^j>1PV|i^+WQ$EO;-vF#!d zswcVX{la-8kQ7|VEN|O{gpv^QS6T$8!ec{pfTZ{k)p4q~W71JNxjbU1vWxA^oK4|z z2$&;-iS`Y@+qZOc($saZZwPI7H$&}>ijWc!xj#d~JySVb_g=I|#L}i>Rfbv`VtdH3 zYv?mPX{D6mnJGmI96q|z&(+iZ+K9Jr@+q>;n(z0m5Y4jtE?0oOA!2ayy|f_XcQ&JL z5AckiA?l%iBQI0EWRFS;(DmUQ>sL=9t1^P3WmiA)3#QUZOW?CLj=#&-DJFr4zA3>W zmF9@E!9k!ke`Zij+019d;pI0L`S@KX@ipm(B?eCv?EL@U(KZ4zA1Yh<&{v$CgTCTY z?pB^yorLR1>9&Cb@=WzS;OkkOI3UeYZj$%uQl~H3rL}RppF0;f7%wnLUFDFRKcV{w8p$O zUR%q-`=+b?tq(ke4ef^Z+7SNF_g|6KyRKtq%oY_%SVvs7zT9;J@`>Speka%Vy8F(! ziV+2SnTe`b{gvGb`8-h79Hn|yd@a%_`*dDn3gWVe*~b}1;xP40ezZ60`Bn{7oRt_AA=QWPVc)vL&8EJhOclSo?~iUZgv{Q%1{TfGF(g zGfuA&)h}@&&phnbx&|`lH!EY1ARJHkL$Aq2c3-tE}HrwCPnZqWoC zzi*!l%SBfgN3ykdzV*4)=NI6bLwZ;3x!VA14D(jVZbJS3ZvH*(ipIx$*wfGa4y)C&R!J^YZQ+B@r1 z3>r~2(v2-0eQTBddi2r^@Y^pebO_|sUzCJ&|L1r0yxHz+N=P@>Tb2WIN*Mg1!o#!HL|I0Ab<;epv?ck&Q*j57FipcAVI>2 zowH=Lj|pFF0rtVQ9sMOJB`A;gVvI9q0|MJ%sRE`mXTM15^>^U4hY8jiwQ&1kYUO9@ zrbo|%Cegd0zX|`VaRltLU>ieKusly%rwCNzcz%?n@OFwA_YOkU7!_D9o81HB5EBo* z&Z$z>)hq!Y(A9@sYPXp*yx>Qc8{jq?hVpZKwl8YVfAC*|XCLGQixlca0q7HjbkR_a zJ92(M7=Pw*{%*}gn(mJje5Pl&&eM)RFzY+1h5>eMKq{}bL=r-QOEb+BFpeZIp_W#Q z3JSq*3E9@xC}gCz%+oP{ubn-JDM3a!U6iS!WBw4UV?Mn2dLQqPikyIXaSE+&x))-P zz}2sL6m{ji5`&R%R`N}c05yXKUL!4P)z*N<;M!L9p~Iyg?2nbzYS>l?w&_Kgnw}dm zo4OK2qs#~ext;EfQr73TXU9IQ9R0VoDtBzI`fw~$AQ<+gXdt#5#3_Z)aG@V)l_h_ zBve%=Q~+tU{>`2eaX+MnZ;-}%1;|%?EhX6 z`cl6u#*|r)Lpdh65~hwF?D$*S+FHVZOtH@taAbH<`dk;Q-(hFLX|LmRYewf=151v) z*R!=KT8VgNmpLy`>6}Zo7`|_Y0ZB#bSbMAn0cpRsIT(F&knQ(l5%#RX{rLZqds6`q zxB<;N;-n^4E6X%0NH^;yyn`cr<=mZu+8l^oMd5(C94QbDV}XZ~-~z=S_~gUy@9B{hpd;8CMUY~erR9vuW4Z#ZAml^YaK$TXXRLA*Lu|> zSug>TgHJXFU*i31z`ZGoa?b{E^|;glcIAi!sUwL&7*_p z#A1c^gXfEhR|V=%Ys?aQrv1`Nr&3Doto@7VL{+gLvJHx8URo0El)Km=3oy+obSeM3 zJ4Rlue~mfiI1Ximr*a{w_17_Q8(Qv31~=Bj9-HZHi)EdHkqVDUN0Sq`;tKoZ#3hCNx zU^%7bP77zvBuPXvnV*rNLWI*sy98#23)i5;(vriPF<9XS`1F;&uX!QV?BSbEp5{rJ zi&hPmWf8nG`kNnIK9CIdSmU)`ok?kHEgL0`tSRO$-}?q|j5B?gy(@Pc-G9wUOU2EuaA z#aj6P6!gHqQ!tBhJjyvYCfd2ebYG#dh^yi}o?*8iJ2bkYnljf`=AIobRGI>|m{W^8 zXlDH!6drng@^TzcoGvBbtq2u4#z9S-Pyuj`)JtO}5{i_2bGc)5Imblxi8Ai}%{>jc ztxV194|x$|?MliK3iIb2G`OF=F4{H^RJCQD07u5C%(Q&k+DUee?SBH6q*7zM8(U)w z6)>+Hx(7G$;pU-OzTqyCfwv7=flZE zzqJR0o$~Nhafv^o>@7%|yeoIxH`zi1R&DBfmSYXmTxB1NzyNW2u$y z9ZG-*0rWJDxWyE@LrGm$_wjdbYW?K0MF~!Ijo4t^Yq_%svB_SrxQ$232j&}N;mktU zy*e3fflu@2cyvd{&% zPT8d+J=G-zo;0A-92D{;c4BgBnvFX)7x?< z^Ih4BX^UF@S9LoYn5>hOSOS9Mf2lNuw{~P+Qz3GEsWq5QXAttC|KNi?S|Mi{o8R&X z($eo&&Sxe*zgr+~Yxizh@~)+w$e23U)&b0@j7>RKj$nWq0k*Eh$`RV4?-JB=o629{ z_cqHHAk@RPn~6GBy~+>R?;#W=&g3l_QkyrTio)6nG#mUfa*>j;7@4qCjkSNZfeyxy z`YVHE_yrj5OeGja(CUM=n_R)f{6{aXEoC&w?eMP6-5`=DCGx& zINA~`Q6YI(kBF?#VvuzZ8^WF`n1}!>COlFYtIYz8MqAl*w!zAlMaQGqj+ksh;R-ui z?LFNlREq=WaU?jukVKCRxY5DW|A_}IZo#x0Q^|B;I^%NDb)zCB^O3g__kHKQEyp8c zN3d1#Qql`*3a4312Ml0Ob8^y<4fAck)cVe?@QQP}zM=Z!`USPc*pETPne3sUsRHqQ z+@r)W*tExZ<~`$Q7n|~DQ=B-TT?+xwaG>Bxq|2vEsw~fQuJ{1Xle+h< zbf1AEYI5DPV?i~A>s~P?skct)&!D8$g+Wr89F1un(9S|azpT$Y`YpD|{pgY%G@t&W z{phLw(F|u7Xcgg(a>wgT#;`0StA3$J@B1-Gj3#0^TFzF0rn=@{Y4af9D?Va~FBexo zBnOZQzQ5EDGIPDkk`%a`4)Ipk=h>9>BLp+P@9?4Ouz*}x(|o($hl$7Hs*0rT5tbeX zs*jgf?6!Ee7HU<4kJ|!%StmH(ZLRRLd1#*(0lFb$PuClZt4Ge8SsKegJ4?FP3Krjv z-^0ZBJG~i0;^JqkS_{0b78Yt0I2^OgF~BU+UfXhCq&Y3oQN@(=ZxhUROk>*MEMv;K zZNtB*nrjv7IH7Es<^2yrV)X;E*VcMIeA_yMerh=yZM_(Bx2&jg&O9Emj|}ZyRkDN? z#ab&Aj7Pcmmf#4uIzDxw2u`!(^t`OX@ByaTuqUdqve+Jo;LASk2LM}zFYrh6n4)p? zOBVsPn>GPFx>{dNjz&Y4j*gRv#Q%@tGv$fTj#ElN75{8Y^iP(I6OWj%09bAbGm_kS zo+b;SeUUml<834=v-qNoy@ACyp@njnn_I1T-CN$uu(7Tr@TYG+=JKL z$xWD&p!wGxRLsYB^;2!1$%jTvlI$z7N3d&POiP8nBA5v2O-K2v*m6VI;PklE@gx5Q z8m%ZCAeqm>JQd6x5e(s(9W#rb?k6A$W^l0W0=eqa*x_^E(>j4*BgugOO%U|BWMPl> zRACi)@F!g3z0$Ut*|yepGau2mvkU4JrpPO03o>bV++`*7bf`pJ=RpDR$tK|AkN?Vq z`${upG!si__eH_{XSlhVS>=y*3pPi*`~?=NpGYWUDLtSV{o?Ahh5IW2bn{n-y?*UP z0@J=NNwdCc^hZMaUSLeh{t~gaYFdC2h=zZ zwefy6q=HeZk}XurnNjAvo~QOGFR&!KmAIM*#%6S*KI@Ym1adoe@*J#Rz&Y_)h@ zqUfZDd)fI1dk3-#@69o<=p-a`V|1QTtP(%H`Hp6y9C@b2BSm#L0Ls3WU78l%#*d;R z5_7)d}Lkqp{SUDZ}3z3&Z1$5Wu75!R@2S5Iu0V0{k4=%Ok52iYCW-8NI zvdhqzTa-$<%JAK-Sj+Hzc$V#7*D1u))=LvBUIiDqLAAWy%o zsIHNx@Q=NvP<#DE>L-|TeC;lD@EA6F2slr}D3ifDC=%9$friRQY=5QXVua?X)?4O? z4Jsua%AuyQhU3xv|0gB$X@HexsGE6zLLrm!81{)@@IC3L<_&9(-CFa6%s${Sl(CYL z#A|3iieJTlH14d^NNoXa5|TtA2{DlaoI|5tg2lK?I?+jX(eMB$NNGpC-_7uvBaA&M;Plv&tKx_2}w76%feNuPTAA z%&(GZlkq}0{9fI)IkC7T1lYI>9iXRaqgi~dG4OdQFv-=z$xw4jaCG%>#)Nn~!c$qS zAdYh|j6L_x5TM_b8&6wIxj(-O3_xxzK^G24EP=JJqjkO^@aHmpBrFi2XhG3H#v_@l zKf<-y)3sa3xvg}Y8j%RvVxpwDfrYuM#*>atHeO;uVbgp@Qn$!Kv|ZmfcUC6l`Rjq1 zB^uHuZy8b^s0Ye3=qacPQKvpq)>Yh85(8{p{HiMB5%HQBj$I>{I%9*q5@&ZG=}^n> z;59Z|jH~YtJ0<`4H(NqL$I8}&QN%C8nE z78x9Cp{X9%8>VWZ#Vj*37&<3Qlpsj?&lvy7A3U5l+I#2GDea$X&77?npR&PL?}5KP zbCwDi>H+XS9=PYxR9E1|&CNRDxf6cNp`*JJixQp)imxLYhWH-js#@;H)8xow%l^wn z!~)vQ>cDA}irRgZ;@!p-Zxu|W*tFldqLxW-WgB@3;8B*8qsc#uybYF5h_L01fSkXf zi~m~=0KV_|wX2zb_2%Ak_;$b&Ssx^Hgn9o* zL$~KMB%P-=Wr$meztC!o6Mw+!4jH19H%R-xBWA;hX(g!GC_%;M0@8GEIod6CofV6)%qm07&z0(Y?Y2jg=L}yKhB(eUiuLLt!th)NHs~Ap47J z73*e(PY2GPpKF6ct2eA289OANGICajI&>TD(<&p`1!xFel)4eXIpzJqUCjc{^7j4R zvkEC-`sG8h(gJo6)nAFekLQ%7Ix95IbFJvxxK``xx<{{_aBkiPBzHt>(7zF`x{EY=hamOYHy8v{M$y?Wp&7b;~yei|G3QrSbdC__L_;mPvznDh&$ur9?hC zI5j`{Z`?SeL$FCfZ1W~WTyR8MiL`o83jhwp;%|N+s`kobUs|Q)ScXqda4N2f6 zq|m4l$}Nc0q^*4_g!`p+qOqLLv0US7d8x>*#`$Tr{3MCJ_`GA}^A~lBBfB_Z`uf0@ zIgM|^HQLd!g-#A&MH1s&0lsgueBWgnskpd3X|jppDVT=*c*31;Ktp8CaT3o~ z*tR0Nz7{{DM|H@1smlD-hDN%3f+lJ|Ql&J_)>w)XWUZkKA=(`Q>Bg;%8lwZBnd46h z;EI^}dlM7W>hDXaHAoL~{0uU}4{B9`DgO8L8om_=sP=Ez5gK{}0EsJGOIjo~-RNnW|v`FhptIY6<&Lim&p>x*lRel)oaSxNQ0zsj-&C#BHxg zxv9&f8sB>q+icyl@JLrLjeRf2%HwZyNqwYZ<#7^gILQj!AHGmtWR^>*ZRjn z`3x%pIq?pmpnte(hj$XFLv4Ji z`?=#oR3G?fWk<&fGK>yuj?V4vf+X`&gf`8CSeGqh&f7Wr;V-pq^ukf3_~+LcfUUIj z?N7KX@iVP?-^Jn>R{>LqjpMw5zP&D-md7hE6_x0ZKVGJ`rg0(0XWCAnS~#zPo$~P9 z_H#QVT!;^O!VzGE`=V5>_U=m?U)5g9YQ3#Ak@&eMW$=t^#?-m8SKYCA`P``3n{&__ z>f04i2tPENxkrkxicy{u(Z$>Vh#{><%PCk|c(p-j`1ZpuNZjtp%z6_et=gaamTU(E zKx9#WyIcx(S+Wy-RWc=>G)Ykq3N0qD7-Q6;+n0~s4+A>#uOA&r;;1bC*hQ&M?DzFu z8+Bk2j%-OwcTdFT`uG^oYjs?a{;6lp#NIEvk5K0aEi2ahtOHkBU|T7Cwwv*(2DN_U z4=nrouq|nm)z^uC$O%9^C+~(md61ER+K(+Tuwm^W&KNsdO(dsyk)1Mb=!mv_Ue6i! z{Er4nD#M;9vBRFji|kH0I?^#Ccw}C~*T)q<>R84QWB9o`y*e`D@)O;Ojjj=LZ(1wl z8!dqv6Ak*!O{PR8euD0q_jJ6Fho>*PJf!~cbXG+l`8(OwOppHMW{unMEnmuxGI7`t zTVg9TruCdQazfprl<0K_LYC38)c0KRK7NPhu1+OYr@dG{y-$t>(;kd=}J>6=q=!I zOvO10-1aDg4roN92mDN5OY(tk!DiFNBVg;{M{C$O-{jemtz;17uL52`-EkAMSmH{!@@*#!3wO599h4OhP=cC(yz^AKx zbUTUt=mrJ8o3wsCAkg`Haz;)04Mvfc`9g@F;ZLqlAv1?z3p?-)HfpvNprMgmznd(P z*RzK}0d&)Q3+0E?{Dn0KkJ^c_-`eQTE6XE}suRI(+6F#PDUAdeIV)cwTLFayO|?w% z4$bsntHTm>3C`}zLfONq#L+fqitG5Z8~X878Y?a9ot%5GsL6R0o=*Xecme)+&Rdh= zL7A2{6pjH4+ln^LOHW+_Aj7|$2JZDZWeuUEHiVM8-!yQ>(9Mw%?;DR6V@5_!eUXh3 zh9P6XJ2yfF(H33%HZj*q8mvHZOZ50YP382Yp#zhB-W!eO273SLYy6jEOXWZ9sRQa3SVAY-hCHHu3ZM%^-sTxeS^A?(Ld&XEV$o1Ck8ox zwTBDg<Eb**_TYEq?ponx3|0{M*%*eBf=S6K6yM%?9g`?5@n_P}sdosVRQ9{1_|5 z{?nz+2m)b$jNy7P+NBzL>RBpX#j*mAKeJ96^OrcBZFSRMC+F{-p6VIC()E-iqQ4ea ztKaxHSeH)c%D*EhuecFUiBl&c{tQ=2KDsX?U~3|UJ3?3coxy-O(>s5Rx|`Ds{5PW9 zgaP91mOJw8(wsO$5NL`hFqF~1_shqZhbr48y(0`#&fIc;E?FoMt@{Lu6$2mnrT+Y2 z-&yZQj`o9$sM*&6mlbj$pip3Is<%sS-4o;o*CH;$L738TRumcorRkG%?_l||TB1da zTH+pg5w(2a=AtD5P|J-Zyld{*FOgm~`8zVhi7jChmr(AuSQ+Fc7XtzLjJ^?#BUcNB)v!xNU*11P*eb;ICi_7NY=l#N3 zXX%SLe!Hij5c{b8oL?_<)wX`>-Wn@)!L7y4-wrwi=eV9OCZZ^wh=+ zSyecMXU+vN7VR30zw72>18&-&*PO>8~h!D&F_?zVUQ<(mpY3z=!uF&??y9 zC7VZG%jY5gJ+;;O+t--oyQ@KLw zR{u7m^1Ttd1%r z8&e@|vTam1D~cg6(_4&q-xpW?JD~q}KHp>)Uj^k_6#yk$!~xW)^Y75V&&bgn6fP7c z?jg=}93w<&4WBqkFO%PM!&Fa>h-}!9n z>;GrrDRdr2T?4T$Jp}Pj{(5`IwD$)-!RsM#cKM8v9<4l@(u_f@l;TS3vl(>%17$xS z1>oCSqID!r@cIwmmGD@vhopEfD85r@>N;up_%$vM>+#&CtGe0b)V+x2R=KS!)krwM zL9;IJk<=A9{N2#TCd+d4iTA<6aLemMUx#0@YI*I9n@v=v3G7;_beT0qZciyQ>!az3 zlM7m)kmMVFj(@WRU!1U-24r}fjpy?*j^zAy0#n0l*@1ulGbk34(pznYpf(}-Hu??v z)@AH=W_v#s;K{l7ca9m2m0njzq`au1o6TDrh#EcZXiJA?e5?S!2zsOAWAD(i<{qVV zYRx(PT0GNo^PrKt?32F@!Tu2#)UeAkaK(tTa29SFxyw_X@;$N#sP_r8TKRkMpJgv) zx$-1uwL)t?bDK!Vs(8+*t>%|(Pg~#m_-kb2d!jzlOq+$=(2PHl|8e|nYplJ5_RGuy z82QZv!I0(sB$|4X8X7K1eaXHPROw#`T$`f6Bfg?y&x990z%AE?6H^Zw{z+>==r7>3PAo>R0`Om;+$&#HX zIq(kDz~V4Eb4Aq;+EISV%``{+oG?-gPxU2ClZP-idMk4^Kd9CukFcAW8mRq$tG8hp zrnSNqu6$P3{oE%NbZBxy21^HkV*x_jVJO-|P_&itNoik#`>j{hV|KoG$%>n6Z?9c8 zj5)~&`H@F7kICS(R*Sz;`!dmiOE*Y2eVGhx^V&Pd{`bWZO1)kOPcA7t&N7m#6IJCvhH?!+0Wof`<-M2Dv zY|b$*!@$S!wNlI*S!oT>m|_tf1|kl@y((5QT5@I1oIc-M1QvjWJt=tqsDujRb)eeS zHB|JUdAz)bZ^N5fy%a=dxkTPr-#77tT-K!6VN&s_8thTvc{PhKY^tM2JkSCw+NHS% z_3CE>LXUy}koA%bIewB0J^lyT;OWnsvtnARF?f{0Ma98Y_A|xU8He+N-mS4)rZpou zs;q~Yb402($^2$3>+{#NqQcjg zN{gF2&Z@99o4_lsyb=W8tvcHjZ1_TK-O+0snvyt?ZZljqF4Sckm$tw+3V?v{-;*9Y zq6DvXL)NRWP$#98%)+IoA<5A(P>f2MrmHDNe(4cw3KOe;ws@Xz%dGNlP7>HS6KrEk z%(&-JqGSZWTiN*N?Rs$aE3A-OIfGpK9{pSkXueBG|tD$lp}mwtveoS*HOdR_T+6EXJ8fP0^0GAQatJ^H_O)}?Hk zGljMF8p$Lsb!YHYY#wx=TCgJjEvS6)zNr91G+mT&Dm3PC?Wpl;k0Zj`UwCTb^=~4& zxYEhmKCcC?NHU^_#25ICTp6`KzAnooIsIPT0m2l!bs%U*9zN3%Tl zhk0*%q*)O#YpUMVVz>|=B*^q+;2aC5%sJr8 z`7kcIQ@3O^4#BeDRQ;Mb-v^nzt8K5b81X9X+fI^-e1EsdBems3wsR`JC z(GaO5aJ->WET=AL$rn^S0)A?mT)ln#6cR)HIpd@fY8&2F;~ z%EX>>Aw0)1D&yubM6ey^=cYC+axFFL8`(Y}pt5?8m)To}php}>R4%zPg7IriLlDQI zB`e2TTj7t(g+!)chg}v{FJ>kow_@g>H55c)=FU6YI1cmU2I=YhF~EN*N8ZQV=cLAd z9UP?rK_>!bJvF~j5cDEHY}(H~F4sO8Mtl}|NFX`(-a!`>O810w(n$;BTL57^1=>)J5s+M`J$IjtLsacupW;2pO^&PEV!JIXu}{rPsqo zGdrb?CKm?odJpJ2>$deiR(!C`+Px}^+*wv;>?soZR&vJ)m6a}@J5J~@C+ivUhfnGY z+fz=)^H&8?4<_>X(&ZON4x?c>MPYd#W%qt30z-<-f$XJL6Ax>6?F=NW!g(By*+gIT zNqOqOjgt8-=gg4r28PNbrCJ8mIGRjA*0r0~@7FWtLOQppqAI`9T4ntbJ*!7@mq#?0 ze2D2?|0nbQbe zh>-P1W=esTfYL_{g#2DnERa${ERaV=%y>FOc(^&%2Npkm2jYh>QV?h1*5LQc_N>p> zn9-ggpJpZLn|&1G!BR8@g3~is>yqE=cLD5SSwx=d84Q<4#yYNa^%1!8FW)XjCJZf{ zuv}N*9yvIgkZebxOahuhSf3G2KQ#MF3g^G4OvL^k62~g!=DU+$8yHk^z&bHpwty3P zu(%YT`$~aU^siPue@sw)ug6;O1FBUW#qnh69pfXExuZh9kJ$x`-Kdwh0xH5q*W!Az ztiHuzxSZg}wuXajDOQqK*1zfRZbwjxZ*uLx=|pHi>&>pGMpWbVa`FB}94xy~NOKj8 zL27DN;J;92iQ{3M#V%!jWbN0r8s=KA`KtGv8oQO8z@cAZou3D@&fwZ~qe>xk|59;`<%)O4@2p)W zTQlsZ6ulZIn8fkbTw5KUDoiS=gd1N24F`u9^1o3k77B&-weMa7F-(lvR+3?}e zCLWgwOZKN^ky!PUki5dqZS_R=LJh8a(=JLD0vY6(9Wz@->AyqPz`WSZZ*o)uD&vLk zHnxC#>S3p!${$TvX1Vj~ugD1r3smNeXL%jDGMmPxQv-;=)0C*5c$G3cwiK1*~d^N zkVZ*{RY=?)J(p)n$ew}lUs+@hfOwT0hFplClaslW^l>q5%rdbnR8a1Unv%06aB6!_ zQpbT$3w-);vmgCqf$>+eOYi8&5}o3n&WyGeOMus)m%8;2UgzY(Pt4E6dX zTC9rzpYg=FoyTODS#jWB~+ z9Q=@qsQj`cQi69W{FM8JG7Xnd__mV-ot7Fn;Zj6cKRPq0eP24>MGLl_x}A%j@UG`DdBM$E z)s$>n?&M8y^fvz`@yQjWv{+1;UZYhmjzsxhRbA8w4Qn2Ov-t?UWBt4ORYhnl>~(2y zxm#oA-72%-&Zl<}_qU|WC6~;#QifO;Y(RI(9Ue4KZ}8mVLG$!uIL=fwa?X0=^eEDi zc0d2|LKQ;UnCM7YiU3M&O2PsgeVV1r8}-xwx}}nE)zjc4&?&TAib3AET#?#@-ptU^ zAe9f^DISW%TPh1+wTso^3R)WS>mw%4aojW!DgI z{9G?Ta5W8zy!r+794dIX_zt>3(7fnkks~gKIAo+0K6}GB#NzmBDr^W=Mi9Es>L4$7 zt6hv88(bVs@IOE=L(FCq@ir)3x8iFp#l^S@$v$?wL|Y*0#v4l>#yNg|uR{1bj&VpB zX^091r0xoU5yYZQpWnFqXYxel=sTVVXqtuIn14F_xnWBoAHSbnb&WizlmvSmWql8-nAGYU{(wCbQo`k^f7Iq8+cMWuxGoCdTLC$tDL|lfVJ`Re_Y$uoQTMKz4GL_5C11$Z?>(G zZ6cHBe8#9GHpJ*R>oFD11p~cv#zKIAa$OcW=;80c?>;M1W$EQKb_p0>tW!b&HeB{* z95ZjTSfx6Mdfe`hwwmj;A_LUPD>*fFH%s%`CROs^JSNaocT@+g#z~#C8Vcai8?0J4 z$a%sO6Q4!&w8orGUuIf2`lCQ=4hWV7E}!~n6sIXsCixC@W#Vvt2f_aPdB?$gA#i@v zdf&R1QRlvQW#q0pwwrJLtaJk`1Dx_o50vCJnh)j#8gOb{vkg2-`tPcGQC>Tb&YI`! z-i>k|Eez=`%=JP1L?Edvr<(5mE$Q zO|}J546;kvFHET|tT0B%)+8AiV&*nsfzl?UI%h|b>S!-c(?(cW-S<5VNQZPIAl)F{9n#$) zjUZjpH!0l>Lw9#KNOyNg3P_hoy`z4K~7P1xq&63&&sI_oG#+*o_xFEiJMA>5eE`~9caq|Wep zqR#g~UU}Vn*4{F=Ai0$676dh10Ghk)(1Dl9$_#!cAS4jh?<##7(s1rtk z!LdXOx_3MVXNPq)dR^Jr5_q4VRcq{PgK++^=3Q*l(E(-;MxqvuV2r$rjK^C)w1Sm|3T3fevAG(? zxwoG}DIL#mOy~SO>yquL;)+ZQTv7c=y0fvQl?#Ja`c7(r?lfxDS_Jhz!8l$+aoEzP zoy1oHk=eB1{N}QWt71Y;6@p{N09UglJl&#fkiUj3^Z5U4@W&4^NQwU?hy-FW_cKc? zOf=7SpT@vWL-75-GQdOJY(laCs<@9yQa!&(T2I2mdl6pP*;;}C6{YU|PL?~&TJ8=& zJ9C?8D?G=oW=5WEWZbaHh2f)GFd6)P_j|d%;9J7L=!Aqr3Wc6kHoF|l^4iZ{1erf_ zW*48~XK1d2hA|g8w72t_oZ2Z&F2-E7d3Rj5CuX`Ak+5|J({M?Gak%Th=DbIG)A5++ z{OhP1sq;}tv_#S4jn6&8&bQ<&7TXPVKu=HB}Y@tnoLl3 z7B&yB$cqj2gur#9qWbvGNov#7T+(g zeQqgWW2M9u%-&yg+;z+Ahr_RqK*W6c83n*je>my$spvw|Ck$?QZhh4n+48Oum?K}} z_lxzfRxwOtd!Ds=nB@Ah=l$V?`Lfd8e=sLRVBb??4AhOyfW~iFINFjv;DuAPvYfwA zlN2)D4ojr7t&|@W72>958^HU+U;L50mhgR5pSYK#|0~N!D&~Goo{(8579+2%tpyZl zoxAK;9~Te8);XD6tDCG|)Sok*1KVr_DgV#Wk(&Bi%{bVNs7FDZO~W={5Q|06@QHwEq|? z7K_8XU9D`12_7ZKrRet{(vH_oOZY9A&S%|W8ArL%{d9_%m3Pk0f6vbzaP}US>CBJ( z-imN0i+SpPs+>_G_F3Ht2BW0WO5#juHP>OfU0}VTr*&5oW_T{HbZ%_rXjkvPaK)d! z*~4h9GFy^sEN?y83#f~~uvw35uk7u>FRAC@o>C~*jX9D%wxy45SD0oW6;hI32C2>6&|?$kqp6I_Dk<+$ufnT=RPBQ zq6c$=5^Jo-bO&q{seC2DXX7O;-<}Dm>SYKE{u+itIyW)MGr+kJ`+a>>!(4bF(bg13 zFd3t>ct_sM>p3Ib{0)*=H(`%Ag$BKDDIQ?Np2xBzEoSW9wbiy+%#$-W5h@d)A1DW_ zj&383-Kn2I^<)xmmeHQfOu_hlxG!X4K?+Z>qOH?URO>3OjhJB@IzV->qP`V}N0wJ0 zWyaI)P;xAZAtTmOx#$n7umw9hlgES~5CeLo~_UPDLOnbI_N&}YNyFn@Uj zUu=>&FKI131#Q2z46#_6m)~cgHy@)z_=Z!?ITr)@_;hyVbxit&V{n<;_mAaigz+`X zxByb-IOE7Ne(@;thgZ!dZy-nPh09XOkZHE-p?;JZ{O>N=sMP z)#u4E%7Au(b`;6FmUC(GdHV#w%OTBUS>SmU=_l&*hwcT4tVpami-00p39?#W%><&?r|8PQ_0L}B$)=#Wt=-^==#-unuP<|%prZ>YN2On>D& zRJe-evG=wvYip-*H6%6Oz$#tVRL+?TZTc28hjm%u3!?k#f2OEE4v4A<9ZDHt;KgVt z!L$qa%$cZ&i&fjh8BS>s)_lHkRzDNS7Zod(qn7{LG${J+dRhmu*R}XD>j#Bbfl28j ziQRa6P~pt_G9ff5R=KMSV0d$Yz58roh|U*=p$m(O57%Cg8SX{Pd7Zk-|OBv z><4(!A02|oqm7x1lJn3cwv4DK?V|N^Lj%eG90N#$7B+yJkX5~cIA0jk{Yb}*z98gA zh9b|!?XN({i3EiicFd|3W>$?iD*A0=PRDx2I->G`lKmURf24mgQ(XSaWeLXpP-^#0 zj6tw_D0uiOdw*7MgqhOB68olYFq{gq(}&sws)>pkSZuXq-Dyr^?BWO)7fJ>J4P;-@ z?n=LZja|z>AyCf~eWw$PRVJhUO@Kl0tD>YuifR_oTW0nf-*y#Hdm$CcRs~oa)Gn=v zj`IV=ak@Xhhg(%YaCL-GopMq0J}eCTibJ-2B+*fEEp7qg*oWYE2=1^7j~F$ zga^%L-tz@E?kCiM{HjrA{}a1C5I^-TH4|Yv0!;CL;XG#{>ZGR;;67arJF?17mEZoF z^{pBIP+-EvmOqVI`Sh%JVBq<>4vL_A+P<)yJ_oGxqS2nPqQ=wg?NFE%x{SvDZaHi{ z#}!W6dyNVc6zzs707bhes_T-Z00Wte>)Nzy({`h zB6SYpYF$FUh6*q`W$Het>BWS{WY|_kH;G=DM`0g~ubjusD7?Rg5~zK0_>~4K^lLQV z5LG=yQk?ym^Fr`z1t{e!v;E=OoYQS=Ptuj#8xoFYgkfq++Ey`a+ndkg6hwo zN%90NP5*+LT-UUi~gd8ijOVz6`Czg0dLN;dQ&FPeLncU?wt?CbSrqUKNmg-*&Q?pg~)AV7l!})Glk+DA5pv z+-_mBV3R3$Ms=J?3~@V22sgTE$G+Tpl=}FFSo#pK0dCHPg^npUMyQ{b)yd(l;%uwZ z)z)r%_#ew}!y>X9z1^Lyg>3HJi=KbJs!Hk_jg~bSR<(02o3Cq}rY>ncn!2ss6iI*S zh&g!x+0CTO>GUqk?ku-(%->0j@@32uEwp=+9P2Ze^{MY-pO1{!RhUjy<$7rpagh)` zrf&cu@jBi&cAAqfoDYi!rI7_%qf-ar*3*q{Oa0@o(={hOCnIiSk9=&8Vf6{u*G^6Y z<}3;B0|7`u6T%{Y(7|RNsE=alJeV ze#wrlZFXY!Z1B$UrULO^-*QNENH(+WgCFLE7Y=OWAkion{(*L{=xW0{1KKdd6g`0) zzaMF{@dd)O|?bQ;2Mj5y$#_;%vDmq@AWn^iZjLx`E4%T8qUm z9CdnVpUu3Qj&>0^TB1s|>a7(SpRGnZ_E}lNM0gt2duv)7kB<-nby<>@T`?$8Z3LEj zlJq~^5I(-SQ4?}YYvu}L1>phw-wvhrwGX8#O!UtK4`5TpZI$@zGEB`8%}1v3o%qx1 zmTsXj8&BMNZ`ej>P6MWS7cek02?Is{irKr!Q506@G(vIr^!IXsi_xItYv|AU-_8wf zw$1VKjXs~{Qz51KrO0&Sx^%48kNArT^hdj7n%q+=CeS@^9{Xtkoyzz8gZ|U)#B2R# z7uwd9k*DS|@{AA5NH+kp#rV0x@NFdOv~GcUu`W(k*zT2}{Aw}b(m6G2O^^kOvc7-a z#4hOVAGRCe#T~)twGQ8~dcS%DKBd$_47*m`*AT~uIZ47A`j|79nOZ^(wXfTo=$Blr z{V@$ec8%1w4rsl3{BnSrGX)j=ms5NQlZ8wT*nto*r)bx&6 z;^`%JMzlF}w|86zpD1`pU7S-Bu!jfO#e=JnGn2&{K9X`xgFtBkjTT^Lf?T0T(9H42i03to_zn?67(%S|4_vbOrPY5NO&e;rYiYx&sCKDY)|EIqmYhIKA`} zj0gF9F%|;$qYW3o2!GIPm(X$x%ql(Up(Z%j#L4_TwoQekv|RCyL~V6e7c8HRczQcd zw1Bj82Zygw(SMs0BgU~bAy*>BrQT`7#i1%TFsSn^2(mWW9_E}Yc&)s&3pf+j3xKsk z#>k>*wZ6?JAF7n3Mr=&&to7}YXJM{Z;Mh5cFn*}TZv~AB`31y&o@x@zqKWN^943}u znBG#@e`EUPU@iN<^sy2qJDC`;AAA9)Zw#Ei)QosLG5noZB6P}9ClR{z@rsfTC_ygo zWz=`As8Tpf0cb70q6!OqewQy+OK78V3Yj9mE5H&4r<~o?D_B$UT;#_3t1d~VlL(zE zHrwk_`aXKsjJW3eL!7#E=TY*s`IKKdUL62c!@P5Jbn9sq_pZ7{jrG)dOIj+8?DMr9 zy*lz|(DZoZy8xH)+`yx=3)O?`_L)#d!I&mgD;sV=WJsIEiQy+HG;1}ADr`UJikI_K z6U3yG=zr?B>F?mKurF~1qOrs5f(g`o)U{WL!gOcM-uf=lMTU9QpnO*bFbmuruY#T`}L+(C_aGNk+Zay3p+?dyP@;~h+1~}ze zFf6MIk>`V@GhSLJl3(a{PCXiO4K{sQ+_RX3%)6s4l$8azuHU4Cq=NpSs>=j-WpJsWDPSoRa9zpZQoM^$NN%0)g?DGc{JMTH|#-QQUG8bR&SF!l0w zzvSzhCIoQT$oG6#%j(d_8h$m0%Nf3tI!=^H#c*y;>?Aj;U^BR#Q!?4pa1PCh1$JD( zpGxfO$PUI*c{o)yn5=7AQv)PxE_tM_6W;N*$l))8`6!bTrh;sS%DUpN~rf5|{{=uUpR**PRpR*&CZ?ZomJEkhou8MB$W0!@pC( z%4K9e`zlH789#LQIo)EC_wJ%_Lbp6|QvUO%-qVL*lI&v-q2kW(FHkl?z=xIkVDHxw zRk)dFSqmGJN3su<`$>7-#xE`H?yk*YK}@1v-b;LZka+!zku)FhexdSaMoQ~XPr-RR3R10Pg8k4__J@x`g?&U`vNqP< zT^q#a+YRw&8q5}@T=%x&!wx}qHHJw*Dg$~UHNkLI=Erkqy5ETSTbi@) z%#@Ue7pj5*fq~LefFZ$t@MBo~7VU?Xe;tYu$`zj@w}Z}egMNlJC$;65heg<`h$`a- z|Ce6S)M(YZ4KH8%mO$lCPWq9Ci*gu~<$FTBwu} zt@%D;`qq@4A&HsC3vIwWr$wpxX3<^8%EI+)S)5FI3H?KTUCiR|WFE67vd?_1xgmk)XGZzYA9<4w>=kI^0^_oI?edSpF^6VzaND3q_RF-_ z{c#3%ruD@yN)hi>RCg;IwTOSxb$1R66UU{_Nt^{}2Ht)Oj-i$C4ff`zPM=qpE9!^E&xUc{$ftI8j!o$|Z5 zdXsvAd5bP9@C-+gE_k&8Ryd>3bA|y=1!~^Dn}j|s>*w>coQhb9>rT?z_l5q1dh>(x zw4dTKkH+)Tga)cHGsh+M`_KSB`3ZBeKa%(3dZ%_-Crt-8-AlK-7D-gijWb=sw5}kv z+FA&E%=t$OPhoQPl$>|rEr!hu;k9^>Mcuz}a|x2i!QrO=4!5|ty;e*_Qa};?wrjXY zOrQPzq}tqJjbnU5PWw6HtYGH$P2gTXJA>{l^_G>w;Cds~di$`dP)j1zx~t zK!Q$rTn{Gm6;xPyJxrWN45}uj8F85ojSGB|rtZ+^@0kR(V&AZCbc1Qe&rNxb9E0Cm zJJu5YNjPOqUHqO7MgVW?WtP=blk}hs?CcNvP0~l~tw#wn!_=hnIu=9M{pGP#9zmpX zfZfa>rMV_uE7R<)qXz#gr2hbNvDl2v02VB*gr?9(2{+37@R2PHN(LBGO5+c+-uX$~ zN;rfyi&$qDLw!t~6a}}gdclUJ(_-^ieoAH~O==EHZK`cXd~@VmrRVX^3)YtgB-1<` z7;fJ}mFN0V92R!J()>0)K-!4*PgqsPd~z%@{b3hl<_Px@>vXZGE_yu0c3%X1Z1>EA z)xrv9VasoaGXJTmBF$~HGv!0>p$u3}14Z2n;Dc(5;DdhTiHPQuZ(`BGsZ= zIW#cmtnZs@=sr8YpKf2lT|Zs?@~L?@JAGvpHVA5PAKUc7q z@GNo79n>mlz3AlWNQJfXyVpdKuu$_wN$0&7jraSyUfRQeVB-O~Z#|v6t|P{pubZvu z-}Oy7Ld~XIBJ>Yn+A4kY`(LjqCqlNlhB?h%3~bM7)JBjbXbyH)l?H;p+JjVRa2=Hz zssIj8mBg27bZG(R{QdO3@g+M^p9Jz$uDT6Jc1p1~Pu#-;j)p#O3Hi{Rva8<7qq`|Y zd21-VHhVJpylcaJ>}V-uFBSVExew7m^KMn={^5`@ib@X}sT{rUO>~JGY0Q2|8lUcH3 z^NIOY>R}P^EsFDO%US)HSWygD(Bx=(dWyIG5Potvi+R7-6V#x3xcF)v_S)oWHW??c z8PXrdoZN?qfLUCIA?sim@FE~}&EwqkBB;S(kMBQ=L>A*P^7$cm)lFyIob|0ea(OjOM*sJCcz4b2TFCprcUq-*n-Cw^qY0?hW zfn~mzW^8VXo7Zy2?NCc)j3qPmm)#mJBP0dlhcVp#Rsd8#_enS_RhkeITkY;y_tB`r z#Zs{L8z+B`Ii^?!9gfuyjmpIMAyleJ{b!9$SrrOwKd2Qbfbm6@pa3Gn?9HUWJbEm( z4)gFEuBA<2#!eCcK_0BnOV_Y9$7CROkHs^wNui`l9_(Fr#fYrC0G!8}(qAw}A7}7! zK8Y@%O?rvr#8~SEDl|BU&{Ks^P5<#wnuZv+cb@MDvF9WS6o%rL$4nfd*-R8bfegqQ zz6Fgb4(Y)P`=sQ!dessCd5mUbkl}J?v0*Bh5$WNpC^XS-DKwQ1q+X%Q4DgYiZxt+^ zVZ$~7hW#cr#_y`c^-26U7iFaejRtexTQpS<3Z7L~$f96|Jd6)s-jE0X%7Cxh@-Vv; zg>y5jHNgKZ-G!H7!B>b(w2cVTHG8lIM9r`3tVwR0C*^Rs*Gx-x3KimX8hOOrV3M)& z{wt3R@TqAVndxW?!Q~yc%$)26fM}$6iRj{!pjkXoA&g-WB45)6_>%RM211N^IDhb5 z3RgQ%B=QiZxl$NbuLMt9veOD-BZ_BOH18yxu)`FtpMviTfY5cHHl?8)X z#IxumNIcJr%Uy3z0PNb6$IguFa)AcE%zcFRWvjCpJsXkY+lR8(K?MDhjv_TB1ugP7 zXDfYe@}1*mN*5Ay(lB(iHCXho(=i2m-|=Y7wQcSS%A;up%zia(VEogrDhP!rLeN88 z4Q3x{pa78DDH^ptu24DYMb~vZdhH`nkLeBWN|&zgZ8d=xzo_hK84&+=A=%$4Ab$Fw zhA8Wv_i>x(if_g%g=)b0E1Epo?U@Q>Vt?lA`TOI_^-HQcc-8}>lASOiK}4GC8?CGE z*7xdTq`RM#M$U~iA(wrjDrC9g(YMGnN;|{=lb~TTjlUBBra7b`$XQJ|L`&j(aO2q^ zgS3fm6t-Uc#nLtdr%k4#VzX^2Gqu$Yna2P5#JM6U3sA^>OL0izrKD1i_WtMmds6I( zqmW+>ZJbF$o1HTlP19<`S=!v^7`#~y=gaN<^UDj)0|0^ zjeCSeX8&3sUzB~vl*H|pvpqiDf8>!H=)kIWkjttzLMVZ7kg^%O-uB0%?OZ@RL^?u3WpXETD@Y025%lzmfWMXhg zm&dzZ&3tUBS*exe*2JrsfFaq(tH2 zsVUu_&9`ktVexK0ClM3xcK8|lI?5^IL>Cx`wtmNV zDI?8+t{kTz6zoQbZ%F+s44C#dg#n+~-iW4K!fDVL)dO?tir5gGb%r%tY6b->&>< zA9er6Qg95_gx8qH98X!FdtCrxy9Lxf}J?N-Mb^dJ-zh*0Xjgvk zEq(Q=_TD|8m zHK7}xji%1k@E~nL5i%X?JVdE-k`fP2Ci1Ed(A0U7-1r=1L&ZLV;k7K`crgm5Uo~+U zMxSEt9eSTgW&8lA?E!R9L|EE>v!!2plEN&6)Ih9qo&{x|$_5QlOa48_@*{s#1b&E< zE`RRR;L1+ARMj@zDaSeSW!n-F@k8>+HZ#7Eo(m*Q?`tQa{F1Ynqg!!)zw#zqv~KMZ zHN{E4Zc_ugl`O(fX^2p`2gN4^jF3>I^oy$|{aa;@)bv28eeWl6Gy@Zw&-9OJLCREG zYH;sHWn1dXbA?SMdPdn@XEn({=l@T9`UB_&;P~3X@j1UudtvH>a%s+epMAtd3b>-? z@^tSylTT1mXq8@&bm=eaE&Nij1Sp%-Binqi_sZp!KRI5FMlN?OA3-dmxLUxq0G^N1 zKCygf(VGUvk5*!w<-hO%G^Gzs2?8S9sGvic8w`ODnR3n&e1Gx@N8PFuk3cNZI#af{AW1&E zh7GM}i(F{Rb`AtFESh@Czyo3pQX>+|-V6$w&_QekjnPl{^zec1oogWgeu`>VnY-S&x%O z2!ojmzNV4-Bx|O)Ekk!|WwB*cI!?3YA^S}YDe<6lWLDy#j61m~3{ZL>sO0AuTK?l~ z=!=bO_H+%@I(9_~_C`1t<(5BF+S7Ii2%6IFb*{&^C&zNz{vOXd9M6dP6+q7JSNvI^ z;)@$=+22q=&kHpszjWhGe%;Bx_RulVG>XHDcvy~*a8RmlFIGt!RE{mI(@v#0%@B>K z(@~x!;$pO)odGNf=HLzJzKO#gZfZ}Kx^fUJHn^zqu#{yXuq|msd_5) ztiM>XX_Jl}a$#yAx1os~W?#s_AzJ*CDRV4d!t*x_{NN9U2e=hEsoZL{4U%fky$9UY zYKoD+3A2}LF^2J@K61au;G$+4aIgI@>nOe-iQ=;zu>d~5?<2bY<+eNdSsm2gOm7zr zNj|G3-2B*j1@9z-WB2g5(xzcJ6F_8mz3K0!0cs?n2I!vTnFT}OL?&7#Zw2F7I zGypxwiS300-(^~oC0y!ET$@`OU+n}9G>6E~v^po3ggQhq{?mYAfhZF~A^O22umsrV z-WLyh8!@StJ~2D03!bj!z)W9H^3}Y-WLn}Tp9nJ?7{g>!*S-BC~{_}HFI zf-_2g_M*?w@v?Q-*5#gsGpZR=r^JEIAykR#`T}i3s=JLd^H2 z3;VCzxYD{fgoJ^Pih&vB#pv!WjJAMpmsxR8DeOUd&(`UM*e~sKB)+Get-O=iE&k#~ zN0^>1AC`+_3MflAUZr0{aB=fhHZt1S)x5&se@Dl2ZlPq!dWZFg2qY+TZ+KcmO40IO zJ{{w{KzG6DuH!wADIm~g%*EnSHxEGfa7asxuqoFR1Mn6M7)AqbT5t@LkJ<3O6bvx6 zhdl`YC;}zhj;M#jN5h{Uj0(Y09!PI-C&XU^0_!OD;;YfTzK1yH*QGY@fjMaNFFUYE zAVV3~8)PjxsuXZSE#(#cV-%YYn-+G{@}WJ|ewIW?UFvOj%T3I2D{32PpwpKD-OT3N z`@yuV(hj#Y|HfaMH%fp&h~6^+JpL-BJny7K_va`IzCgL6T3FD1+pe6Qq(fwMhiD!KjizrzptmF+@))k-hm(yctvmDBdpG9q5lB+QF0j+O2> zEQl-#T^vhFSTIs6A&gb}k!7cZPgw>0#Q*V^C4uiO_od}y`L5~+A&i2W6BOwE>5;oV z!QJ)7{xFKl!J8HySH+n(#f0n669>|z4ePD|suXS21EV@dpv?E|eh`_<{kgvOn+GbP z<+d4|R@O}36H5rjRR+cic13-b(dF*~<&B>_mrbME4BBY?NnlN8f(5PCCWSXmN9h0R zs<-&D(-bx5kEN71bJBSC@x(7#yIfFhyZhA2i;m^`Lfe}wcaD%GB4rulR$W*=K(9EA zE_IiTR%`(zrUPm3*Sk?x*CLw`2c3Vj@zoZgR2f(#G{8lcZ?u&H1j#fAs?$M{1Vr#Q zeCzF5ojPA~l=O^z)k5tQrl4PIM%crenXVQ}8m>;E(6q=WYUWA`wwxklGp- z&utNJhQ!xi(x9uWazhE8aBb=giSLr4Ahn49b2zF12|~O>{`Ri6bbkUD6vFWSL2Qhb z0_nG*qP#7s`a$w8;K!V@v((4wjq)y@l9=YNbS;tVYpg>Vhr`Q|G499f;g<@M&f^`3 z1mP85bA&Y05icc$i*GF(c%CWS)<|o#yA}n6$>5;j@=aOc@c+zCXo}LC?=~g8>-*TI z1b|hxL9grN^$Bdi`J)>eqsrR{)rYXx_DAWNt}~|g@LGD5kl}F*Chmz7TGRmnx=#sP z2^MqggYrmg_0DOqTkKJnAb$G2)JsV}%y|$*(J1^Rd6v&!s+A-F#SeeSL$HU$GK?d^ z>O+bX$0z$5JC+p33W+qmwV;%}gz$sCG4SqQ!Q$MEwE^$1g}}|_h-AK7J!($MHhQJq zBWL7sD-R&SgSNizbskz~$&m%8h}@vzh&-Xaz7gXMC0et%Kv2+=ly_RI@0OP>vV@@C z2^k%(!$=0#Z6Kv_1n!oIM*hn~+n=N>P+m*eQvt1CBPCHUAaYQcN3pT6V}W$RA&Uah zbeoez)}-KCF$1STKY@>yqo?|6{_z3BTzs$S;)i=a0=DIrbj4^Dzz-(6p8G+B9wAQ3 zVCVp23I=~i3ZjwN{F=#d-!dHvTT}42{}e68jOc~iUE}%PUZf~aDUTlmn7g#W+!c#I zg~CaW0VB%|xbwgB6i#tjOU>fbF#Y=A2v@Xr*KgIw2z|4@g)KAowuQ&&ET5)J;L^L{ zpsazZ9Whj9@yoNR;%3*n&HQ-oes>C+cNwKk6UxzMm&i@PtWbjsnw~s*!dLBuxoTre zs<>gSPxWkIA;czg2y^jQEywgXwmG6uN2V*PhPNsLOqKX3kui!vxrjy07f3}~dH?B3 zca;Oy@vb)Q0$5kNiua*?(8p;X3GSS^w9svYY)5XC*PBbWB*(vTsML8a7e(~f4<6SDl|O*{Ej%)Ht8!~I_UX*Ly(rUUP%wf8Wj-`6}D>Q<<8KR{<< z^$9XAv^Vz4V=GrFbw$}jk(4?-^fx_Q$LvXHtN50+zsX1ZrgsW`;7E;?teb3(h=*lt zgq~ph4Sf9{_?nauiFqT3JhX|ue>m_J-DzGMu5)Yw;{Z{AV6QMum4^NF&=!kqMF(q} zjxDGczS8#0Wx#rzdMPj1+mduoGm?za4fOt1sb0JT;%6^;C;o!{Sw;Ja5!3+UJ7r_u zCf?Ms3dujEj55^Zar##ML14Ckro$Ua2j$TY9OjfYw*rQ%t2oMM20CuVG8(5vA9?!~ zw*NHcRRUf-suvz`vJW%VKi3MO_5ms|RO(%~`br`jEG=Jd8F8cnJJbGM281^!n z@E*=U-@Se1RPENql3BB@p$D1TAJLwcF~WGMOro zBErXCDk_oD$<-!IlBtu7M2d1(5&o+h5F>Y7s3%8`3)_`xobjvDtrT*mnu}&t*hXTL z((u169euEQcl3I7)wAx~u@ui8+-03(n}OH}BBfkF2wbgdchQ{fck%<-o2smN65a?P z`#CnEz!(aTz_oDu3B+y*U%NGD=XgFrI%;~v^+!X(7-*vyxM}&`zF#gZ)%%)VkEPmQ zz>SrRNG^ngSVR)AN9$Y_Z9w2!;r4lKE>q6t?@$)GegS{#y2d5oT}TVB$zr%(13&V9Pf3!lq&An% zqV!9Gr`1lq$v?(Z^&~n0Pw5r#lulboo{lQnpPM6=uMcn?VyEY#wTAvgSj{)R`K&T)coz?iroZ)+&$}=hPB+m7BG~pD-)L`eXt5x+m*)K z1t{J)vnJyFVPDV@xN0f|S52jN@=+|C=bHG{Gg{CvUmR&z5)ve09&$>Vc0ot96E+h6 z@h!{zpo8wL#a^SzMsbM`ep8~Ag8Yqx;%7yd+>^G6b@79UT55={0RGM(wC)-^({czv z+ro6W>Wq!|@wJPAr2+;PIf<6+p^Px>9&tNj3e*>3Am;Zj#HfGnOi^DirgZDCDf z6}c5c_t$X}xlmoQCqG28n_X7HAn_5oaDl&7{1+1qYt(kCAVA*_?jGh0X+`bBW4+bO zkcxFMopcyRmE;W=wlTwC`W~?DHX@x~qd?c3HGV5& z=-UQ)&RR&zLuH5S>xKc9jKuXL@;#b0O@3KGb=9R?tCmqPqZ5v{b-UHPFh@g&IL2%# zZU2`uOmd%z8;Z|0u_ZQEExZ&BC@SUlV&;uEF!%k`rF`$ak5?O4@wc>)kKhfB7-Jft7~~ zZ3|2OGMx7nG!Rdl_7_FqkH)czJ{Cet%*q(!(=1S+%|VX($JD8qntg+N3%{@??5oQD zugHMt;SMwZRgNX!yINoRLk)Mc%!>a*<0qcB={)RSIQ60stLTh8v~h*RWs;vGNlBV{ z^4Lw3Ws;n5EKwfw_4T=D0rV+s9hsWE>S15J*_-@XbwE**E9Na_-f&$H0$}`cB z(qw4IBsk#rm(y%%VZ*=Szj{U0o6B@Wm-x=FjaxfRmG@sj!adwF7Qf096na<1X-HeS z5fR}@D6r5@-qB=B-Wj!(wm&)4`Ax(4EjRL7IeuAx@wCVNbc_i+T@bQ6aT3f6KlMlA-o<$$q?n8B_X2Thi^Pm%3ooj&4JW6mvKbhPn-6i z&%2@a;*82o6`+@hKj*aRRn;eA`$kJL7f2n95QQx?e1DJhL5%wLz^Xo)$SLJyA!A~5 zhsIJ55Sf`!ci`{lk0pftnIxCi!I_@J^R7L)FMqD|MBoddz_0b=9Ju)_HqT&d)-%jM z4E+`Lc*&1sVYfTFa~PdP{CTWu2XyaFanUzvG7#WAARaT`OEY8v)e<~zzd`-adOYF{ zK8$51-buUjIX&Dboyt@}1Q7yMg+ecHR+``3-sJdE_ij>|krk0`^0;S_KEz2o6kWzN9iD z`xNu&&RtpZ`||(86w!gaIkz1v zxm!Hv1yMi*GXr8g2)xTahAlR1O40O+LUtV!{K)?k&DM@v{BqqT6*wAd?rFDc=&nFk z=_okPo={i1*t62goRKvn?)jUZ=i#-tBr6Okzd$5EmyhI>Z1=b#r9Uku=-F;BmOZGa z&q7W>jEGSiuzdFuhjzn}J!+VcfR2~`@_XI`mUM<&6nznf7))dM!@BsQj+U!j8(k+2 zqdN+Zk5}QUu9vFb3Hw^?dp-p|_2c1y*oMeGU(9A!Zdm8{RlwsLBOmbM_GGtI^@M5L z(w6n0rGF!M_t}TJJ*y+~u?z5gS*zsSSe!5X<<5B2cMIn8k#_KdM-M1dCrouJtuh(9RPOmz``KE}@&hC9~n1zY>euDp**5@|i`uiSz zl^fA4b%9)Qdyoxd(ekKz9Z%&VvuD%?efPSu=Q@LizHV+%OO>L?+5!_p^e`&-{ip_kf5qwjEFg&4PNqDQjR@sw#2@OLGm_4PM~d1Q+c zb1d2UT||=@mk^PSw*wM7@6=CGOP|zJAIy3Cv`hcv8Wd6!B3TYkjU>9g6MoYeipkiR zcOAdc2{Dwdf~BIcVK>iy;OG#HG2HfaWYmCzfpOa8_@&RIyjRIZ*PDOM=B^Nf_yF=Rm-gtz(l0QublfmW z9;;5-tf^3cJ*q#Vg5S73qP3)wp-mDiY-*TRfpqEiA2nx|Piu z1(hy950iB1N~{(#kSAgWcu;Rl@A#d3DRI>?Ew5_eRqdqrndMuK{5i0QCJ&m4J&g*A z5b_vDULuP4qU|65*rbXe``C$8)UQ%y|C)$u*7$D|#=hIK245k39A2ke86v2N* zOGLpsu8l4ws48)u4Qr4_=7|Kl`F{Xa7;VyFJ~`r1(4LWX2!1WV=KUuFke=a_j%=g{ z--_nHHvZ&xp@{5U*@EOX9 zYcedoCIZwl%Md@4{x0 zAb>a`CLplyyVa>fa}n!cEU~bhB^jH ziDx4F|L?Zy@9S7Uf*H{$a7>UFLy{?HI&SCPK2xBhBjdt0&UWxDWk}{`Ft*)hmB4Aa zH5TNHhjj_xulse6=9nkz+48gimIkUDj&C8m7CaMQ3pRi~B2zi@?Z2JZ7(X@#Cs1g* zs+=DAh*|f(k@CqP1}o{KFNT6r4=r{MA*($V(?1Li;SGKr&q@sa4IzB+SjIRYyh$cP z-8J>M`pjt6mhqAKZHi#+TvhICYB_vveBY4S(S*fJstdM{8fAZ6^3i3~M2E>^ZGwDhM4464HjMxWQw!!=V z=Y{*fxCQN=%e@RnR_|M$<-9hKc)`qwigt9w2p!iOetBM_v3%btV#xd|Kor|hDdFj) zDKdwfh%|Xqz)O2WQlTn0KDVzFaQIeT$Bw^};~O7)*>S7To87UN&);q0YwS?glfQf< z`kM5XgAYYwyj0D5wQU|2qf;~2PpNm67}XIIN?~)urb%9r!IX4p^DpJTx>h*X{j@%@SpG_$3C2R$TOv34eVjkdkCLq*r|>IyIA(uXD_Q^txl%`4?L6>; zpE0GB;#H7oFEWCfJ;A?afLG@PQm??n3=7r(RDb*@e!OWijz*BR@hEg3JX64Xf)E9y(Mmn zIl5k5@Wk?BewDB8O=lX~jW7Z1gR^fFSVRvN_wZ9mZ(8Mf||0@VF?P{1ozMkv%Lfz30!#I(J zfAC@L&C z&8N5jN=eM)8k}F8rW*>2;#>?IR^N%JW@2oGlXpZTx?xa+Kbs7fipd;iCVoPB4{;f5H4~Kh*TQG|2F>vgWWRF^&cfzOxP2s;t~i zf3G|-aSl+>HSsu}aMZQZn0nhavaM~*&=G7xITG8_HzxD7eo(w30!v536e|6>SpTaC zg&|l1R160}y}O-=avYa#ZZL%>!~J>PLPrHyvZo~osa^B#u`HZ#xgIZuKvCVI{7rQ* z$Ib4d0%bidvgCHb%y!yG^eeMv<9%WvhKh}t=zH4z=Bjh~)M5(>A18p~d^aI*!MML>b#IN;A`+kzj^S1PI<`gtR1e^g6#WtrFu?05WT zA!0a*qY|Uw9eL>e=fz~&694ix3topF{jLYRsl|OfzaSMy^}83nuJw7oBgRdL+=y1# zTNOp8CgaYyjX^Q5Yqw6;$;LSkq^akT5rk?u!o8K4D1kKBX#t(@`sULzwftc>cE`DKq2Y-f~I=N2f30 z0KTvil&Cp+bta?KzIG>yC<4}>9r4A&$E@{e3A~HiTvLU z_`Oli0%XPEhW2N?aIMTb(Vi}_0ePdntUuSRSud=tBwQ~5vMt=6 zD&XXJJ!6WDx{?dD%(qSeD3l1skDtfGb$tk0h>Z965{*izeheDf6;=&!VFX;)s;}o; zga@(u@AuXa7X1%=i=de%|kcDRQ}xBbk=646MY9j-+A7RB-5Ovn&z- z_5j_EX15Z9hzg7*`JxeCHGM|rI0g?hcJ~@E@F}L1#jAs z4C31#Rli_l%o;D6@>vqG`e6Y6E=7!Xh{UmMoP3jMfXR>fR&kyQ1V;{oh z6fk8hn0o#fv~u~dAGLSfx8CS5vdjV&wE+bx$U6j0MauGTyD<2YjWd8-uxQ!%e0+aPP0hf=4T+EItuhUx^ZEZ@+UX%YbP85x3^? zeCWMvYZ4D=%(bzayalcscG3Mg&l{(0sJKNIYBV3EI%F)3bA;pSxVJYVobz;w+LSNc z%lR9;g7BTW@=8xUP_Anu!xW{9`<+M*KtjADfN)bgBiOS>fQW{F9)Rv5-|cWUyJmn; z_|(O*_oOjQ?pez{G@1Ry)y`sj)bLOYbx+MFl0!lMYEsU_*~(y)jQAsd(TZX_k0aHg zeBnyYUv;DsW$>RKIoHN14_#_w)kW0`>B>kFH0WJXandicGi+}4}m#K-omqBnTfuPEHFVcu2y>^}0GmV&Z9 zcW=}gC}7y$TIl4+Tf`sb5e$?ww>vMOPq&-!>t@7VL^>fiV~tq#R~aiS^J!+&)qn{= zPM;EQ$0x*-`F;cZXJxwlSf0Gnrw%@b^8<;hmvj?2_ukHU*tNMM2ozq;w5aa*kABY< z8-qCB{{~^cpFt3VwbOT0w#vQ%c8`2rLYGkRn@zr};`Mwcu)9Sue$`vA7WBNTeh=r{ zX>VW8N3rpx4(WsVQo5KR4z3knMJ8Y=fSJe1@xP8~xUM5Fez}8dcy6L7=r6R_;RTX0 zwZRh*A4by2MHMb`k)iasSsuZD>#vE$|K&eIZ6m+qr8SMZVuyi(OR6c+uywU~^3s~i z^`cv-GcNdUNCJekJ~r4^4{ zvF48D#00Zn)^(fjarv12b(qs2Y~l+L9Xvd~8>}i9O%Al1 zLoGsw@uxEq#i0xruQ8{}oz7}Dhv6T;{QA#f?h7Re3zL~JB<`N(4;46iF6bw%1l{p9 z%~jFB3UVJXn&8k%EOTq#zPnTjYHwGg+ADJZr7E%^jF0@IiSdNI_h~Bj!;frI#a`#L z3pLUa%j;Wr?TqZaH4lltCLYXn&n1|5Ty|0g7m_d#-mP zL{Yt5Om_ewATf3;Wcu{coBMt;>o=ds-yZ0I8!Xjjf0iR}hw|!+*d2gld>F2&0tEVh zQYEM+8{26q@2R1Qo`FjD4E`VeW5%G;wdv07q-|&;C3QR;K$FARqYsq)|Lbhwb#xwNg##a&3PU|z9 z+=GoVa|PPp_&W@4`n;JeLpF(7gpg)}d%{6E%}A`M&JQeitwEW5RcupqM>kM;>~{hl zzxPFKx&PrzLuVgN;=Y;|uqmwGB7Wjic89Yt+T+V)!dSZcNDUcY2TBy*czd!NQh z9qSQSmc|b}nV~vq#B@`s?K-?2JtZlZf*M_OUt08rA0GA&+IxPe%h_e8|GBzbR#iMa z9nz~`@RK9U_DcUm7ZY)iC8Lbstw%Dm9v?S_H!A7f#W?r`|ooX`SWBysjRmY}T&B!coC<#d z(Vc}yQF8er0LxEsl%&rie>I~Zkg~&a{^IHakA$o$Ynkb339A)UsKa_%3|6zoG%(do_F%mz-l0ov_kI7@ z8M`f$u*2pBk11cq+aa4C+wc}J+ga?7Yioa3h6?2_5}%-|GEXwKPqg6uv-@KX%?sG? zZZ*qP`W6=&S~fEV*;Yt+Rzw3!Z=!S`sere1>|=}Bys98QCzkYl=}^zdzMrUUG-l&D z30csWAl5S>XjP%ThX zVSJV)y$uuV$?M^`&aL9BcxQQeRt+TNHR^fSpCjASFLZpXXRgnRK&a!o>`>uoEyzOw zWx@{Nm{k_|8`6{d$&8IjiH)EPvdwy^&gm1)iOcIaG^-w@MVyfPSH+D^mKA;^!7TEH z#Zv5oPKP4g#JKRy_AMfxI9{SNRPA!aB)9L{U2iu|7!v6l)yNNdR^sTQ-UR+N65@uh zkSJn`T}8rlq8mRn?b)=*K3h!#WEzKC z>)&i(r1dJilhU^8isg3~Lr8TPqTYGqNOOi}e>BBbDltmd5AsGTj;SGe(#H^*JJnT> zU0ViD&Y3%u0S_0vI;E-_W|T9x_oD6in8(xH5QVFk>uL?>^w8XUrv~_XofH<6lU@PTWnLhGDq)?L>PLgnzT7Ufqt6| zqaqLzVvcke5OO%! zY*^oyjtqWpHRKkp{y_-iz6<@DOY{fDAh?7vC`$~Dyl*l z67#(Vs#<+_WA~1yL{*gEdEi|)-zEkCiS4XTe7$XlV~YB6(e#nqY@S;>#AhK2&xdh^ z`netF*DZ+9AqV9`|Aky!FhicVAxo#Es7u1-ilJ;vLTsc!jY=BAs8KmO;= z{-Up52dXQx%Z9%Sp$JRb`)%)EexGj|U}0aG9k{029ozL4@}PjlA4l<7K`qRimW6V^ zAGJLaY#3a$2X-hi&IK<%;u}Hr%Ws4!R?^X&49Hk{nZkG zf>~84m}Y0jK#3;7d0$ABIojC1b3DI$H!rxadhf_*vFxI3_1FO-BrNt=KmC-6P;gtI zn}-O~s9uPWi}YJ~+&H6oZ6H-X%cp=htE;^L@vfQH`ikY@VB>@6DX>$>Rs1c95cZ-k zkw=iSR5j0o_>Ti)ySjr=NhF9(on|98XQus*AJplyD!SVD>OtS>-d3I`@rD}O_ zv$tHiy#xh*-G0si_cl-deCvnP_JQx$C*wI)-?B>oFco#k$`%B>IaR^p%F>qcX{u38 zhEjjgg6L>H)pU~(a0>_lDyVU9j{Kcc+J9X`^tz%hOrDCmGD(JtOh&*>OvIod_ZEmZ zUpWGDdQerfP-nP%)jpv+2g&9>cWGEvc*^y3`1uvtc!`;v_EY-g!v{q&VRjM^k*CBh zcRWvlkVv1pb!j33T9eeq}DF^*xJ#=*F^^GDZu^4YM-Q@{)2dz6t!hq9a0>%tB232VV9h}W zjXpLb?>O2*IslT+h1IB=Dq>MZgKTC#D?l{&lBk{Mi6bJN2`OE-#m~NF`h;NZfyXz- z&e@3QTh&4P%gz{WlRVUv-b_JQ-C%by=(N|>dkq@BuLSmKaS@K~hCYX{!A*mWc1BQg zEB<$WzZ;GPp>g~JENJm;kH_?#$7rRTA-NNuQ@x9gP(P>A56fSnK8ZU%X-wwr$f$*75&0!jIE_! z9t}hQ-@2hYMFg>uwsZbx@UyUM)t~zjfqaZ82OmtQl7S7FmiXG*Y-x6iC_icxM0#Fj zv_iRUFdZFqw>f`uW36MEx9D-3^f9<(Jc9?^vzh)!{>73Uvj3TopyPXAKd>%~V%-^xM@} z)PC^dD|(yQTBwWyy4SGz!n^lA>T(m+0S9)Yb8}o}v;%p##j)pdUHc%Lq>Acgrsf~< zM#ab*RUhzQ@);iOZn_4v zvhIs>^%Gvd2nQ@zY2!uoUA5LI&K6789-)x&uO!C;El;NhBoZD}2*WXjjMK!eAJ}?X zIU1SSdR@P>sg!~#f<}||M>jY!t5t>19)*gK@(A7(VKaaoQ$ZN2UepVwhAG&HmuGQ4r7fNkO!qtiYf2nE7Q80Qh z5w%o)y0SFV)C>Gj%R;KON~rM;d(=QP#zuS+Bc&L7!^wwccR>vs#wS&L^Y5;vBvUv< zz(DvkY)u#dwabsxT6H6egGwC#y~;g4*frX09mb7ZmKB5lGwC~#`L$=G{1urNHc77h zvR6!o9u30T*HWv5wkd#%0Kw8?$8Smcv)wb2+I1Opci`nGY_0K(H+`&!dju}?YTEuBOPFQgpxQtY!2EZ=Xg znANKH;97a7_1CQJl7y{_q?mDPQs8bgPhF6vm<5lDeAS`AMQ5IJz)b8x`AE@2^F8K5 zS#4J6w@AX^FH}YLvQ?FS)TEGq3iGTQTioFP6(13yKA1%iXI0;XGi5}tzz9myI%ZG| zjg1(jxjGV3G;`hGYXg$d<@6!nfKROfB;rjJi$Bp&l&uZB&7JSpC@m@OFNRYS_!Ok- z#gFRWRTPe4Owvz7KP5X$BP7|uQV70&q_(TRF6m?1Q<L^5ZBgHIi3Ek*(tm0n(Ojef~$U8o>TJ-XWL=of)r>r4IbtDs&j^e?l8f8 z`B_g4omf)@~>a5$5>G@g1ZVPB?ZeknWI%s8!IX%3w zJ1A;E5C-0xKsFoChMJm+snykMf<9MOy!W%B{A5+0++KlfyGoi8jNqu3Rcq&7+FWN- z!c+2fJxJ=yzRGfJupI=KcWY(-(HDUDMfQluW2Ac&`A#dGgk`5TWcxvyqY{mO?G^bbi-lmf(E+wMEO zv>IU4W%>$Y%ZYg3y3{QrLnwx0T0T~&q2RHF*kmPwg9nc7?35+Dx3!x+e+vEL0fH65 zZDuF^JNJU9kIU8f#g&=@!onYEUuX4*>t>nu-2U9SiY-zGe+9Gr6e(jN)- z^fpmVAGo@k5r4N^n3#h=X$c^I)p5ku%jf!FKV}$giTqXAF}cuQg{(HY-(2@sF%@DW zjL*<^_J?blkD9(h_?28D|6qv__5@>w51-k7#$QK))JEWGZN=|SB4`{obw_Ur$NN#; zT19Ln*nd>tWPEtina#a7zGm89{dY^zt00__o+cUAP4vF(V6Isi! zpyhu&pBNC9Zrv8HC`ECmyw*%Z)7;T4oi6vHOZURRuWJw61ip>ec$E3$dM~ zxEcYS7AmN7OB~Q|7z#$P+hng$E4FwN0Eck^yEaIYQfJ}B~! zk5Up(McTspOw9C~d@5Sk%Nv0Lk3;~8yLD&FmRZ`tMup31&h9S(bQYM%0D&pujWwp;`mXp^QrX$Lcj%mH|=zZ_WhviWhE}fc>r# z>_Yqh^V$oMXY?;IEgU0{?oI@Awf2V|A!iX*GJXE}H8N*6R-mf9@z;hO*=y_8s%4dL z^8UYUGK@IBqeq=$J{QODW6RArc^f-AHU6}Wo1<5utSS0VaTb^C;XIO|69S6o*0gtv z!i$?wriZia-ecSg1iEF9@1^Q(Ex$mI9ygime`KmxzsuWZ0Vei;~$T3oV~Yy ze?Wn_^n`M{vnndge!Lju*c4r1>u}`xm47tIptd?%F+a`uS(!bs zDH`ctgB*7bv;rGsjpF#k4*paVc}|_r z7+{L&Pcq9(W4uU+67+$*Oj)GRoW|xbPfsi_-RT(xYS)U{?=0$Tkwdjx`S@uAtZ1`p zUj}BWUg$z&)z3zvs%1ozCTPWlVe4&!j2tD^h&S)N;C4`luBk2OX=*E{MPR2L3e3fG zHL$(!_k5~#*dK7@XLJ`j0`YzH5Y(|eGMVn%SrFU9=K4NsA_^UrUTSA;6ierHo}fvs z`3!l#^81?JG_gBY@j22ShHPTXZPwz?y|8?n`Co{M_9faIy9Q(XnrF}MecPHez4B<| z8fuiyFUq<)L7=wl^yyRt{X{iizAW zOAlUsl5AO+_B6OTA8ktxO7Kt9W-6Ubj*a-;BN3=!6dpKAV=MCl#w^dTmpaxF;j0to zw;j&YHudY-&(?Q0PQBDlXS8puYpHyd)P?Dc$5uVBP+*Us#+m&1nlB$X-hko>Zdt>R zU83*t^L+$v)Ltg$3Y8i~i(uRD)<*@(zCt>GMS*94;jQxPE@_Ac>BEi}dABu7pNFSA z^SXhgA4=;`?j}y9pxLRgMP}|FMyBfcp-4!TQ!j3T^5VfWEHK>CVjy{^P|Y|Qi5dZIo(O3CS>);;i$&w8lo+^AX@)UHqx!0`jW zDwdzhD$%ggKGz9*EKc0Xl8Tx=nx-e;<2r()D3GJ79px#iMeZQ`V`&fEu9=2;Opc;} z;8DyNbbhoMcPcO2Z&(&&t;7ZX+5E0Q6tkSYx5+Pb8>jIKr?)A#&M^8}W*-qOZ&Qk` zDw5`MD&7He$tQf)OR?->>E0_gsv4iO@ZQv{)PK*&J6OFGZZm3ITSd#~OcjoTC(_$zS^q)v)P0V#&_0iZ<;t zv`9E&ZKbxtEv$+L?%Pn*aDJ#wS>?mP5B}ir6MGi;6gJBG`;|FN^eE9)ylEf#ACv8_ znVVV_6;N^%=MreNLX#Dz*G?)v9U1`f!ipVSyR_2~g|LNR-2FP6Q1rZn6)YnDpgT}0 z=U>5Yi2^Yzcj7FB7B~63-AmD^>rbnfZkyLITXuCPQoG-S8vx95OFmB|WNH_C4O}0PtFz6Q6gt~5 zJ9llTm^S*JJ!>=u+b}qHyeb%#C?rinb%!roCgYn%zCnh2rlQ!v+^(j&p?2(6`_Gm@ad-?158JMUB*r2B$HVlE=LMk|1>RHFHcgB>7HP=+CTZ_UN zS0w9=e@QJr4+HGH^_^lm7<+EL(JIfw;Jo!SR26lsWfQ0pE?f3LC;`^Js(;kTQyvGfE5}Ngj3>zE*ww%-Lv(82fmKUo_vwF z-!wz0G#*g<-K>X84SmHfV|~^z=xl;ckp}n&p7jTyOJ&Z}9k=SfXNCCX!gjdlQiJF# zx~PoVwmwSJ!n*5kgIuJ&Pq1P66hS|g%jwfa6lm#i8v|8I2(h+2v3zs?j7b6MuPb4` zJ~%%;9eXM_UOARm0tH=fdM6(%-$g!^Fg&x&C~`L9YCne_=`mksNEklvZ*bw1qX)2R z7GrG*w;z(`=mjF)lIj#=DGIl9!XHyjB>QIbA-pqfmO#WD^hq`0&m!lw`^LmD`~RxB z-2^#$H=lz%;;$XCWmt9LbRT9SdXj>#h6b<^KAy@QJ!Bbg3Ct;@Qyd>fR^6>BBkB?P z@=u2Z%w?`eG^s2}s1gD5ebZq6uzgXU{PD|3Jj3pD5%o5Nf$SgdsZ#RY^2P{JI-Hi& z7H@Qc(RwqK56g?mU)VwfMkIeH4~IIV8NCyq4AI^@XCAP; zTd;Hf4;$leGKS7^@pUdy$#`Bmu)Mx*B&s_cnG!l=W6&xRDbD`Zv13)5Z15BJG@EL9 zK?U{~1!W|?Wd4k1sga0{FW&PSH(`;(Fh>UK4GIWV>(hPo=c2}|`_QbWFC!=t=HCKj z58z*q<2(U^D@Zv)k_=WRNFGYKiXS3-?Y^`^LnrQ@u9NOBB-$u~W$Rp7G#?tC50&~? zT{e6W6v=B671&Vyhxg&i`@Y^MUKrNvuDmRvj|8n2f>pGfZ}ox$D&UY229z@{7Ss}i9msI0?XVgwH~oIErR8K^$!B#{tO5kiD@jW6SuRIY32xoC?ozxq zO87V?@r4u_v)e;gEV?#0vWePaO{>f;5;izn4x?~M+G2sL%&8`RaIc|3_Vh_agnM*h zrqn>0umI8sGm0s%J)=O=>c1&W_ti{{wwQpDjU<;q>x%*bPwR_LZWS5c{Y?UQ)=I)c ziKOMjl_?f^&HJq;QFuEMn55`~4=%erNP0A{4tSmHMinub$bxAJJ#rAp_qom;mh1ZW z$A7F`+AswEplD;f0O`8JDnw&|H3^+AY|b6}HX{`=V$0wgDLJgd8$%n%^bOUHeKWGv zz5X1u;haM6$*_H5Fp6<%JNEZ9o{QHCEsACJIS4c6?%RPP^#S!64SZYXXk%U%1m`0j z!x>;tV@~bowr-h&^WnOb6#l9j{eoW1gXhUxuZx?Nk>hxM*z-|_lfFCPN-|kx%>!Nb z?%TQ5+r`~zG;M!La^P4X64r&sn#oE1fga&d$;tO)@won6GzQEF2J|qoCJoje@Q4I+ zER2k1#BCtd_`UgQPx2?{5zXiXMRw`Zmf+}mNUX5`hX~+t8%-UGhl)}km@d38{RVEo zAU&I7yt580GZnk7&};kHSU(`s7a_V@pCD5qyh}P=&hD(tTXPs;6KV^aKD+fj98Xe< zHV-;JJu|HE%m!`X&#IO!W=dJLfp9(J17-ZK= zhm7^l8Wa5Sow>NF*dZo9(O`9z9tre}6m#y95L5!%83{i)yuCpNY%2Q0qum}q8C=zi z`jPX_<*^#Y;`%FIf8NL!pY)jMtS)nKRem0&37^&+sKKcGEUL>qejM0O9W~7@ z8%rfzOxx7-|0Jv!T>C1fqA(hj#=(g)dH>79Sz}gWXQyV9-y^yt?NSr;Z<|?w9N!BN zVVFe={Em{Uu^KOUQg~$5=9qWoce3EwtLWFteR~oaP3U2k<^DwOb<#yf2ajvw!($@l z4$n7Dy}KgTc|OXML#k|cH=ytm{xhhZ(ha`q5>&rHK*!nScgaMKIal&LvxB&1NX7ph zeW)(Mp#V#wikZ{Y4%9l-OS4E6LBd-VrT}gTihq z!C`obeY@qxt{{jP%_kZmanKxMxSW%=hxog5#-7fuvyw;*9(V?=1@J#9JMa8R9*>0w zagZ+c!9jGYg(qRj@I3ezD;W~Dy-m;UZ_12)NHYh1DWHKrD1MKic$(${o3iYC2w3r_ z&84o2t?rT=uRmDhKkeka?@c#(Gt1LX1?pfAE=5~3j~5{i=68LsJBIBw&IW6%i&+wX zgtDAXU{_rOsr}AcNx8w`PK6nEggY&o|JD`k)~Ch>1e7?Wxdado;%#nu)AdPH3UFOf z_)vurj*K7#Xg+&IrR5$72ui}&nI-qMp?W$GEE8s}H&|iZ3k@zBUidT)7OZP)u-y4p z+UmQ*cAwL)RkPwiZf)18j0{7j>=(S81K)nF`KV^JAEf1Ne*s0YR_Pe0JtsU$|9o@s zFmcq&v0>es!R=w~@^43VSX84bi}ZMO3})9^8?7t> zB)ah9G{S(^qD0;E66uimd1o1wKe13`h-aoKjswTSB?X)3`qM2h?NNb8uGICM{65mp zGtkhYQ`?>~w)|ZTQ&x-qpEAl$*!;DS-AXv>AFz(A<*FpB$bWzV6&_ZY24Al0xbM^! zxO}z^Eu?!P!+B+;i)lS`Im%70ixFbf4%{7l32}|G>u_&YTkC{GU}BKUmU}pXVWz1Lum`i#%w|>jB45{H^g^LRf?~cS5sHP-vDK!%h zu>Er%7hpwFD~c3jd5gi79pS3yMjJbtJ3=p^SbBgLjnyfIi{cPI(K5EjFKe?VnRvD` zbLA#5@Z_ExhAXCc5r|@L5&gaaTO&XOJik0|kEV43j}zm0vPVKl(x=K?P0{V$WPBtF$+J&vC6Vt3=1_^B!Xmxun zV9bg3>`KOvPl=)+e3JP?TcC31$8PV_ed zauKRfW_5We^gsYj=ydLlvVdbAX{Fe|fSGS70h`gw=egi`M}$uy`>Zs2xzYd`9xbG2 zQvB8r;hODS?kG3tgq)N3^TKjH><&MMU84{q<`!Mh>s5HTv=*YtilGvQalpL zZc^h+X4OXPn^OBKB*4$9P!IZTTC{P-&{=)+e)l7Ho~o%J2?Hy<1AUaHWUnFZ)S2e8 zPdDU%y7Z2vYFMbTx0Lic`7m&lydHb*WV3FwWf^n}@*9__Q(srt7*IhuX(Vocd3)o7 zs_H}CQ9Lj%FbtwmR;={;z8xa+>KaM(XPbS5TG6^@jESNh3F89o{#9QIQ}v@A`4a*1HtX1tiU> z^mu4ci%_4UdON{R|FFGw6-G&vf91r=$83*R)=c7fqVDN$usH3|Z2d~%I#qV-Cuv-B zWvh!Wv;ezmr<&X|eGK9Fsk8Dl8RWRall==4Pu8yW%Ndx3H0i;2MCRmeE5*RtfVoM@ znSQx`l06OFuAH8Vt%cT?DgBh3e|zlpQPs_;!32Gf+>}Q?wtX$-DvKCqu2D-$0m){2 zAngvmLTo!PNl#^_VxL&gcq~<+Ok!PS(B|sT4Wq4k4zu&mqvtwTv7fa2j&PLi>j8W9 zFZ?P-x_R3oLcm_`(OG_F>Y_)8QjFEAa^4HcMxiUR*PIxe&1ONU$-Jp8tt|T@`+;Q? zpG&C~UzY4lX{0&ahBBr4!tD>LUn-AgFZG$d_wLa zQ1gZONxqZ>J1+U7&7=5^`Cl{nLkmXvvc!`fm%u z@3Wu*qu>(%0fV;L6yHx>u31kemQfpPV_B6t`w-7BENE8bVt4|QnRK(q0yR_=7h1)xhj#$7j>Gu>=nTz;Zsy!ImQl)C%4o4rd?kIyZAEg5pf_Zv7 zDhrbKo@TU~X8d$u)qZ1%Db}0XGtY#`R&LHN%j*!yYe)j0-LAltREoan2UGn=dHy{c zYU>~_c!Gf&k2u*G^P?dis`QPc~`_@M4q6X7$0#AiS6Y;-x z=-$Jm4~+ziDiSxIvnaB3W~!2B!3e2*PBL$T`WHUpe@8(8qjUB7lU=+c6jaInXX0oF zdrYX|0ZKTpdn~Hi)S&R{)uQ}ePD>TXZRr`v{EoVIW!a5kF95w8Up zjnc$|F5uVXPx~thHM(b!mOM+hX z+Ww;5l?8a9e9Rg>$8bR!(@iqmZ?7Nh{UQG$ivKyT85gLGIbE;?#G@mhj%+2+T0Rj> zMD#t%j}wM*5g45=2&cH9LkSXXpKI3Lem3m^UHqlg|%+A?N{i zk?Zxdwf1=((wWbA0wf=Ldv^3J;M7rV^2E`KI9uD7i4Yidd~+CDmUY{%v*!rxqn;%{ z=kERK+&bPkZG+&YrNyL~n zNs~9xyLU-L4E&|vebgaMMn&)DysKpm6;3p^@5*f{*2qkPrxoQy+~K8n2VwG2Hi@AA zdny&XkogZs#lwM5B?a=-D2O>}R)6Dfp(}!1*zg5wj#Bh4(KFa;BSh}{9N?l&GaCoY zH0@WY%>joqdeYX=wyPx(D8U39L};hJ4u{>1xZ7f*>p1^wkvky|nL zx5x^isRH81)$lfYLAe~2rDbw zgH;KsM3@sIyGqcx?@VQNH&Vsyg2#KUKPV8{hObF9Y|+X|Ig;4vP1Q~ta;2UHOyT}_ zdPmhs1gfx&(3S7S)UpRq2789NE8hVN_T*ScP3Ss<37g!Nfs^)Q+jXV>_|v7Z@L`f122 ziS&!Ii-~lo@WesLu8|&R*R%()pZn)y)L!fMOqFCJ=@@kVf^;a91mJ@kWE(NY6J&An zII3acc@+-dY+C2)_ip+_#6-lgWYC)ZQ?{=aCX1%Gu4gw~$93NJuXeCW29$+HbG%i)z#&@iM%&W+;qX{_7*kkTZ6r z_`gtSwUpD18F(Y}6vxFY(c_bpg+JX(*@sX>SOMV`7#oUc@=lX<%i8ZJtheUav-~}`h+Eztz_s#`J*`#D&3n^x zp46Wv!MLixdg_%vSHi2=;g_PQHSSwTdFy#QltaKX@cOhPgnB%-s1MxGf)d=CjT;h8#uEd)8Dm$vJ1xO4_tw|2NZr zSXHbg7f>1#<01-~h{r<6VpOb)iP+Nks>{5E2SoAySR?9NMeml>OZ2 zNpAvIRwlyAy%Hhp)ZwE2&A2Ob{<4y8Mo}Ewdh=(CvYfW-i)iN6>|Vs15>h}-5)I4jci2MU7q33;f4hGONW?|!zCLuE%@ z`{8WkGezhd2W2A}EKu+oU4|S_`14$2&z7a2&OS74`h;(p!=DdTM>thm%-a#}+>lwF zV~t$GntV3wKBHLrtLGyXmgr_PFM+7BIk69#*($$g*aBb#=r&1&nG&?l!{~%9fK>>; zYxRlZf7QywP#Je;`W7^#OcBZ|F+wcorqi+jp7Qf=ZUOL@IKF}Iq1k1uqE=gF2S}^j zB>k7I>c=xjkiNvk-G}Q@mquM%+glj^7`SWtwGD#&ojE?ID)hjBhR`6(7E8mM<(}^*l03eTxJZ!|h38X=UxpJ3A3!jNDIKUB0JSBz4 zvd&4uxT@v!S?Kvcnl!JS*WHbY@z0aBk3`#*WrE7Po((6v3EwMt3j{zO86%?Ho(?>UCK;w&Wd-^Gmk%KrlZRPlURNm72)}8+fz_sm-39K&qNoxC$69LFP z6w=m{e_w$=0f@E!aGns)a#OY+b&kzpU{v4uye)a!gMtiWUuWIROO7VnqEB6(D_Z!q zO7eLX&fiCZL#;>KIpl^%53hDVzDk`0y$%h+-QQc!pg*2)dOGfmZ(i4gZ#SjqrMJ6o zRh@C?p9T%n`*{u9P|?r46u;;>W{vq%Z59yy{?6h`2>4;Bll)sXgXjR)?FkBmQ{Q>* zkV$MHdZ_@Co2??rB5ZGUdvlClNU%3&xUKQflyBX4BX2E`wm$B!@2nX5kUE9uP7%)W!r&RpADg7_!GasEK8qo*Y-JWv9nI&R_YP3{N4E2 zX*;(+o;;7#ol-Y(vGQJ3@Mt>I)DzXTcqKde&R9QA($^(4?L0G&-SIGt70 zhwF)*UiQUfOaH`|%|WU6RzK;PBsm%xd1BJcFE6iG&Vt;p1x)`OJ9Bg>%js2>3Zc4Q zz1f~;X~VsB`^=d$bR{kRMCJLs&r-3K!E zMu(c06E+8Yl+y!l6m}i0S9_ePx0~&`KR16CXg86a-gkX);}G#VavKNAQ2=l&V|471 zySHfM;E)Yz)uhYvaV5;}wK!q^#er>$FdtQQo;69Qr(F-YCGCYU{)r(2f{H%}ONqk+ zxfJvwJF^NKt*DBxAyiapfzaPIP*@#9>O z#;M!SyRsUHvFDw3W&7dSHA|m41Q(gS zSd!)vB6MjLC3dquX#@6X{89+Mv2`k;lx7HWvO%|v zJ4O;l2bN?~Ud)$#0&A-?lSU=K^nK|q?VXj*WS8Zh5P1qEzEiouS&~6jz}90nEj?DC z8QpTsA5?+K@C>=D2x0H|iJ+6c+7{S!DDQf9#*ukT9Oy#*zUQjn74L#jdIE|L*XoDM zI?K16ay3VLSLw!O>!W&=DO(mfdlFo_&t*#N0no&wCUO(K_+i$9G}JT9m3k%mdz%lqyzg)s zUz(N%6^^rf*ez`U7=&!^Mp*p>;q0aRbqo$IB_i37Omur;kZRJXM?&@9Zo)>P#%NI= zfcm>RJcFYwSo|cb6bS`=+Nwxhl>=~_M@P2Y0zE(0QFJ`Zd~3besJve3Wc(^-dHLh; zbLTN^_H}0nUvbcCBfOyTHlntzy1nztgwx^3{m<)z^3>Ktia zzkX!?jCqv|dtSL6?94|krDlu)LhPkxr8Zg#?4vXUkaBvX;_+FP3b0BSe-u~y9MF-; z{Mr^t5tTLNjjaW5t1{7CFR!*~f_27lVvNO9p^yeO(_CU$K9DlJB!+~$fv`|P;_+u*<&hu0pb7z^(@@%<%X{s1 zzik#;86Wy%FO_g43nvu}vYx!nA;f3M>M@{`QZq>6j@33Epe+XNp1t(WNBhqL9tE)M zJ5GLkRj-a5Ej-%r{lKg(92I>0vYf*~UvEfk_i+0w&yKCoZjFi~pt)mtWCQINeI}OE zGz}az8u7*dXcA&N_vW>Nga{8T$M`MkKb_x3hrHYU%>9)~!q2Ue^oQ?$eRy8mc5d#Y zSA8A3)jQlZF4+97o$T#`$Mm0ZH=-tGwB#J;NhdH+?e!3ULRI z3Z45&Wi%|l#L6Yo>F)9KN;9i#*9%Hy%-zr=UW{H2|G1&~SQ}LMFjb+7o3m}{HsRXr zO1AnN*N6Ru8ydYJ+f~VDXE}k5=x;Ppzt`x!eDO02DpCb=+P2g!Xg+%k{kn)pm6`Ms zMh)bI7gWN%K03e6gT(Efq2fH%GMtm094Xc z+>O1;E8wkvZ?aOK;WWK$MhO>SwF+-FUV1qrmY#C3C%(Jhsy_yUsZ?5OzWlB&U6Z^M zSQxtPg8tI>M>hNHH;_HJ6%UPk_#YHQJ5Nr{>YNU8P>_4;hyy$)qQ%iy{>eNj|3(qg z7o$y?sUK310;Dkoy8ua5OhlWToIichK zQ`I*t-(Nm~9LMC*!V_2{(xWvGNFsykWXm6*F6+iFE;vkf;QFGYiV(r}kJM)tyN|c4 zjRaO&9B(JTb6}6Bs(I{Q7CBjwwnoy5?e6jdMt)8GFi{#L9F(G|8dbg%e}CQz+&@vu z7sH=g7B_!QAS97NJ|o<1H1I{OO_syrFjWyr69{n@|lVJy`aK@k7fS$8!xZ+(cxSp@L853@%OKaPMzCR)2`9Z9*F6EWw<^mwphj1CJjk1|?vPxop2 z=N_H00o5}Cru<~df1L1}fUk>ZAO}Ag!mMrEl>CK#( z5LZ2obt(xRAr}Hzfj6)(F{f3!mAjt;6jx(EjGI~G)f3nq+2BoHjVl!%x0MAhXIZ#e zFXLbqrdGg(wJ9G!QRpExcmgNvR=in{Vu3$=2-9exEy>?AgndGNq;7?YE~fa@v~aSb z2}M3^u-iyOzrO?77@UswpF8Gd|EA;`e$}UBo**PNcLtX-^9+f73L#|eShF`NKR8Yz zDX+`+0}t@bIls#`pWi}fUv)7YjoHOL+ZCU1LM}Uc(P&_I_QZ?J+aEBmIT&`n+ z)E^{Zxr?l<#B=VTLHdW3o#24AHt=^zF^r#uOY}sQ$R`)^M46KkzJVlbl`23(WWWOv z?cX>fw>0kgj*mnfBVVF{)X{zIgf@CA7PMiC4mVk3Ewc^^dIuJfK$=P|9!%<1X~+ts7w~ zErGssMG^xLPBSqx=cNP|-(v6>1(# zh`KOq3jRQrdk1`dKeG6Ssex;|w1k^mlH|6@li{1NcCII`Mg^~x+hbvj<}@ewS&t!% zZw#huPp(j^RiRcYf9BdKHz-{bm#df@q>^7wfd7GoU`#0iti$vpMx*P{h>oZNVAj9# z;Xpib&j}8rDBTBN^<|kQSYP%uLYat7VGJs$Dh&P)F@wv=ppj+0pgONA)`iA(F;rk- z#~D}{Az9G&paj)~pkGB;xCtO37tVHo{J}A50wGC#M!#E%h{ncK zZlPRVtBfy7-*o}ZINBMsfyp7={7m<@wwo83bQt}k00ADSE^I3AQNi_*6D)+Gr$J#I zyLp@fQ_qR(vE+`-Ag&l?+~4$eaBv;GPM;@hzfcUiPaK)N0z(jeW1a5sHDjM^m*?? zCBv?*sUUGh{$MJ{k?Ohm8T2=XB*?g8sM1$S-T7|kDK-jm^T?JuCiA(>ULRx573a5= zQzdKTXcjx!BH`1pq1(W+VS}EWvg)Lt_$8maK!_P~&~#?8k}O{Fb^?TKD2!qA->XNsK-T6k8b9OTn3NZV3O(- znvpeX0yM}6rjC}I{)LNsW_c`r#Ot0^!Wpbf{3wC#{y|Vw8U7kP5lc463l$gPhHUN` zBhz<~B>#<&*I7iWh%=#KQW~}dvOdb*PsrQ{%<+qai+PUakR$lT?@2$K$h#yHoS!|^ zqugokFH~4NY8$iST&Q1!v{UKaHTnThH0} zp<_L_rPsLJznL!ogg7Us&RfXqHH;ZBOf$V9@8F)g*yk@|vUl=Xx+fyM2EYQYmrx1w zXJe zXiL3a3}%zJ7o1DsGCAwU=id1H639wEPhliyY}`F$tuIc-r*}nF)IP_uMsCW!(q%bX z5A?f^y1g1R0#qQCc6dHb+afve!1)_9_rT6cb+!D2vti^LwT`woGft`Q9siIApAlD_ z>k4=BLg#FA+JJe6A@@$L5_v{58M9QYut*|0B_`(DRKc;O!w_TBIQNcwU=sM0<8FlY zOqyo&Z7f%wI(J8{yT5L_LA$%@O{SK~G>=KPBKb5>0r!!Abvtu+$-zFi4(da7 zg{Ov>gU^;G-qd#qA$FTC=Dw{!7aXt&SW13fLj5cIuH(J%hW-?`dHX>Xw; zfDTdm5{^a|pY^q&@vPOvU%l;mbzNJnjkPKSFL!B&>PG&NS^lqIMTx#_{8(}SL|1wq zj95xK6AhXbMxZL`U4Is#Um|)`H#e=1Q!15)mTQ;WK+0ii-dgV--xvEj{`&;U5G)&9|iK)hV)Pl%DG5oqHyJlzP>z3;nD~P zDI{_e)>Yc1oHzKt4Q?gHrq1~vpClza<24lAx0bg=-(T^uNOiBsCBGP#>_) zzg?eG)%&z|7LIH;-4iDP^9OYIc;VA4KOuURVxW1P~o7S|x3;JJ)6<^M2nRTQy&?cm~1$ zvZ&&TH!8VOnmMTxB*pwG6MBY>#R;A^Dx;J~_O)=lQ^0nkdpw)FVLPY#W(9YLJh$66 z?xSC|^X*%|I9{)l#qloeLwiXoVRD@-x*GR`kGxyXZBKxZPzzc?qu-d$_d~ppgzEoN=fS=5v_*zs z=7eHP#K9>QOTKC1L8k%=L8@GljTxKyokLBCLux7?w}8X=B;8j2dOBay>un08!uXyQPC=&dJjPQ%kG{UAi;Bc-Aete}h z+Ei+4?GzbW1w!MQl!3GO3r&hO015OTJ|}Otq-`@C1Qizw%D|Kh1*eG>JP@PU$w74I zybzl*b!WZ%M`w}Mq%Z>)FitO@xoNq_5J&H^_~??KtSX$l71r1^e42{+_T{y}BR98S z7{zYBYz*jsy0gLkZGeK#M1>|RYfw645+tEzi8rA{BYgzaCr{{=lxE4yKNR>-*X^`?)PMcV@oMX4CuRDo*kX}#x^vZY?g`iK zcJgeutxjf@Q&QfAE1f3{&DYmNm`AY4-h@2m z8L2`}Z|HllD~U8gYDP+6svTFp8Y%u4VtEoBEPjh(>|J-Ndpg>v8dn#sVg^@nr;4G@ zbfempb2DVPIUC=9EobPU!vQP+2ykpqTQpl);l*Th$4hgXTQ00!C_kGYwp$l*T^%k7 z?es_5@iS|CJS;Qaaj-yH=YeT0uSEDy>uMm)ejJvwm949&Qy=XB=92C2*1OMVl_*?6@#XTd!Inm=OZK-gkY~M_IMP56K*0 zFVt`qhxRm3yJmAyOZ8%;X@A?MO;O)Pm!cuzL;f#~Qh$Hy0{L~}!o~U|^^;znAiH!z zgw6YrzO^^GFkU?>vF6rh&zAH%piT!x)BG3DLxrQS5nP&2too?mU0yy)U815hxqa~( zOnk~~qoGP0mA+0NlOUWdApa!IgM3~va3L39e~flt3cB7w0*xIZf%F(z@2VACOmDL> z!^PooGsh?L<~y6SzmGqz?|F;rdn`PC+H$=LQ+CdjARZpB6&MAk{Ca-c;B?n!;RQ-V zI$!;(*(J7-RpNZv@ktYmEt{>iycJH*K z>eofbE5vA<^#*v^y+*^@Kc3z!h}6)o%mWKJ9hC!x^iUhnVz8={HJ8DP=|4)P?ur3) zP`C{6yKD-1vD4Yh6tV4k6=cK8;_*|MlG0tt={u%-F|2Cu>$b`7L}XZeMP;zD!|A9! zXW78-HnXi`>hCPjL|cb2qrWR##<8f@%)i{vSd2L}%KV{X;Xc2(CHrH$aTj+AHeFfg zHLu#OOMLBgYv3tWiq;LKX6M;JhNGDZ>KhH zS#k(nOk01mRHbBxrZ8W=XpFl3TqpQqy*=cz+5i>L*Gr6F@%NV1!fMNPI(E1I>`D=* z7jG8opJI;{8;-R{;wyI!{^&kIkO6_yt>RBL4eIg1ayzEcE@q&#OYq1!>YXV+_C5Dc zpAUt6+6;wMtLbe}5C4FQ5Pt81sV==wsNaYAR+J%d=pz_UVr%8M4L+t9@!sv5a^z`Y z%(gF+VO&8=&C{MW*A()&69%&`#fgZT)4$!I7f`ZCbYp5uf4w$JSHf!DcQ075&33yX>rVtq3y!Y$l0OrC*n$49>dWK z;JEDy^;J#GiLfOj1fKAA{|I_XnS)94Gg~~;y2j%Y%5NAeiJ>1zR z-j8;xz`NgW;fC^v)%AAm<^dQ*GofYVmp@?T+xzua9{UwfuZbx-v|yus^^7r&>KHBm z10)!YQfj510fUFbkuXio$HX=HVL2^n&Ln+GO9DAWN$Br1!p^{~m;Oq`#8`@cIL;yC zl(uJA`A$W{ZMx!B-!};B+EwhgKVySC8Vt@; z4oT<6t#?VBSbcDM)2#pMEb}F}Pp)=nL;Q5A!7y9M0`nnb{Z&<`6GX6MblbE5hm6mkD|a|K_)n>W&mGK^&#ozh zU&Lyyo{hnTvDrlLTELY!k&K@c*1~(&|9RHLB&4iZNX4S;Ey$juf&l6#^Ek&*bWpW&V z=^!qR)!+F$q%@Ps#pCFf2(V728KZ}g+eTXooQfBHxh~kbIGzhl^EwS7cW?8XwW9J} zcJ_S9%{(3KT{|D&pm>G0*SF^7;+XrLNA_w?GEP;dKaz&rx5HoW!$`ywg1&f;8{q|k z>QoMW9y~0Y;!y4~&?%?{2(3Uoi1n7fFgjb3V%G|OwX@K!>Suq893Rok#x_Hz5PI1{ zB59_t-;VyBTGJ{{W=1^RMa@AQp%Zr?cN(hVMd(Hd!E8BuaC!TK8l_R z%4(I!d$J&#P{lN(w>`S*1YrxL(_xf1JMu-)#(YaZ4~i*2L)VX@Zz zB+{N3iv|IQLfpVbwv@DAEdtJRRVpNjVhJ4OaPOtH6X$*3mWF^gZFZd+a1|VnDdFLs zW_@q;-YR&#trzA3Qa#Yta%wGz(*)`cJv9$0eOD}?)X4Ep^Xgx6f=h#ui36m_eI8th z+EJTpm|*(RnA(#=&tR#aDh}>$jsP->gYE z|I#wiv*%o={_&*5pMzg5lwVpk67HEe<*lRfKe~MO=$CRaSuJU5&nyvBG)t0dlJ)m& zPbTt6vsa%{hgPYWH?LUHI1HS}YJlK<$gG1I&Y#7vY~OA*QgfFK8Z~_z zodMSZ(ozo_>__V%Yaj*8d}cF+LB{03!>mp+6??QFP*#X;#506zg z<_bvvMBL^V-6W);9GnrR7OrosB^XGfB&_hv@MsdTQ?L?lq0U`O7n4 z-QQ-9Ko$t%sHwWzr!p|fWgjLEzbbuiT)%2@G33@>U-(#fw1(Vz{PvBXPC;45%Bdy; zVG0jvOaurS2<3XqOM>=iC1=SAKE!n8&+@m%;Vj@{DekBL5oH%;i{civhLeV@Y#E=Jc4 z9NW0}^X{#yTZVrPQAT66poI&Q9Z75FBX zf7UapE}I?i)FfI6l&i}Z*OKFA6!I9Fsh-xo(EGkNm~Rc3D|q^68$xCy`&O^%c=U?` zT^(8G3J(=M8~d?-SUFH9C;y~hSSNu!{n0`^X#D>ZJet=r1Wk8a@ZA^!O zPqG{Rc06sV2$2kif>biQS)$Nj<7a(FPT*O0HSu3_`-*OlFt<7cr+h{;+)ndhl$8gq zZhtu_fo)gur|!<^5ZnsBglD{Lf00(7Sv2{e@|Z|+Ocj1DkCS9DTV0gs&0G3ECdq;0 zj)1f%03XbfCOll*_;gd9820I`9!sGT!<-|!z>F!sgOH76M09EPvk(s^`r!hk7rw*6W5Vax)@Cv2bXK25wi!k(0MDvESdHBHz9;cG@s`<7Ei*?(d|y z+Muj+q@+}??OO<0ck-%cIqKefu2WX!dGn^ltNY^X#ixe#);ARoZyHkf>U0Tj%787= z7E0uaPPVDAtscnSzj@}w+olf6i7nc=EgZU0a}TSyaAKl?ajhgULmrSW5SDD=Lu4&% zRvLTLEMN{6xwou@t>an9`Nb?E0kjg7JKAT@<{I@2gPmF7BA9GjOTC4HJq^p1jU$yq zU4`@bq|tW8%rI1({4^8YkZpm^+i<>T?f6ZVR|l#e*RyW+^vxOdXlufMveCH2O;i%b zRxyP(B|sX3D;rCPOZSpilU|dDPFNL1o@Z5IOc=Kmh^6Wd`wKOkb+X{zQCTo3?{OE7 zz0+;EV{Z+w`3=bFJG-8%Wcf|mN#ITiA8}~#a^O}d)T66BK|TL+RGmFHvP7P+xxK<&+6lE1riKQ`Frv83&((CKK2gvrb{YX@^{g7ZD1i6$Q@QRMKttBZM zGYgY3=N?L=oe7hcm-xv(DsR~kX5rIiuHUO6d&}^ELn;4nDBJYoHn{fZenyOy8Iun% z@aLo+ZRXji9osRHRr3naJhr$dkE6{zc9DJ<6SqWaG?or;){66R${* z+D#$d%m6M1bf*IL_Ysd=?IJ|TWRUw25!C+zJIRVeDWey|HgzZYkiXP1h0`__8bwPz z%`xDJubwfN&v;`E?_sz7J44s-1gnFi1S>s8U{~iow-^sFDx5?>)z{NQYI_xzy~i9E z^}3Q5-J?LB;@CJ-$Vt=x`rMrh$*IAy*6RmD7x(!L2qGd3jZiTMt9FZG_~+&*7ynCI zS!}^7(ICN>GQVmG%by<@A}JN$YaX#P<1Iq-ZxNb@JUnI}m?&RSLL8g6Th7&?F~0Vx znt`*i8tOuo%BFsJTeo5H?o7=%bsxJei=Y7uY*am`JEQQxiP6ldA4r2Bux57z+U9Qu zl}CRf_b}og(IAzVGW>OfZnN#GED-`c_et=&OPpqOZk%Sf1V|tTG1$lib{pLMZt&Oa z+-ZQf1Ugkq+6G(j78diVX~X$bf^1X_66KB(9t~f|!WQ`ofOxjW;@jr>t@)>!DYn~GBN+DBz zXe|^2xz_~aydS^ewLd=@F|ggtXJU?|8s!!$(@7bVeOy`@l15j}Cc37%ioligX-gz|MIj+i0 zI-9z2O|`L!!HukV&m3q5;4}SJX19d`KQ~JqO86`zZ}2pT$zW20^bih?KPbUv+1!zn z45w8c#4U8b!bw+2GLVtD@RvCPaX9I+zX;3*jAoH>FfDh3;H6W1hD#uD&b)B zWPfp29T(1@(KTHS95g#vzJn?DI3J#_LBrBtIiP5!3uInA{AbIWI~QSJ7Xb;j;$zmB zV#FRB6-QAR7QIp;vo@x>(MvuoZLgu)8Ictv42u zxJG}S5W&u6W_&AJGJzK+`5%^F!7~vr=)`Mc?;JV_yzprh@ve8(S1Vv?-5)guA4te@ zCNx7x|E;X?d4c*^f=R1TKrM%Y792w;@?Dc_PFcla(X0$0a*a|5>!;TjODI+?e}~yD z(#PT>+J}u8WiyF9%EsRH8Eg4>Aep(;Z0w~u$Rw-OtQwZn=!)Hz@<)>~w!qf51Ch?gK7dR@`rPSz(QLkT zdBD~AIkWdgX;wMfJ5=9wm3JO-d5-F@{ZinV-%sV;+}m%A+OAEhIGgW0Vsu-L<|B3H z>x)Xo##DEvTW7xXZ|)l9xwi`C)KB63(zE&gsGMvPF{i7-9N1{uY!@d{w^UU1OqLE{T{*k>!+q(KzTyOLiF(~l5<`4vY56}W=)YEdG_ z2~ZSP^$oa~IlCl?611?yX^CFsfvl!CxRt+ryE76F&f~uKc2W&I1x1yR@ewZC0_@rN z>WEXvnsvTi@$sRP&V4pM8}iBQYWuKsg7KvWl*-1Hgrm>fxurOlWa>mpGs zI%>`^m1_Tb_=TU8p&P-N=bJ+s!o00!{)kUSC+LU5}DVmS`Cn-ygiDK*_@?&g=;7) zx5RMUK|QM@S4?O>o%O*V!A_O-+~26sHm4Y*4E~h$E(V(*N{ujeS{-qlDFaalC;GNuz;ffnhUfYs_ z-~}y>jrF4AY|k=Ytz|!M6J1`Jaj+oigA^>LI*Ep!eCWQ^yBpglI2uJ!wj%V#R9d04 z#{VPOgVUa)yeYSFEPugq^hiHRZ7Pvgo?ae0@lJOEVB}!G2|}FZ`)|8(qf}gnq6+oz z5qC_)^wCvE6gTyxt5N!Xc%Jqe)(VraA%OdXXy6R4!q*dD^0K{tje3fex;`2k5$$3A z{RYBkle@o=+E~v=cqLx~KNBei+ zn()F#G-`3?&Lq%FJc4JP4HDH3DwgyTh(6zWc(s5^e;bi#?W#HdOxIP;Tj4{ElmHzw zhzXOfLXuQ*m}iBJ{Q&*H8a|EJ7CtZ_{~G4A7sBEGu~``VAW~Yq6}4HyQycjpP|y5I zEx-9I@~^5ng7&&9wdqz0&%LxTG$caZ*4yG`iVft@0S8l;*{$ysBM;G&y#H@Eer>RuU3`<6phUw7v(zcdwg*ZUAIk?@vIM{vmFwMAB_Ax99Dc*4GJD9$q7n zSkD&|PLxhh3Hsv})(`gvok?atiaDpAJ}y1!WDPwvvu44XrBFIty4_#3YA}?*6R7^K zDZ@clqyz$UieUc{;h@1M!Ay0yrD}bY)Xi5VpTW$YtRL+~CFZg7{Oc0>?%0y3aKJ4|u zeKz=sy`laOz28tMFb&J$F&$z!b}XsL{|Vi&%~-o*IILM$tbA$mbC9D^u%NzNQg=|? zar*Qd!O?2-mAN_(S0`-VGD!&1k!rehu{>i+o5M)mk=E@Qtyauw;U zt8Jz(TIjgqG@5<+SK7LrdFuWNcCqXOo+kbq7-VaXAPw(7-h7jEVvGQs-S72duurzH#eRbf>i1~{o48*>5|X4 zJ^MM5nouWOV)pIxeD8p54@B+VDC4s;efABSn?$LcJu1CX=2fSaGL(cWRmksK0wkO& zbgJm(Aq?=?@ru0YuoEQHQwEvxh+zK_;lWc+kaTt?!Q#mp8c|a5U^nS;*69M`x_469 zllmCK(ZRvm_a4+JiKnOh3a{MEcx5jLrDG9^MwY{?BWg->0m)o`_}SW!h5*~z@~wfF z^Y`b|gu73EfP5MpRgGpzxm;w~SoiocQw)FYrs2VOYhypw>N|6Ly=Sgt+;C1f8KcpFFKG zn3H(0p}Ws(g{VBhoTseiulqQtWRugS3=1|XkAt5Vnx3!iSUlnUDvbcN-A5s z|MR2uF2s?DADw#$&HINW$Jpf*2&%l(4`xi1%Xv({3oxr&s*iM+pU&*agK+N+Afg_K zKjEL;JtSwIMzzD%3u=gDcEJ+}J#;-vTPCe00dtwcGxK2|(X)$daYO3Xxij!Mz0G$# zkXhHz$;t~yMdyEe_P%IJgNB}Wj&k#|q?{afX0AAowb8e{$Q%aa3Q>4VdJ>x>I_53O z;L`$PL~I9(+g4iBm$sp$Ro9ooR0Y1$Hh#9HlOUc5^J#q%N~(Ep4L*`_9K&p*V1zX+ z1!<28_mahvl<+-=iv?V}5RpIn8HR~M{QJXf=GNWJX|i;?h-t5oG2#_=ntlopeNb(% zBIBMR_g*p)v`CH%Og%jE>5njd&n?L~PW$x5FgG2~kevn{;41f1icYHEm6A&xGvjjT z*n(Xe>pteP{8BHNTW8WJ$6mmycFQi->r6-IH;1<`WBm>?p1urt(EQoZQ6CF`_O(|< zRc++_LMC>E!LVU%G?OCuL!1@6XhwGUAJKVk6S0!dJkre_C4lMEgE2wM*A^csCHEPC z8VgL>{uGQ8lbF zUp^gs)mU~^qPIU>jlFTK=39zyj|0CFs(_ehI&gmO0CuL3yS68q|g>4I|%Z$rS z+G^{PY6cFz2+dOk?%Pb4z`KO9;RPVtEDA#LwmwriclPA7F`s-Ce@d~wHR_Mk)8Za| z**{D$D;h^OZ)d#hX3yO$UUC$ zTu2WZmnA+#UQbC^)R5$F@S|{pZNb%=$8Dn* zeotrZ@!73075+Vwg)cI~*(_`wR%La=ftBrL3x**@RcU1f$YtkW(|lNT5~_1y6? z=QmF6`LFIi;+>tOxzn3Gz6G-DdBcibFI==oqOYVS{hjOmKsY^Z$?RKpRIk4R%NPFe z(@IinraSpt7uA<}DvkxOe0nFXr6=(pftHj^DxqPOpyFOi`a@ufc1&KO>z(X| zm^uj-(Kh#qGwXn9BEdbVqK(rqL57l&5pWXx9I37Q^@tR6&8aN1_>$?0?%LPUlRI+C zU290`y#LeRn}A;^n&&=8Ip{j~G;yw4(Mw8VadO2j^#wcuW9TMfwrzR$^nq}=hu}In zglPz;2%$g5e*_o!3-s|IXNCK4`bXN>vUghA1sKEdYe_mHt_gw!hTBg8E zCR=*?3=-@-^und>@Z#@J|4KLACU(LOoE|Lglg(bNz+IU;Ly7ld9)cJir)DubiK0m~ z83c3-gf7c`|6Gtc+Q;MR>6H%Ous%XRsQxmhEGw3_KJRSBQrUB`8A;`9qb+MH@(9iQ zl7nglYSo=iieqhM-T6nbXQjVzv7$30{@jzJPn>xnmm}AuamB!8g4wNb1Srr40>M9& z?#=K*5pM)xhSmr(ybVD)KRyUuRvxk7RQ=^;cIpZ%rriJK;>>gH8H{q>uX%Ob7HjU` zEWb>VIL(58>7w^4^Ce~TO1M7c+UD#B+&C&O65Ve);}G8I7aeOk$ZCb0j(|!lSK|0N z)YEiS91C1J0MEGdNce}3a>)vhJd2{PmaD=~;kbOM?f2>(tftTZ5-Y1QWKPHsaynvG z^`9fXhVUnK3+F9kLSCy9h=D@UiP!Y`yir~q8+X(*dp|McJ7b5Z?R0S8U{}XnR9o?q zO_O^H*2X|ghuNw}IZgH48GTr3bCh7yqpU(q#T}&AeD|MEu$Uef)!Z|M2if*Kb_utE1|2D-B%7 zzrP#`ShvBH^$h}3Nd>5YOPpvAAJq`t2kqIN$tbYW# zjG#NpR!mCFk(wNJomQADX_CP}a)FOt4LkIc)_KARxeOq9&-B&^L<+dtg~t(&+>AnC z3Zomb5U4p_jQPo29r&XGi#80kTuJoKVZ3(KL=+a8BIF*>I&g&c$Z$I)z+f!(c_r_e z_zrR_a{d*M)2Rtn-JLl7^h7cr)Jn)542O=I{SlygF4@@;T8+~5cBaIg_(UzhM*N9p zO}g4U!4Gb$c&}~0lUoV>?a?EVdPI-r5k2xlM)ZhmL|~o5enE*UhlI(6+I8@GMrOk@ zTD7yh$1Brj=`dv0T@RmN(UhJLRm)q4Ag)Lxgd+Y3ax{K-l$FVt_j*O7AcY7i8CLp) z7)JS$_nH75i#lCL`2)1S`^}RtM1l~lc0_p`jI=I9exW4G^)vr9>a!bvHjpK&s>c_7 z9;GF#Xk)OXQ693_js6N($bFw!!wGliW+W}&S>-FqUVP$)Yp2!KRQB)^Ic&+}Xtw3) zV$*8+$+XEA+#TydY^$UU0VTT)>x2y8AIV;tPE%lIJiuR8mZ6ncTtJ+KUqQgd6yGw= zl*F8Hdy|WJ=r3eo`xaOQ`e+dDn8C2C50t%;#^1uQ-NaOibEZFef*}S!Z;E z-|RPazxP~>P1z7WF?M<7An)8-&vhBm`B3MPTszgm(BSEZFscBz-}A#maaJB&=W`WH zI=;7!_z?j+x!qiF?1NUZmSOcdd3M}K^6LNxe;a~DH=5#mG2gp~i!u%;w7 z=|!JkEOeBiPbownL7!G*yRs)CyHm_dr0_1oSuMOg78sVkYj!|FF4QbV$v#6tC7fc| ze?(;7AbBt|9X4cERAf?XlD5WBprn!?vrOxk@W>GcBfy%{twwjh9`>ajU3()flDUSh z2tq}+EOnZT@#+#n#gZ0fafeAn-#@osuk@fa&N%!?0}$N@k8V)7gT0`mKmQ2O5{ImJ zKX)oo6@mQMm)6GTO20(nH1tTXb-oQN`1cMHvZOB(I{LK|tD00p8cO)6XAgm%77 z?!a)~zC@s@F;|xV)1-#;nUmsFn}Bj{Dcp?BWA!Oqfog?_ef%&q;GJ5%Grw15*FxI5 zf_#nkhO-ss7e4INY?1HX6ypbJx6k5NF110K0sipiZ-_WzNd>|DhNwYY@ka;kKD^pR zrhksufVKFMZkP~IPlzYoRAXB2Q6YwMQfo+P&};9Cxza>p%H6~BoNQbW^p)ysGh?NB z^l@*P=msC6qfYSr^ONdxr!yji?g z%6UVtv(6QrkjmSeJ=Yd$&Gi9+$@DJ76SDvUlpjF3ap~|P)G+(Z#W9m&5*TCX26&<| zwI!kyT$s34UeG|f?@jbOig%ptTAKB<8a8_62lm3Y53T>vn&<#Z_45%FN?rw_pI-xf zSCj!(4MX0(3)xrG6RVQu9C)zlEPG~Un6a@ZvUGF*&R(?^Zt7_>@-%Q2CiHubakY9P zSm-xIt&gp`pF(h86<2bAOPW3KIkganX$T?l5!gcB0!lrS{E1mna~+@<043w!$Ns(V zlB5^w>N4fgwq6~BtSU|2*L_vr`-&TpBV1uLr*D{(YS^kmyHyr0#(MYPO}0(!`t=B% zjCGCfWpxY#z9&XU^qx-0 za4eGOk6po$3m+8kA`5XZUZ5RjMlXJ(ELJ&q{`o+b}|j}Ywq zII)@^;iq&^yPBSKi@kMj7GkI_vz)n}mTice&rbgeVId(~9dnw3!54H?8eUL*DnMXH zRMe$=8%!U7kYf&)cZNu z{rz$)dTvpRw7IH4ze5|MVLGwssx@|#0Z<#FVM}noReFsD@*KI`19=1u90u+JbIkri!;U2DkzS*^#-K@Iy{nN`uJ!l zWoZv-6Rc`}ILA#NX{!`S{9yp}EUBBDUe-p5lI}|)Ge84+7Ad8h&P|!9(PiKFg;iY; z$FE5#>&fRijOO48?2?oN&w#Vlj)hYxNfWb4+T zeDXdSftU|&C}hJs;G(+!W9llyqKekFl$5lB0@B^x-Q5UCcX#KOk`Ae%ySuv^>28qj zkd(fo=N!GiUS`Yob+j`ZW~ zfCj{>=oo~Bk`2E)$z7`b`q2^?)uQmbCgG8bF@^KMg1?!#O z`4N-`>{R*wT5&1c1-;(2UqI!!B7X0^9wxmMe>t1(38|IYRN8W?hnIq7nI89kWzzBf z_~~7FoQ+{g2(giJ@U&M!c_jULaDAQ%unL9Wku)N%d}qbt42~4bj0q`&BgM?VlQUV{ zj2LNlNlbEX@#aKRl|&)C;g#WgOz6&O0xR(0`Tvww#>0%NgC{xE**6J(3YR(7F}b6= z0>y~zeXNH%?5qjY9o!W51)Anv_A>4=<`K(u$XW$1dsATq&lmatl(o(E#Q>ZU6BV!> zyZVC$wEPi*7wES6;=*|H+U(MtoulH8`tg3n2NFbPwuQ3UwRSE0yyV&1QnWmPyjj`N z&?4O`=lh!1hrR2mi$ly#J;nTM4?k|~;Z1#`jaDGtbi793W6K?$b%x8-MkDGi_vhnw z7x5S;oc*QP`Bi#;y!xn=wCB6ZOTL)C4$lcyt!a&NCg8C4j4F*~Ts6|S!#O_Zs;nfO zB&sC$UD#%FY+)pez9N}Ksl^t(GkTy&uI^N?2tI;%Ry`!tGD3(BYG*(+KUw?p6=i4h_neXHF;J zM+MH&5>FxueF`2Kem@`IJIXgYTEL_D`TE(-3o*(|%H4LxncwYwSHd;t^Ks2;qUlRQ z;LGSk?YoXj3>{{ysE^KESILg&3x;|b^IzPKCGP9x!L9V6jt^@Kc+H8D=qA}@MWK1c zMDGTwu+)zrJ=a#b*tubvW%#s27nQZ-#j8hpd7_TB$(P8Q zIs(AiO0j8KN8)1Sg>7RO{YZf32#l^cSU)#$&#&Jv>|ql8;)-cMVV+}(tu7y-BAq1J zGeJiWTS<5BCi>97+bw;j_*z@9Li5WH>i^F3(9Gp+Xyo`6>f+l3<57E${JAK#uQi?P zv?P;9g}X_+dEjk}%Z0x9PDA)X;WIf##fg;=v};NPLT+7j5V=x)&oKx@O$6})u-3(F zaeyIND0QxMw~Flc;W<9psp`=>1r}gZ=#RQ)ABNcL8-B4fZpb=*SWqkww&e=)<$ZnQ zjxpF7NrDomyXPE78Y)s6DJkSG*T}}4RLNvXsv|AQtVagLRQXqfFY-(GWU);3!18D- zl)N6i+UC#m^z4KQ33whZfcri@Y}F8e(6-ijW%*ChU*_e-iFjG6pjdxGtp9*WA@3L< zXj$u;oZ5|k!SQk1)B%~`IlG>%!w2hT!Y?OEH%D@PTdHyz`-PS*k~)SicSB_SgutAeX^mx73!rkH2u86wXbIe{x1`cd+j z(?`@00NgNN4n7mEETNBG$SVAzWb2c;p*G=`?>$> zPZZ1{{*kJ)yAKi*>F<+(8^K0@}-F4GhE2D8p&A zdtP1^I5bBEX`Vj#iAX)o`OMz00`!0PqoaIbI99y4dj;8JQjN|83h(_4pN(!z=zd9_ z^eLo}N?!)TEfcc)A2Y9f3t@Z2KtcLdbg1~9$r<}l>hF7D9iaAS3XI%h)h~kYP)fKt3&~oWxYpjJ*}bJ{;$tQrs??COJA0-jx6G1260Y1yw z{L=c@c%08Y2i$*A&#ipq!vU&ii?rlA^-gV%-;m-_|@S2{>3)+9Lz4W#HC~gCyF<({dQU3 zj|7L$jhSmUcA$in zvfUK_!vB_uWzcPDVpxS1-X~_N{|6W_aR}9E_E@$RMS$ME)8s@@6VSICY0k zVu06`@ka0l=ZHvcT}FRI$vW9onEywBAR*wKHCwC#tBS^=HyLVc)6a9(Ssh?kA z0<{sG@2qu~q$agjvra`L`s6(nO1v|wwbUZLG?%I)E!$u*c?V5@8CvG!eH@z8JoCEz zVT|-nxp;+9Gq`PJz&K~I(F%I2dQ#&LpoI^M!O`J_am7lep{1GC+)Nge5rJ6s6}5I0 z`_a=OQ9kQwVgB_qZ>D+xx|L@jY~uHT>F1 zKhIo5wSg9HoYeROXm2*e-~v+m;^l<9f=dHQoD<)(D-n?bGDi&KPIzPp>hHTy>Hfwt zcnV=Rz#3);wwqCez{lcC!TBeZcCg8V>_ioa$c2jjqrv5V(*lpSZ`Gq_`C;9?P0+B- zVxca@@IBUbSDPsJSZpSixQ}>Z6j+KU=i$V_Qate+h~IlhpkAr=(v+*mM<G>?5tC-*CGKFtw2*PWTIgE)1dEuF(|dz2B~=vVR0 zP8zlUT%3p{GU6=&=jS~K!{JKnQ6MGfb|mBU zG{PCW0;KuWH>b@aIrb;6{6dLuJE6aB*5p(IkY2u=HFTeny*ZrS4Fgwr^c0=nMm9se zDG)R5D$>@=;O?|LRJf2KCrap5wMlrVST3nb-cJ-$Nz|ldQim3lZ2C+Eh4!Z4AIUy? z*jYHabNnV5Z0?=p>6hL_mmqgi%}JMvfF#sMb5j`lwWc8Cda2J3(9@nkB@Fh@#Pb`D zkGJUcclVLwqTE>fkNM0g)ULa|B^fVoiZO{ljM67OLHJ>W-)T`NIy44$YFRpA&V$o| z8gL_Z;5ZLOw`}H@eLs?+uH-4zpRsJ!LLL&;lVTZwku^epK0jxg0b(sWTjr<^L&?^ zKX37oIl95uJrA?d+%BG#QWKo$%s3C)`e9iCf2k zs|J?-41wf~ZHzsL(tXitK8Vk~xJ=H`{XR7U{a1T!NeosG`U%_(120q)NW>lWnL%m5 z!g{X$!sE@DebG%Pt^J-wR?|FVF$~;`ZY`uOW|ZNlDE>tNptupZ zxaRw1;Au`Ue+zE$Lrfm8om!Nk4ov#wfjKRupC8{XLoJ#(*IbUCBq2x@@2E8YO=Dl> z196jtL43f-V+MeT41V_Sk))vzWu6Bz{S00^qEK>&rLO#a8>~4`(}-XNk`b3gi<)Z! zJQ5ze3DQr4J>3O8fRT^3&#poHOmHYZCCjUp`7N_Q6*!3ohldicvEBNxFaLBGOqmvu zsPvvO&y+C#t(XjDc%l+C<2(DrKq-puxN=Fnolr9!)7&Y0++vEEq>B#rECz$WOwXA) zBh0_L2&SBaNw}A|JeU#3mM`F&`gQG6v$k%f)d!$9h`4)sUGDX=Z1Z&mPAFB z3~`l62oyq24iZI%y}yNM#`9+%UCAyx!fYHb9x=Vf!tLf;j`JK5lLeQjOw}kTgX>km zbtsg6$rgCZ=DV={bO8*Q-InNNETpa3MJge?sm4CHUljkPrJKZ2So6Srn^gcE!>vFv z)@aG=4)>7(72OSxi9;V#5aW|e+hnQ!ic}`|HQx1CQz4@D{7n_^zQ8?IP zQ~{rW9%Ee!<7STlc%pax!`g}!?uq@o$9l9wwW{hMj>Mu7^2@4w$D|FuwvrzlM?bme zalNir$0EqgkVmQ=V@^!gZDN*ZTvn^A&&*QHCtIR?6}}@&oIN9UYE>bgcc0SwByX@} z)Ul`4sF4(=(+znJ#~klOb%hD>Tk(N!CJZa*tn6!C8gFw0x=s}qHC7yuI%+(^BJIA{ znfRByeXVw&@q-Gi5eVQ95Ngvisud`sQYD)t23n|;wE6i&eTG>_iT6bq;Q#-PYdDnQ zHA>N=l!I-d@<5ghm$JJE-HrLz$uxu~$BLUo3S?QiDakxGpbQYTx9QP$X*Jk6ohWU< z(_Yuh>yG@K<@LdU&9Wn__EX`q>iON0-?io~2ROo1wxzwUga2~M9(E@~oi2>D)kw79*Z8TZ^opaALrt3{INU$v+aNPe00 zdv`Y1GO+6doHihljMQ4|slitx<$mnV`o$Q%OC>6yDi|NFp%ojjLnv9t`#?5HSw#HFzC2GZd&w4x zq3EwF5aaBBE55qO1s7?UKuKK651*{zWdl!p((CBYudVshUex#U=S$X@o`-$9`1CAhp1;A7x*N`QPPvrE=zRz2Ous{&M{qA~EW@Bqe45-X+xz z>a(1F=RYaUpMugl*nv<3OQ}lqE_f^kR6}+ew=zW8_9B`Z&E|`7?>n5exR4PsEpUWK zcAKWR4)K^7?Y;d+sdN}AvO|(lA@oJ4ySMUhCF3(m)XcGq!EI@u?_{CHwEiaR%!o>Z z8moti%K>$)j+SL3&(Axjdy?VD*!XsiS7o0BDFYj1ej;ISZB2h`)UgyC(8F&+mK*%( z@dmRWT&@A|FW^>$@E-Qh8eD_FnrzdpcKKn^w4nb_T`1k>Zbdtn6|k7NY~F0ZE>0%64wylv^#deD%EA-pfh$sgTope`H=+I zGv9iSm*DFF{NRw9waFn{i#nqLDde|uxk zP&Kug{}~$jJZ)&cxTEp8H0S3V7YaJmbw*M&?OeHia@x>)*X}^BReL$OW2so4 zK8zCj%_BN>%M;|OqSsGLPlEmDB6^CL%()l4yIiO(dNpjZ#GXIa%ah8TH=2ndG=Yw) zisGC6I_|uyz~|C=qz{*N>L;M6oAZiUebYH}q_2jz?|;pkFAOAK4gb |k&XeRRVc76ej)!ya#07Ex4Z{gVvbN-o@ z9)R@gt-O#yW_myb#081m8%~#`_9tX|AxNDRIB@z*>e=dz_#!i;>pEB59eT!>_0!HP z6X}?=h(%G*!uN+fQQKqwV62v&9GIV_w#|DJUy4RdfkmquP}ea%cNnOa34;1BPm8V= zbY0wUu)sW(g#q(4->+8y{09_xa(C#l%#Pq=n->R9>M4!H432h621`(RidWT6x$DW& ziRpt;(b2el3-|5z?$NGZ$tOU^hW%)Fp<+%wISkQ@({?gTCTY+r6x8(={MJolhQ49F zP!QqU3L}+IJb=E)p1Fhtc7FhQ5&_c|RfL(u^o%ZvFZkKNCb&$l_|NKLmzM(F-6~c5In#wFm6F z^05S6Ijsk;)9o5ITe0O2>&bx90uPwpPa8Aj52MO}mX+kH3MJ_Z30OuchD74OQDG|P z8Ir}lI)?0b`n#PNVe!gxyG8xwv=h>v)Z4*AyEr9DtcidW} z@TH9(roH)chfRc=!AaNyAIw~ESTT?L%>i=WOGZYOJKH=9_SnWi*qB{4q#x6( z;{#gv-CH(El?$=YBIy08oYHQqh6CSTwnC1U@3>HcoD`=K*vssdEm$LTZt-%D+IVuM zkrL8O5e$;D#|*LLs;7jJ z+eDTfA9(Al$&rOoNir_nmpr&WMPu~sEQAPssJb@}lHC69;*jFI&wy`@&%?2eGpMmr zf^7NmeusWa2p5=yn*z1M)#8Uso`(`fo{i%KaRn;6*RHH_+m^_S-gU5(mBldLWzC+# zmzFx8KF-lqBQ=;1J_y`!Wg$IV5xH>e3*bD~1glS1iQY*pgLcAIPyH1MG15(6cFfPfnge*6K&zch)^dB%%8?BI!% z0yFI5H^c703nnGklvVKCL4ut8SIM zqnpa{XNUQ8w-qN2H@>*$Qp6@(S$vT}_of?vfCKLk!_5qRS22+U?J|MK2+&Aqv^uzl zp?+fe`91RukqogN&s)|qyJ>9pyid~-#2#*iFBfhUti82j3K8-XaM_4T#AffWNFoTD z?;?)i5;|VNpVcI~=x25*s1{=t@9DhRJXmsiYM8oPu)h05r-OMrMZCD6s?WE6Fuu#} zoqBdPzWE32+o#EYjS+yS2yVoaB8ntd$-o5#8sjp|(+1iJlVfG2on6_tWBgmmI}fjd zmkTd)@Jgt_D^Y-<;-tw#U^bWYSh-n#_(XSxkE!WHpO1o9h}^LPzZ$0H)2Y*S&ufQ# z(Nv@da0H?POZZc;)n`TX09(?*mQg-{`5S=zsMsVvK@&`Aau=y46A8VI=y;$0?*h;? zh~G)5iRrw2Ibb-FLXtlj2rS zs_fPW?P1mTv0$#9mN#+PTal8k!;3PWi^2H47v)%^DueZ!oT_#BaY|IB+Be?+PABbX(>1d5<-XqVCIJ!W`TUi1T;ITWRQphG=|KHamlwrU29oGK z$J>Jpm_M+kkSj0nO))8+P9b_FRtc3vu-AcolO{Yt2NxQR{+q}EAF^n6{yUq`Tlq5< z*aw0rp;x+ip}AiZ=b+HZa>190`^`XQd#40{R1Tab82d)`Mp3i{AVdAg|2=&PrAF|6)Q9}$?jvTT91?3DQVpdTe!=^v8j9cGooa9eA8Ma8pqM0JywVwx zcoZBHuY+1S<($xZ{&AfC_-#&P9q5ug-(@9c8;acpprxm0{>euzz1$->w*+M89Ua{bcBBiA4NZgfyx`G#i~q|=)) zybvXVOD-5$_zIc*A7P3FP;9`2u>lk2lP_?&Ay$nj1ycxK(W`j(Izu#;h}`K}8PvhE zAv!{CrennY0vFxY`VBPP@3kxzAF3-X<3(#xJs}w1HTyn>g%a{#pe09`DcipbQ)_}> zxqsN1#lE3!4?!X$y*v;H*q%6WohV36C!_KWQ{sMHZB1Nx$&82a((Ck(ATf`{tN@OQ zX91+tkQoE;uGvhL+IwgDh9%$!i7o!aMJdUN9DILJ0e%r7SzdsZj5PdgpRsk?FII2c zAKU2WPmxw_bDdkrG10=;WS(Z*p4Az^;i1zjsnsFaH!o#U5@c0or-wcHue_%OlV}Yz z3Zp4m2`EHrf+|a&%EbbFu>nBnz2D;gmfeIe1GH%tc$r}g?_)*Zf6d=BOt8UpZ_;I| zI2Yb+a_{!bc2bY-6HUU>*%ZH-f`^FY`$tlEVHEE-I(Xh-l45?noD{D{>>ePnMceOL zcCrQq9rU}f-Ny`Ps63E!-^+{^&%2*IC<0_e9pwu1y& zo8_@hg?z3)J@*Ub=FcRT6mJOV(asSC$&Lw2|V@UFUbVg{(kj@`uN(a`N zz-_PHm_xs}F-hvmtbavl?=Gt>Du&8Z&LGHEiqhJ4BMzG6zrE{ zDdHN8Sp%#Adu^)s3pYZlyr|y8_?txs2%k#89&Jbw35WBvN)jt*1J;2_IhiR18Oe@| zg(K__bRJB6$rR2p)-e(NR?|)GmB3*?l1&kn6nhySrWBWDJJ1H1iv0gfia5NF*sVMt z!H0Sotp~+pxK)XaO2I1kl-5hPBJc9q(_*FiC?a2+l4I5cF+Eh zxV>4dt4&h5LS@nOzHCilGXFh(&_^tH3{2hfa=^RI?K-jjX`r(;NOp~PP?b<>g3w6b zmCqb|giIDHl?7>x=nvRUu@Fd1uWVFdcqmzJW*ZG_k%Wumnfd?;=ZOQN8>BamTd&Av z|Cu4V1>(uC>E)A^gk_{rCKF@Q?+kUPZ}Xi^=`iO3Kk2E`tWUYx!NKLZv6~DMyoJYhH7VVyBA!fgdcE0u!b7RonI-IB4ivzi>+GRIbp% zTn1us*d*QQ8_^%W{lP;0PqB8d%;tXVn12E*)@YW+;tPD;Btb~M9J--e`W1NPLrhGiW;fS+`IhbxQv?4+8E~C)RhPyefEeq24UKUGvfria0@*h~nM#pv)VlG{abFk#Q%5=AJO1>mowVi zZP5%XW2SQb%KLKkeRRTE<6g2)>vI4c5~Hb|N2A3H+0#?m$(JXn#eq2N5fj58f8^O8 zG;DKDR?1MR5g(Ij21Ybq>)&u*hV8_-YoJ#S{uCn9Vy8$jjt)xa^&sn9RR3!@0K}~O zRaITXHC15C!GfXV=PYML#Q`@|SPHeGpP^ouyQlay11)qP@fVi9&Eby$liz&__+i_X zr8f%A*=PH>i>N>;_X=7x?b8jFhyz~eY>Ben$gm#~1~f=Y4;IL9IpDcjG`_H}k0vZK z>AOdBj9e2K+M&`XX~NOpZV4Dk0A{jZVk`fi)?d5PZX_1YcO=ynwS7lZUtA{XsAJ>)w&$wHwBdZUiTp_J$aqU6|$_`-)BJU+W)#;+X@ zy0KQVIET-JGtH^$5rmaOOAqW%j--{+m%+??pPU|*v?IC!c=(L88c?d^nS5|e2pQ(M zz3kr5R}Z);%_NNM|98MpilRgy>EcD?eVs^KcJ?#7FJB6=^{T0|X4m;vRuE`lLN_sO zv!Ajym1RZWT@Fv~OulaQ1X7!~eZD^G%YHaG(;pHA z15_h>nmvnNmcf^08ybIraIE1g^g1?O&dQK`Hv;l!g46&QCDg=0Tr_dQac2DrG+{8NFCw)+s|JFiGWTNLgo)e;Z0s)4z4G;|}!wtZmC~AEAm) zl@PUIo0oGC)O_;P1MC16zlN}o##axRy?e|KWENq{s8KLvM_=? z?Iwl2f9j4jyP={6T)#KF-Zu$IonD_oZ4p>Io_GHw9M;3l;@5>66>D!CGOBC{q=||n zf()rGaz2a*_qB^n7`qbW)HV4-iky=@sRN)2iNuD;LS>O{vypfce>^8rUsxvyGah1# z=|D?Ze*smhEyvR4F?wPlh9yh`6XcYOR2`RylK8a-Vj2}zrl;oBZxF_1K!Wd_LD?F) zjQ!GNOrehXI@P_3A_??!!m(P5j`Em6Js2wguat=yOhU=@fM8{c2vzcX{mi67`jR+> zhEn`PU?xwic|%p|;2Zjc;@<=SonjCaAr3doXRa*?BVB6q3VG+}ukNQ1zfISzBl-T6 zWN{TP2{{UMUyL{86T=?smk`D!Mj8i2i$aKNk1(BWk9NiR%UCWQyQ=!oWR(j^FU1@d z>nWyi$^3kW^m!^AdoKt1N09jK#8+%u3uVow$)v6k^$6ry-u~;;ZSj_mZ_K?)U9Lan zp&cNGX-n@qW^Gu3$I3TNoYR0<#2^HLG3rS`Th!Xr8CDCVeQTpfE za%_<(HRqRo<&L8;`D^}X6JUPtGI7HSkGa=<BkMh$3olDTR?x|!6X*YKWu0%x|v(y zRC97wo?WXr@Cxf`jVS=^>4zM z?EH;4cFkQ3sCw`IpBE&$|1)-D_!8^|DTfNMJn4vLHWR<~ZB|PpQa~l!KHF?DnDi> zv?2~62Baq0$F*uCvY?(cr|MRAFmMFcmb?lHF8;yLW=x1Lul!_uBk0Jiq**A!_SBP( z?2m0EgBPzQu%7POIc3dXH_GuKRoUA4h4XgM2 zCX56Le?(_f2<<}i7{K51^annsY`NJ-)3gy_-7ts3!IJ*ZDgam`uCigJ#OP6^!2Cae z3FJCG`q)ud*G9Cgv}w0A!67TF!$$H|UDsO)o}?B4v=l1)KDBdO=N3>Lw;;{Hy`XxS z$6R~VcRXC$51O$df7swKa>D!r0b9{%zQSCD;|B8^BN2LisF-+&p!VTZ<8Ke5>T&KS z{K~<0xB&X!O=f@fY$JMdcqk*m`H>3QAn2gdjI zlY_R76r4^ILJV$qCue*~@>esi03YOsQ85ByT;K39p+8^;%|wJM@vX^tlk;M^eMGCD znO-log%2@|WK$=dR(PPQ9e0RqjFiyPvnGGz#TDhvModmeZzm{Hk!TqK=say3?zbX{otGi0u3 zC8vP>m)DD!iBWXm(vUtlaV&6Y$ZsIV)eeVqQjAlA;u+BYrrU1?5BtV_5Cn{jyWs_n zDK%z&^oX=`Li@`N3Ggjm23HsRMBpv|tpX=SLGBkbX~`~gVR;FNK6;(H_AYu9S9#g^ z%TY7(vv#^(`tfUsMIr*RmKjSZb;@&5#rV7hh`>TQ#bap5*{wK&kzEwxRQ~X>%|BrG z%s})@I9-qz=xNnkL6T1B3mKO}BcXBHoRH4$L^1G;Y=qlG`Ja%oMnGo`;EU0ZY>8s~cTYV|^%x*ob&``vl@ z4wmTB8~hGHF@w4^M|h+ADeW=wjvV(3!ZlFy7}eJ!S8o0#%`b42{-^=JBC*Epb_dbX z=U}I6w)%Fbe2I?l7JEU}jPJvTQ8HrU)bQ{zqCa5A#6&bWNa3{AeY>+s;+Q}KpOZ-1 zG^lYvpF<>>5O{u4kb)*B_RrubQiuu<*GUftd$dY~p_HjgS(gmJV64r^Z4qj`Qw`SS zgo*9qEJ_PP!dqQ_+8d!Yr}#35LJaE!pO(*P!aiL);x5Z@JN>nX7l+Dq%d@EbHzl8v z5ozf=Oka?=35$wxDvr1h*F)=@Vlvuw77q|Cik0t~Q+mSfkeRu{{y;b9NHBO~D}0-W z)l0Lf(d`ulkkg#6rZ(BUcb7zM946g_*}x_HXM8_jag6NmfLq>zDW3@8`{AEBQJQ%U z`WLPS%6Ua>&)n+FnY)gUA{3V2E9;<6uBv}uI$dlx$vG7?6~JfHB2R3@%8uB>Zj{#~ zMDV=AWR0g>O_VhUo05n98gcmt3;8%4KprQ{qMWA4CywC&Qe&k`B4lVsrUs+H1}9J? z&I6vyRH$NV6R=e@ZKA@qEyy0JlX}N_TrHFef8ffEOYKbZcaSS3(BQQOL=n z(N(hGT^7dE2w_y4z!uQ8~%0;9i36fUb1Y&&WNPS!N< z4$m?%%~Be@Y4NCkj#9l=*^AYnDe6~Kz!xu{Sl+Juq`_ebIe%5wR6B1;My|u!7BHWn zskzz%JWxN2gu=D*y9fA)XQHBT|8%3Fy)xCXzWMx4mwvlssR?hY<<}=`w$%Y=_SrUY z6!^NM3(EIosccMx*j7x9X082G7THr)b6d@KX`YlLTx8B@&@YfbGC4s=Vux+ZHQz`s+qe_7c4Zr-S}OHZT46 zbf={fL+i}(fz{Qs#1XKg-55RcRm2b%J!0JN57K(1wBIEPh<~a=rK1QWV96!|VE?wGe{+4U^VyKEo|>~(^>uveb%jaA zje1o$JvJvmjT*zhEgnB@kRaqq$rg=I?0KJ(w75RQqdMuvthRWvsqffWwq45^KJ@JN zsCsQ%eq--c*S`mm;^OwpMmL^koxK8Uph(l_MQ3RFrDW{QQlSd(50;Z#9yLe5m?#IC zw6luQC1T)_{ds=Xx6gN=&ZRW%%{m~WMb5Oud^W`VCxD=cpA*Y>(bYI|EWj9j7FwbqyNP{?PKL>00-yfG7#B0I97lNH$67-gX zyC_IxD+*?YCl=$2+Ar($uzbbKmD&1i7_~i_-Q;%J%!qjhJD)1`m#33FZQ>9)y@m(n zhwlw)1r(`t@0ypW{74F%Iq4{e%R+Y6Gg$J!C0Q`!15}KZdO?Sm`ZeyCcM~f`(wcVO z6~o%z9fRz}`!1S~FyQN51>~S^>r4y>86yb?O!fZ&$5&j8_YPY3HfVi*qLSa3DM|69 ztGkU?Hf%_U@WPDD=P_}G#r_7hrV{YJ;${R8j?ZEu?4-?LQt|HJS`0r9X-zjk9*}^( zDnU>HD{7i`9YH`3E>&a5MV;z}BOq%=vhdIs$zHa^9R;4;D6bn5RXSkFZ354wGav~ccqZv{`E4EOL9lq z_59el;KN+SWl`J9kH6ko!@yqCZ|MzM#?l4Hy>VOJF|cZBT>V)l)w(bpdpK$K){Q#8 zNggGDUu0u(H*S(j>m0Q)9ehi`VemwFG5aq4d|1xBioD`m{6Wf%P?nTHAkrR_i!Utj zH}q@lC+cOjai9y*A?!91#!Wf%U|urmCAC2N5bP2vfr$Dw%>KGB#G;2)6F((suCzq6 z6?P>>iLikNqS1^IR__!p(P~Sy$yU$hhU=Syc0QIc*oj=q`MqAeyUYQ0luRhI2K+%A za3tOYV~7!uBN;G78)5_l$2VLIk?QkS4oMI2pRupF(|baU z{=NR)KHAVvNs$Y!cbQ){CEpQ%Uym^I=k;*!z)kV4F64NJ`F`1rr9(R)7yB#v?HH&@ zsBGJ|&mYPfLO-)C>o%W{&*doqmh^qEY1i7@xSHQq`bT<4yLJOeD>A{^BDkoy7XL&uCLM1EHv<|xe>5JCN&GPG3N@lb(_>fu zw?0XEe7SwF8%#!Ai1gm}{Ha;@WT+GqY*W$OlkdY6q+(GLPk+Nbc&&hHzPp~WbXTK% z|H*TEi4?>29gXwI&LCk}Q1j9u#kj?Cij1aG4;@Xfh@E~?gcwQ?E&}3f_Lr|Ie9mMk z7N{$ZyT(MoEkZ_o`k7=9sjK>CAk45|rV}w9rx1Z2(HL*e-~3at*wj{fENDBuXpCId z-{P^Y*uLMW{9u{I?`=V@-=XE8XoohS#FI54>J&fziW^-RrI!k4Mxeu%Jq^boGD(o8 zdE?&q-S~h?N@L)aOfLTnVZ;Tz)80&31#rR8Nn2L=3)Z0=<0#LF4T~4oDU)_cL#y^+ zfr!7~=vzkCP_<<@s9hNo&k>{ZLoA1370v+7%q@FY2Ehv@$4zO78Mjd7eerRxB)i$oT1AXy;|TE^~MLuJ6gQ z?5a{k360K{x4P!@Z;eh{$f4W}X2W0g&Xw|z-?dGCj5{e2S2dL}y@r)t3CZU>&L#Ww zAZ8`S?I64wM~Rj)Y6Kp`8=IEeXY?C>$hZhGEHZ+Ql3P(}ZnvWEY!Z$P?a46|RhqNl z0=#$Pf5@=?vk`-@6OXq^ldOs_&C!Ubrw%t$Fw(TrnEfs9*S>gp$6vlLt6fv&{wdpD z>OxD*WxXnJSCTdxWZjUX$M>xKcXmuTS#ov(T%3p?cy$O7AlWCaMLy+%bl9g)a7m8>V@6WUCWig+ksruS_5T2eNh)fhy-uS&c(SVC4`D?W5aI@`uPME6;*Uhef7CI#V%XXyWi$j+XOsXtBmcu*CD6Cs#wp1x z_rpuS<8|9O`^$_yN*XW)#A8+P3F{a1@Oq8m6^h9UoZ;0C=jhlDe!(!^nUPRNXG$TH zvr7ga{ePg#d@~?3WSHlswf9mZwW-pIN~r%b)5v#=%;pEVeMo9NIfv}ObCiUTH<`m- zGCA?k>oXt}++QF$$O*^jZYv;EE<#x!xUhKbzn`^w#^_y`7CUUHKz%&9t$Yue0q|ID zk2i)|RYYT#6!7kJv3OL~MU(9V$Vy^tb_r{Vq#%<}PflP)D0ziO67dDo|PEYK}bx+>e0Q_d>59t3# zv->N!&23V612E05v(V{peR49Eei3c&|2j-f(we@78+sJ3vm7tk(bRs2JC-_NTdplB zcQl)7xaT}+a&gz6vZhW&A^5$oo_7WtK0wIdRkTIkn-p*75O z{&}P%*+Exi^dVPDY4Xz0@$c?hNH%fPL9OD6BB&>N?v8F>QZoX--!^S{7Wz$S(Xe@W zdcOMB_{zmbcMrH06ZZyj`_OmN3vX`)ps6C6a_Z#hw2G;D(M73#yuXb0U;mDFCP-=J z*!*4=VG_yU6NO^zNPYlDD!LrQ*e(0YRT1-|iod`Y*(vzfXb=id+La^U5K~+2ct9Ws zXy^r1DDf}<7OIjH^opFEu=CK)@#jXgtVJ)t*-1b9EA9%ThtGq3C;7Ntc>lP9e-c|q zOmi+kwCoa3MKi5+eA{53T;>&CUfH^dyp`M=8~SM$A1m61<*T3srOAxhqrL&9G?ro2 zP&sKWVEJ$brPv9|>n)qsZM0G4N&d21puAV{h4$*qj!z;75x2k(HxL@+OQD=@VK*I+ z;cC;;R&krc*9lwz% zgk8*#lwP^rZ5W5p$jjmX?an~5So7i*C^q)j&a~4d?&l;6uNWJHi9^;!-mH}AvXd!i zTHV(IYQG?TM9)xe(|EAyVdIX5BW-cswVmUT#B*|0RkS}QJQpWOO~@Q3*RicWxI5zT z&YD!kKgZn1X*q%&PraN3cU0vBIW{W?iE{gyo&P9 z52Qgh?(xH}${99A&Dws#$#=VnLE`Q8#?FY-il41hFh;uKUeDgmEj7u?gwxk=rr9TE^jvM zjnXG;BX~rN-mETl;6*&T;o}`M)c#;=t2XR9Dbh*}+%_sva=)TpLTJ>p8F!VAFaTWv zU2sw=u8?!5!QY3jt0=d!D99P!hSjB(wA*M0sPdyq1j3*15=f_<>ey};)h6WcVP0Et zcWlX~Ac_K6EFK!RpSyb2k+6Z4mzNiAm$dyCmdxGjC*D+&p6}HPVAU|zRRFlO zEbD0CyPn_(;o}hOBG?x)}I01sGG zcrpJDyzZ7~OV0t%AoZ4wyt$5*syA2mZp|L%uGY+}N2yb(vm&NT9~$~ms^XZPb8IJ1 zC39ZL_?- zbKtLzNvC6VKWN5RH?`bX%-R6a4Z9fQXWQ>s!qjy6Svz!S);`u-_`;9wRD9nz3{&xe z|IXjnzG^ndDZl(ME6;Bs`5G{5+4T0NR>3;7%xg*90FB#M^~M8}`wO96q$M|7x;<>L zC9Q6ac6Cp+MJW4fv&S3=vrfBe@36)7WgI(-gXan=#798yV(DiL>(DN$l5LB~T}E!d zdWmN-;t4g zIc>fUWt=)5p%J+cR1%BK+U0-BX2bz&GBsF}E%Sa|>Jta~dBv!XjofZ3(%s6Vbhp#5 zYp2OlhU`Z#AZGJ?S-SWZC(VzlRPIk>LP)>4aO=2XT&@jJPVS?w{H-#}yYi57S8^IO zmvR@Qfm?Lrf^(hmDhyRAe#oJ6@vTR#HklV?vh_)+SA{L|qnI1H*`12K{SGl*dZ76z?yihET&U4o+{|VD$ z8X)h@P}mynz0_$k6#=63-%huL)^ON=6m0zf!l*{eF zzHa;CRfp;4Bz_YstyZR6$&Gv*?r%TsYLq5tc&$7_JOS?{Z6L{4{DZ!n;MJ$MV_6O42r+495OP zm9%S5E>9(qQFAU&vBx)yje+ZmX?>ei*3p{mV-47%AdKr4!V#x|Ye0;`wTPyn8!w)EGD3zZiKkhJN3+DM=XgZ)`9}V4 zsjkO~^o`3flPj=QZ+vYd1J)WP&rV3j3cTtKGF`8Wab2gV4^2CuY?o&Qu?$d!}V_F=|^;VGF?v-J<-klY0^fL*s2~MzK~^cdtxzz6o@4ZdLgTU zW~sq<95lPn=$s$+NX@g%wpxzhlt`Q?O{;X0!*j;ZfJ)7pFs%*&bH9E)Op%N?y(M`Z zZ#oI2j;=+e@1_AOfSV3M2D44FdXtGvW7dOhefHA zcbrO$$KN1jeBXTUW09&K@vC4;g<|F=@~Q;ZRS;1tJ0jpgm|;zgnLa&Ds(IF#uz4_n zf}dRnUYYCPRM_Y4++S#0jL^Andqvf8Ya+J~IfHMDYGbcB0UGzq5G`0f2v#VL2x*SE z5&LyH`T~~8TIs879ek~_?ZvrhrsAB`_r{Sw)6xRWz^E~vrsTZ8+mQ@PZ|f$znigFy zt>UJ&nt|~Fdjqn7@fM@BK|sd0PE{iR}cc*aSlzy3pzrXwXE)kre z_Yi^`LJxi)ns2M2m8G;*C7@pnbV$ZTWl>fpr0P7uVQ}k-cyQLLHOru47)_$ZkR}BD z>~;p__hIIP{qk4&4VtTWY1lmlX?w?UPkVR_3`#S zOr88i1-gRk$s2a-I`7H6Xp{(F?#=O9IezXW_+=GvaVhmU0q=`4+ z9t_}3yBQ-5C25$1VBaP$F;-RnXX-?^oV>SakOSM_bVGwPM-jIGjk1+aO0hJd!8TvW zEZyKlINl)99EH{@(&KvkpmqDr+ra}_r927Y#gT`(&v!N74Dy0F$TuQ8(z-0bFu_dI z<}E-0d!M;&$pJ>a+|?3&#_@7PAskN*fBxS^dmG|-;H9#&I@G`yu zRpql3QkTHQEt0_{`Jp~L6{4I8koTK{z`g^ttRI3Bjt_Sx)mym3oq)2lw{TJ4mL41Y zsKjG@1lf6c>Jm7!^FKc}Q^IAcXdnlOv3UT@)5}iZ1sV#@W<6?*NEkRa7go6%Ya$jd zR95mdR`%iTfh*w8O$r~8*3dgSP+Y^(%g_L~7o zYjB4)3YW){X$et1$H9B$2RI|U>+HjSG;!Z|_r~g{!b*wm@sLHED!!s!O`}kpC)d5) z_I1_S|Gh|yJT_iI4lIB5p*rs6d)=T@rnIqVWm^h8j%j;mwR8Tlg96m6V&kVHIYHPE z-E6U}82QDE@WDehu&Fr;*SdiF7o8d35mg>fSg{b5&e$)!#|P!1aTbKxaArdRicVx` zJP?sEYe07kiitxzhZyVXnEa2gyh-vBu=Gm^^+8X$1A5=x(k}+4XW(`Pa~AjboX9tj z(D1rG|L3v~?+EmraMp)!eylDgHg6ZnXoZ^C5Od4oyD=hQW;>qk-tFHj$krj*tzC4pBS6cyYrV&b{pjwOD#md z9s2&JtT*5N9Z!4%^V@e-lL&({s{I(C2)Nl!Zm-f5_O5s`!W9jsn_44|uxNe&`Jgm&$q(gF zreq9L6IMl4f zx7lBdSZFI3&o?)Z066whaZRIW8bi>DxY<)B)h5Hi8S+QJi70I) z4_0mKH^aaSn&uE9f`|)yP$p(Or-lNhIjBMABH+gAn>oqg{Ee!cc_&xjuqn6An)wUv z2er}w%QKRE>Z6Cb$7+W5?NvzIGnJei8xFkN)0ofOd!?OcbcXE#0+f?cUa^iL8|SuP@A2@b{04}W4~<*TJ{nLbyf`O zXf@dx?j^^lr+yk0Av~K!#*X(0>?MAC%qDP@>0h1|#I*2REWBi->)WuFjSL>~Yn$(W z*r=h$*iYx4JjLm8Kb8x=yHL zHej~>sK*bB3yP_9E}wYNCz*ozFyt&Ra+m?`1H+WkIJRP18ng}E1i1Qv?5g5&1K3zB z)X`ChpjSrh?}#BF!yY0DMCXGd;1=L=77+pi>MA0l8@~OOcKT`4k8636dnMF2MD#8$ ziXK?pWe*(7-)hKd%;<513JDuhE_(f5%JU>NS3aVM6tQ-yf$H4U5VBJy+58N`!GVsR zLcmc?QO1%x1bTblW!&6q=6JPLO4leDM03e!WOCXar273Yjos5l{vaA3f796gn?~c` zG%op8aCXz7n7!1zox)?5Cz$~o3R%iHQDYX>KLk9>MqqDxF>)ZOAz17*9-93&1)vYA zqIVjZ0vC9+)h+?dB}rhR3LzM^qs-v_2)Sb7=Wq)Rj+JcygTDd6VkrJ^^Dh~fIyS5u z1yEv&d3_2cD{DHoE_yjjulV*Go@@#&Hz@ATp#Dwhlt9h0#tGEN-qb*+bP{T^kzJkm6uy0b z;)Bq^Gny9AkpE;n2*-bN2U5$VW{!H6gH2(4hPG_{F0pby7cfk>iv8~FItl7+qF{X_ z?bQJc8;mOr%MnZ*IEC@>DR1sKrNE&`vSl@jv`1M2kN4{CUveIg9T6<<{NXK2E4=4B z=vwbUZC8^pgy%w_FIl`OU&ysBXpEgvm{a=MsI5G4Bvn2~izotCmxSnfvOvf7N-{vg z@wQNf?7Pp-y=*j5AX`crNPd8~Q?SD_aWi6)f!TUO76$}JF8(_MYbg{d&Z z`#XW1p3-I?xRnear7nx9*(ew`ln)rXbVe>8$w~AZL%&oa%>vL?BvOJuDe9GcPXkun zT9u-oDOb55vj9C+&N(0N2h8+mz9T6;62w_Iy9dtFIXTm&v`M!pj7g|WfxOHay`1hu zHPCeR!KK|lks}asS;P^@1d^1Ij*p*+ zd;GG#i=~VtcS6n1SvjWYz;`hnGKzgG*RkcrQYcE8eyephXhY8-7MW`)Z~DS-%2M=t zLqYxlAS0uX%k-f^SjCO=_cfT2Q^IVz9k^&fu`@b$Zc-@2D4DWbzk2CH$li!nuelNs z(%Fo;erKDM?q9>0_~TYc<=zrp`ty))_zzV6L~vJ)C)=-n8yBQAU7Yk3a9{Y{UK~1Z z%klMTM8YS#a@6hm6570;3?Ff+x%z0^=8}CSP#?kfhIh+Q6MwKM+swB}jrNQE!@J)f znAS%^21ZJd4~cJuq-nT-F#+48l=zj&oeiFB>t9v~bi129&Dxv5W1l-Vt}MRu?p9>l zDuT_n?NzU1?o9juv+q!EuZ(U+L2==q!2)aNHlxqitTyN5!yrg1Ej~Is4%!w%itgJg z_;5?l6EtiITjpx-KyMak?u?PmXW9r!_+3(8dF+tMZ-PXl>p5K*5 zEsv}7lSTz%l+5bUD5Ol`WMLx_(%+2-$?$`KQ~4}Kz6wM%i;_OLR(NZky^qMW zcLOu^nsa43yPl{2iij>nq8PbH(NeQTCftzim`@Ne!b#x7f@=QbLB*!9oS7wyS)Aq{ zX+4nT&t|@Z?PT|G8Mw<%=jOZJ8>YV2ChR4?83v9XbdRhReywrl%Vz!`QFH8{LWvDQ zH2MCfDIxTMTeD`|+E<>llr=!mJEPhctJzrKBB6se6qwV- zIekRH3__w$<9Pu2K?SS=LUk-_lpdipCl%i}q>?0qC~1PqmvqjXLCCD_EnMJx_qy`! zQ46i9q2Eg0*M+BnVyVR+WPHa@gXqd^`jI+y6opkv=&PL8){S{rFm03xZ|3$E;(rp! zw{LMZE-X#7ehcpQsN$rzyTXob{ng4yqrP>y@SKj=4T)q6B(m2WI^@V+fd+GPp#}Bn z*zCT|SUz_xCPF2b6WY*^0xg^QaZ8r>C5;WTcH747hpB3-+ zH=>`s@68HLu;YDQ1E6AAuLR@sa1vH((N~_~&i&qs4_baqA&*gHpEXqygyzteV@GCO zIiaSuWq*#1U!rB;$pgvVdtw0m$rkMw$^2UX^8w?2eQf6F?1vFjV`l>i22^tFxMsQQ zRsY!&;1(^zU+wg|Rnoe!6fyoiNiS4>`RIWRLWVhic*=t1PDXgqEdJADxtYsh1m$)D zRGl&(61%cv>>8ZBUnDM!ML~C4Gtfz)w`96g?0E%}R1&;h(G^cqCs5D$#Xg-YB*fl3 z*dp}Pesl9Ue&v;C{$2NH-Zt65lHEAbkeXAG>MxVA+JpgAj>jPaV-iMFe~zYp-Dp}U zpjHpyfs8@4SKUh0;qY`S{+JAS2gsJ%bf3s!;Rhzr4xlBC{sw7oKZpPD7Q_ITmEY&R zjXbp0$s6A_to!MA5GHd|LGH;jgmyiSy-l1f>O=MW@eL4Rc2Dd(B#qwZ47rZ`20YE* zt`z%y#{ixtilrWZkn`9}ul)6>aR!WAm| zNu&W4IJ{DWi%BFz@freoeSPCc1AdM~P6p_akq63%Sg3ya=QIZE=6|F~^ zamkv>7%c)H{;Z3hjOQwjT-THB0|p+niTNL?4Y{QSNp0aDsSN=!RCX`}_WgY41y8oq z%2wY+y)1A5%@9 zWK|*p+HB-F>8a`yI&jlxs)b$&d6x&}6-|>p#e3k1FyR^_~s~6jlD~!G#TP-cPE( zS&C?a*I@+G4l1u^Jk z?@$Ib@k34F^?-VO zK1~bX0x5cXNXf!=m~YPymFY)2LihSj^|3$?A`w6KaY;_g@{ojwuMjcs`b@LKFg*4S zL@L{KTWMtr65##gU0{JpO861t-2vguW`%SRYY~rR1{59D5NXJOt!-imj*SGCcM3C z4p|$jkKt7QpSSH8-b!U}Y{EISW~Cf~a<>^5xx@*5Lv!4wzn6jueCmz&p(L*3+W&sq zkfB$A85?TD^;jg14UOu#Su@fPlQ=7%;SEZky`THvqj zRwcPlyoB%I+DkWQY5v;J(%W*yH_JkS&qH#y@O?J(NMeyIQ0A{c7R*d{jP)3*#o!#9 ziI#Zwr2h%&s#wSYHR+2RcX|jKP{^=$>$W4Brz+V#&Q_QjV~-{NRqQM%we7E3J z&8vIJfy^-?2C47t7sbJ8g#Yd$Vug}HAd3JeBX6NYIUXoDf%}kYw<=Mr$58(334>Qf z#>nI#9PMgJwWhjpJ$h<~u{t(75M(O7J~d=2g)Ifp{LfTwT7yg_={v<>8?ZJqO~%ea zZERj{RXSc$({KzjNk#y0^KZ&!%oOEANvPEd^*ZOvDwXThSFdD z;ibjPN6e{PHlLr&6XlCAdpu2_SupTIJdH=&`eKCSo@oQV&N;Ct-glMug1 zP@UTi6O+?s;II5bP|?fUIkFqY4sYcI(oz=C|4{mwFr`hl)?J zpGS{XDsw&O=Uddr6Pbc(1Z^-%QFf^cjzLu@k({bQub=;bAFa~?n=%wzUabv?TDVZt z=FVc>pM<Gaj1RaI2@rs=;|| z4>8EY(dU9)N&$TaYIKyDg^lk0<+MqDcd)bLHNN37(zHAQDCMe7|9br=AD2siy6~=F z>J16eS@L&jaeixa(@%-x6Z_VH25--i<~c(f&Aqh!kjOZjLyl-om*el`nQS=vNI;9C zO0c+UXv=~>0MLeydRSrDn>ax>V2vGCs{pUP4=IZcU_ucUjFc^2)%)+hE>SomstLi` zx-VTQT9}4WDEgIO-feJ%R4hCba{Dg(-K&49qq%!act7> z4=c3Wx@3Zk2pAdPUzhmu)u+m0mA!)}&W~z9L-c0MVoKuY;6!N~`&>#U-Y-tgAEk|N z$rnp!ffv6#nAuM}21xdVdIsvPj+T#=oo}gjA*T-{q_24%-cEzq(xQON%IKp!+@vsd9J zYKI&=^3+fEE;8m|P_8F>#AX6RwaW*A&u-x27f2dIv18HkQAjCV>JOL`$9l)vrPPta zQ}BB2%iQxN$E?A$myLk0PhE;<4vHO`edi9`4C&ah(;THY(ZX2zOOwOtzND7G*pWdy zOwJ$5i<=C8z&lA}2=LG`K1na<^SWtylU6MkHf*1Qf$Mrqg=90~Po(|`aovA)Vn_-l z6baVqN(_(8I|FoyerC-oVgOA>fr-%mcxD1-9laO*vF?Xh=;3aKhI%c^S?U9h^IQJ9 za}~`Bje0|U6>xmAJRV%-x>l1{;JR_5*Thtj?KYQ?06M8*gTJw&dv2v+VU<5-V|A{b zKR7!iTEdXVi)6)n#M|A3-3AyCb1}9JCZMW8psv160Q>+<%Nbf}l*>}~_0)kX%+ zMKXzG0nrAAdWP z=>|Fw09i-1j;&X$AKZ)L&ARq36Po!&F2ZGO3SAsW826U)p!`&UHiA(JPYA*_q;Ziy zz{!n^bW$G;;J-Nl4XRaYN$vnpG?x644IT{NOEDZ2G5GswX?))=C3Q}pHj4vKaWKgyTcWxK9LA3 zz-}aAD7%l0oyTGl75Pkf!w8ny*r@x!2vF!37JibA%2BcfHuYH4B$riz>CA3|8%MF` z-GG#*6Kwneq&$BB;D7)%+wsSi9zR2dRCo4+^k7MPufWaC^vJ3l)1`?|f?I%V=YRaf z=^bAP@NGV2We}-Yp&(KV6Vilf;iq2h+xqzlDymFwJj3mMc-B^2U*|uGUIMqTJqG#& zMt!_-8#!kCdAOo|9f3dKg@+@jqjP$iHZO(R38!<+5XWl`_!ruvEwjcYB{sKP z`5Mh`$g6&$KIJT^Am;ivj-WWZ|H7WOOZEcnD*29!M1n$RS6#~61xF9*O5hZRZE>?X zVy|1jvZ+G#93n}tqxmMHD9!67Rbc=!|HfHwwNB6L^rqytS0 zhwYcGF%m}yWg$p@j1iNB0<8R<6RneKUI@+-_4J9z)yaU28FD`2LKPT& z@7O!((^eh?*%byZneT0}m>=2Ti}8u!ORI#h&Sw(d(r3gpLh?m{>t4*H;kAw+>snS3{sKjwtL<^m&Y0|O8-OaaY*Y)^;e#dgg0~tTzwCx%ZyC)G)+FD;r0A|- zO9_XT2E8LFPPVlF0J69*;gIzXKWDYT`siL*>9x>9;daPjcVc{;w^n2&Ljm=1{~qUy zOZmQ0Kh;yORh@wEzTCf9}$f=Ck zr^uw*Xtb#&dA0m&bSxdnA3J#Zn#|D+`Zj|~U*1(n`YjVW_s?^Sminu$cJlm%y% zHH8k#Z%hchn>LZ-N$dC-f={$r7Vxru-Z`6A!6X#^bFM>3EUX1n&CH_cfGjRI+_K;g z0C*FlAGR(HTGod5KLgEiKb&7hgnqjqJDMuU z?s?ZacHr&!b2j<$_L+IDHA*j#@!qi={`C&j&>J3cV}RX?)1G+y>qjr_G|Ol(UhI2t zbPR`6RZ;u5%}v)-2EA9{8j- z{9kWD`G+tR&6yFvtUzz02C#>%2vK`pgaj_4m9I!JyW!LbmYF#IhkJM<^?Vir6Z-ua ziFJI=tru9Ubb$J~5Qyu)99^D=*zF+!A5`s-vmu!BkXae;-TwSjzxOJ65Y3NJ{CwvH zl!7Ar!FC1IBsWB;4Z9L|U+U;dfIc*8omtQhIHt?wzTe3N>Jy@l!nz$qyDt6Z`KHw) z7e8NLT>0!y*+BECwz4KWmb*d2&&?ltDQkb&sIi=hAOJoha8%5P%*m+jB)jcOMWxLz z-&1Ajw($CH8=;ry#P2aI4g7GmaLsJtUf2hS&8#ASkt^7R()-dwd`={0J`%4PJ4u5E z%FExXJu+$XSqQSCb@ow4${9OGktDP^)c(>5dVE~~s1#&hVrP#x9f)6K)sv`=8pAt~ z?GhP432vc%CY4~vw7mP5w@4i9$90cWD8_f64NBRQZG5OUXGbauZgTi>~ z(s*){8td4@ls>?AIY&x%V*zI)(g?adZC3PS?PUA89XWRr$m;xl7eAp2o;p^yzZnxQ zu;Y2TOjfWi~zer=YiMMwl%U8- z2LoTYtpaSi4j%qBnRRd?o~GBzx=;WCR{Vb8=beO*)$F#xuBQqh%ZE-wQeoWe^O3(G z@sF!z>$1jB8g^%zr&LeyXPG1%B@&%WP#C2y2p8gAGjl>j0NOn=PVJH~1R60rY7Q1V z>efFfnlMD`36=CY4#Tj>Q4N+XoslqV?Ie(KZ4|>F)!SqKeRnXl(!Yu3kY8}vQC|}B z!9czV7{#(d*Ud(Uwjm-HXz&zO zE+fp+@%PeN*)Fn>JNN2m0lr39gu{q=c?r2`cnO94gNlW~BzNBxf)64CS}%K6O`Xx4 z`;!Uks(SW><&lc9Fx+XnkitYKgD*OVQsU^m(G zA;TX48-7Uv-VO7!GbSoP+_*b~IVj;OCfMm=^+TPe3rceSeKO4Lj zG}tY3oIu8`ePh1Zd;c?5kj!B@gW(kpT3WTFuPUQqAUFLWT*;v7@e2_^FDd+}VYqeVb@#w}ZVasGbW+HS+8;sM0`NTp#I- zam{6#fshP0Px)}MZUp%n!?jHs$@vOOY&JJltCA-wbQ?y;_^u<>=sPhTVfOl!Cxp9< zrs>ZaR=idAbyMrB{sSZRz+tjpxTrGei}RJMp6RYxquOiSQ0_COIx8gvWhk~EOA{V7 z*SEp(i-3iblG)aIi%hLt91IR zXXs12l;f-Qw{eNqhAb#%;*v=x(L%Ry3{vfqS(*}B8FJmliwA)0KbbE}T2>Fbf)&*UHmQNC{`0Lue$Cx|e*gUnSwpO%IOV4XNOKNwaTmF*=&qcIUQF zWJ3`xIbRex&-*Cy?tf77LRuGPfI~Wt-BIhbIb(249~I@8f(fx#;N`c$+%-iR46orXD1cp;eRXLFZ>hZlqMYl%H9hyEK6 z@;nro-tO`bUW*zdCucyCCVO!9O^c2XIXlN_sP4C>%O?^WcfC(fVHCm4#ZSDVyXmZaruJX zsL`HQ;m_lHyHv$`PIsC<$eg~CGZ}xa{ts3OOGo70-K0s_uW#LJ<}6E$)xFb>uOw zbcbY?kt0O=l>X=;;^|_c9U_h);l=s?K0b!?W~QWiBqO5(oq>WBzIHrH+ALhM?I@T3 z%-e-GY^%rN8OzG<>)Vc=H`0$np7JOJE;z6?&dE%T#8x(#HU)o$y6`yeadEqGZI4r} z<529`Ihn#8kW<{}lkU`EB(_p{6k%2HlT5BZQrXl9*RVrS->GKt`kDXLfUJa0&_Ac^ zHA=70aZ``5R&++o*2(kMloNb;e3y3r`P9FyC(1?gwmMdmNAs1*+RdVgrhV%o6PZ5X!mv+7FI+ni< zkjqkZY^1-G9pcY8*SvJ+@&N~vH3z!~FV1y3fS&`JsI^9%PtA-Z&X?YqxD z;20Mgx71r#Cbe6LSv{M=K_3Wxysdne-T52MTOK(W9VFqhn%B%dH_T-oS151z!7D~; zALDPo&OB$Z@JyZJ=73zhSpN4C18#ORT6_|gR^9@okv+!mGT8(@d{Y^EsG?nHCLTcD zYb_lXK!1n%yXl+yfW81Fa;m^PV^*uMik?cKW5L^^9C^;5qDtR1(j!5+rpBCJX0K@t zYm^JdU1}|w$2XT*5o)nfrN51Fsyp|7`$Zb#6S~OQkr(oU=5Z5f$w$(Fb8ncJj7m4>eY*rOd5jJ&u11=PyBPTt|tDYal|d%7_a2e+4>&Co03c7HV@ z#W^*icZl?KiHXY#fbj1LwP3Zk!zuMwcu0d%hujd-+|NhFMPFOcix9e-Ik>bBRh*Uz zn?!4YR|#zxSxw2_8W(q^_z4jSycJb&6)1YUm4+Ml{^h{=kmV;Zlu|*)Cy6xmPvt|e zva!=KlJ6`})1c?4?i?oWh9V^f&rExiJnc+OU@=OJ`*R(4Aei!CEnWwZ#`3l#t+s`TFlvQ_Gn6c7S4YKMomfRUKg#~l zdBG0l$GpO&NQ(CAjbMlZyK+kKx553JO)Qx!cDk3h*H<<%{)>v!cSjxh!zWFvgtHz- zo-jr%)sP+0K!1M{Z>}q?QrN_A4;(z(OIw^Q#10sFSPmFF|DYIKoT~`HPpi><)Z`I3 zh&c&;#P?c zqDR`66e~%zzZUbe3!Xc1%o)`BjctDa057)ZbVKYJ{thA%R96B;B!I$9lfR;A;Em!! zKWjze6aNLUCMW`M-(MOSZSje0W8bvyDv9E?^*PZbh|)ZErY@L59x zjP#v4t98PQ&BkcUizXG53-$5!h#ZZ&ChutEGBth_`GHEg=NAN$g|$~LP2NIatso!4 z1}=qnJG2I`?<2zGdWiR~hvs>$`2sfAslzp##TR>EqeTbNBG!p=lKUas^)+o9kV^_P zd$E!tGdl)jYX~r-HxswrgeT#7IXIro=IP+ndFe&%6LJss| zMW$zTqU$P|rHvIaV#cFslVU|S-?M_H?Dr4SFU-4TO1y&H+7AgQ4cdfjo?H*)-d2VN zy3NPtGL^VU>j+Wd{s1RyLdsK`xYI#=a{9S!o3o}!#W}!V|0Ly#5G;G&C4=WRt$0D2 z(07#uc+C=^Qj)cN2+oW=Vp$EIW5=x6N)dP$2=f}baE)f52M;GQgJD-V1jmV%YlM-L zVuZ2v4~hoIX^i_(Snb#7fpIS%@H?y)^|la`1cZTD;=!Km&AdSf&0_vEcpAE%Ozbo* z@*TQeVKn8Ul15xVS$z%|QTVuA755(YGH*f>i|YydFznYKM;G5jYqGxOBp%_xHA~1l zrUukS%Bunkbn9PrsV0f2NyZ3aOC_$u#}bczt!1$E=jHM)m+Zm7C{C8H14%ur#x0EL zOGY!!@x6uVdD>ZKv-L*53kkENb9B_L&s}F;Ivk5mBga_fJEWJ)A=%8>XB_t@@_6FE z`qt8n&6;rz&rZ`EOq~jl3s%g{E^(chGm!uh|uY!F-(wA)z%3ff8 z8vQIk&@;rM2antc^Ih3i7npj&*=2P}AoM}}k%XPKC_6h0W6K)Ec54vZ|Db4zVM*K> z1bfQ8K{33eBbLa~-vAa(XU^Z9T(`mp1;}&5f@Ki&WSrs<_6U@Kp4NR{3+AB-Ua+%FlfbU zh&i|r_y(6yI0QXfpBtrSH-l2_RNV)A)JB0xWvD??NE8}Z&&&_c;Gzj|bXS-_n-hDO zVrXr(`^!S9rOjnVPd31bc51CC50jo7fd1l=B(`%`DOvRED5c(abE=h=1u9i?*ZD|! znZltX4zyeYAV@R}Ft+~S7-&Zv;<=XMg#Dvi!qh!_=2=^j>~=K-s;|0l5jVhq6-~k)3pbhq+pe) zW*By{b<8(f=N6laWJ;tta?#cn1wrpNB7NE&1=dBjFk)r7fG)HY1k{a=+~@gDO}k&* zv8I<7lQo~dNdu0km+9G*_`B2{;TI~AsZH-H0%~X7#T@C!_Ro|#2~R9U)>o1i8>u*! zmGyrXd@I=JsW6bZpTC`odnQg^b2z9CKtc3Xd=%l$<*QA%?XGSNCT!^M7kw|h? z2a@w?g4{1ns%}^H-zd3@df{kO5v{8>u~R^eYgfy~$AlEd(?vSH2{tb3h)X@Jf0saf zz@S>jEm02(v;>DzF`-2FMS7$!uwu!@j+@Kfn?g31q)%;cwB8)HN5q?QZzO6p*pkx1 zIZvx(%xfXGUYsV`FTSL}3-1!Y(5R!?KV9l^;dwZ@o?O3*+kdsVPw?~!_YNx!*136W5 z5-#4#nAYQAP`g-{HhRxWGrld-Qpdf*)XgTWWF06A$5bL=jfv!wK{_Qp#;aB|*yK1+ zS1#2kXszR&-m`txwNC+kvOohEW?!EeGAxd<&qRKygabGC{rGWN0~>DR_1sxnqx{K3W(_Q@DWJ|(D;f8WC6$G6owZETnEZHCLBj015NNmxF< zB8U`h;6L05Gp0BuJ>TKQwq+?NXO%7=RR0&-rc0OzMZkTx$~N18lHUG z5_TM!BszXaxV*fT_TaQ#Q}q&SUf~*fTz;ER+I%LUJEE@l2EgQ8vb9An!*t>7R)fRQ z=ieWR_ECFos0b^;KN}jP>~tK_L3Gp`2RhB;3;6@AE=C5<{1;&Mk=LZ%K##^hr@Zgs z+`(P{R9{`{o@r_A_`Oxzl&@$Vwe18;QK10Wzy)<|yFrCkrzgy6UM9?nGg&T)v<#L4 zt-hsJbpLA7eAO9n^AR;FL9+0Y)s#K@3KRaX-ZU7%i_0193gV8z+5!iP@aB3UNmUy^ z8^>A9)cDDwIAkpxMZF#gRNmM$_Bl1>Ne9c1>$HXq&da&|$Wiz4Xgm(8SK`^#-?KGX zu)*ojrR&O_S>|IaWO|AIMO`GP3Nhz3QlRCfP@wJn zgJN)_pUbrvpTqC>7BJ#?Wb~Mnmym~~hdS>MC>uMF;edvffBjJcnWj?29%bD@7?~c> z4g655Ec7~+E^)^}X0m*1yD=TSlI}r~`oko{7e$pP5_ zb8^FEC=5ZwzjHGM5eaV>WA@3reOR;BdVGb5eD2;#9fcq(-7~bDx2sGv$rZtbubEWf zeKTqQKPa^eLTW2XxPrl;yZ)BYVLA)(m>xEhADWp#6GOsk5bgw{Pze+hRZB8{iSps$ z9uT{i<}Mzt&0gn}8O?~`G=o!2>FV-EBofx1m_8$<#_R7-r z>xpgQzFTjc{F~BXJ}M-G3;DQ+4<}G}xwSSJJQ4=56aViv>NRQlY+B*k8{Y@fy?o^* zgy@g5@l^yTO1!A+mf$yG(a>rnvFa~7TSo9{8)wvW@FMDP^A%D$O&YRQI13ZvB`SDZ z0<+xTo>5W)-WC2DFZiODMZI35`p{D28QjpwIT)a-A)g^F9w-1Do+Q)M4F|Z{M{?ae z-p+-8pSA6HNfFeQ@v)<28`P^&N8)rn&0N-WO(hTe3t&nA6G~0Hgd^ENV9Du|6S~rAIa_2w(<`cEPTe!)S#uo2$GS?Q3WY(; zmD%x_<+PV#FjCO_B;pcKR0S%HSe7_%mUe4*Q$&lGSnn_l=C;@B5ovWgI6f2`{(~fq zgqmH(wC~p2&=T4e0f3V?Gsb5Ca88sL`UmW^c*!q7Z?ZBY^Yu6Uuv9?X zZTfy|Ps6zo80)-B@bAt6_9fhB022Hu7%ZmNgD*fCxO;2eP;}Jn1Tv`D-4S(Tr{(v3l>GO<~U-Y0`OB%5Z4=CC`vi zxmj$+sXNiV*H2S^>)_5ty^o#9LDm?s4EzHCT0|H|jTiliu<%{*18^Cdn4Hl$ zK)e2+)w<{pai+xS7!js~UnKrr_zy>*{}WDlHTppIg$RYZcN3>;R|k#yQPmomVaD;` z=U1+ql4OkF17r-IBj23bl`*qjM3b78HKHYHp1H+2oz; zMz$c|+aF%;zWI{LZsfkyqs$GIvvE6j)UVlWS`L`Tq)ryBde7|E@Y%NVD2f%{%<&7e z(u{B-_!z_SvC%y|a>q{_pC{!@dH%^))vyh{Z!xiF;_56pTUoZtHQ@P>DGhu2hHD6T zOq!R}sgKvDwv$eGc%MvM>I^(71E~dkz8jlqOFyez3h`tN5gWMRN`Vpr>UDccg`(J& zM3443f=dp-g@#gdlh~MJAft=)pjC+5eozUo(7KZLW!U{|grTO1lZXtHhe|=qQe2ku zOLA-2^_Q*7W!(|(5}^=>Q^UFc)0wQdebssd*BCm=@wz7O`^>K0QB8Mf7-Ie zD#rUP>Lc+m6<|wa^ED^?`XXx#^S-ma6x5(l%H4)K>*SG+5!Phd$GdOp?w8uV1(SRpf=lGF$s|_I|@-BScb(^xiRVy7@Tq4Z{OC za;#E@Ay{z?sNlm^Q(e8#p?u!QAthD6VnnQARj3$*=`Bpd2he%PGA+d$RIxL9yN4M{ z)F^o4bx2H)*n;2Sio3YCjdo~BFmpEyuYNO%%VF$s+K2AuB8F@VLz+TJ`=8G?HF7Rq zBg?uDN_Cz(`Kt3|b;}ccRSEQ;;C@{ zb=6T>Jx?D5q(P;-q>=8FMid0;E&=K8xO8`SN<>igsS2WRg&&vJI} z-kHzLd}ekxN%srR#FZ-z39v)$2LbPK$<|3elV4h7kJ^VXPQg5FywXYK#XMci$`+I{ zU`Lsl1*b4fz$w{6mC%raF>p?TGf2&AfXGpH$a~!}Q0ugW%P#gdrmp+{?Ki18Ly&q@ z9YrxgIBDk!wd@8GL^3{a2q`zuApYlG<70JsWnZzTp;y)cuG+|oOZWVV$^=D zNR>elA-*K?cQI&!XGuM^UPJ9#p>7$3d_+h90TlP?g7`Ms1+PSC1iFEH|UT9RPk;h zr}1s9RQt3P5Ea-M*;LZ?b4rh~M#$iEw2C#Gt!|32%9*tD+XDX8v2AH)7^YX~uo+{O zB<^+Ps8ZCVz1gA4DRrU|w>r%Op?K59I(lz}1+D%+j3wT>^qL_Tv>KZ`B^EtZPJOI`RLyS*Po($hz5vcUVULWA6_((a_icUKBKYh*AFNEKYH zz8rud&JpBQk{yXhZVWeHC=XqS?Ixtc>q_c`SyV5nE-9nh#T&2f@{#$7mTNmF)YZ?T zo7G%?-!`pfRTa%FGs#s_3BGg9-_GDO*R%vKY5)7 zE(7u(-E4pBeB_0dIYvs>r9j9Je-FjB>f-qUELB~)AN9&P!(VN6dt&K(qEf|i8Dx2I z)BlgC(al{BPK<}1_+-+fN5SMMIl$|!ND0fqbiUXl;9S{4#y0!O+Yhbo)TkLLk}ph9 zs$E-jW*|kgEtv^AahhhP3L`wS7jS;q8i-_LTS&Xy1F3km0~$?JF5ApVylVTC=CGUN znPQ%?=f$~NiX$;=UnemujA|q86ee|K8zK>>&x+^d)q*shAcECCceia<=lHl&2j%{F zmKzjIrbiz^`vfymaku_+aLgG zwXbe`TdjJawS}Kmu~uyvvrTrLc(VAFcyQJY;-dNreLvY6D2M}duV!Q{Bi8l=77G1W z2NttRufO1(i^!A}S>j`2`W|x4B1N#hWojKrwj6A!_G#JO(CFVVOi$Slax`6}+`-l&pGi*~>8i1> z$~i5+!OY3=yx**}gV8zN!+mO*c9iP@=O=XX<$pX(yy9ndDX6=zuXw6XHEaCXru zhJ9E(GDx@xK6*Ma)VbyaL2+~K-hL7tTJh+~w8&ZXx&1?SxfQAY2YXP^={l%TCtF$= z=qIpXL6E1HvpJT+_Yxl&q^XaTnQ>I;hkHa)k?MEnL5kh_>4I0V@TGifzJAwlREl(R z0AnW3&`F%eMQ+jC3BgUA|EZj>s~`|I8yrF|a0SAq>c}MsqoImL>CBhw=;FLF9-y@j zw=$$ifVwQrc!*6Usbph4h4^O}0B|&~L%-)+_nCq)Vk*p^OZOy((LrnrlB*WkhElv% zE*ko^Yr@hGm$&ueqX*d*)+$$0hr14#iQn0 zze_8fGI3(+HMr@fxP-EBU}|4ts0b?tAx-9Nk6-q@LhrouM0!~&kam=ySXzltqVwW_ z`1a|o*4#j5z{Au zLt?-DDAP2e=T8=KO4joKUw7jeztP`E_ifOS^l;{>GI_Or(>KF18a_F;b=jR}su|;PVTYV>Z$URI zlM4quIJ_m>W1y!%TKAWVk)5UGG9|<)HM2dLK0N4wM2N?#O@D$S1ina zeHlD6>1}oS8jon%N3;79h{8intw@T$>P}*4$N`^8VM*^DEzmzyH9SLnY-srO{R z@)@Df!=2Lj^b)tb2f`g=gkviP)a&cmOp!7inP1WTjbi~>h(mHR@JA2>e+1Nw_^)D| z>+a^i+XU*n!50$TJ_dL*YcM0M%TSFKtxTYq5l$55W$fud8zW-(QbHoGdP2dR z*pLy=EZdY<9%R!z5WjRN+bZjMPqxfKpN?;-HB-KQD25aBu26D^2d-eFq0nIe3mM~J zg$y5sdYy`qacyzNR%2tzL!}I!EeIX-q{uEuAGnetY-Xc@f4* z6vD4dQK6HL>X0jWq-f6TlPQJ9S-RBs^JhgwjX+wr$lVUVf+o?66nKpGOkZ8CWe8V4 z=qdhA$nL*Dq}z>g&eB8N{B4BJ4y1|cq{~IMu$Ut7I_COHeOGnN)Wa%AD_`()($u`6 ztMDD>J?d1qGYcJ@C<`@I{V#cNa>4xJAlN`v25dLd`VCe8iJsgm)J6Ra6{`LSmW5`E zY>{Xe_aCv2s#n{vdvnTOFbj|a78{b*O$-}JQA!W82gCrS;Az7fRm}yofj5OE@p>?w ziJJKx%ymVI&r^?Dv~?RXkY5Rk*aZ(p(2&0xW-P6hkFauOwsoW79#p==HRb*LXiA!? zqvDf@hG9*yamP%2>)Am{sm4t5yrW-9YR#u7doWeT#JUQPod1s;%`Au?(bi(k^aQUs zz^cKYx%zL(-zDXKhsU>n*16Wiz?Iv_*hb;#Jlu*~J4*2K{!tR{G4 zUh-J1qtTsfGf44o8uj^4-HS3!ON#M%mBpXRY(o~ccGys^N(%?URpjt8!*H7>ss zmcaAX<}o+5+pk!gDten{#Sn$!&&M6Z_Q)9ulKFkeKL{FU`MnNZNrI|B`p;!D_b{zZ zv2Nsq2(f-k7B_ovQnhm9IlL79X)Jg5H@0qg6stn5^_v8_MtUhRw{x-dG*vqv z%MU)*Bh-LoAbvJgKaUVL02+(bfe+W;em}}1tb8z_5aF1fr-XdqP#X4QHRN2ibb5JlZFp#is;N^r;gX7Rnj##POX-{#G6YR(_ zwDtndy$vpO&2F-o=@s@14S{VUiCruuZZ2~soVziR%op+{7r(^Zy(j(3FQ2C0AI?Zu z&VLJ^dN4>*mNAJgT~gB5sMIQ)Y*KF^KU9>tYlXCRT$CS;J4dBz|M9_>{$4BJ0Kv?C zlq0h3A=mt_NTtiTAnd{3Y*%?lQzOo|4CSN4LY zI?i$;5TiAcF=}1%eUPl2@!&9Vl|9Q*FH$c`kwrbGmTzp_YVGCTrMC?wYO0k$guQ=8o?NYTyj$+fo(1pL4 zHi^Y3*)#p@(vl8W^jJb`4i;(1P5~i~rNyIeQs1iv_wS6T!)1GnS39 zZC}A{WqZ$l5cQHR-ENvIb8b>_7ZoGl<$7{s`&x4v?-t92@9`iWxY((5QXF4v9XTDU zU$&u&rG&2j%u%i;=+Q0A-Msz@1}vB`;BBaOw(WTzU^r`s-n<*EH%8UI73WM`c`$aEsr z(r$^WbdrMeLzLT2#I+CyeLLeQX@nmCV_(VAk8)ta1EYcmzBWqAdDcnir{wd%cOA$J zEPtIoG$`7(2D9(Mog-u^>s1(@KW zQGQORpf@y0VV5OS$A*1S8JkS zq~)>jndr+AsL8Q-e!F?VqX_RoGBp0#vTyL5Y$EBf>GOHLuQU8keOF>g3=ikGqZHr2 z%?cnY47+Hec5|5At_N_P7v#c&vyc8?>e1ZtKuA`Vl& zj`u>b#$IOqe5Mlne3F(&23L@3@t<$YIc{fQADoUXjY@t7@`nnK45_^NYxdT#S>H8F8S{2%ok~EOm6@u6#A@bCs{PZ(>r} zxA|OB-L&z#ynj&t^~iQzM^0T71^0XDLvBNb3wz5lV7jeM(;vbG$^yrRXUlZAlj~f! zMY}v6mJU^qXXw@xXQO$R#HtMIMeb2%p^so(;&8 zbN$+K7hk}1+2c`9qBY8zUn|SE!KB+;Da-fn$U=b(?whn+?Y3rXq!X&cwI{8^4O36Q zb(f(_HHH5qYEaXqBm2S$*O{SW+Q9{#_%Fs)I1HEtmgm)e=%!qXnwk$Z>zQ76cO7#> z5h$YB+%D6<0{LjT+I8UqaHscoq6Epg3lGU00flSdsb~gcSw|JD&c?ZdA8akp#@l{> z^(Pisq^Jq6(}XTT;A44pTa3&s;82U^SRS9Kfk7$oKN{C)1H^YWPC`{rWUtV-#H2*t zowf$T&UE;!YN2tdk(9Dg>Qi^r&|iFC0o|hBku=fQd4vbVh?FYvXy7PU-Rv&djyspl z0n1dx5(=lk&WvF&%BCLgR19R$-QXQ+S(U~_7`n?Pw(009*i6rK@q_Ut{ZP%3KADpk zM&!0N@}lBk*|)V5!wF5J+6)U1ty$8&d--ab3mv2cQKAom47mpc=eoLdtlyn#R`(5W zfzrA-!jX&j3eQWP2a0*Bz0EA$hKo^3d^*ccl17?M$MP0kxg%`jn;WW;&Q%ID2rex~ z2)lf7$j#e>&Ja}(5{3MJcl!8*>20#E$J;2S@bpYe1r|bG)lpWthQhHTo^FqmcQ|)` zyJHl~wZGsfJ%fgPFx4*imMzZ*yd<4vfZ2i{$)9Y6OJT7$OAcbyB7qjn*uEu`H-b(% z7!L+qtOO01$@OG?ZM8JF6AP*w*!DARrn&5!w%PFdW%NV}AJ*0R`Jp9#aA&GX{y3j1 zbiCrY)L!F(^*Fu6yCv2*Ib8CqD!j>ko$=}U9=5%}Osl&HF%1K$RPI^a0hY`c190+9 z$jWtIOziZwo3|4gvg7_+eud;5E^0^MhZ-sZc}u_V z7{MbcXA`J$@b9*N;G$bkg3okH^y9xFpa%=<2cZlxf$FhNIKfbJvd$Wd<)vPW9`kf~ z41(rUji;00Jizn_^EvhT+CTi>aJ>9r`=}e)Tp$KX#a)Vm2ng={HuO%9!BAGwk4CSu91sM*>72RKX`$`2 zNL~{3nLT9UJi7YX!`AQ^c%4gM=ly72rKm8=&DeIZJ`=k1*Q&VT=e=I6%ojAiuq6^0 zxLF1%oVUQtTXbH>3$#OW0UO(V>Z47JB@%NyTicz=oNfz2S=(E_mp$8e$MtkcIh?O5 z*Vki6?FQ``Zo-Eti&5ZA?!+cv!ySa@^C*hC&`e@xsv)gwZnS>2~808E8_ERh!;0Ydi#ZxplzyyLAMR4cuy%X@~f1wRQxL6rb<#G73hLSQLeT|*~(G2Ob7;kvdAUznnUUvqYgo^DA*s^iR z@|5Kr_yEQO%LCM(?!0`TAmGZhwRWr?w0Oj^D1#-JS1` z`my@GvQ@Ghnkc2v6ZdN7mLg{Lt)|XnDA^n6m@FH%?id|yz5RIuVnM-0xCb%I?1OEk zN3uEdQT`dgkUSU6_1(3QykM3z`ZmXEOKhksA17Zt z<{`v%!PpT1F39J#XX2@?RX5rT!kf?Q@h&2=q{TGJEyOXl)u<_WgXZw<)Kji_HxmcL zJ|mePgD%Bt$2D$4l|+$0yq)wZxBKGTBB-R4pbSKxi{vBcAVLIhzN>GNJdR6W*H~6g zJ+IO{k{2C6QHk9f*D&WkP^;(N5TRB}1{NhT0@rSpD*M-q{+Y{7E5!-EU<^BO)1@LC zuPv$;6#^;H%BzJQa?h&^J`bNn9>uQK%-$&lL-c<-8rgrXEPLHvM5TX>9-kL6D%U*0 z$s(C3UDQy$arzED1<_{tJ$Jr|h6!th$d82JIvysFZ!x5vYSxIh*jo;3~ zP@NMUL}~yc)J+q&d~IPbh2JOqzop1Dapt2MZeWZNpS}MU3nCtAShK2%6r(vnyiH@h zEOAtw)YrclT%GZ>_-2sI{0Ybp{__pD2om(?#TR|uHxcBN&4y*<&?D!F){LcKJ zwdzH7iAZtKkqE1}CNr17_{O{C$N3Fx(l{~wCBYzI`xQU+@M;UDV$dkuH}un zOsi4lET5GS@{153&5}(tBBB|`G!a>S1re_?C9N2+y6$Akaj_X|JA7~Sn!w?7f(De5 zTU;zAovP-J&=tQ0fTLkSpwcp>CrElF9dk5)5qUQlzP3O30J>-8X& zi@;imd?IhVhE;tCQ1NA(^cyBIk44L5bKbk1i&awr7UgpTW0RXeC0Yo$q|5C>h0Hn@ zw(rHbHj-c6S!@mdt|Fm98BO;45SO`wJ+9$p?D)#eN_N+#r>BsZ4 z=g=L{0I6yp_6RO8iiqe?K9o!>wx?8gA;V5`)gD1NEf&CAE!s|cHIi^eH*ZH|<}@dz zW-8&Gn%Sm71&C18>!r4T3nVDS)rP0j$8(eW=T@ipKvEymeeCOiq(+7P$@?n8I1sM4 zs4oHQHUD~fDpRZ%GR{o7;TA3*euNNMXMw+@edO>p1od&d2fF^TxNBOGs>8sx6@O3# zPp?<&V_MnRwL{e_!i=!gb%SAlOt<De;`2AA1;TfTUC`@l=^V zxG@x*Exn|YAMKwlO&G@Q1id#=@dim+KXF@pEYywblj7{C5Jv$E4?`Gt<{0q*we7u5 zF8R?8Iun6lH68k#zphZGVi>bR1x!%g47y@vfY5NuHQkU|e5=QI$}ec->9 zBuXev{|_Mma9w>bnaf6$gO2r|u?asV+`$(MSh3*p*!C9eyyKF=((35fb#1lSM~Mf! zE<0MB?i;DTL{)xLPrmEof2bU_YR@)!+Vhl@esY@aFPj%alBFk+8d~@Qf7bW!@@4|J zd=I@XjP4?{_mI!ryHoO?emm=5Rb={lf)5wcUD(l|Xr0XEN;fheFgE4}MFm}BEFVnc zbN6cWKT}<+)rG{cOvQCBpNPkn&&$`1l({#AO>VPI#eLo{(cIcY%`?}ibDff^=`WU_ zB$iEV!gu@dcRg4c#6#Upa{@KN)fA3Sv^b5fR5+Np$fRv6+Hp?yiebSJh_l$zF6#; zoJ?A*;?5G)K+5K++X^95R3hV*w;ViH;muyCH&Fk`l*hM}i4T<$6hxGXt|{No;G+u2 ziLg`BnHhRry9tgMW1;6Kz{hlu0n*I>nF=D8_tAh()E_x`l1NZh%<4ZCd3fueNVR^v zL@9n{9XM*hy~fe%?R45{_uGPNak8j$h3jeQK_8xcjO4R@B`_cYBfxi4XHvK%jJG^j z|MqK(kRCeUQBw-LjT1*~Y=Dbni#2J3$w#lghS_3_i_2^Z&bwOxFQh?V1C8?Kkk zGXq&Ad&7pwzq|{T<3$9`bGrlvSfjmQb@r51aEZ1Hq@8qaIx~)8#|}aK<~mo*DW|!g=Z13OY_^9e(wv3mU=0z zJ*yy`-Ox%f%{q7th)UE0;ENpx@a_&-9Tf6C^A*6Q){^U|LfOxG z?DGexFGNxt&W6{3R9A3owe*|PF^@BC7JT2*)>ecFmNU#c*8!Vvd51UMaGjns%eB?g zf8v=ov!42Zcn$_t_a3Xt=eMuJ6z>{wkcsM7CUm7IT8ChwJ321!B|gH(2W@NF@jEH- zn>*|qPGTD7)l2Z6gw|o7!9H01YXF1 z6ZkuuD(XH9wh6Yn>ZpeKuYIs%U6hsQYpw6>u*SYuYMK`0WdAPPPy=R7-fK}#x6Qpx z+nQfBlBR08`vtOhX*LMw1w2d}YX(nhP={5jXl9x*>Co`X)ejRI^~*g`Zv<$|AN*a# zW5Gq%J<*OsL|0mEJ3ucLnTA8pjbGsLS*a@Me3P*ks$ji%+UsE$Go@d`9; zVG`&7(PdN=3r48>tqbj(|A%*jt|$<;19FAg`V2%QNIz4VLB3n+29wU z!wl;%t?3P7>^G>cWc3%s-+uu_S?mKHjVIr7`aXb=;59td-LeBI!DiU;MT=g7^Jj1} z>an5<=K>d(@HO9BQo5w(!_S6T!hYHJ0|_-(tdxtkjo(rsYVK2yqDG|X<>WKO#W!oQ+Y>(VS0GFec!@$yc#}hqrw3+D&)kw03@a4TD;$Y zTPWaZ=^tIf1Oq$%P}%xxs*E~!MSD($*>XwcAXtSs;ZWSmDQtxrs^h-U5l^zLKiZ>t)IOO^wbE3 zKYTQ@iPoBkY5G6~?P4kesiSe0MJ)pD;@)*GHUw*}VE|}K)F^Oi-}gMJw;$AVn*9qn zG*YS&hq4Y|fg8&?`ivh9jA!TC)YvJzEDS3!zhcjon{8PrZOAysI2!1s=U*n%Yv=My z!%}B1tU|ou2o;;N%g$=$C`KIIiOF)KzDZAX%x2ny>tYe?Qq;|{8HP-)^8*0m{Rfo# zzmoTe3A^Z3`LPB9cJURyEh5}VahECf8;A%6(!3RO`UE0p@P0HH2nd6gEm=rS`@!fRXPDH(V{KK38;Is=G?7CNFYb^xq`YZepL^#G0eKYJ75td<8 z((XFE^7dddElw1Ck>o%9UUY3Ek<SmJwTgHk&V+X1wa=`{D_Ke+BoR&(whCk#N0s+V-Ym8Qage#>pb21qtB`xNdO1*Zb|I02}mkxTHkknFYc{ z%_C&|+bKv~$j|X~Q{eOXWLtMVfi~YZfj&Y4%O4v@Z!DwMr_9Bs{5-eOtB-FC)5{=; z9t8N+p5>ru-e_kmhot;0JQJOweJUG%%DZ3w{ZOTgO?zA8i!t;x^%yWKeyXdN|A($8 z>MHoPLPztVwcr;--qN>izB__-iF8eK`v?p>- z{In@>`tG&(@EH%D3*AtLwflx&zkcuP#_T}{C(H}-kP#ipYPb1PGlETbhmYqve~7Sl z%pzLenNO^+KUEd%ho<_9yKvJ(6A5J4xL?N|7Dc!3`pz}gbjdYp_Hv(GvxhT%k)VhG zi#prg%{7-w{1K^<2HJ#0T*^Kf;7R84NG=6am zF-+9_+v|XW^JpljwGA-d66c-T{N1d#YiujAG@DOt;9Ae20RDV?br zB=UglP_Y)^biY3=P{R*TDLW6My9xr|7-w}u@rW~ZV!a8N_$>*ne0BIsnw)?AN1CLA zNfQ7}nh5wuL0%X$qP&Lf9_aTb?_VP}q(Q|WYmF~)68O+5$nc+18=_tyFd#XDmHPST z32nQ8Rax*a*CgPbV#w2Pb8~@~`^{Xt(Gm}wLZYjNtcTq2SdL9UsVjB-q5t(O0GXjs1$G(R5)9kp@j2hQTW3PP+Tu&)tq7GuC2{!`^3z8RWEMpMz* zY>iW&sSt7Xw}yoh9Yo`L%@QGgXU$_?cdVfKLX@z4#j;yxt>X;UM9rq=y;AE{D3uA! zpTeayc9`Rg>(IKmSL6xGDn)YQKxJ<(<5E#CwfY-sFFOy;Yt$)`oNDiDFEkwVb1q3de(-b*`aJV!pHV3(@TVW#pVcd5L zIfF6Mx^#WP%^IDeM456q9<=+;Ktl9~_<{2WkFMDwZ6;Q^%k>3h^>awmfJ){6Jp4(* zU<}QKuB?O6W@n-3F0$qzGQ~XJf?1_NPlDQo0fT+mW*F4T{l0A9H~cFAhwER_yWmVI zM;O*E5&}0?-8Ap93(Kfp@mQ*NFG4hjSgwuLO?T9Rj zF?@6Da8N!ytEQ9GUyZM7#mv%r2 zWRV~N#NN6Y=dgTpmaX_qB+L?EY!O=5NFvSX3*Gh}|E<*!%hp}yAn$T?^den#;&D6t z7j!JA0MpYo=>HnGC?X7J#paI|chGJVa`FBo z@HRn>Y8@yE_5Ml%$?v2|u`sYT03ZMMyaM|wg}E(5*tk5Uj@No%R)_?J|3A}S<+38@ zsB;nsHtp;>84!%JPZcdmMxCoCnJ#E?{-QNu7VtzI`t(2}+Z?5I&DdzYX)w7~DGL=j zH*djick3$$N>I;aZf16ze=*&iu%n}q#k}kxQ9@&eWw*?rw*Y*;dvZ;y}jP>t7gC=(7tlX8SB z>GvDRK6;&8P8ZI3Zarg(rZS|P>|)+_=!N)RX4Mw!#d5z=2tNXgxP$D~&PO}N(9+c% zos^_G+p`UxiiB9W8QJLOmbW_^?ybjX|45fPPBV-&Q8n4@yi)SlXkkkLW3$HO^Fr*c zz|+=4(U;z5@em2orly-Y*+AawUe6P3)EN%Gn$ErSk_!Ro$an z7y{@i2@LHE`oB7E6bZq0R~}0N?sQQuk@0kN7P)u7$ z(4P5f1W$wi01s$Z6iAQvebwa2;$87R;vLFkvo=8`=2VN4nn|5%uz~Ur$Mjy&N7wB# z2Pb5iYj_CKqV!X~kP_dSN6cV_1`Pc!Iou)Bs35 zVkK_hVNyKjTFXEC%pr8O!+bd7{9i%|iJ6YGEJQu07(Rge-MiNT5&?QnV2I*^NOKm) zyoYlW#kjKx2wHZ${9&(;-zfZt%dKZdSrRq$bePzYGvr!amE%a%3BL|M(+cjr9^oQ5 zHB31ShN~{^^2D};8#ovC7nQF5{&^U+(Nqz_Px}h|>wi9u!1YY?PP-`)*vBz!2Ow65 zIp-bvqLUsIv2P9qO;sDK`3ffG{B&Uk#WRl$ExOC(T=K(D2s6IO)kPwv80R1)*I-Pc z7~I)S*W)xyn&h7;gCc1s$Kg@5YZ}L-LO3p;WT!P0T{~%s$?A1b&(6-Cxvke8}Ccq~Q8S;W9!zTnnEFBq1SK2VSbz46%4x`{>+HlBZh)^-3B=~TVuAC6R z=pd;ODq#pc66&|Boq&(n#H6oKP}9zSZUtDb5wtz1vtg`FJ??#CP3yHA)f+qzGFx+j zWLljA<-l5`ZK~!j)$C}0mi;KjLGS&kB#GMIezHPvPGswe6ZjJFm)!wh@&=v}JQ=vL zOkgC{ZpYN}I{OfLp*)1+@E9@Mj0J@b`Ne0}!7Aa+3-~wBd&6fVcKCq7-vJ)V=Xi~A z^$+-KAXvEm+QKw-6Fz6U)o)x|=5*Ci3SaBH%bOFviMRcFdA5=6FgzbSm+;H+5l}!e zO8Msg!(pvq4tZtj{&}bQnOmcYO0@Xf(EhfR`wnagZC+pDu5;la2hieYdkNlXOy@?~ z@*AHE|-Yw4~Forslf4cqnk+nFF9rX@gx*>lO*U?p(YGRF`0UC=(kU6 zvb;hzY^nVa@`3J-8pDsFmw7aV$-+FjY^>IE=DzBW`0moPe$&*T9$b3TZK{)VYtS!m zVtA*Asc%oBDh1alkMyg9MCMO}rPk);&D*;3Y@I$@T2)$w$l2Ag^5jXgYCw4@`q-G% z)ROY^;sb${>;bAI5XPQ+BpH{R9xMsk1GeX ze+rCFp*$-~M^z3?d@4)d0z=JW(D!q%tdK@;!=FCBdF?)`W~)pR1?R8z)k*#w%L|(-?Zz3^gs#eJ{D7oyr{cr(X43=8 z!uh0FbC;CEHi+7{gz4f{`u^c_&^L3}djs_-esh`_hIO{5eOldq;bQSnAXqDS*3A8V&!CT{BCx+FnPVMq* z``v4*;VxOFzO!O=$-|>76*sd-I)TWB!JbEfwMc!>^2EHM$**NnwEGEt_L-*g&OpJta+%HE*5t^|<$VtB ztb#6V{8k*xd67~}%$d~&l69qv8QXah!zPw8G01uu)vJRdj2p`zJ`|T0;X6hETJ4{x ztW(Alt#(ue+8i7g(pZ|Zla>Lqah!S(*^I+iLYOd>5u5gDP$94Ag1F>YX28MQ{|-bF zMNJN+4;cijzKkGth7e5H;J3K>xM<2Q_;y7G>GzxNc?-31^i3vnlKrtBS0Yuco-K{w zsT1QL)Qr{4PafG_Q|^COa0ig<5?<$lk!ah6QK z0=BwzPJ9V_p?LF@$=5oR3EHN$Knr_gnCglC^w^`SoGcX9Szna^*LPeFdeV^?o-3cV zbp~W%3<33*G&s6~bBKwpPIqjDxHv{T#D-b&I(%47+F8WbiXamH>E&k#ZhKmY4J|tO zIhJ(Urk_uK9<$_DgqVN*6ywt9aYCkFZz>Zwu->n2}J2+4@-cB$vKYkyE6s)1j z+e>}j@%f&F>-1sn%SRT=CWcv_$Wl2Th!skwqJ}hu6jB` zRn(g213|k^lQC8v>sUV^E!;44U6eW*fFx#Rk?Ol&1{zDDGOH$}-_irW2|C$-Pi;33#RJd=-C@`xxc~ zf=z$=Cg>`dcDiW9OS)8*2dlI*QpkHJx%OY7C-V?bx8Z46u}(DEI-~BF)_{e#zGwz0 zvE+34lNW@=^(k(kXUNMy8}h_pgK6{+mO zPb_0pH5b~x^iuMT&E@dcP1m|0VKOCpY+h1$h*53a@&3mRKE4xwwO$#~iY@+14<9}R z{(ae-IxHA#ox}zih>0|-INwZdY2wEAZF3518^GBngv|2=fHh`?wNl5PnN8`no;oo0{z8tLtP9H?z=s6{?WU%%UzaKm%{e7YlT>;%@Rud~rhE z0&x>{@)m^G@>r7s9d+A$A)Ar(R6pmXiS+ ztx@|3zQ@KpWS0I-v*=c(qme%yih)poiXxrchIjC}*UKcW4+t5swGyzvlMIu>=G>d% z{2-C&7Eduf1-~SfAUinTHc^`-`FviO%vyT!*5+(;y5_e<%N|Abnq^6&OMc(uV~2gq zxSLT?Y#k1Oe>d$TEHP(JWT`rT8*ain2Z=hQT=d;qZy zufcU|aG;=(CMrwZ(m^d)KFDYI_?{BOu6|#o9}KO3l|7P zt;AU5hyxO1!r>fXVvrT{k1+y95v_1(`GdQIz)iPNQ9@R^I^|V6r*5K|_(1SRQtbVL zo*+H*@;UD^X7wz%FXD^)p*fRXzJ@ri40b;d;i1Hv-iVj~8FbYOam)BS#~$AAw4^aF zP^*32fnuTmaK4AGukqmBwNAIIizAIdmrFj=NvMSm5+?7>yZ-cNyK&uFxA>}ENHO5- zj8FnY3;QQHfYy}8mPqGtRU^|3lar5`CA7S)TPU&@XQDaFDKOtu1eXW;mN0^7$1kXi z7DpDm8ewkWW2wgC9^__8t+^V(x4KnNDV@rcAaW8$okB7*Pv9n6Y@n7Z2_<`{L`j2) z%@YzSE|C8TEdjn^(pqIg?i5h=yUi-sh^nbE_qa}$>LDet-97X_aq8m3TJnyYDAEu%e8m%I-&p zn3eJYijZ@mdR2b_oh<+O4$Tb#yE;utW<>~_4;|>_Q3t># zB+7s7PxgWp^$@A$Vno_`H5mhPP=|yP$6iCQ?76NQ?GHZZfiURv z|DPjAhFax9=&Ujo_)FY{3Wl8ETqeejdzWi)=o3=o;*UMTvLGnO8}mYtMy{Hs8{dFK zEP!A_ZP;n~@n`09?mGCGT@t8DRQSNADfxZFPB~d-gui731ynebl5%_)6f+lgP3q z1<_y3B`l>rkhQHe#yX|pF`75fBL)pz$J@j86dQ1e)KR=_IuO`;>Qq+x+ch3l%PEc9^Sue%IN%#)JnW?; zbuDV5248LVA^+W%h&otuwSJ0W^B-3PMG~8NHB*&_ox!pQ|CXkU3I@D1O$pd;#%y8= zcCuxf_P-t?N|ee3E$BLD_#&yr-h?Owt1)t}#P(~pXj^Gx?fFcn4>EHuv-QBml(+w{ z>OwZ;#F=TW;&TXwQFz!}A5Q`P_>6YecC=%rC9rnU<_BQpzBK? z*`T6;23MiU8!TUT!b?ABa@Nt!iq2(s!0SLDQc_LWd3EWn`e3VHritsX_j%~ptH-pq z1An(Y&`WApjmh_j!WT(1*I^23SGmG^uj}lpg6{-P_NTMVYDKO?&Fe6j7J{ey?<*>f z*cA7_QwD#?sa`Oprz%MvA;em!{qxQlTh%Im!L0Yu;7S}M~mXeTBc0u=vt zgBGzw`j@e9?PkvR`gb;w`UJ9@^!d?f0Ta_Q1xO&) z9~2OlSI<+JD2w@Z6@4~TA1tmoD$lbSF~LRR0PE{vIW&8G_ zgL_=lu#rUbY9AUviA)x+_0O~;7j5Oe7yuG>HuO^kf0Z&+NPmc$|5h$x>fUi+Ulwwj)YmzkKl5@ zMUtR78Ikc=P(k~>sP%NXOUc&^DQ6pSef6^TGL;#JqdD|1#L9Q4zuqkmka(2w#G98z zn`_%Y?|NJGwiyBA#665RarmwcvkDJ$&e!73W;yp?97u&FYoA@c*kZ45j+e8Lj)g}WL?S!Tj}s~H5}@FMq9YxgDaoqaw$zbR zur+07ilR0DkEyGUi?Zq3B1lN7ARQ6{(%m7ANJ@!xEuBl(O$yRTE{#Y?cXu~Z(%l_P z=eO!B&-X9f`f@vDvwCm1r#&OAAw!GHZ0dsViX!)n$6uS;#N=WAz=)_uIJ&rbSjtn7Jv`5!)@~j1?yLEIhZ8orH_)sxeAf;^*lpS*aB1IlefSE<+7AIv{?u) ztBH0uKQ-*;%qbqa$6e}I+UxC*ODyY^c7lggh+H`QV;RaTb34jcyCmTVqeu%8zTuLO zzsmEGpmZ+TXCMpOm?qh0$^KVBh|)Is1e@L+?N-T5tsFh*0Z{? zV^k@g2YXKK^=uNla={2%9patJsjk`d&Z~vwN!>*;1owy9b$e5LmNKR(rz6K%xZHtk4N~hlSCy*0 zXABL3{#Z~gNSyi3cy^+b&Ig0b$YDz~f%xh+gN4#+v6Ci29&)@ovisO>{Uc)Ub{ZH(1FVMt1~OLD&SNAJ2k;_+lI znf>R1fJH0jvN1aM^p_D?0BN%*Ph_v5nWh1uK!r0Z@Cp6HAR%^M}1Ek{UgpVY+b0URop?( zVW)#Q9`Y&|TTG2I6ngVgTr9_MH{j@`g==+jMOy|ft3IB{^Ww$**E`(neAevo-A_kW z=P}X;BeQuY3kM24p9=kFkgR@kfcdJ2#{&xA&*BOCr^w`_J3&jLWWs`D@3twUR$h4F zl|K#@!!B$6>}ZpoSkk>DxFSp=LK56M6e14RXp`vbfMZeqbEhmt*B+ccz^U@WJa^@V zV>sXbUrJyT=~hHsms@k!6#MV-YDQC4nDqr>{k;(B^+%)mekQ*rn?Rja^Gr%~x{tO> zZ~QW4V0#f#8)rZ|(_=&MS43spE})fFh-`$hX1^cdx(^CQ&!dHODKYk8??t z#nWXz9-HSC+gyf?*Pb`ho@+Ghp}!loNosgma}uj*sSA0-NtivEqrtb{8uf9m0OfZ>pumJwXxO4$2;Nl!s55&xB~HLH;zQwV$< zQ~oG*U0TjpzX8A&H|vu?%4#dN376wiR$RrUmJ`RbRqBuT2;FKstO0lPKaba>ak?EB`N>VxbVQA zr%yoM^N09q@uZ{Io3gmF%w#D4TiEoy+(TQHg6m+(kkk9UtRuK}e^@T)U~9%FmX0s| zCs|n;7Gh(d84CS56<26eru8GRt^RDim19<(^t{0G)LvtS*{h+!aWsSr%_ivcy_y)|1u~c}J zyL)_c_yWZS;0Wxrk|o=YeyJS1${&s>Gfm>nup+|5iu%EJVg<9ptss5xIQkC@jW%3^u~|Xm!3poA@H;P8iTn|gGX}7>3=c46L^#@nal$`caWHR zt^bH4DG+YVh8$6$&09c-4M8E!MC4JGwrjyRrD<7iWVrg|E3UVuRa9PI?hzr{`~|sl zDMba6jMR#R>50}R*B53KE0=0ioE^;U#8$(2@}I+b1F2Vw@E6!@s7B2b{pDnNsgy+-eTgo250?4--k&<$ZjF+HDqF)$m=;$!#bVuZSY~Ok=A=s z&hcn%>F2*eVhJu_iHPVk7#VNy2wsR0c3g89DAm=*iMB?4hZ3m>79 zIaU2!d|J6GOj3ezP4V!L<$fv32Nwz@^=K0RaX;7?Hid&NHM{|f+c(Vv_2ih4F43IJ z_$Ty^T7yp$hxGXtg%=@Z+C)it5B^7yd(+loP^W!d(NX9vE1k9VLZag>pl%FPva`R)#Ils5!#CjYt zy`WttRhGze8&%Aw;#9hmczhGf;v}3;8FnHs-lbt_6wLtsD9za-US{VnCYQivpML7W zCPe4Iupu>yJBDJR z2#gF3k=^FBAbfj|eqa9KwW&iJE4%|HkF`fW32jqGzn3r6W6Wbwjt{agda!Ol4N1bu zz9vfA2P4-q(YCY3HTDt_Zuf2tru2pQ!=5<)c-SwRE5^q?_t4j($le?F7}OCvS9E-n zE%1DpBKeGHEF2(kpYDRt&SnQUm?OMZs&xg;_eDqU&v-<7!@a1V?|JPCeP^BH6SI9c z6UO4k8Fs5!BF6OHYxc8H z%>~AgTM?MsTj(qi`k&id*w+IFb^LB&bSwx0k#iIt*F=aB1Tr2GZ=6e1UoXBt%~Y8q zut#)#y?<`5U67g?br8MK)|HSKewx?mphFj5by=q~a_@?+akDLZ$iX_$`9^44BK-2y za1gU0H5?WSm?uHOHiJWC+)dRqMB`-2hUxIcB9@!a%yux+@#o3PVS<2t@<$Lr2K(_2 z$p%akNxubQu7AG6%YOb5&N+W&hol)DuH+hYS~>`OtyaY>$S7Gbq3mAx5Verg@> z?yo!{L7nlU0<)&6W|2BEjJ1BNFkfIyUvj}^l;dj`!$~`_IO+`(eBPjIrxc`eK zm7PXmR*hCM4H|+*FGqzj0Il!#uURbfRq}WUnCy;8#$g00!w9lF#>%T#FG@J}3JgzG zq7QTDn3PPUwN}%pVlKN=8nf%sJbFzzOs{5sDNAA<#4%+TfpMKUrDl5-RvT)Ny4rI? z{5K*f;09o1SiiogV|Hv~?t@((IkZm^>;b#@j@z*3 zCEcsDHF{0=h1iOeggk<9=KI*9<OFaVH)&U(Mj-1PYxC{}x3HuD z*8WA*CC?v+*K=g+IoNT@6Sug5FytR+%t62^DIU2vbmW{Qis0Qe%^pa=EsBqXUB)S^ zWp}I*#jX?C2OF@X)O=#P0Bdrs9Y7t$3E-i7@LR3}6 z@dQ13nma#26zA~5?hH4nqt0oJlsr#DDk3)>MMa1Jv&OP{WY{gIz+KQ>GIlhE~P=|UT1#Z|D9Fh`_UUZe5_$h z9+8NzPNjTAgr&LmQ{@&$A5sPQ_y~z#0Vt|#G<0RWOvl+_p|^X%@Y+G|me%xG@<5Dt z77hNQ5t--D5J-rA*6ZG8xIq;Umn^Rr9GeW}!s;T)n&he0bOD?KLnt5B8ox}h3)-8F zmnjKdjnuO=^nM4Utv9nMVzF_BQ8YTdi%H6uQFaQS^iBOU$7oM)=E>ITjmg)lf$F3M z$tXLn6SAADA^GORxCp!5vUI2O7~1h)+KR`-giE!#up3e@B;>!vd(^x}knFP1o@Wx| zkR+|ZWz|7I%unnovOA;lxCUG6S&syz1Ssij*O25 zH!9EY;J(b@;Tw`DM#iP{$p=3n>ohr`VKTpI1fb1emItZkW9rli$)!H6T`6Nyn-FSBXt;=Nyu6jk;y|9W zu#6CKnI;lWXy$(9w9&L@0T>A;IAVbjKyU*6k43hW=%(xt+8%d$+i7;a7gJRb-?P{c ztRB0MMaV@PpFNK@XYxPL!+9qCp1z|#Gm(RrmX{B0PYk60m&NPQL3Jb;y-RctCzcn)84^*v$~H7g^ThQnM@R?n<{;T_>{0G_6c4ZbA-!s zT_GL+nsaM-a?Rl5dCm4P8F%XA6!>F|RV!aIa zoY3WaZT%U4v-on*RhaABRHsCTyW2JT@gjYfjL$UyqyD`ZuZuhz(ly8HKp~+m%zM6C z1Ecxtaw!{Y#`zGW{8+)JRY+#d{M+}}QR+g!=~Aah&y+7PEIFw$gq*4wQ3liC>Ma4{ zt>^r=`k2R3-TX?8sYbL(Gv=!o@u$8cFW%G9XR7`%-on_~5W?E&>R6)}sO2#?r5cfL z+Ayq~Ppjg)_Cg~~D%{=oXum98aLS%4V1LbtK9aq#W>&{HH#>L-E$8d4&BAHupGh4n z@|f0sUvx`&+s7fP^|CDQRG7phU|$+oJBe>h4BTm03fv9riXe4DGNC+>2i@oz!*GR- zA9Um1e{qSnqSpRyE0_C)BDRvARnxOC8Is4g5doPpKJ+Mi3+sZQo3!%wk*Du}sBGgm zwq0BfwO`oU^0b9p4HBf}Rd(Tf_QRJpwC&+9MpE}SM(v;{pL))2-B+bgd(Ht)m3MLz zTskp>^-8^zp||}qJseCI1s@)*ow6i$oxW(AppJ4W<_cCVog#{I5u}2;f9|JSo=ok^ zq$cMY5p@s>7k>fzP<=G(aPtbn*Vyo(FuaGKhM}aq^@CZAE9XIk%N<*!i>Bt_dPZUy zr!hH;Kg-mH?@j-&0k=c&!0t~#&MF7`qFD+sOzj28h!s|l#9S*Dop8!!d)69N_kS2PJLQ~ zRTg7>a8CSn+S4Pfa_%EHMnZ4C{(|m>b=8wRz+9J;v%ozBa29~!+{N&KdKX(HcUQQJ z;D8(P^!@X$k;*pvsrr_+`QmFT_}P7v0@?5_Q;G1;d%4=h8GV4t_WbUnNwWjk1rUgY zuTPtP`Xs-JR`;O%iD@~$P_|e2XnfyY=E#-{zUwUNx!@!OM&XA?5*O|vhnHxr6N|hj zjT59$m!v>|yC>78w-}k9I*r5C?P)VI=|2J+uzw0)+!%{oR99<0#hXi#g_HSSHLdIj z4TrmUyW?cBQ;ByM>IvC7Z*V-D6D97;T9$LV32Px#yytPq(m-d6o5^wwnA?b-Ua1v2 zsZ5pGYq_KU)B|#m*}IINhT@wQ30oo*Q~*0e&RtlnbmWmn;4X%Ykl5)x)vmGsxRmFV z1LIN-j7i3)Fec@JUvH<4*HE)rIK*C$Asijm|pE^tRt>JlVo|6n}bP_QvLFj>p^K?65(p{S`R z<3&?Jl}??p^zJ4_!yROSt}xbX&LK=IXuu({K+v;pj_3hh=|`U<$95r! zZp9>0lj1rQdy!Y%4Sa14ep;;id6?_LXd3s^tnb*;tzkwp0W+G$Mg&iTRJjIGM0iFS zuR%tL$GnxE5dUuU52vPtnBqS7P({wdDAC3gw6Z@tTsKE6O<7npGbyebwUUK}v>nvr~D z9%9MFhaPM0=~>C{{01ysICcvp?X9-$4uno)yv!iHq{U#4=$t3@ ze2EkVVgCaG{GpKYM{K5WZQn0*rPlqGr$=36g4G(ON|~_~cUK|wD)I0iUpLGAx4gVl zJW##}iD!pFz?LMlX-GB`Ux&jO)HJqmhG|R3=TmE zuis&s!>WK&x3{^9GxafZLFcI_%@djR@jnuO4;Qb7%3OrQT>t4AwLhuY2TH4G)P?ut zk=S7r>sE}x3es!bXT#23E*!sw0Q|wpH)(BoPlnp_Y;9|>o7sW7QHhVf>uMIz7J2i+ zqsv5hoB0q_anh;X@9OjO=2cQ_h4tn0{Vp4W$%4sBs8nFHVj&nn^ALm0LJh&ZZ9m?u zQAMs8emi`uc2N`U`iS&3IrwXJg!(RJ3h@UN=4`~w*RiS}r3*d`Z4m=<49-+?p}~DT z$)kW)^;odV~u&HB@zc^FiEUv=?gETijYx3iB z{Eaa?@HkMJ&2X4=)Kj8sJcW(PgO_VObpkS_qDe~Q)MInVfa`_AZegYxUb z*D`0@onyYg1hZl+`JXcNJMqur;^=0D?69YNOq7XknTH|Vx`|BmlXx0byl?bF9zq{V z=r&F4m-@P&Pu1ItF+z)_l;2Tj%n*luVf{l4@Y_v=?LRYWVS8=_v$$b;B+lK<_q|Op zVt8B;#6Uz^8R-MUa;M%50aL-EPh$C#=FVJy-8{FX9!_1p-u4?$HNKSS$xYj7v-qyTAt(#$uh1kanAI3I3$Tw zfC@b7kT?>C2Hht~Ov-TMvD(D&C)joud-(Bp2foEvV07}Ud%2W)E%lg1QIRukdL*q% z8|tkG=5*_GA>aH|Tm<;=p@t85OEkOG<72$s1H)V2n)MK0$a<1*mzGC!i;UNF%T;>9 z7y25->y`9`yOB18Tc7#O0~3K~O>>q(+e2$x)pb!I;zUp9;^~oF(cAc`;HuPnmg|Yc zm8LEzFnoLK$aejG-|_kY69An#i~{0NphQiF7ida^`Zdqe$RS4wv;T=6Upz(}Cg_QM zhWCu2Uti}(+Otg3m#t30V(qs1l3Q}x2>uz5b$tB1gxMdI2_+r=+mj)LZ!qieYvwS1 z@pv@pJ@QJSV8pXd6+QDgYZ)uELWqnWRp0jcxrLT$O2Ow%%e4*}%abD5yS;ZtSxu|q zRpwg5aOVw`JWw}J@RPxg3S7xc`I6v}~JgM-- z(^qfTzfk)y2L{z7#=NE}C(;!}{}<jH=c8QiG^Va7F?Y$<5rRLEm+9;w#lxbc`> zgD3A?P+(fy66n}2nIIGbkw(udOl4kmol0IfI*rBlED6*fI4t#dXda{mxAjyL{FWv? zevTMKQ<6sGSRJBseBpUIUJ$%B|t?c`n4Qzx~E^fe!-ND1bv{&XQz zO@JE*KH`=}tG!^Auv{INj89r6Tl`}tB51M_&R*)4<7%4*UO4^My$LjV{)SqSt@lR#uHsWvMp?oVDk;3> zEW;w)onaFC8E9CV^S~gfAkt#q*oG6r4Y893?u{9c%T#yOQ#}z62d8=97lCt{63Q?X9cP8>xy&&K(P;^Hl}cZhI@p zk5WT9UQWo{>#3U}h!fp}Yrfug)vlZy9p_==L?jqhK6|RQhn;X2c96(|3g~3l2sEvX zNS`8T6mL&?KR&AY`s+_yF%mvo&bZeF2{W=GrVr7AE7kr_izT*U3m9YCWx#{&aqLZ? z#MGuTB*#P>Z!@)tkeSRAY##ak1=OK8mv0J#cj<4^mL;{8!sP;pu5 zHATAvDVa2vy53QhlK1r(dlgp zHJw69R^2I@V)wS!0y9OywFqLisz#x?;`YFhvd8cZ9RFcp5ZnI1!C>PgiN0spZ3D)t zR}TX5A0F{M!m=l$+7$Vm2G0DDLh39+I~~34@+I(=8!HPBZQKWih`G26;h}!gK=hMr zv(=b<6Bf5)R3mu*)*g-p7e|tVlI*0gUij0;?o3aTtYx!1YPN@V0J&+|u;+Yd^GGs+ z_@#gS=_+0+DvKd5YlPM^BFRg;7ydFQ%?rU#$-oO(>Lly_N@8DRSnGON43QrE_$qNX zY~$UqjYDo;Nbhf#u20;E3eSV4J!aPvm5yk@J5Hrn8@0J$ZBn<%ANlTMD^8>JY=ifb zr+|_#=7mR5-UjD}rvp4^YRKT#4UmzkSF4I zF!{@#YN>Y3+?vCf_v>nf%ymCav0NGVH1tH!M*eAlz13X~{D}Av!icRcJ`_BF57imF zNw5?&6AnYw52FB}*LCaFie-eIM8>m>)h$fNSM`7>hX(1)`YFCC;F(}K##J$VX`sZg zV|iM1`$S8M1k}{@o|Foj^Mgddf^&SL;mt1pO$^{EZ`|Wur&aBYE1Lz?wT5Nt@6Z*l z#-wA%Y#7yX4oYcylDKh{okcF>mcMYzOY2ou8rRm~PRlC>GABO>jfum4vwjnRZ1OWQ z#u3D?!zZd1F`Bv$2tBKO@dQ_I8p%`OL;S}?@>T?r>%>;38xvMqYq&t}>&%5y+x4Kq_GFK8QoYBR|C~@t9v_1Ci3|b>?)gNOTBU*4!ZG^r z^wi6lXug4H51jsKfOw*@5?mp2UVJy7KPamOgfk0totku)M8Wa?&8vgqYLVgXpTqwg zFSGGabKPzYfBNS8fzdZMRO3|haOSrU8yYGh_F{CU@(K$MChlXuSqibNbAiz0yIhJ& zA5E=j8eF}yPNBIh5n!k%NZQRCVV&A{=HmlQ8jjB{a;-Mvgq#jfa;=69(J)|TL1|7T z1GK_O3ygI+QWZUkid2M`z{tUDb2eDYLr=Qb56l%CnVj~88S%f>TZqwMtE2s1y`P(w*nYqtWOmfY4U$F&-u zWai6$9NVR(S~@dzt|A$x4kr6vC`+I$a%X+`MeiU^WLKRZB0ST~(u^y92Owfo!TXwQ6r+qy#L6z=HPiTsEQA9{C^cQSRrSs0X`Ro z8M(H$C3BF^6nleWdV7NcvG%8SXVtIuYQMeMTvmYMRc0c={`n4{Ye!<#hiTl#TilPS;+h4P#Aut2@q4HK zrXBf{mZl%m@1g6Cl?7Em?v8M4WaFd$6csRijR$abnVe!AzJ;L44)OZq4Hy93$1p>< z^d(zNFtrz^NjmgM-BxPP)LYVj*&)_C1x2D-e5n4dg=4_s3Shx?b#z?%noCh~HE1sE zS6*3PqcA$L*-oOh3gB6JTOgdDZ4DH?K|dP6&jcC%SMa5`tCXq`@$zYY^Q>Sah_F$!8$O=yf7QSGK_i@F#2O{lLXSK zpL+Cnz&)&^s%@F$mlB>5Y?l80emu)Lf^R#_cJM}x{&O{R>3z$_-}TK3`#%r!m~H_W3D`zv}mvIDP)caY)}0?EyxO`F20v$n4_b;=09}bN?#C z^)cM_6;4@uTJ`*es+t0O1gDA>S#MNO#jsw>`Yc78-Nao1sbI2BmXOz0^%Cgb>8znl zeibS~@?*007RuG>g+F1SoWhVI1H`oq{!Us=W#T&G8H0Ih^Vj7O7%WG>_|`}TiJ>SR z`_ndF6gDJ?hHU*!SbyiMDf>T-j@X8cG-ubXb<4`l@2B1RI%~}2w-SiM+yvU|;c%Mr zbqTNIBibO22aeYu^{b_NmQTg=7SqeUrQ{7;&oTl?A#=&)_iP;iv4#D-H<*dd!&f_{ zAM%$Nqkag?`S+n2t6Hx{lQVj#U5I0kqWIO^NtQ(_`LJ-T_djTyOHCW3W2hZsYb)sn zX&dZxy)1ofv1=fr4Vorn8vTN_o>Y3KYm<;>_3U5@6bEn^lMVl(E3=E;u#aAfq{@W? zxo5d|9O&+vsj_}EWsf??s_T5zby+k1#O@k6%^{yc@GIi=#OUbS&H zhY(H!s*>gks&@GH4$4eR0JCAbI6|Yw<`~+ae8d!{nj2|})L5p)Y_Nh#4L+7B3)P5z zm{f*rJc_KVaS2H(bqbx~hmlvwoO+!nJXTDpLc+tC+1vFMIC!!{g zIQFOb59UA|(?`qcKuc4#MppEZgU9t;lvMuIg9{Q3G!X3GbIUV8`)~VT2PB2yR1}4k ze0Sr`*hytDLg#W4-4YNPfr(hO3Rb8C{hM#EqC2h?Y9VfuYoL;@#d}?^K z@m5ur0I(4JWn2YN->L}lDKb2{6t^RBD}H`hK7 zaTKoeiiL^k}P5aLMnwbxy$OvYaY24pf|3Ve?inl;NW z@6(EFE0<@XxEx3y2Uh&-@(j`To6n>CQau8g4x3N0^%JMCSP(K|9;LepKsjTbU&|JfrAF)fn|6>T`o z9y4ri-NYnncH>nmscABp_hi(iJWO2)s7%Y90Q)d_6Qui;JEtRYkZ%P^{Id~)xjh))tme+{;F?+5s=-R2!j4^=|2|` zm-4NRR&8EIh>AP(@Ru>5KG}f#5Tng{YAr&tgvWg)8 z4&XJuH6!c!Ja6?AMkXu=q@KB?A)$+t>*rDx)I0iyd9<>&Ad@{vQ&!nBl*;ycS~b;c^}Z;k-$_1eL(9X<{>;b#T{HMY}4rYYc9YdPipML@4{ zR9joHC7Rr+OB7$9HRmsjJ~yZ7`v`aV!M!AOfAq@XCTE{6?1%MkAHMr%3s?|X(tCSEu<^Z8wtxW6?odc1EshR{0tZF_@_*iNkkK1{vg4{K&-=mKoY!p`IX~>VMB$F8YN`xN>;D>NEL8FOGTcEW z_CEA#g`U@RIu~|@erU@dP26fcmumH}XVhq4$guqGX8##ZD02ix`P}lYWB*m9B>EraH`FVMb1@0Et^PFQYvzAy~b`i zc_o2Yqm5DH%G&XVA&Ge`9r3zBEP6DZt;xp1@kr#o%4tG3@RHpw_^3>0KKy}g{P4!_ zDC710{xz;QwlO;5`LQ~>JBatThp|_@@|fW9YSwol#hPA7GF$sg^;NfD7J^~vtm%_KttvLxtQ)BEJerzC){dy~ZoMIz>JC)Y;lxaF%X!P-VL)iDXs?CSw z*UpHgt%jb@e`f=g`CgYD2+&}ZHYQ&2eT0#o4*sXnhbkX}CY`=_L+g=GaGkJ0XJ+mw z>$vIvI@L!07)|jZz%uTF``si@fekYu^HDtXTlIR=ix!|M`%B*J74AhY?l-7O;br3O z&9Emw(L{t71?_xBrN1XNor^`1RMA!eyKy^qwxzHbt3Y4=)f7}kWKj|gt8~b&ovW{`-&p4m@3oso6e2 z*9*)9p7jd*hHRQ8aQq@t+$epaR-FiEM4o?0yOp8^@6|snFy0T{z{GoXd#zL(7s|D( zUFo6`O>G@~tlYtHr7~yPxi5Y|kO*MJlQLZ+?7xH4MM3gyE`T(~R@vEe(fAjn zn5wuV|Kq>GrT%UEe%_#BH$QbIUfCE+&vfs;Vo_z>cEdI4mieVBZbboY zCjfsh@-?)9omZljJ!wt;ne{r7BmG)OgL)$=FkstBQ}{gUJn(!D1+Xj7Zz9 zI{S#SJX?Wvc-M7XQ-fy#lGOEHUfufSh1%u*{;4g~MEgx+%RbD($zF+=?nSTOZjOy}enOsnQBd+#UJK(gR+b@S^CbTa#MO@pY$Gk z(wn}k^IzbsBfMg-9=G1yN7e@D+?5ioS_DV^@lVqS`Ol&smvB@X=qiPnawm$qA!y$G zpGT)O`FqbB*PUrPCst6(Z5t)Nk8uDSE1k%i*kuL&Pq&G}L2v3HjMV0%#=V|ZEakmz z+7q=3YNv`i#B@eZtlvj27FwGZb!lTh|4}jkR$mY@vq=j;6uTehUVP=K!6sF0e*eKI z{Zadh>sO>VZccik)B3hEUb=qix1E}GdMRkqP1X0mwN=N7)_w+Rr89hUBlV$0 zE>nz1g4J;yN>7(>z6Ik_92s`N|F~o~c63Zbv;SOs{n?w&KBD*MADJkew-cJcn@0Qg zvu2$4X`GqWbHpb5h4T}DRe!Cu>T*yruLUpy?{+B*$zbW<^=OcwB^ zSqPnFp;$PuBTN_n9R>;u;|ufrlolF#?wNzLs!@6Q(xYP^*q3Eujg8*&=i@p-uC{D< zPWf{DwzzjsX79YNf%CA^8E-n#fgdd5?vRv!DO2T!`_2p0_jKyEeI1nj?+3LJe zcO|*Bd-h>wV5ve=sP9K0Rx*rfmX&eEorJRV5!P9RMcad4ocq2qm;HKX(mBZqvJQlw zGJc=EASB(;qLOZCl*k^Bzq~k8(hN`F%J!LWy|3lDbIa-)D!M;izc^r1Q75iE>IQE#KQT75u`f>`daCqEYUjI?BeXa(G7 z3Qz?C8`Vali@5?CDiN7X)TV0Z--?Wi24LVK^-3-g-Zh`uH7^bt68)~6N@1bTBUIwm zN75q-#d+3eq1g#_uct`y6KK?BzJO#1rL3@KD@|ljLNw03xV$X^#DIT{F+Rk=*x+Zu z=;~NO8x&TrE8zY0T6-_Hvz^c_Zxb4C{;|kvn5ynNG(U(##jPo)C|8h2+U+>gkxhVy zE>+5X>a|qdOI3uPt6EFw1H!`es+4aRKwDjL7E1u=#h$bK>}o`F~P6mgt7DbQ?GyB z&cF;yg=GNoe}SD@00^8C4_aBaRb9KF>&(T|Hn5JaqQy$Dq%Dx;+Te4aB`G)E4tnZz z!d0mtSu_94S6|RKT-EGMpfM8jhJwI3TTWsO*4TippHm$BiEb*S7f92$jpxoh(O*K! z{h6^!`F!M*LNT{qYPl8lsZl}ZFN8{hml^sBev8`D9s*!TXQquWE=-K` zlHd@92Fw*%l|o;2gmn?^cVLtB7U#t{hV{ltY6V%uE4rc>7CLonu^2S z_ErjQ`qUBg1+rjqL)Ty`S^#XegTOQws;5#0n{-KSsjP3u+)$51p-$__BzN);$@suc zJ4h@Ef>M?Y$?@UM`25rAjT?;0HGY=Lj*i6Tn@F;~*e=+MdOI&$L+1v`Kq{=jH;3$xBNN(f(1 z@jD)mxDF~{O>ToiOoaaqywA=GmnTt6lvg`9<*h8#-A+u!&D~m+)d4>=2Z(UbVnY)~ zCMezU4dj9w+*VeE9J2Q~LEfdgX2S(P&aJ~pErW0GYvxJi?bysox`Ty)raOIxiBRiB z_!(ca2|22=zl2r9_rnM?$7iKux@oTW%wUG>9D&~=ckyTFOZ4z#M!AzrwMZjHssGC! zlk0u~dlBmUSW)Vl^`?bu-!N*=>W?7iQ*{S}N|=*z!Adhu8Vfh+`&Lj|&m*_1J7ZTe z!uA!L-pbr7k@+2Y*cEPoP-13wZg~+2%Fj2tsz95@ZL_0o^TNI%GwL5OzMVs;yr_$$ zzY~n3U(F=^EcdLA9Qrf>uni4rnndBp#TZwl|H9ZT98tCuR?r8Yo0_pv%MFPULZ(~y=) zjL~Ruqa;uK8c`e<{?k7;ohHq}mCsTm!i0yFJRnBw$eC3+Stp52HF0R>!HnF!p;S4H zVYz>WepL&EyIp!W;3a)^q+a>>7j9%i3~KPY?C^>5kfT20l-IR{8Z2GckjV0Z-+ZMH z1ZG8C-@V#<;;k8C@UVS05KccuqL)y&o74L{hd@jS-2H9?kd9UbOF%`V(gJs0QF9@j8b zYjo*zvfX4)&eMj17s8q=cR_0yrJ4(K*1y)yr$hxHW(DWaed`K&>v7Pi$D{Edw`izzzHSTv~^b`jeS~ zedYdn?2#lcdADZ=${hB;;!s?C~h6 z%SBi@J^G|MDdM4O357A4uxDF)m!4aPPr{~GE!siwkY$`K|ju72?ku^-y?egrkYd4V$c(}tz) z$;0Tw7_noYhrVNQFjvQz#XGv6C%F?Rv;9hR7Pjc5W`|=;=4>wyk4|UkL@N5XUo?E} z3$4)JbDQ13+|3N&=Y#DF){>pz{B)wY<%wM!w&~_6Tv^ci}j>1UJ8Wn}h#+8TnD)eg})whnK@SeTy53 z90JLMssW5jruW)F`1PIlUTXw3b(AWs?In@0{SJ`%1glg>p_#_`H^yCjkt~vVbCY%= z_JZolw+hWyhIVbx;IJk59o<7sE@d}D6$V(Un)Q0}$BS5pl%Ib{v?HVtfvGXaDa@m{ zMF9P*pq;@8A!;_2ziY_%E5nvZMN?YqWu_%sz#2>%^zPnpl_GR0L|y@0lKie#DiFpC zHT#wS8KC{Xd{LXS3+#um&E57mB3?r4mmort?d8`|<{yXHZ_7W}*XCB5c$D+Rw5XF# zC^I;ob?I1-46Sc*oXgVbuo=r$tj6$@kOVFK+~jIfxty38+~l;tI@A}E#c`^`Xhgb>p!78Q z%&2R6@lPL&qlAw+=DeNxC9d`4B>xOTNT|z?=PceOkk6nB)u#7O*R>zUr}Q?F`i_4V zCfy1%fcEM3c9T7I5>coPrmRkl>i`E9hK^JF?%F8RH-GS=f-x(TU*^3F8pBHjD9w4< z$L^ev3Wwl`Uk=2#*0w3_k!-0OX9PSXS(y)-pk5{V-bG&Kz3tKGfu8ya}O~<5V6ZGGj}x&KG2-e6$*8l)IMQzjoQ->udh0g|r8W)M`5F0nhu#ffU5CU39Q~(BatDiQ z^8nV08cdb4*+RRNcMq9OI_AxlO4_X4D)D}a{s{B!JuiQ=)NybuS9hK`n>4nxu~9e% zXMGDl$r-5E&2x~p5OneK94o}e@tCFyHg?(Vz=1f)Tv8>E%)?(XjH zM!LVB`0Dfh!C?>Q=FINQ>@~BqGqWJ83+UTA=3%HUgwN=e&2->ndL|DVFwCSa?@TE) zB>Y^^c`EJEeZG!}&?@$BQitNZv5`|#a@zI)y_T1Z74uOGDhP5dM)D8RS22)R@yb}Z z!xvz@ix>>yL{k(gG1=lGfoT`%Rf-J=(GpO;8j>I+ulgsrxf)@>0wg&LkmQaASc}Un z8eEyex|Xxgj&*I9ryzYKyU16bjjx%|LcJbp`ja&1SayH+YvLf-JQdR2*wMIZGRZKv zTc)$TZRU0lhTO|}oqq|%ar53S^5pu>g7^brTA1M<$2FQMVoM)?z|f9%CUwV$UKk~? zvWpm&B^s#HczbcLE>;FRKwCZ2f6f^3AGGxn;1A#h87{2|42~hrB?Plu8RnMZ=mREV zvlBdaLjs}q_ZOP{jIgHjF?~dVldPIz8%HMZZE6m_L_L;y;C--Zsmb=f+dU!2;G zwU{;++X+4({`_Q-PH>Uj7q+`q@L>X=XrA}cJeV{n=NwuhC^X2jcDkFZB9zS^68ljj z?p(pa@-)bxhG7vz~4jyB?e1p zHx^rbTXuF!rm?^Z%%0frzK?&_8T5ngCWk32a5nEwI-9OVMU^mX$@rq=r}0qPqXrrZ z9Tp_XHDHuhFdm->#uAYb{V(M*UY$EEg(D&wFIkL_6<0SKa*r-n%jy#(Umis+lgUj?IpIXEhJ?Ee2qgL5mSaUk~NC4XD9;FV@nj&UoIiM$&B~5WOJ$?7w}t23M$qHH9Pv z*c{2mWqoLHQ2QaxLdm7Hl^?WYZXw1eldYPQ`@TJCn93uDtLr>8E$>GtXBTLJ#`bPy)o1=WtzsPXgYZw_v4O+9+J(+=NDr0V=XTAi2hLz)1*3cjA zQ`URGbpfJyG8$SNOjHMczd4*Gr=eTeFFOSl)Z_r+$-tw$Uy#^s{`E_Ne=%CGi8w_( z`hmao{w*KgV@-7(7g|oTtXWxHvDOCe<(*{-l=D+o`oMgZwqtGoafTDM=b79N#-+R@ zPxzCy%cbq}IiRNgUE%rH*2E5QJC|ly>w~ljU<1s|?mlA`_#3*PW!Qb`xN@Uuxwf_L z&XTC%VKIv8PW#Ewe9|yTU<}niXAU~-1^Oh;MxtCWF~j_IK^S_Rq9g%)W-j&~Eif5} zaOzwPlE}vv)B)n~lB;$8wCL@EY@Wh$~ zQF^8f8b#k0ucPR(f^0MJR*}TzL53_%{hQ!s5pPXozL!kmzq^kC7lQstBJsqCA(wc@ zT&)dp(}um&y6tqh^rPBxZ`Dg#<#3VVi2I4m8ZhG#%Z;pUmB&wrKlY4*?xdVy9%cCw z%C&BcW5)^?DR2*SaotgnW)1~TCaIH`N=`5?x26u^i~(xL&-a;;;SAc67c=z^8@|KJtla+Lr>o+U7p(C66sgbzB+Q_Bc@IHAx0w>L0K0luUi!{Q=JzeS|hoysyBZ{QbtV(5- zGDNl#={b=gp8O#1ib<`pO{_<8Q>j9NayBZts;Q_w3#3Fj-F;VT9>a26h|&1;y%9y@ z1pPX$1n}wxbxnfrAFC`4ceojsfRrbysE%Bc_9r8e*`6<@01C;W;mc^`ZMz`TwIjzh zczD<65^+P4>1?L8-L{169s^eNiXFx@vquJV%jNv5!1k_ zkid*rrw}lJw19@^=-Xlw`_#nNS|-UlcK-7_7J{kNk}oZuc-9`)d#ws8fx`D9N9*`BqQiyj@!R z_c76yM5HrMqP~H?CaJ=39;63f0&CetGoX2OXC8Sdk`8`e5V#F4=m&i(h63QhP zxT3Hg6PFZr+(o{<-KiL!_zqsbdN%$354&u9@oykF)HC+@m*Re6|JcrM}9LVbrDM>!#x&#Jq<%`unwk_>pamCf?-olBdn)f`Jc@J4Nbm zk7P?w_vLe|y=AQLu@o2h|BT?PWO-E&xtepAuCKF!(Vj<68>ZkBRJUYrvPcOpD*=z-66ZToW+G37M;PalAOV4G9$_~nEKpg_ z&iFIWS4~IWVy=|tnDuG_S`2pGxQffO4EA@ux)U_{cQJc*L=$UIqE5AuFC%{8AT%uu zcOS7J%Y8tC0#hS8)^E2kFajvuVUP*>Pm^^CxEBE>?vzmWl$M0=A8HR5dI|zfF1xBk zUsVJ|ma3@^&Z2fHQ`rPgC)$i$qS|Y9SKh-W4_1S^I`al-cUFT!=Tz_&N1#lY8L}kb z+!2VObhwps*l37o1~Zb-?XpIhxGVI)IhTKoruxxQeJ|f%4dS!%Y_D=#kn-$1JDvsL zO}|!ZhseG8;a1pHVlSTNSeUET#eAcK2{tv`{mopM&HSOTGmHGf-F*nCA@hK@JtK@s z3EF@RW>=cU$){*s$IIuUr`aE41wl5IGc%8U%`=iE>GOpS0?z!b>nFC&l>yMu#6`^N zL9Y(J|2%#ljykQgC56=MRO(q*LjD{MP_rL&L{AIQ*j#Sx#LLF9hK6ygj?KzGJsh*W?zO1HZnp)jbG(_UdgRty^nmPD6R0ahD#-hBJN|Xv3G!}D!HODs?(kzF zL+#0DbL#G+DIjh7KFPw;L|irCheCf5)y7>#1IZ~jaSk)-}_B}ox4)}TVER1wNa_9o`jg)M{<+iERziC8z{SPo<4-SQ) z)0~LFu&g-)n8JHUqYm)6Ky}>cMpecCPgSNaJ1+@mWwY5flKHht>mT~Hy$d!pZOelez zI?Z-K!|d17r&lLP(Dd^}$g7X9UoR6OGv2>p?qTaP0ar~%X+8nxhI5xvxP+!A%p@79 zG9_*lc=d0(nEQuFpy>jyK+}Z-P1iV6njOL}e55&3zj-Z<(i>9sOVKbF22#3rOT3ED zbecuNCxQ-j`n)o!Ce3mfne%!1=ZVo8ppZhSftUJ8Otnz%L zwLi@&cl@EvC`kZR8Ec0!M5OmJY8`!$!%l!@^^+Qf7Eq4pU2jKI$;r}CsiMG>Isb z8_)3;c*-`uhX~`km%Eo3{#~jylpU#bd`dqZZ3vVNa-1BrK5F zRJ(El92aOsaW~#oF8j>kKmA}ge>@mETLH#e%F~@23}izmJX-7Nb*jVZuCIAK(K_7~ z#_$DI9X}HpHA@(+!GZB5b*XqRw}T7(vu%x2#5evF?`}Z0%{|ndm)=&}@2CPPdsx%X zi`8#|f|G`g6wTAmK&a7r+juzC1vno3d?|cr0xJ-IH-hw-zI5=TB2S*PLVRr1;7(rF za!Engrlx7mt7f`|NgyRD6ZL1P4bpYPtNb`RHRemZFu_Yj4d>}J$GohkHls;_Rv;fF(|sbn zNdY~#C+eE!jLo|NhU&??7@W!G(KkB=R|5sk4lTL-m&)sG!Ppb| z`+M!!$USCIKbf3sY7RCuj^q>7e%2XAfh8TkaT-O}{dC~^vY5KR=<+N~K!?C+rr@5~ zukW51tdWSM)=WU;)3q?Tn}A5`VNeF$zKXDf0t#`3uy$v#ir-Z}hv)mF0@#zF|CUzB z4f=12C8Rdc(o|(O>yGf*mnl)Veo(5l*8El%ppD{p`C9x2*y4C3uZhF)rjAVY6nsCgS zoXe`IX*Ab3-0dm4e_V4hA9;wd;8F{gjuYpbzt~75ygM2@oS!uK)wXF3^LjZBS*wzc zxOD*)%;co)9FSKBii(qTr!M1`(E$^^5B)=HWgR@*F1Tv)$fLv$w5OtRbyB0b6DB|+ zpXvHf^ndpd4ko5FqNm?AscOwSxMD!cZK_iq?B|Vr8Gji|xMKyUa1afr^oU_?sN&!7 zI~3k|OH@vifkr zh-~IBYuFwcMm%EIoy`~ib{M>1X;~HBR}}cRPi}<|MP``~WpxRyO|*dmtkILC74*yG zTEssd28?s}d!~pHH9Um1tM%}CX&!B(C)huj?B7331Ht4qI0z<<`MQpS;XLey*qiI; za{yCK3JaT!yX1L7ft2!&R$gMX`aTAA;Cm`}W5oq!)yg&9mDE9|les4%-erT;m`Z)} zTuE-kSO-jj$z(p7s%#M(nkySab#wOg5RTAiLRiTIY8c_KD zB=VwTNH?ZKZbgEPe)t=Ljpe7tpdn)dgIs!_+h6+0K?E8FQ5I23c_-V@vAQ9h<@BfeC$`6%tvdn!=Z%_`r;Uv~j+2t-jYxqK_2;vllNntf zFfNO`G4Qrc0;nAxk0~Y{3D2*&bB8=b(bn0ps`K^GTnUgzBANgp!5a$Fd#D z#*Kd#?;Ib)#RdPfeEr6!Q1*oE+V1pNcIl?Jz0f%)o0T&_kfK^p zgolrRpHNeI_`+`J!)Z{Axhw1Q3O)A4$FcMidAy1aDIhO8`EC)_Q*D)-BMPIv5Bd34 zbfjF!4W)AhyxJ&0tlTKzg^>{B;Ie8k0$;Qr39zx+y@;njx3JNC#$NxIy%CSWjSSp; zM-~977!70iGq3eUQTbi(%`(^Ud>Ssj@2%p7jfLL&jB#;G-%vf{)IH4CQqur?AUcV8 zb_b(~Xgzs? zA|3FlAncbBvx2vB;>XeQ^o#(3XfinxnRibf2lae3dijL^Hh|jh`^&W$p-ZjGwI8jl zK3ZzE;KkzM4H~{cu)Nvqo({gNpUi^V9(QAk_2$*Kh%OGp(BL5bigjUK^c6JX{nalf z_3ve`36fpRiWZVl+SZ)pi#~DdI^AV5_+*#3i3hh&=fyY4`BpMvL?BUgoDm0ZbcC+n zAis=+5hF^Z1>vZBsq@K-qC~&KRPd{vxK>jj!1oB71AjY;;SzB2<3sf@jJIjE32zMBXN4=CF@I+q*s&0%H`!GPYHBL1cg)ukmroX{E?3jN+`d$~|M z;3xol^ug^*nccsWLd22Y+8QTqial+la-<6_T8K04gij9pfyZ~f8d}X!f)8;;Qo8(B z4IH7>cfn6p%b1^`#x#2hgU zc}Am4jve`6RkrCwRN$IcvxUITg}E4(=Xb_!T34+Fw!sMVZXRB@{fAn|=m7oVl}bR7 z+$f5(U9y~6%^qjdw<*Ns%b5H>vS~*d=^(N(XS9(r5m&Tm`y17Z10D82e`M}5F#(@J zYD}|%Fz8~(26isq+*FEZlD19*W#L4Qqo#tRNWP>cK?)tbm`GJrKrIru`TQNZ?F-Rt zGrTvdd?2a*OB&E5fE@wPgpb2)N2cnk;3$BWI6iz8(~ee7ONP-GX|Qq$*Ylde0ABoG zM2^K7DgwTzEjp|q@oh^pTSdM)O+zFXnZ5TYJNu}FTv#x{+FDlWO8cV!hwlugwn__h zjfQx6w?C=n@KiB|e~6vl*(a!4Qfs<8&iC@o@^}M;_lp&S#%Go1MpuY087>5&a}A(I zT5W<}rjai=VG8tsh zkL8^whv&I$F~_XEx)u6#nH7$P#sf9SMNXpt4X^1Bt$2YF%+W(0mRh*c1E9`hUY72X zJL%^rUbw*Kp-IKSris`}U&W8(SI zcEIR+?dVrOMh*ZFTIlpxrAT05t#vNl>#4&dPdzq8h^$a9jjAiAUx#n4;$xF#e+@}I zK&G~O`Ao5pIuhVAITO zq_=>0H(=#GdmOPaVKT9VNo^j~v$JG#?%qN(gXetHvI9Ji(9GR-C9m9XxCA-4VvCeH zrHTOjpA!pRg2;6kv5M1cZFX;M*5|QiNn~dJUeHbsh!fP)ef4yoCE;bYfAF*s5}jU&w7PND*lu&62#s<|Q{H$&wK` z#AFg#K-N>{x5Fv>tgG_E6_O@2+I|67j?6pvWy7acLYRgXq3-do9e<0mY zG$qPCT&gTiLVZitA9yUz0xXDXaj8cumW#(ackY)lMwHC=nY3qZ&hS`V>apE7~JNJ5xA` z9cF@6cRlslYf8|>uq*y@3n(zXMKl4i%cKV)Gy3R|?~!c@toi6DAKRrv-qLMo+2x#8E%D2F9eVR*iNhY`-OAUuDoWj=z_GtCclUo#Qdj4{ zA}a5@VlOCG=Pm-@ketWXxNYk_J4E`aL71MSkh^kg*h(kIpO0fdU+3W2{HS3H^_05% zxOPCeM6UbzMQ5gpup2@dU9gyDQ+3@$6Z>Syf)5TjN_L=ex&tUf9dtx&_JZiKtqc!A z8vM8ZPn~C0`vQHI0L$o`x_D=)r}M`S%ctp}rvA#O12t=+s{(~4%X22$-5U-M=-k>2 zAB2g#tNW4Xj3o4nZ!6OkEucif)`)}Q(f(zl)|WI~<)hHo4bX2~P~Ob$MXoX0eM8rf z6Q}Is9KWKIiXIW(GZkc2$0=n1AP@h+=v>X4SyB1dv!J!lxq{a2{lB$0%N#@^-7An` zxVg#3I+|S0hn1b5++j#t)~m?c0$!gpv zqCUJKGw5wf|Ii36$}G>Dxvfv@-{?dNp_a`E=>4mS1NCocrT2hsjez^5r^X`6@&VN^ z^s-t z-%doDT)$|HB-fw(D>m{i+&y3-tA?P6DrBiz&_YM@4ny5^L=`Q@(B~HrTPRg2&*c;3 z2`)+h_+c+v44+c{rubmbHz-6@Efp_$Afpn^7lj<`Z`}~LypDYkbXd9{^rjy#xx0N? z!e$p6k&Mn^$E(|rmi#ByjL4f|BW>*;DXaM9qdG`D#~cnth1~6|EZ29Z+C00%Ubia; z`oWKI>ksp$1);#f^!xn~iVEMCT$zOWq}I5}DT$G&dZ+%(0Hl5b1pOPI7M`V+#eSa4 z@rRE-IO|{|!UX>VzX^}_%?rE@B2=CI0$ky zP3UECyG>7*=i*fc?Yx=4%HbTy=aFU81^A!`lhI$6lDVct4Vya0dM6ThYyE9A2}tqX zyVN${P}TC&_hugsbgmzIN^BBP#YHjQz-|!ygMfl=L z-(gg^Gnt$l1P;NWJ~rtR)Y6!H+9mF~+I)u^(bxK%8Ma

dy`O;vbpYs*Y_CnQeOz z74@sb6a5w)hYPNIMl%S5Qzv%%_Kr!wSQF>w=aZ4jy~W&0%9*3txBDefF(S^E75u8b zH?G5#5%}*m#S+S?;V6yRq;5?9t6O!xHs+6v83lZap`40k2|<$BZuUP=EvXU&l3LYF z4Z)G5UOLC_93uK*2|)PuK)8Ra(8#ixor_QTF~kplL2fedEUnI8dU3+<15^{`5*QXo zG@w4LrVdX1flW~+bu7bTdXrl26}k)PI+gZI1Nob=6hyHc?qAD|l-dH4?Snp(dSP|k z|2$R9BRl6aWjklBC~?pextoD>9(}>%haK-RjV;e`gqpcA`(--S@3pu;Kfom=@GTB# zHQA7t>C99Bt<`l?*G-mb_ip=RgJ(v&f1JSZu*?Q*VOOR%OBiz47y)Q-9Hj5rT`#X~ z;}o33N0A0*L($9ywmG{;|Fd+Yt{DwCR2e)VH3}O{S8i0-D;oGx{f6EIr%?bZ_h&6l z@{-w9ilg%zq`V=z$?LiFUzJ>HG=N!U=@t7UXOXRw8XKq|{?U|!LD;(e5-#q0d9kxU zX}y!!U7<`NSS*w}8I4)+2D1Y+o8i*3VX>%#PPLr& zqR3NLz^TN#GTS(JX#4)K%j8jY=;@s7`fi6~rR@L@%}dMn?7)+`9m@0fsY0#?T9>QdT4|p9Bo&|84=}0l18ajjCMcQDgbxGj5g6Q;xFI zit2Go2xZ$`L$NLknxkL>Hua0`ZQBn@>EZe0PfluBpH*98O<9%gxC^&=v5JC6N}Np$ zit)_YX%pd#U$isJKe-hXisNfn+Yac*{fF09gTe7_^J%ITeK{w*$a-yBNX%PWUY^h- zJ&*sASp9h})PA8~U}9}5B5t429Ii@_(p^bTA_69u*|m(eBaaK6%xTsmIyDR&?-CZ* zi@8sqWXU@;|70-gz}vpVUY5dkqmfrZ{g#8OugKXRFGse{OBt{+*u>dq{I#yN348fp z0`JZ;Vq+{XL}M4kt(gu(&q;TKt%D=x>}q1Jt$0vn!wtx=d6O8e9vs=*0vi|0Wkcpv zb>wlTQ^feSTj&JY$-BgwSUS+`mooeu;mVdubZ7doz)xP z;}zDOso$FX1hR?X>X-E&d%s349_6>&lg7Ad@mZaA3{K5a$cQKnwR*C?u^r*Z=K1S) z6~udU&uaWa2WD}wjHIq`aK_WT>GeluDcX&QKvgZ-^#$xzDG@bJXwE3OEcZ{_LsN&M zY=s$n4eYX0;TI!w6x*nSdG-XjxN0)n6MxP_IQsl_`fn@qWW}z$-OBUP#z@hST*ZDo z>GfrQ2&NpSI_p(XkhP3XnCH|NsyR&BzhYxR~N3y(Q-HDsz!D3pZA&Q|CQTpNgWGn@v?r;=qiFcF`X zP%j((?JQx;G!SaOq*ezosmJRT)9crA=Qs$!ENN}(sO`#wQJ`s{$F?J=X0#7Z1W#3H zVmtoVUYK@q4cPyhx4K{ZR+*NU`TJ6Pe5y?ns?ihf zqc&tlo8NLA$_)rVaj@k6KXAbA@c~N0AW>$+b5O&0?+nr zmg#*+BOU0&h3WTGhb4D1*FlhXMdJ_Dt*dw}u39sJ%Zo9IJTE-2;xsu%9b9||@2FmD zp#v^Twi|{enAiBFGw}e+9oe|~f`xm%%f^0i@!t`$!Y!yyIt}ov1BtxsrZ>tZRJVP( zO#X8j=fs0{6~8TP@5IHTP7?D;#n7=y6CbwcL`~JL{P0jh;f4p(<~HbMpckWDkK^bJ z>N?BPF%^49pdHw!#hJ)4lRmCUOctAqFz}(DG7T#Ye8X;V>K|c8$DksRsuh9g+Mfd; z!W_EoGa$nDEE6fi&BN?dq&e+lcuADmQi6J)!l}5ArGz6=Wybyp*^o(eM&kK?<|$-9 z{u1voZF#aKm&*8{mZx{yK8h=chPOv@_tagy)15>#F1GoEvy4UkinVwU|m zWMQ!!XX~N9w~bf*=G6_$5&1j3#Y7MkOS4H_UJZLiliJpw4*UA(8J z_Dr(H2QwOF#YmBbGt-d0OUnVn;k-ZXlFd2BdZQjKzZZxF9_oVX#|Fy)9~ATJKoY5P zr5iyeET!Q$(M7d`q!dbWdXE;iV4C6Za{~WsaT2{05uN_&(a>Lp=@-Ny(SqA-FIE`< zXr0dqoUlKen9KpUws$cpff@TPshPJ%%PrFj2G`eZyw@!UiFLwxQe8uN7ej+Kwi4jw z9FRwR7|@+B!8}jlx23UGSKF)HJs=d=67oo+@QS?^;x2y5Q17Q%>Kup}zrz6qv*+>J zo&Wd3gr_Hgr@(8i9>_!k-~?`!yZWrOiNWt+cAJ$-T$JX@+In|c4R4Obx$<+hV$WP_ zQ}c=T$>K;%8TW)!Rt~Y+jD#{BLRr09xkggkbPBTrKF)1B9BDlDh!II>#RrL*vkj7q z9no*IppV%8u{-XHC(Z}VDjeZg1NXS6>6Ni-3n-U|8n8TI+MULK2kWv_stDvbY90^q zI@@S-g5r9NK~=xx^NO1apY4I?Cx(U|u2&^~x~Rwc5Bb&l zRN8VwRTR5W2)8y;!JhRzk1Q{+*M*ZF_yGY8c&-Z(bhGO`b9m=%M};;#lMHd2dv!G& z?CkGRe~gz&O`^P8m?FBWVL*LL`8B`@D5P9+JP}K|Wn?K9m-zISC0c?PRPtYm^!>Uj zVHbO&K0gr689S#G$E*-B8@(FyF0$d1$;DM-P>24Ed(aS#*OA1`VSu$9s65q6xrMe? zei&9IVw;5i1Fau?e``>fxO;nsQzezUC5JAhCsGh5XJuz*ECy~uNxoroaqBXvY=8`_ z?&nFzK`i3+nAw4$dr~FClZZ5eK`)depJNetxiK)~p-mGj(oad6oI{m;CG$323f+Wr z&j}37u@ym)rZyP`F7R82RinUsSz3I7IoMl3p`HYh&dw}Yn1+V6)X=^sLff}k0yfdC z2fAQqmPrVFFA(Jjh`rjOXnxI8D?Sh#rS$15JkA$8QQNlbfb-*-^c3|*m%^pu!W=;! z71$BCrr}i3i%*lef*jrrVqveYhjYi#&&CE3KvkrftX-IQNaYq#w@d)qeX+*EKEo1V zBw@?F(z8EsR&_YtxEY@#9TORMR=a9X{vk=o`g9Tj`#R=RfM`;;`*vQjEgi2FxTY+c zR7GdzJH($qMq63m5llEiB)y|D$}%VUo@SUtzpD8){P|lXn?WRHni<}uBFn?mbtFf} ztW6ocbb+)2@==0yrVADRcEUh#G&Zsn&_pKAy6q~PqqDw|h-X$9AXE@fXB7GxWm0;C zh9$aHyHkVFP>@zCZdgm5n@D5(7bCp;w>dU^(D$QYL2;aw4o6t>zO^ zxj@yr>3YWQH{Dwg|H$X~He?TOxo{hio~6DYayI<$vtP*{1I zN*lr*NXJIa@3@odd~>NehijZ*l(v8t+Hk?ywg=^=k8@Z-H8<^_-dr+zsfpP@cWJ?) z0OfCGq`JNJ(!T$GeB}Tm@lmFy3nz=Rvh{x&M&^v2buoBLC;2Z1s}i3I8uR>sXE4fHH7m- z&62`er=mq;ZD!ISzNk10$Eb=h5Wpg?ox-(`IyhFlnR5`FFf`t3Du{DS3-f*66XJS& zaRAf|tsx)9O4T!kD?~^d|D#5x@4Rb5_Ay&RHfT;3^3mdoRTQ{iEd-8~^gLRtN7wy( zTP`YboIYqfY&TMi6dX(cGW{~+TOn3Zw%X5|$PyA^0)m15Fh?=%6qbDeHAQiRrsM6o zQrwwPY3ojkak0dQV+s=aN6HWb9)!g%uIzujc%R6VqIiv)qA1lXVw~F>m(Q%L06Hnj z(5~*Finwxr>E-uvs1M4rrc@9|t|hHOveRRLt*CDSy*)Q>S&O7SWWcOWK zoT&Gqm0Bg*1Pbvk5e^Ie>31o$W4E#TiPoylWv$qUi!NF2ukXT1DatrZi3IvE`*B-8 zS5eS;q;SYpLF`!=X>x%P!-CEy35;Q0#kr2P@=EIFKpfJ!+;HWhZ*MAoNfF&=S45RH_#soXpFTJPIv_tLk7h~Nl_)_kWO8fIf&^YpVLKUmYH z`!IwU(tE_|z_Qwt+AVWu8tjB`(cHZEf%sq%$&*NZxUQmqO;T7IsvMx5LVbv;qCYcY zTEQ5i0lby1TMUOF-VlW580~KUB8pNM{rGmatDyZK+go#8^V^Tv^4me;W>2NY4xYb& z1Kne!=s~6ymccYIh>Dpby327N9o}B)TvQvDOhc8DUdPTyst$`yH62;li?^XvL^y^N zl&vE!8p$#J*&IB>R4&3=a|OUbu6Nz*WC*77MiOJ+Mc*xl zEEWG42ZbxdvgszsvN%*`#W|P);P7)Xo~@~u!cfmrZE)Df!ll!C9t^jFW^2_!^`5{Z zi_jRe0{XFc9?brj1cQt3m8&pKN9$3FtH8rq!z#udH@=FBrj@=0qG6M3+YRkeyB(tC zw!n1et1$DT|AU90N23x;mZK6Nbf}7pk}{_oO9}fvI>m4lB0Y6*xMDx^eE{G#Np?mI zt%mU}9LS4?#i1X@&Z!rVbz{~?f1w+TO%YblRNM)^#@zcrd%pHS3Y~)rn98 z&)h#MJ)TH3XO2ZLS1XbUfkW*h)1wMeX0Kl4^gNr;@9sVk1RF42XKd_LxwosBIa z{@4x-6W|$bNwp<0#DOBL4Y6=K9##@Cix47oM!B)WPi*Z@_d`6?ww62Utxo+&XV zIO4bM6??T~gxhNZ4lQT0O;JH6E#1A;`0eSMR2JJ#g+68PJ}S0qr@`_lh)Br0**!!e40vSQ9qj!*BKX%^x3^On0z+kXLTdI^l~p zh>Ic?)>(GTLh|}3z`e2NweYVRX=keIzqG(}A6c?95jt6?%M^$}{YIavZmL+w@&Y!| zg29SWB#}Wd4ph5y<2KajJK76xm|AmgX`zOX8{ee<&L+QPS|>K>r}?pS#&uTNLHuAzK> zlr?NYrCv`a--kR@XMij#GO=E7#ZZPLQckQOL#Aq< zqO|uoB2;i#Z%|&8jqXL0@t`qAmevxbBgvP5R0fe&Pm2k-cY~pj(GGkvOT@BQ^dRYr z>TM31piwmQ75;Qs3T|ge`-)m$*Ev z33;$fskmjnrSHOCxI=;e(bddOOh<}2v#fT{Zr>r$Md>z3J| z>p)nyZN*)3b@jE|bw{>8PpaNpo^)Ztp7`qSUi@6-*Hi!}4Pxj5S`T5XBU|x@ib<{P3SBaSrW1G+Ekx0Eu#F^}=%IH&+1H@i)toI&i##|rV{xI5w`EO=va)~smfjt6g@l5V zO~+|77Kc$*rkC`(wM}G%<0(+V&{355!zH5sFexy< zqvW!2Oe>67o>4l#$v##CZ8^kO&bi-6tpo704dzYZZgHfz05p3M?BnE`O_#Stm6?S|n0S73wT8J_Yi!=#e z0-&5yqxuBi(QX^J8Xm_MQ}n|bplB+um~5e><706GT`<@@_c8`cdSD2DG7M?@{mXWn_r z)mtMxsLsvjJ?lh4uyV8#HPa(3ui~x;6F|?8CX?!&kwE z8o*s7z$x%PV;?Hs%N2|iSmU+*3&3WjgHCSC%WQ7TAR!D4UZB?h4^}ikesSrbmA=ut zz3RI?y*;N8_sLy}{z)*rmg~{UxwveE$ibZea*B(|IfEA7Ki4Ha>{$GI&Yt>wW0B4K zrF=2~b*Lf%LXd=mP86MKMb>NWjO?1k6M+p$o&k9OR|D^gf>$INPD`S7-oqqTCn+e2 ztH;3oRsp{s`^kejN4 za94Uwy3>kyj=Xk z3Qgz59yEA`fA|{ViVFW=NrtT;Bvx^@GGRE|dS}>lb97bSeA2t!qPlRIiCYI1f_mC4 zyRmbMt*|1EHSm=tEk>G!RMnL<7XM2_)p;Q%*pKupo0Q0L@B@Q^!;I&tEziF>-%t17V9>l+M2crdieOzyDpV)40zadMt1aF_%?#ziPyZs%XaH?5>j&TasLPC*!+r;e1GSG_RmlGq%?o1h^1e|!*VxnExuSEKf?(h$sL#vtJ>QY4tZM*ZjDn}1yO&$l| zb9w{#0e?dSX7)k+$GZOfaxj^d31)KUXYZO;##lbljfgY^N`Nc(L#)!T+lD$L|$TfDYMc!xd4zjH<#W@6WhE-sz8k1f)iZi%!<7b7Bn`*>+7UFIEga;TS@Msz3 zOGW$*;%$;L=IWmr(7qZ&96oKqUrT^MzXlz=Z?x6hEGJcBmwJ8mDd>EuEfBVPobeHS zdZr^EnjfpQ6YXIc*|@b5DU?5r{SHy6g8ooSwB9d+Y>~}8?2mu(;j_a6zK8PcxjKA;^A9s%(Su;Njg0-&uA*wNJ#vCHMW>j^2mGNPt?SymzF5101TKjjt7wQB=dWlW+9Nw3Fs zIyJgYsRpDu!a^&<{5Y$B|J#42pl~S@7{8mz7*`UaoFY$BF7%c>alL@oE0m3>=W4Il zB`QoE-xE4ypF*3gUHq}2q+z{V^wYiwsbuqnC^EU@W1&NGjkUUYineq(%95u%`AnAo zZv!Q^vH6jRV&)FK&SiUe^J+dk0r@EmqWH^)I5I-CObWkV$50ZfL)`Ef(3t@E>*$EN z_EtTy^;UuQLU!=>H!qos#+3Zu ztGX};{W%w?V(yIM_U4v@E0%r9o*iiV(ls{t#sWqQa`??QWF}U8qD1?s8vO+l>1<&+ zry@$gpO{N5aD@7FvYkc_eK<^}0KEd|=vIDncn6;e~U>xKeQ z>32(t#nm;Q5sTnsCpjg>Xp$jMMqf!@AhD1}PKh;2RvU&q;RKUuhu6>^yTgT30%znq z9KoIF*AOx~(B+6Nk*Qzi-=KxJGXl2^P`ZjM!zcxvS*+qHq|LDZ7?Ji`M7zMHMoFAw zN^WV`LDxGV^mr4kmo0V&%DE4hvrCJ<@=~#@D&;{ic2P;cIJG%f$if5i_W1PGRCCj= z>``ib3unm<*73vJSiO-gfu9%Mx{w=(RJ@nayYyTMgK)yXBL*Vj9Da1Twr@j$?rUOc z)`o;wh)C(}IvdCwI)gZ)Xg%b^nb8PDP;)*8NK*9 zqRMb<;G>KA4lw+zM0E3{P&D5v@No6??5@=u9Gdxp~M3WKX>&{JKQH1?d(KnYz$lZRH$la90-|lq8uzxeSoGZ~w6y`%);Bj;0z5!YJc&SfdxUYBOjX#0H!ms5-;pnrnAUHATS_{lx3yQ*3 zFs_S6mFmTPqeU+3Q4;v%P@&k}WTdv4)6{GANqOu)-X`uUjQLqAjDbie)`o?MagtxO?dR8w>p7^y_&o5-1b&3wTilXaQ$SEj&M2=EwM zSlD<9!OqX|c9`#}9=_f48ySoGBs36TYc+trV*ck8Wh4@iYuF)>zIzc&g^f170I5`yT+!SMxfmrT@f~n_e<4axbgZ=~amwM2px;^!fnYv~Qy%++x z>O!9r(~GvNY62=(rE)r<`K0)BGe=uKT5|BO5_)7l8`R}A-w7@vzf#BApV#>8( z$EWJKfJa`2)s-)tzQ=0brqt2Uq5u zDf&sVUZ0Szy-@}zATn^u2Yp-{hIl``DB zr@+$jp^$*hq+M`jTT%#i#+E-DUJ(cV2bOZ1{!+-dE`I*$I6Y-kzeVGKG=lxynX$>Wtru?Yfm6vUg@AM)2?R4;V-L;q1h8Bp87UErJhT{SI+Z zX?It$!q@j!&dGY^Ea!HtwGphkPu$muimY z$3Mi)pWfw>2!6C3w#Z%JK(NBjIW?U@9+iJ@=Vc&qh6>Ih z2PUR{PzUKq^~|GRY5%%j}z?Pl~PDi91CLAeNV z+K`D5$d7W^h=v{S6k`gLM}UtE;+^1}he&@`j?&)W2_(2qAi+gTG+WV0Gn(BTI#`WF z{Z_~@;KX_>_y!z#;#5V!rrJx3P!84&3A@0BM0`d&#b3fHoRCF^oa8qbQMDn`jYL86 z0|J=|4m{G8#E_+pGN;NuJ+}~(g#$T_k{Q#$&Dj{}2@Lq-v;{PHM7qy#L`0-ua!W)U zgftioNuyA|QPGT_$ay7IG}R3qwGkGB+n5DBDNgZN16jIIS&!UOSKM_uay$6{vV28x z8$Y{{cJY5eocyZ$_XPAf3(3#U6ESYXYs=@)?Go1vN^TBN9fYNHGx^KRhWEkf~!;F zn%sn5=hWW)z^RNgCl_XZWc(2jr^be}O98^1;}Gg&-E-I?O*vx1Ps_WImk#Afm8ZfP zLuKQf>i=j9@H+u(=ICDxQkP$iLDMm}3wg@5N zkHXwTqG%Z2WS!R<3VB?c8psut*I5CkT(=~^W9~As+`B)#^n==mg9xx}%Lp(kVqf&k zBxN;U3waG>djup<%Rcw=cV9|ht&7&L4`qEY5hvXS8LE=vya;(Gg`C34$V8&KJpYaP z%+y2lg0-1`y?$y|!hPf)sZcj_=>uJ9%ymF4HJPwzaQ^JM<=bbXv+##Vo1<%w0s;V%>G4PC<(HOu z&O~k>;M1ybSjPz~@&Qanqg9#nf#J)VK#9RE5y5uz0_8(EAH|w0J^R^<$huX}Ta@(N zeq0KkA{-L=Cc?%KCy+KWDp0O)qiNE?nZ{^YKHjz7g3G7(7}i^rZ8HGkR#(>BFf-;3 z#!lEDQBsdwe`xcF&UvdDtamGT@MR-@F4y~S z1r6)F++F~^u^+xKi-H}FNm48^ zk+qsxWu8EpRoWynd-v0!*FM*n%B+xep%TX(6KA(Cz7EHKLE?dPgY$U2OE8!$gfGi6 zNqm1W7{lAF_`6^*YHX4eckxiD>6L*gp5MWTPKq1m`c!j3JWmK14iG%IKE?BQ5-s=# z+K%uC_@GJXWO1dfI!o7)vE8O{e=~%2j(G!9lMbdYOO2P6#JL@I02!_$OTLu(FB@yU z;oBUbH?3`}RKKYHN`57{*y;{93V%jqGqu0Z-?ZzbAPp{6lmv#W)V-+=A^?MI3l6CJ zLwSI2Erkb~_euPR-&Yc6%jxI#-$OLLhB0OqgIC1{i8wR5e*WLVa#!l zDG%f?l9x^xWOkqm4=}G8Na=Z^H~@4C3qqIRx6AWzd74zPjBvP+K;_ncs$_LS3if8? zdja_fQiZlJatv$l^*tF!5ms zrT%96*X?v>WBH??^R>d4h^pe}!u{mULaPBYW=)iTE#?T*XdG+Ah$_h(5M@k|QyITI zJO+noB|Gr-W3a{trH*PMR7iV3!MB?1FK=GDUqO~_SwRL0(MvPuq73VHgz`SzKjoBi zZ62)p=P$3BRnDNKN=0XMoIE)=%yr2^=ouH$MFrjsWwf<|$^V4lOp+=1ovC{6fdyr% z_8FXDZDo_7C1c-2fd$50O#J~yu02J zDlzj6dG~Y5*!Qe2biU-ktA^{v@-=?J#~artW5$?PXL(bs-e~L}|AxFp%bZ<|z1TmP zIvB6K+oeS@SjMEceyoP)I{QyhAa2sG3GR?v>$!9qrs)5*KQ+x=j3MP6j5)pv3$je_ z`)VGAoQdz>Kjk>LmF%s48Cr6`jqeEuBLu1!@CbY4EmZ>!Ip&Z0fb(m?rYHXL+w1j~ zGNOjr8GT((?OFSWTIkGWfXW?FHLUi@qMRKJNTk1Np*Eqt4nrh?`~}0r^i@^JqNrD9 z*l6NEw2YO)inW>3kw64b?uA4CaUc=1gSR8`lqt=RX=v!X^pHnxdRXA6{;h4yX>XoQXiRg>~?R+-EuX;ygF4JJ=m8ab6!pqHb zvdi9(>cfqWL7s?c#N1#hsD3t1?d>Q;>v;=kza{j2(DmZPQn!J2oB^VUzr8N6H}?Fj z%~9Uld>p0AZ%}VG2egF$O(3$p=bUBiZT!I$Pa6rw05GYdo{0YVj>K+_mB-PF&w7Fj zC1U*;ojy=zBTDs}~KWlEAOI}dh3TuM0rHrZ_7%`ikmMR4c%6ggx0GIj8{Cl;Y} z_NqF$Z7vFKwic1tHy24cE?<`THEltwjg}%6K{(SnYvFsjOe=dOqi}Qm^k=(k8a2Hm zjBktrlYj_eK{AYoj0PjbU>X(pD?1CT`b51dY>k-l+|ghxfMofef>b);6hcEX@B8o7 z{pbXvkLYsj!pO2&++6sqVM@@SxEKDaLAWOvR&HwODglYTtZx!`6#?h=Iw1n! zL18ET`~uf+Cu?SfIIFPK52y3E&Dp6pr3j>oz42bafzR& z?feD}Ez1m(!$i(c|56kOmX;I5HDqWVAbczZn_Y8VbyM$i!~3O2#HA+o zprzU!D)hPK^Q`>nsgQ-JnxJTEms=kqbmeO6+rc0yAHV2>^1}^Eb*1W5HE6NJKKwC6 zPLu7@^aG!-Pl6Vg>aEs8S~2;-Uz3pmi#%-Inb~hJv%ij^2+56|kDNJQznllrJOl|!hAsaUG^0ZOb?auom$z`L^R+9+Q z#usXf-RXl_ehbh0M!C0&nA|tO=;^IcU;Enb>DJg{arOdZTzp;}D6IAI;1&CwG?KIojk|CL0tOk`$}&E{k&c1p0=D?Tm?KDJ^Dinxrx zj6a$x65=d)M{KyFEt;22D;&N)=!Mnd`0-h*8q40l#_Pv}kpWD7gr;$dV}U#`(TT?Y zl0HSdoYk})iN>%!v~VoM5DXfL{#0-#cGUQc#n2Yxyo~TgbulvUUCUuQ=sv%y`EoT_zqBuRPFYF7V?uK9x|9a!4mX zfoM9%JHowL)~a{%c~P00|KvuTH&m)1@}tPmVoPX+?+N1vbfrxBl0<3YMSH85r7u5R zW^)Ru>8D8j_`@;PR11?ymr0Uk`<9A$i3DM_wdI^2XV~d7m{Vg<*Um^QG`4lO+Vh=; zD}k$Oz`Wf~&UN$Bw&`x!qXwwAg4?5p(!WL6=ecccFiZC{PDYTFEF|fCFNrr z(pF{nWwgf*1ub%7UrzN=CX?uX|N5rSmdi>p+$Ws;P?)@zFTA+eG=A@3ZWNK%mlJWe^BrlUB`p)YO zH1;Pl6B}AwE5r)4!-~eimHxB^?qA$SFO;0N1MG(kohgyuxyZ;)j*Xy&wA{L2+EB9RaG?=^s4 zyDaQKv`YmVewK#4Y!)_|73i02Jb28O>d{!oLk^k-_??Q5J#&{VD$)J(>}fftKP$rJ zTmPVBYk9+fi_ld$LNA9-syh$>I&FaZ$G`MWQh;&~N(yxxk_r>Qi!lEH7>3krA|$rf z5Rz}i=&^Cu@DnH8Q6qp2D~JB~Lr zAHz=JA!Smt+_vnaOUf)}KbI8Ic=E=tgJKl`*|y>Mtn2%(ZiN$0e!L=h-}P7KmiPZc z_-m~Ec#!SxQ)#KeW~g#htLSFPX&dJ4$Z@AmIPEc}GWj0B)hX7oZ~Q-;pr9K*iO@pZ zLf#UB!d}#e$@&j?*=HiJua;8Qe%1QIZhtat=h%YU_>||c`_e$a(3wk4;Vt!IG|TH4 z0aBlDkNx{b^jQCJUE~(&$X4Tg;2JgMh#FyD@hQn5Q{3IEDQicM^=F}fwIX1Go`xBM za?@IbI7-;u^-vjDFgJbnPRSZt>EYq481#%^tc65$?P8R?$L5mf7#XdAdwJ)gSo$6K zbDVgLJ2UV5f9-56ZoYpmCoe78p1vqK=4{QdMpEO1Xj&}arhOsgj&rwXWVf+3;1a2v zLhx5#W158#rOPD|vwc$wm((Ndc_Jp%PguAsXgJ0z0u7SiurqA+#u7q&9rvb@IAG_2 z%v*GW)S5ntr@s|Lr{Z-y!0ng!7(48GDag})DeC21+Cv41pu^lo_KgNH{+H>Um$DmF zlTxUQ`gQ9H?B~;74Z;-piihMkj-hZ|e#PoPE>Dwj~H_({=JR@Ti zKj@R2Y!DXN5!rzUonk$>qNh{dzTuR>T2jsAb;m)wq<=e4PSi*f+P!isa(+?fG<)$~ zs{$Di{H}6QMc%FQBo3+79Pb&_m6rcR9ENlc)hlE5w4a(cQR}zSun3JFQcBT^L)ogT z36UnaRI#X8DuLdnjqv*EcsR)%n|#ISEV{lpjYARtcin1FB8Da`qd?AwLGkeSyo=ei zYeR7Q#}3IiKhK_w0(W`vL6%OcWUWqTOI#=K8j(-!hpG-VIy!W`)!aFCJQvf-IO7nP zpV709IC(-m4oL_35($3~X)x@vODTmg4&{lFX=qR@K@d6FyKWxwrw=&x zcW$e2Z8kIEmX1!nT*g~kAtj^#jPUCYozbLq3bP4OvNI}(ff@!YUn8bLZRq8I_lyft zu;2(E6e?=PZ2%-#-{=3olG`1pd3Y1tVn64VdWc#mwx46*tn(KjR3UWd4Ayd~QI}XE6#CHt{;!QmR zwEAfpw|NYmn3tXOdXN?$Ovk)YfeFT>~Z}wt7I{=q|AHcIfXTb zAegU{8?rD>Ja?39mDxqF{<<~yMj)k_oxrL5jZ&X~s~y2zYd=j3Rxy9-oJEU%L65ug za=8OOm;06`rMELqqvr@gVh5rrsKHKA>7rZ}0jY3O{T%C~9m+GX^ev@g7sDt(Lq;OO zzZ0DKE0hKS*BG{ZG&YUls6#xo{dv7upXLAtF0(hCSj9F>U6r9Q&xZ4HKRVTynwn8r zw^41XHv2P$(x(ZU!6y7coH^vGGi+XrhqWQTgi0UcCH6{AAif(zXV3T{=>#vD$t5RW>WQ(N` zQsKBAainvDVeqBCtFnyo8@b1-tV@I z0y`Mz*6YT+78e45ku(1<7LE-E8RPBH_hu^w(RA;nhI#bW;Di+}ArQOt*l9i`_Cf-1 zLZccO&DfXVV{lc>PNK*}7*N|gp?bl{R$ShtM{~bAeYN3)rx}zNsw@g9`SC5qZEBF= z90buhny%?$Z0>5x1r(9EUljV=6C%2l!>Q6y&KXDb4ilyO6UYzHM={T*RLr2VGo=)4 z=hUX4#gn?9qkl{>8Dx*Jx7_<3E#Ct#4fmBR=UPvjz_R4|g+}+Qg)5Mr(-;xvvjc{a zbrL4zMz{R7)s9=UEKcDA;hxwd_t|7EYX)>fegiV;yG2Nu<@s;HLx@HF+KMH$iCtbr zHUgu*stsTARypGu9|hVPb!iqcpA|V$EOr&r41#6r97HZbTLINy?{1F8&Ypprk?h0; zj)|UW!2R(PdS7V4YG+ttslK2$oA0?0cfbAj$ZG1_zK82G_)V@4zCUZ<@6=B^e1@k{ zb!7n6$!^9p8b?*N%d^Ct6Peh>z;N_ybA(hB&<}>;bzqRr*+Xc~S7z#mHvNdz8*2Gg zp`-9U+}bluUlcoX_kB2H$>wo9b1o=pKjz+AIt_WyCd4b-Hym?$a9K{HjnqcBCptxp4VDIyu!s@=9bSb3Nz~mX(z5n z*8M${ZVOKbCj*vBWeK(ngF7vk$+9Bz5t2J!5u;0o!w_ z35>hbSUwvb+0>Xns7QiSF7v5IUiWIeT%A0_W3j=&?S215v)-J$2^z75bEq>;rs_O{1bi^b4BFpDQQm`TKQGr-r!^mwqaKIkA-WWGr2~K6MY} zC-5rh=|9hUo;U)sH4CUC z=9X=n{{9biubPPulf}iuCV^~Z{Ylw=_Y#td?PC z&65|n4Y0S2xT!rT8cyVw$4-ld#R!89HkAX#2;)yrygxKtKDoDu>SLtjo4f^U_Mzi2 zLud!dd@pBUkeON@?cihpZb;&qsV&$HV*n&mIOoP!8Uhyy3LS})-SGK4qNz2nzbxGXTY47jM~noE36>~NNv zpQO+ce0~NvbCq6N zRE|T1YUr~0W|aeKv1VSas_3gOxbv7pp#8-fo5WKTU2b0&U|Ge&cdXwt!O^kUcTvi` zBkyF?7fgJhz4neV4m@otQ#bPCbqFwrDaP*1-GK27c72^L!XyR8Y*XoHlV>#X_XZ*Udwy4ex@&|d8bC1JM(eY z`SIzZJcFM#+Gm2U=1qI(C^5Glh8+N?8SZ-emQ#&@@jYkL3GVc)7uhH?M=tg}>1 zq)@qYyC@aO-@bH|oW#i3qI>V9J@DOWCcF2n-Y3ezxTvduv6=h!m*S21_I1$bFS1Q= zzRN<Yg8XN$!LqgEDwhtMbkB2xsL|!_PkU1zqep0OnWWj>fqgd;`t>Qa zAd!b^fh6Pdh}T#t-Pw`g{%Vuz`lwP9?4CcqMB{|KyFsM28*YS|IFxZn*8L*gzf!=gdm1Z%ig(Jy!V>m)Qbd+t-%Zgt7V&%@92bIVMN z62enB?8{<3%ksbg3k+!})>flP+|dA)NZ|$r(wkiqnThr!I=+yv+B}5y?QN*gbj=%1_R&v(J2WY@oR_AImR0hN@_k6F`S zQ48g$Fco8VQXm7rxihWZP>)?EFvM?t7}6T6pM3xUzR+8VBGe!{@rqb{T%1$uqG;)y z%Adc!qE5hU%GQvBJ{3acW$p|lKlI{=`|Mgh$X+PG-kN@jL_6qt{gqnEo;jciY#_}h zx88ql2mV~2xZ@qnGj*FYL+e2N&k|6An_{O=Uf1U(q8TvnMI1eN46m2ooqmKbKZGY5 z{8g>#*)mqeEp)cUmLS20VV|MXQxKSv=I-aEeTk85MH0BP%UwfZkTHKz(f8N~&a%ig z%p8{E(kSAlKH6oE5lat;`qm}RHvN2RC{aD&(^qS>9X@-#JJ zmvw&O2;L&vzKlJ2y?b0uRL*UvMTZ>h?(CJoP5;n3X}*bM>$tMN=8aQU{cxSS;N&9L zb5QT+rCVEPf9*q}dQ=RMvc6nmFx6d=)_vD*DYgk8EUHrZzG4qgackLw@fK4V?RY;M zq5I;oMS=RM_dY)F%yU}u*dH8A(#yznSneYD}C}z{D?4be^^_#(i4{28uS&$=m*IGq!xe}jLUb!5H_N&Rl0LPgaf)O=yXhFMhxTmf$QSwU zqQTP^aBx3$1$RJw{2v(Ngh*eL-<8pkLPv;h}z5r4c_^Hrco#ui@dbgA3iAN``h0uH!|C(w712DXYQY9KHDdF z`Hae++QciI2+=RwDs?)snfL3(XAzC-0iS?fTzxq~F9o&d?3x2x`HP*qf^aAFkx7}h z)>FyRER`a{)Jl9I4Poq(QyW#t(B;e@D#W(rTQioc!{9?WxH*hpd@9hR2JHwIJ!Qv) zoW!dXmWM!BB&~|e2e@gnDh1NU`}CejJ>#TCS{N+^vI-@P-ok)vT1mt2kfCB#3V@;& zllO1yQWm*Pt8!aHJB3*q>Dw(mD_ZO9QLGOTe#F_nXHHs9qHl{sd~p4Ilb88WPWW98rWPqDQ`cq|x`oc7 zFuCcc`l-I-`tpm8tl#uVbsJ#!qUjWa8%MFLN!mciL2Y;E0xLY*`H zFvETqy%utkc+hUAVN;JKrwt(a(}@Y*ngG^H-#!GTMJpY6h_EsC--EIEksDAheN- z5i?qZSD7JVxZtfcd9Bl=?u$((;^F<-XwAbo;-D=)&LSHQfxYKV+A$S3ABllPAi-(7 zUP?EcTydP6{paSlA#KzFc|YB5&TWXOU@jca`>ks^*NS|oVsf)9L2ar2j$4(!YW%RV=C*Giji4$f zl2Ol&T)0CUxxmJ8Ni%x3z(%2_L<5RcmISB20DC7apEn}r$vxeX1bknMdCk5&0-Ka@ zdD>15Hj>Zp}39l#!K>bP`uGS{_m|3N<@SVv6cMK#?rb>1P>(bHFI1(O#m|H`hS3cj-eV zFtXEu@l`qr`%szn7x=L>NtT>wNR}{sW`PNeFT?h|J7@DTlPSlZa%3CwLy&*&zGUbl z!mn~vh;r1E(nfN6CtSGZA5~N$0}{OwXbqN8w?4Ouc)Mya46tC@_`qr~QWA>Fa`fDb znvwSR3y`iECs!X8Ts|O9wa_9?1=Jr(}0)`(#2XDfs1e1Gq5@vlqDSw#o} zDp$;>#90-{@S`)WY7`rpSQW59^9@9KMdN zrtqsF>EB&sUk-YHi7%)DqXuwyV{e59CX@0GTLt7w2>_m$-Rz_8^ey(a*w+PD zn;=H39*!)*$;cFrdsNh?IKZ8TKZ3t*V+JpR|AIl*JAUvR3N#VwbPFrEcC_Hl+}$#W zxwps6imz^>vzr`hi{IpWV{Wl{@^*VSE3nr64rWRb7LRAi=K2fPGO(?ly2qi3=@2x5 z=XO;#q7YkY+@?!hNT^B2(68GA>vUzo71eg26W3-TqNzRp%JmbI4k%&|OVxKNv$Aq#atm zQ`rJ$gX88Q_wL4tRLD5MW(t}abFbKVpDXBHSG4?Hm{atU*^~8SAi*e{a7&q0M{r*I z?nUdq_4HPRL21TLP8g=Gp|Kv^cJauM@1Kf^Z)YyN0(IZ~nR@V9BljFx)6{ujx_HvB z=4n#i0h@Ud^MQ1Jq3+tksd(0$qCXmQTvW%#-X3UK5!V;Day3FXx1=c3Nn=XiQOmKG zb=40xs(Y4o1XeObML>SPlQ<*w-FK~j=7TQoFm|mMt8rq(8u)Q+IMz(}PJTG3LeK69 z!xn}n0nkD=p@n`?Y6m}o!csKWIx18$^T^ZYo8v$1ae7Rh51UKazdhMztoUh#O1@$%XOgL*Qc)|6RXSe zO=+s$D2dK}MeX(Wpwsq|841L;Vv)NGr9NN6dX2+tG6(zUbPWTG3(ZMkcX7?f&o=`d z;8~FUqnCAeLOVXynId<+qKGdEzDLKX?>di*Zw5Zuza&+?C7*|YUG-XY5Ev^uWemUz zDE7;`YVEbUfoyD8xzf_I`G7gwOp7@iP`7Xt`SdBgKRh%l!L*vwP z@5sjgY6Qbn7_%VL9@vjhYfc-MPt6jp#qK%XctggPoNjY3ccPErcACMbJ(uU??_88H zZ+ZVt&6x~K+n8R$^d>K##hrA2c*S^s7^D=j*aK`g0a}~P@jOjncr;@6q5lu7FfVHv zo*p#z#&k=oCk}A%uS|sQtL~I&8M>JY1jc(efr$d)qp!wkPtmQ&WB02|uaDxpF4{^u zKvZ2KCwy*ON5#UbZd|eTCT=pkXZa{p+{2v_6}RZYx(Cka>tfrWsntsJ5~2HCWknyek6k+<3*FcR*IJ^SD>72Yg#?V&xP9>kEnORluR;eVI|ArS_@jHcFk3i_$K$;R zez}k0Yy3~uhlMFWV>~LR7B7CnNx$Qq0{aH|UR&E%ZR#a*xc>?-)G-hiobe5a-SBd3 z%_@@hR`=c9dFK`#R2I`3@4V8ctkg0&>GI11N*fR{7Uz2ueaxhM+g3Ct*!66)A+{fn zy%Y!!j~4>$(;UgUxx4u|MT1WUVy5t|?50OC@aOWcl?w7=-A|n6cJlJ$;>PH4+OYw8 zR=izTb<0~WA(19YDRKN`}BdX_!#+}rLXCyS7` zFK&~TP+v*ez<&-|{Qeu6^p-%8g@|sGF~A|dM^L4L2$3{S1lF_?7s4w6y}Cvq0eeMa z;$^IN0q1r-bCZ;n zmMzwjfuFqV@vCn@>A(noC9cXZ!LU%L`0!B@rq;6MD>Z!JTG>+eEicRQecESOz|1w7 z|D)-5_C!T+%n`SnfVm4e`^A?1#^V(U>t+`X>t>Fq#govjI(HH4W?hI}!Uv`yZGOFp zv|ZXz6M|sZqadY*i6s93I>Lc3;*~xBBb0}lK|e6H9U4MUC^cm)(-Q+7`S4-TbaSI)-cZVjsbXQ9RecjR$`#9`wvFUte?R;{O z#Y@W9S(KD}b4aWw(BZqHgZrkTgXaM{e6)btbL4~4*+&T*x09b7Q9P&GaXhD?Tchrz zjh6(8Jh~7hfx>FO6ZFv5YfJ?B#566mD8~EH#!*BVZXa9-{&>1fzmuI&clEK6n4;EX=Xl&BQo8BMpm`qwPgj2KIQ&S>{V#p)c{V>h!OgnO& zn{>VQYV`0FOKL2OZ$XD{U1aJZa$Us#GV5;2Jr;26+qAb4dby%CWtUB!LuX_zciBY$ zq^2#GnJ-pm10UZU-ECM7=-Xy%JM|nWV5>hs=f9_EB;RxRl}F#++&1-gO>9{b{z;6h zqFjOCuq4NQ$chzHz>(DV{S0khF7tFOb#GvaD5jRyvFzC3tytAX%Mj>_Eb*}UK(m@% zb@ALT9ZYMI7T-X7wi!UCpT;8FIl3fLCf{$t8WkJm~$AaDj#UkN~JORmpPq{KU_myPtA=&g26sX-K0htmQBpPKK=@ z=?xh~X7B#)g-92B6Ei%nbG`Ur3zP^1T1NAqt7)U;JCxXP^Ea=m_oYe+>?fLDBYh#B z--#)c^xn}tqhZmfH=#+Iaz4H+WHRVI@J=zaag%dwTm0VGL`$&%3Pp+|Q=s-hXxQyC zp1%W(?rn4Ymkuy`z`VQ-kGL3gZee-56UAjCq1e;-{j8g&%Bn?QDwpmd$1%T?b64mk z?ka!`-BJkg&bQM-g1Wx0iAg z7X)5RID}$irVAg!TJN*;)BiL8*n58siGI#d-Ea1JC!p=?8?d zuT`~}7!7t))BfCNDrWm~vCp_4QO>fPh|u0zD9c{g><4Q$T?ZJ2%kH!nu8d{Kce`hq zfB|$wYx45q$G7tw`Y*=&1!6TLzSzSioey)D*1{*}B$xI(aAT(5F^z4nb^GlJAUZ=Q z3c5c@zesRX2mL7uK%J2lzb;P;laj>a&==WskijDMUf7Rh@phF{>C#la)6z|gDP$!x zZ=M?Ywwpwk|c2c#&YvlmB3tr-5ubKWwanZAvR4+<`)wN&wZlxrC_9AZTz5x`iD0JB#3H+1{)2 zv=B*2y!ua|S`8bTYWvbMoQZcUv4Nks z4fN8TG$=FZg>dfUOG&J5-DmeXM%I#$V)U0C4RuFsX8?{y3ZxXJ>x!ZsSSLx{?WOIt z8#ccVodh1dg<^CyBgfCrUi)M>J8^X1BNob1}<{}`sddZXw ztpQzQM;vb+@fyIZ&MwX(AQj8SD+0116F|0r-yb25cETU=s3F`J5C#?Xus7TVO)4LNMi-p zLZ6Sr9cfx1K{talzhqZ+2*!HZYr;rN`{0JdSj>JeCIh%R2lGcQZ|KG?Z-g7w-;vJK z@kK6^1To5+>I?^UZquHD>$+)knP$c}njg5fCW{2f;tp5~{_&T9*<{l^-3zGKIA!1_ zd#IU5m@KJ?2a5YX{YN25obJ3-hr{iQe3w(?Au-lAOM3#GBwOL1UrZ9%ScYHb@Mn5m z^wWzie6Xs{M~{wn#t^9sRK8$sUGduXpTuXn%W=3M8|J`wG!ThYj2-FIxkDU|euQMGz=V65UgP%bQu2b7t@<&K);4)+1 zTF?j#+yhS`R?p->=QD^$DLxH>u1F&^-~)CKMU)~613KVE#Va``>wzI6Iea%9sxjO` zE91jR^YvT83h2H+#^Og_eR9Z#E-$uU6sNUYVDD~%ju1rSx~E_(tbqqCZ2o1h)Bcl* z)c}?M+>x(~Jx2jOX~YVFQ?KMTmCIu3Qy!=0th*&8vi5Fiy#`(J2$b{u0S1k>vJMO2 z5NoNvr<9uC9bSE!R_b)_&4G{r-;Xs=tbHlWCFQitYZc95*>L&B0xbol)E!EZO#hWp zUGqAf2K`m@owlH^@kK}WOUC^?V72`Kb$j;mt1{*bf?obNN4w#X9&lU7Vj4y(|JpqZ zWjaas<%mr$B-x_IyH=m7Aq9sv_hwe8W=4;r@zu?os@68a5#Pmj#z&ZfWz}e%IkX|06@>*ZNrDJd%;{)r?@*$`?4lFLyUDoc0Yeh>FO1 zAzIo-I>vWt1q^wJ#yTpUTAMG|bUEwQXX18)hHpL(HIdDuMX*`PnGh*35{cBa&0lj) z^|Mk*AVc`oVCIkakEW^kQOKrpB^qj1>8!R*0V7?Ono{)_!8kU!`L@&WA5^`3#kuCs z*%t&;5s@cDH2d}o(LrnB2U-h1{;1FE;W=ucwGd5t^ip}imi~x%Vj~41ebH&Gh=y5) zI~v5i7T|;@St{^H!OifSK|e69Oas#InaHd$&8k==Qb~!dR1xl;EMa`WcM%>rS+c*e zbgC7hz`hh6Cx-iL@!`hV!@L>_Q`)BXLRT?itP9lkzKWXNn50h!JX~U}6V^)71EQ+1 zy9xuW4Emhd$U2j2FUJ>4W0G9axW@}ptF1+MCU*HRkaaQzQV|nms@KO=`E{&4ef0pR zZPklvlEnB-UupZEQ$jy^)7KEb^f}zvUDto4STs3{i9X34BF1CAU;y;kn2QfZ^)0)@BbfD-xwZNv$fqcwr$&K zY#WV}#%R*m&Q4>yv2EM7(b%@x;LCH)`QARi=FjZwnzd))UK|&mD!xRMM67AG71mgt znZXRe^i z5>|-wkDeYa z>)^^1d#fsEpMO!4}iWbh*<|6;CbyH{)eq* zMHsRbYY{{(_8k9x+X@wmwFVftUmhj~TJm5MBk#V4lA612lEZ1um_FG8_+O|ibhh8} zF+{*An=BGn<=C|N2A+ls?nL+LJe<0_t*I8mrXg>n?D3Cpx73*OBpmVY*l6$Ad5S{M zU#SvHVI_>V+`#b}LT_47mw03A8o$W~8#Ohgxv4XxL##D|sJxO0lzR`sav7|gsEUpN zL_~|~aH)-U^`PaLO4<;e+{o$bW1T^_dKAi`5~APAtO4R8$>!u)57v_KN5li8=o!f zB-*XlIE*TgQXMBw9eFvkJbK%=26#1EPg8nu&Btz)`a^CFC+wMFg~Op6iDs4Md}CDN zHfvPk^vUMQu%x~~2dl)<$;2iTCeooP4fwLed5B)UPv2MYS(8e&TU%NCOGL|HQyva$ z5QC*_J{ICY8+1jXKg3p4)PVC{b^!9@@^*$CNbUYBvzJZ0Zn~@&LYM+En%F6(4>Ib= z@|c>(aits29S`2E-&+sXTF_1Q%UG0%LW?ZcsHky|%VyfwvYNBtr5*W|$n25Caz=wm zV*IF3xPnQLh0&l<1cuCxs8Dp$seH{HNl||9_E8C13+2eTksOBj^o|^7bBB>%$5??D>0KL%B~>+d_#Cv( zk5}po^Mlu+VaFGqY^}g*o_(V6LBT zW<2OEVO%GQl5gH22wou@7NDOtYt11H*v%vdJEs!P=z;^vz$rG00qFeF7b!Yn(fx)I z6C(olGRenI6RsypYa1bZ<}O8g*p|{=^~IDjrY>e#HJSH1bt~A^wFR|%{J>DxN!(|a zlmvy}2Q;0P1pY$z)#h2h_s&T5P+PZ34GA_T)FbTxIsl#4^|MORVnzjrS{YBGCsMis ze=y#z-yzGj&@K@nAc}A;N5ele6c_6;VDs7 z=%m1_*Q_(vX6x11kxCDS@un~JeLHfiIdJ_blaKyXT?66{8cBV@s1!ZBcp)2{y$uU_ zm6-hPRsFsvTSgTAskRYA84>0)E_FRqT57$8?JrdnXi9UGL9~!K0~9V#4?e#`&sgDI zB5KjZ7&H<{K#JHt8jZw1FIr4WZGf5F94C=X8jF;TfhBf|W;CbB*ubEe1f5F~Ms2Bw zSex6p)O-nxQZ825(JA(G0dl`o_^vI9JjoB+UL?xToSQRzuH4AKzkY5nM8ExrO`>#S zXo#sH^6mQnEbM|x5xgl(knX2Qcz{h#(XB?m%~vmA2ZF_?6-g1(e&V5-^U!5548xYV zwOV7&ec6b&=JU??&TEyvvn*1L)jDbajU%xBKHZPTxonlnVS08KIj425ngN-01d`N5 znzC#$@6&RZ!MO|#=Y98P<2@W$A$eAs{2*Pw^cJ>Ki}$$2=yHm?;&Xud)_=b@jthPN z>S5#N0&L9tUo3os);g=;c)dedhY}Yrg_>_*%<}jWQnzst4#d9$uYpQ?PPgjWsYB56 zA>eP5*0#v$lRd$Bbm50A7~;G72BHWU;{H`kBnjV@2pm|s=$eydPka<{4yHsH;BJxv zLF(C>K6b;ET5d(t>Cb!-CEN!94;4+nmU6$Y0EM(J2iyq6ydDD;f!d zoUdh-8^hfvSbAk+mmVeP^rKkx8t&W+Q;L6H6DabS3Qp#N6UBWpndngSaq#i*ZneQN z&m3vs9YLp|hU%H}3cR~{2!Xi{jVg{D_K|(ZWYSepc3l{6O~?odosaLtWOHB6f?cWs zUVQ<6QUlHdsAdKuGPC)(p*?*vI1^Ol4JO(eHU_A>(G<~cUJ|yNN~#*s zqur8KBNzxvGsN0*qXR=GEGRjptSC$oRQ3kpfv7PjU&TMWv#1>kBkC7gw=!&^l#wb$ zS7v$UlDk5gWYWXB8Vpj{N13$3HifzX@T9c4?X4sN<6z-Z&X|xD5GX;d&*N1TGnFCM z1US~W{QR1XgF`*1NDlm0`X9$MWFRH@I405#5doaZ;B11}FLF)6CzGa47bD4p@sm)L zPMYH?n(V?z`rxR&<0xvsT5o)Lqi)@Y2}&yn>e)lPwGAdwl==aW(qb~6y>^Lv_x)KFIiE;O zeFuLv*oottwYM99+v33#PTL#71^;~!q^YO#>M8lX*E}c~LoeZ}QdNOCB|(mOS&`j@ zEgz)we2;7-H(Jy#1qEj&jS0|QkizPB(x=YG=g+ftlb(RZSNK zL4v*C`g2ms;^Nk_eGZurtAQ>{ss4%DHD{~!*$vCepgn5pTCsfT^xGn&swHjb)j7_R ziHLiZG>wu1HPRa|znVV3zhNIC+Hw7?gHXiRtUYD#*?H)p5@X#$aoZ=&N=cpQ{%ikA zz_vy_%$lhbyoB4QKe{h+fCl9ICz!B@l+yPMb<3C|F+n|J^U!2koDx-?i%4Skb= zl#Pn^tEs9=zn#)^47>|I8025c3U8(8Chp+w2AK`sW)P3&M0WWQEO!=nmd4R!%FBmW z=g!m;ryCG;L+CO*5cQP@z$-sGVFt#u5cytFU!Uw_4qlsr%X)@YF?}YIcE;&8aZhjR z-K>_rA#bKa`6L}#&WQqT0-uI&&z3-S%Yyy{tB%0#+8S=Xt|p|kd`aDpoBC_r#_)(A zH$o(lNs$~J!BfU zqv&u-0fJ;?cxp5IYBX>XLcD}(pOEY@jJ_DAv%d(lTRFiD9NcglLROM?gfAfTxZ+p) zEg+M&MW*aKMei|(%tWW!8|Wfw8He|=F`V#H&2ra~jrAeu27Ta~|G^pv#<&G!z4V2j z=AzxOI{|4>y1_VjZSq?#S@br{^s}OffKEn5MtH??MgL;=NrlvMlTt&r2}%=?AS-;B znQ5TXdg1Z$c?MhvWg!r*mIh$Fg4nTg(B!hi7#p~_$V5)?G{vtNGA*hb2d&&d(^mUcq3DTggy8%C zS`^X;7 zJ@f;AIFYRx$t$ubcYyG2BEQ6-@=cpy&Wd4C_u%;`XLz^Z$R|(p|yZJp1VDN)D>jbt}E5;)p#awLqidMsS)TUcID?Icb-z-9zCS4 z_RB!wIizM5Rxs$efK*kAsmpRec>*DI>o$m(hfb9+M`!v`OM-uk_AkOLDEK}IQQ028dRm z%0`5^bfgp&Lu_a7$3S{0#q)*xMY#K!eZ1`0P8>gbYKiLWp}vuJ1EfkObmF?fy^nH(rQuB2BcZ83}8xFPs$F<4s>wjyPhqcp^-iZ`vcU|)7; z$SCRZq|RBbQ%n-B&#L`641dw%)#Qr+4Jio`AY;1`ed-4h`Z!9TS`lo(l>Jsr4(^+} zAQ0SN;K~qw-BvObb%j?6VkBH_Y?z3Nz-DQf<jGMJ@$#HuW`F;Q_NVDkPF^6~f(`(;FSvwAg=Uyb_b*les&y?l@Ilx9T^xJI3T` z7N1IY9U3p2{x!7l41keVXSw)nN*0noJ2AJ!dg=kK<_le|&`Pstz@ukQkL?6i&K!%_`uIK-MYbZzWQv#EJ+e{RZFCsbK9yswVh7 z1+rejSS2eEKU64`(8jy6b(mN=CzXfdivpt3;1igAgz{KDL3zcUG^)Cj7x<`rQ zjro?&`_sHn9}yQ|IW-7XT8A3H!M)8_=lZwM^};FdkT?fyTO2&zrpu@FvG7*`~avfvz5IiPEL97kywyg7h0L@3O$ESO1F6*^iZ7sAC>(-aVZ_Asws=pxVrlMX2 zzfEPPO|oFi^Z38*vLuA4@qxc;v4g*gEM3(JCgy@fNa`pNKFiFJRgR>6(yNdiWqY8N z8DqDrlKr1I3H;+u-lo#U?H<#i%96soVvX(^A4;HYO##-q(3V*=gLH6pUo9ak8X)2G zNxF#MEh|ZFd$t`*MUK64S0Q$pK-qs(Hr?qiI3i{*++pB^pxdZ8Xc{X^v?N z+S&F~!QM}PNKVjGTa^ubcWW$n9&d4X$o0l!=@4=PGDV&SzQ)Ns?zq^$%^n9kw@~I# z2^aApu5 zgSZCqcypk*lwkJj6j@z!0UgDM86RizcLPmynirHAD`uTv)`ZL|`TEN(J(0t*Ng7rf z`>tVi1Z>f5yEDdniS2i~ zw5KKE)D&Aq8Vgh(*V-4P%E0rwDQ^g$qt;Nchr8 zo)G!`D;|^g1)6Ah9-1gg9L=2h^U$zl7?nM0%(P#14;{NAp!*iU`V}1uKcT2}UPpy@ z-uIKi)lWlK_&QqS>lxd3gkPf-K7AE|2r~XY(vHQ9bVg;V*mQrSS)VH!}D&) zAOAWq`pO!s=MhR{naQ0%4NDl}p6RylKA!LszI~D?PPHf`?B*tI9MHc(EN?LO+2xCB zs2GMTio**kuSGdo;+Ix_W{thZO99@heFKS1LOp9v4X+@!6ip7(_W6pJ_H%~3>DyK+ zVf`*#EH%SIH3oqO*22nnPZE)BA{MelWNZ}37-BmlY!v??#VH!u?4NFU3FIL&u`y-R z)Y)}VJ9AMvX<8$;6aWH=-(R>mKpZy|{VjdS$6VA73j1OpTjmJ%&@D~Wx4&*ECF$Do z{UUp5_IFtj^%LADdDGvx#%V@I@VYLO>8#E;MHgK=#eB6t3TvrM7r%!}R4}Cr3sJkhK4)IHg{w6Lb zi8trpCnP6{^h20Es+VSz3uzBs@GEj`n?6W3Kl}`LKG!JyS{^Fomw#Dpkyt4?$qIS7 zkEoC@<}n-DYDQIt62BjKG7>!}OZwcTuYg&}97<13&)k~yB+Qyev~nwE|L*~S=kEMb zE@)?pz7z5+t9%mScx|mA$2sje<VvOR$Nu@6E)U@t1h$xSpf-59M8>-(^meIJg152p5{c~_WOH@8$)DIgfSVzBdN>ONs1Q2;D2qWgXq zPvF6Sw(s{|o?bd*D4+7CMORK&_Qv<>VH(9=1>TA$&GV5#%r%6AQ9`fZ>~jIf+)6Vw zyAM9?lAs{2_)}Y!b*iUS=|oQa_(q&(P_NB!;Dx)e+2;oG4U) zE5z@fGr5H>cSk9}yA8=cbzPoAjCCbI2Rk%UG-V)j%ovx#$`c~U=c*c{W7^A7_^S&@ zlceRIMctjA!3w6~l@HzJeW_((A(Rhkkdk@^Hjc;qD}uEWzXMb1FANAT)j=KbI$|Vm zeK#x92k%$+r_lCV^f8}qaf`}1jDJ$w@&(W)(vcXA zuDSJO@3LJcj?GW32B|xyCY!CHCc_BAndeOdIS7 zfJ)$A{PYi;0{$0M9F}Dlba!I^RDdkRV#!xXyd(xsIrYVn(=-ZMpS#6_7+78)38#$v zs34I-ITn*nP?Ev4-Q9o(MzWW}*$na?hJ4KyIhX^KX_OjTEACHl>Ez}NcRHbroMsR} z%^emIQ^21cs!xCGLpkRCG$-S!7GZA?q4Z5x0N^C?`+RO$35a56q9j68io8=m->PVn7e8?}=zd&~_P8Kypo z1kk+-GfSHu6W)-;UwQ)mMa=ow>C5f$(o>Q+*m>1m8iWfb`F^g&rzTWLhmFg^`+nnd z9zmotOk%hsOe(RJQv$OEyUXN;vj?ijr zY-te9V9_m())-c;4?2}iMVH++MbZR6u1cKWC^gXOW#6uU*ezTyL}eKLS*4K%S3a>^ zh0t}4^?k$92IN<=$Ik1;K2b4LR0IrxNR3P@=4<^EkGN{@sg==?ky1Ys$2h1)#8)QN z{A~UCA8U{5dG75p6aujy;QXWk#{@9QjlZU zY+~~Z441~tEa*TQ^XUSOy&jMK?Ro)*|2AsmaSN@?TICf-N2^eI zP!&r6UKL*G&CEFakRG^iVpuskWR$Iwu>s7hk@Jhr6ijRR-eNQW^YX_i{3?`k&CNyS zACsRICMk3C5Ll$$v9ZaWqLscvVv~yvQ3*xwiD{7M1<%HcIweQ*Mxt!9W(LxQZ%1p9 zoEQ6r|If4i$FbF$|9BLmog4eZId3bezDv6=>8L}6Zhp*L* zr*crXP7(Q1C9L)4oz!GeWzplTiHLG9ooBEg&@#x&cDxRGKc^Da`}rMzISpoar+MOIO^O(Rz` zvd=Vcou=?!v5o?yuvCV6+n2sM6@)WAtIQ-&y=U%|+yI8&XyV*wimdMXg+Yr3YbDh@ z{B`@jJAZ5Tmj?tq!tUp3WS;pi=8K2Q+!4ES@*p*~LDa44b2gy5+5C3bHctMgBjyL} ziN@xxT#o&$kA+goaS6G_mggjT;3k;~7QF|sSb|4Sa9MNRpQIU$KIJ1oC?4y7%7+3C z&NtUmX9h@3zKPUVf>ovL=P`f+y2jYBy<@&p2oTYKQIWV=97w!wI*7lyC=yQorDJ^> z{TDo2_@q}i7-+Mk9{|;|eWQ279=|82P;ooG-FF`v->E<;)DP~mX;AF!)bl-TVtcyv z;x!=VPWR4IVg!M4gx+Xdf_j70`k4QL#x{~iqZBOrTE~_K&7~c-9JMxxqvZI_r1_!N z$oXZFD#Lp(LI7Oe>jz_07=Bi7314PTJU5l}kqKJ8=8!2@*5Msb_Zaw$=^(S5+;1G(gI}*eAKdZ-g#$1myVjz#jkV=z1CbCOA_Y?%6ctM z&+jI?CqJbMKsEw4q7b<8_ea0s`uhjcjSdT}p6_8_$_ku^7H*n01R4d}y+##`8{6Gx zsyuto?i-$^7n65;!+O}U-X1Trt; zxgX_^Ogszcx?QC4Jqyvcc+i!GbJ%XAa0aPEiuB?vCxie#IM9(7-pZUI3@WF~^nc}8 zLsLBqZ;w4GWl4RvhYnE{@uq#U9s^`49oy&(A?6pdP-O|Da30L6Z9$k`bIMZl)SQ*D z3}nAvZKfq@TuF%*>w=`C`N%#QG{-dAw`e=bmN7C=7s)9LWGB;%uF-#WMT3(rvPS`K zsd$wyeo=}yTIp@qM1A>L|5ig!=rZp7O6arajcE^x>XC@=rfyOL`M$VR)o8wamA{>vv~3N> zMn!%1NSvMc=f~Vk23c7O?ACpbiAD;b1rSLyXv7f3;=lN4&;Zq5|9H84Z|0`hzSmsh zqH(myUh8i6&qq7oKY*hArYFiXC5AWmB>`n1Tu<@q+hlycx72KCLBcXau^-L%|HkzG z(R>>=6sipE+^Ps4nr}lf7W>&-cYZh94^Z30NQ(GlKCbJG2ob>qRcMyGGR{(7O6cIl5CxozI+T0wP$&Op zE(*1?p)O4Ze^=;^-!Ov2saXBS4D9qli1xg9A zHHKpG)z5Sv_W`Tkb7 zM%ch&?BZ`qc+q)?TXqZkAhL&EXF&s&p$S0=L2jwyjJbj2sI@VKVCUDAyMC;&E7EJXB2hZz0 zN6|1fRQH?%50Ih{po|Qahm+#$^!gY%qM$>vMjEizsC(nJqK-8SX;e!VQ#pz-allH* z3VFla8vc~Tl@yii_mo6DHpm%y%^3`XLa~=7TCX6L012KgrZK}-x>Hg$2Qi8_Ch?c= z;3g6&q0Lw@29dNkKgYn8Fs=uxUaSw=b(pFTPEaY1dTEP$!*zW%-mf~jsG(@kvj zM6K@=S@I+)3Ocf@&W-P!0n+}L{ILi6)t#~KvD&{me@2YBlLjOdH696dAOXt2o08jtSsbU`}GV4cn=kD zHnV^yCAn-VYP!$)!|Ipu84w3Eo_W^|RaWC^cC6T*M~2_6AYO7fb2)X5`#d83d9SX} z(K>4UHOF0gNJvzuU_3<}p9PXIynVo}#OxDYCJ)uG4j7%}`UGHHEqbW=uM@?1P*aj2 z)3_Ap;a3SVV5~<)3|W*_Z-`c1Jl-MoNag^Bm>p5%_TQxl+mI`AIgSo>Zv|lvq0%lv zg+~4EC*_SimW@3;pNW=gU3HVjkeUu8s6&-+Igp^3mZ$!F{;liGZ^7tLbzd{8;gRfD zpU9=*f!(t#^ZHRdp)dd9rWhOi1Wm0m^gfJ|kU#Y;dTDB3A(H)q8aCTD#__-4ykbkXaFqf65oM>*zQ}^A=>~iB}=&@`KcAD;l z4!DX%{G8ct(^0#29Am}K5!WInt^5Atb)r-JjJa{^yg7Zi=EfXI_PbBi5&tuaSJycv z^k)=lSr2a^gm5l=?k8bfQHHwzzFiMPOo#xN8Aee>gUs$Oz|(;qNvRb%JR{F%q!~|seaHQEVgux{P1rT|Ycz+IPmQIfk*nq4DNRN#mbk5@yJ)-v9>JyCaQmB_D_4?-u*&t#Epe}C zepRYUY%|>VR(0Y}6r!3Ua2q&dr!zTBL9;@pGl?Afo6E=18N{o&9gF-JO6$Zo6Zaf> zXN?%)rLoFzhfJUP>pFGf%YJ<8#7$gqC9#2!#C>|^6YkQ69~}d%zq7|do4RxY<&ohx z4}eIAck8ZV@7R7T(EexqdO|QH9zQ)zZJf2Ln1Dc|_2Rn6yAZKl>Cy5wT~inCT#9}# zpAtaDiT{nHs^Pb^#>JSYTws-IFZX~`E~Ye+JTWvS0I6ddr!Y{BZ@-cyxxXcaLBg_v z<+bcA$Ovmu#>G4G#}9^yH@E;8_28j{m}50H><3h(}1=Yk49=V%y3E zORQ9 zh}8Ya6WrGw4`YV-HFCtuePeye$#asDil=x1YEoj`hP+}am1Jkh#!vLE-C{UhJ^n^c z9>ol=Kg9UvA2EI=>7FxSjD>Ao%Z7AJGdgTDBsy-&ZnmZ|$xReLxp$dwbQ&ej_c%nS z6$TfhzW_qwI&{iYGI#gEaXLpo6(!5%q;#`3U7fmYb59F~*WM&S;oQ1f=}U5?+K@$O$VEthbUnNp_2PlYU}Mc-3Kv zyjlI0*{wyalo|>I>(jlbSYoi-+dJ#?W@2)rIRIeciC5bnDNudK%k2+%7M*{gt{VG` ztUyU9hX_G(ASZZ=v(OFO-%VG`)h^i&^Is6#hnd68?rGl5?!y{_iL2m$4qtSI!=C)h8p@Q`VQ3#32}%O zc$&GMzHSle?nB-mpDYwdD8%o$x*jcx(Yl+%RTwQ;cl{?rdP4;d_=ZCGcdkF;BDN&# z2`R>L()hMzp~DvEdpe(IiT{P0I~*BO5o49|5q)fLhq#E!LG4!zCek^S{+-u~)`ogX znQpYdGQPT95PaHsQ>+Y4Q6ieuShpQQ>)Z+b^H^aS)@vZ~_@jfPM}jQ06z08A)Og5@ zIaaDA5TJ`Czr9_xGkZ+^$S$MEqB7)=b#Ko0vNeB%F29b@`d@`t6iiw}t2fW4i=)4p8_hJ2fIt zR+tG*dh+PLt|l6{^BZ2_yr8RHJ0H2&JL5i|{q0u4U6I8?A3;Ps#uoR&S@CVUI31Sf zCf?2QUBx^V4M{l)S3o~)f%@rq?gwV=ay45;?3 zFcWY7L{=ADuA9-Ov}V82WPqnBjjLy`%roJa!GL6P5VXWJ8F@2df-!$o92<>if&_-1 z!uh8CUq&!O`_i2DG~b-|A$4NYu+3?Uu4rPFJ$rq1x2GfPDQwbdB$4=*A+Z$87HZSt zTtCaa%iH;0uGil3KGLaVPvdPaqmz7^x~+89z$=;cJHVO@vM3C(2}dP$$@7!Vahgc+ z)^16lL_BuHpw6bF=4|Xw`k6CY+YE)0G8bB&d7C$iTOiBX2L@4{E~0DzEK3?^CK+A{ z+JlC9n_qV-xOjO}nwc+4TVHSQ@8#u8K_pIH4n7awNM$$sp{3}F!;ItSO|1&Sj3a-g zir8+017@SE;#KkRUj2;?kYmXTnlo!^^kec3zn&8X{EKK?HmU5Vd8zCVqQM7YrLsSW z#shrNjz39=j$Y6Nxo<)T)g4qY!}=_QC5{GG^_b8wK|DtD{Fa~p^2fDj8yr)o!2N{1 z$;Yxs+sc#;_NHbsg5TKy7IXq=Lvsj#oUT@@R9trY_NP>h9{(EJK>PTDBuXpqW1>nX z`N|nrc(5@~wO+Rwjvrk(3Ptv#Yz6NA+n6*AH7ZGVG(eV#$`E~*FD_?+&J)~8k7Fk& zti%M#G64cNzcm~d3FcUdGYs=byUlWrL97_Ly6QKa_U!@5wRsb@LMSFcf;Y0-LEnj! zfrhK0Cs;Q&NvXAukYnPFJ=Q#p3nM(rM3GE5=%%#m zjVI5w(BYU;*u5-NS2yzCP67yvIJ0EEbh8li7o{qG&2;cGMslqWMe)ZL8U7-l@v>L| z>wDyYo8D4k`C-=rP?E4!=S7Fp^f`=1^)e&6cTT*mGi7Zd$GoG20(@28%eq~mGmOCZ zIzag6W=(k$aw}#r0m&J*6K0*@QQ@x$mq{UI(T$Ind(ru)rkBf_qY7*U_kCX6IMP-> z`wxXImwN6Wuwpns8ZmcIh9mF`C80DJ z6!|v9le-85Ie){SfkJWBNqXtk!5;)+@qQ2l!Dz)3oH1oCPMaepWKds#sBKMqt!=K3 zQmIyyhx+{wo`H8W`;4hTXq~2AQTp(x-PXc>w+H0Y4-cv@3nrUdM8Dg|2&EGDF^qV6 z07i{vTdo|(wM$4L4$H!ufJ~zM*`bohny0NQ%;4aT5EP)?{^&O&-oc6=Q}n#5E;_;$ zkzhmV({jF48GinZcIlYOkia6_@f0k7?eX^-z7hjTCkLbpzQ%8mx$P;|w>-j|UTZ#> z>S~aSwU8a^5YQ}ZjKIE^z9P9ea-6X}koky^7#P8SvwqYXxSt`p7T+v7n81ASNP-=~RgY&TLuc1OQ> zPV_IMVPwe>67w`467!G0dLK8hS%q(<7;Nx|`eg`VC7rL6S(O{OB%hZ1+U8_*9EnC! zIkC+;GpY4qMglqG3~OXk9TrX>Qjh$ef*DM42C_wq`ni8O_=2plA`+)jz^hsp{t!3; zi?^uNJ)2I(r;Hn)qudD1SbNqpp4>|7Bv~0OKyEe_mJXLSp+z(7WWhwsnEX73PuKOr zf}ww|53-Mdp&toUee#pUY6*Wd*Nvr`aQIr~CbrEBF4AahpwH@nPbc`V5JCV2EK?^p zEYe2^LD98_8x}2Rmm3bI8nwsf&w=8ZwFKXpO25kmrZ`7QUA5&Nh5oFs^U%!rvUpsr ztmyAw$k2Lgxi3h+RuOd~tgkU0Sj!11HrRUrPVo0CC_6dFO4U?PtLS@E0*@REB`%{o zw>wjc7i8h#DbOwEit<%j>voMcGHXv0Sub5m6{&^l$6%rm%MRvJk57M;TB2_}msf0; zk?nQGJ!VTNV`has{)t!K)s7*~x(OfGg+pMGx*s@ZHc6M!9DVwi_0rc6%rWt^;;XD0~aNqekgav29W7Bl z29w7A+$kSw4ZUs&h5yei4#Q5M$kgY&b0=BS$HHgGgA9;l^~8BvL>>@dzq6tgXGJYZ zRPAsS&)oJ-0+ea=Pmno`mYD!mS0^-)U}rT>2qv5B=prOBy6p57+pZv(_Mn$hEYS9SI5 zRAXwFxZ4j-z z+IcMJAe_EOB{zPL_Ny=dC=-ij0}IJnx$ZYi$%Z@?Ew5eT$u*ZKazgefROSoOa=xFC zWH(3w7t&Jo7WMVj6U$|}%%*dfw@(q3!Vl1tSBCwuw8Zl-TIxTe0`(Q+>q1|0ik$u- zrmgmY!JA<1OgROXaPG$JCzB)N+8RQrQ2U-)%|^M5kn49I>pj8t?i?;3#vc+V?mEtq zJVJf%Hn2X~5=>OoL|iN_(hpU}%`b0v4BafCf;$?J``eosoF`+_UOg^Atyhzcma*XllI8x(wb+49Ztu zmBvLJW$ua*Y9~KfbZR&o_{=nM8Xt&ut;x#OWbF1jA+8P zTlq%S$?v!!)dx8p=~j6r-*Z2fxnT+=LId1+llVd*&6ujPrt)LVFT=BLk|-FpdBHGh z0m`YbGv*oMUOX#94F9WWxD!FWs~l(lV3Z=@Ka65sy8S`|J3tD$A)_sSSBl0**Zl+m z4Cs<8%aOf>1`$5%YBAxjW%`>pV1!}xv1XYGE%RjMgjp@S6m~#zyg?Yy*TxDi2Xo21gj6jmE{F00IFJ&i3 zRh%uYM-15499bM^?dpdYArO`dcsS!lp;=pX18RBG&*|vv3EtWQKv7%2nhAyzhD)i& zQ~mzViFYr?E_Y@n=|D!9j&nz3LVCo9Z?18nWC{qoS4>i5vJZov@YS5?OfC$QRIU zGq9W4(gj?ER+})n-m@+SQ_`R6^_AZmS-a6fIFuXeE$j4D;!Oew;9I2r zAeWT3!;Nn^m2wLo(vc`VeA`Fzy5NP}&alCYJ5Kuq9EXc%e$CC0PbbSg!&ybB3F+m! zLkeQA1Fws*Syr=?g5$-kKAR(<=fVA0a^%@V7NP2?5QGJ8%qJMn&HLUd_k;0&f03e= z8O?*4rAm_*SV$>EUXiD-8U0^l>1m(nsfBXb$JH6?{pad7))lr;G^s=nH(SNO0bt$u z+_riXZS%+K3W1A%VliBzv0N2KE8)iEsYn+zjR&LiKJ|S*Dop=zf%6-rg4Fko4DX&m zdHGlu^rbTc_bBj_R{l$=CD*`ot;j+o2-&2cO}Pi?5S}cj-*-2NlQ+0{L|4xr`5Hla zJ&lTdztzqw15}Owq6_WY=bJS-`3j5+qjb>wSvST@t-TKbi!NH zC)~o{atmE=`+t^LwZ_A5;x4!}ODj|5t<*Z{_KxR5pbz{S#!cb^Ks%YcFvkGZNk!S8 zP6Mw|j|ucPaJxafwu))v8aQ&??k3;*G>%miI#^D_^J6SYxUyw6RE5I`AONxFZ8Bo6 zQP8iyh2rPD0@KdOo;=g#jA~iW+3ClDF70 zbu-b=BRhKDMJ#6bi2C}ugny+ZSGdP-O;AJvUK#MdS9^c%y>{me3S$dNrm<3SWR7cS znAZNzotW*CJoaqO*W*SD92eNH`d_6&1V2qJt22pELMgUnruMBx3~Di*{qaVWD96si z{l+nf3MoBpXBB+_a#YTe^Sk1mbQwuo|7r}w)Nr%8$c&QFd}-;Q#i>S0MRZ7}Ix|o6 z8%16L7n#82d$wvqj9JFK0ZyKQiu}T_nUq4MX?flM@dv;z-ajVVZxNUH!5}pMmF*^e z`D_}g%E4Fb*N9Z9&Wc7orwta&FjUpGd<7|>`0Iv;l!xgQWEQ3UPMB7SLawq`31o^| zCXle)LPxg+fmFV@^%Hfo>@lzW!AhITCi^6ho6}HM@kkRRu1208&b3q;lCic0Bi@Gx6YwG1H{q_Bk8dS|8M+#;t+M_R5-9sTHxC zpNR++P)7{q#$HH1C?=}Qyo*C$!$}C*58Pfzdf_k!gS>}u)T4Jb?O8+ni#+hV9(vBYK+83t0zIt;FLc`jquoAWFaN=9p`9--G zD*NZ>g3koOuLGs1hg5oLO+ea9lZb~pUz}RzD{up9{hs)&iS%mmIH-Ov3}gMiV4=-N zf7`g#_g1TE{DCzV0pzf<53KR(jIku?%xi@_HXHm-SiH|qu9W_mcS%j|CRoabSlU)m zC}V6fKD%i1J?8)aM}tnAnxU7{+99S01dFG8|GRMRPWc_+9o)hd=)tjUih@_M8_qqi z|44lfZIhAXu@jYA`|`sd7g|@^9IXHFM>$tXvPoLz0X=1_`6ZB)=e;x`-CAXkuh`lW zzzd}c*02iV7#5s&*`$)nzg4EyXz~!NG;Xl|-frDb8&R3}#V8*G<^M7Dm0@uz5EyK8YRUZlkqcX#*VP~6?!-QBIY^X_xbdH)ZeZrGi@?#xV*NixYV6;;|t zGT`R0S;3w=-69K4$nn5Qu~*qf|B~L zQ5+~4=eMt);TLErN{Wuh2%+l76o?(o3&grm;KBm(5+JMO#CjaLbOg%#!5+0@zI)`R zU2N)Eq>bei>VU;+p<)=DI_sge=&~|*w;%ims0K5Ar#jP-~9TD>D6O#dhs}Py71f zp4UXPoEt)(*J#H&ThErLg{bhQIeXIQ82F}SA(kmY~+@q1yD0}2rkDrDaiyZICOXCOw zQX+YCu{T8vT6V5$zb*JkM>BB{YM0>fwOEJ2O7(~@@TE*m=2hHTUFv*y&r@N@zCZa% zQb0yW2$oUPxtr2e!Ug4;_pPJF{Q~Xc;Py?!Hm`b(AVrn+X*Tq%ZNc?I<0TGQf_H{+ ze)CGbE_uP$u`bf#Up2BYIXkR&)bNvkCzdq3Gy`tiq+NR8E=kY`1wd;fzf`K*P=cO@$EJ zFlm3(FmE@+N1GgI6e;w5dn^UXO>w$%D8XE=w8Q)On6Y3NGN1Lx0CBWHwGAmcvAnmN zNx>AR>UWKebMvL}Xo^`1tR*HgenFhuwtM~e%e)j ztEomYX9;kjI|T*pQt^b-Hj9iaxd#R9H+1h?doJ75*9CTf2F^eKwjfeN)1-MBA;$HFR>LiYQ z-j0hz5Gsqp_iLhBj(1k=w2SPzM-=U}sLADS|9&>9@5-28DU`5q08x4ICZJriU;ETz z218MopwSH&>OPB4QmUme zN!^I=lQUIat7{j9-=<0aiph>vbOG@S0!ZVs$DAu^=~!=kD4@&8QH#K_uIl}RF!XOC z?r|RYbE0G^Pu9a%DsE`aUun)>_Ut|#Y6x<|C^|;(7ZxrUiSV8-nBK#sD+F8wa8w53HX1g3Kz0; z=|E>X!UD7|p0cpX;-9W)WGH-C-^1ba@+~vVeoBj#{=&7fbLRNK|C)H03$XgD7o}{n)SrddHhGuzZ-A}$ShY-W2<0=S z0n5DRS@4GBeN7fL82tytXe886gJcUcM!z3-A09`p!?vikF$DyDiZY^feBN{bo<<52 zSYNz*tzQnfn`8doVn&cjh#T1jel7kbTfIgKMm^{AV+?{hRV9oQnkG(-sCPt2^d7uy zb7JMfiT=d(_75sbr65!Eou%d5aV>az&2r>{YXHdVfYyK=814u+-s9m?Z}&6aqaZA; zH4)N+{t??JCYsBQD2Z(n4sb{Z{x zdrMiLDds(ZnmP!FGqAQmgJV(CtdO4ehPJ9X#jIp3W%+ zh$)7>yJ5IcWBaXB?5Wo0$gRH2R)KtEP;mLTlaI24fzF(@b8QiUh(N0x$|Z`QBqr?l zs`&`I60XTIOvp8`)N(qKVs7NMh}1u2mZqUe7CdWqqk)wNoN519Vw$k}BOT#?_IMt& z+x`CRQFxRCgP|P~#_`~Q&pw3)L!)26hsiaxgWGYtcjsqdm_-e9UGKu zuNfZWOLi(|&3MBmFZo^g$Sl!Kd)x3L)asV9_z54%Z`D~QL)-ePLvu>6n{r^?o)%?V zbSv(@tsy&qqC^);^N(cztZYyN`^5-Q&sioq)8s3Z+LEH#Zxm$lNH^wD&ARQ8yFx0u z$U{7eDAIF^974rc*Chyf!BAi6CF5bhbA*!7j|aT)aKw7ab;gVQlubY8Kg{K; zK57)If;7BhUlB2GQKrE2GlqPRRlSjDNjp+mEga8u{_gvrjNJx;)?e`jg1gSByNC%-}V#h)96G1xorSm9P)rR{YopU5L6;ua5+Kq$C=h@rWc#GkY0fi7aT+E=|Wr zO5nnhMa$qef&2cDc$BCG@X7+lUAtx-pz8;R5h2*>|6ME_vgAdp_ zeZS!oV1XVRZbW|!XeZ)Oe92b~Ua0$fa!tCIfX_iGYyH%_i{(|bKj{X1w(QraHC};L zDns_v^4k^rq?NnPQo z9#%=Xv9M^U+TgGfra0aP|2;_9(xHE@FM1<7RqlDWGEo*DDLSMtvVHnApNy5eI4vM^0Oo`doZZkoX@?7| z1@@y$`s~=$(pb$Ib+HOrE#R&Il&aC9rdVoX&rL8j_FE6pt5k4S|8e)C-U)c!&ABFR zN6WCFE`jjM*T{VA!K$=LiUD$OLLgvMXzZgyApB)T51O(j*~pYY)kdPFUuk{WD8iwC zX+DYJ_4`2Q5t@+ydmx7^QKir{a;Lz7vb!CDz2+?nkBGP&-B;b8j1-ZaF!w zv)M8tx8STE5{+r&Y=xVqQ97UIHhy++5@uv_aoi>SfU8Zb3F|VTcl;T*zrH(R+hZOu z^fqIiVy`>QR#rENlBD6VbS53%zVJkUp#nWcFG+G?cl-xirtqvyRlNTq4(&&vLD zpj!2}@KL4ZFHZoXjI%GJ8Z^SiMZgCJO(9rNJd~GSlJoaE#R{*?%^z`O8^fLw-Y{;= zGh|Otb1Lx+IKr#W8G|nz6Q;1x2Q_{Wusk%4;Y65Ri$XqrM3|(f*}lr!`3}-A4BLrR zjI6PHhM-;otxVU$pF?M-i?qLIiaWsa4AT8Ce%L4HqG<2zf(lZ14&nYjIS*oGq&IAr zU>F5PmN4d51h{9Doo9L^PiuCEeg5pv`+`mWwU*}UYqe#VeQ@*T^{Jx{34Ok##iZdnDsKxS8*^6gjn zLWrLS)fz0eQA^~_rG@uev#Sq+J|u^2Jl=?Qe^_>I4?bN0enjO-XvC=W1?g|JyU#4u zLUb}@|3uh>n@m)oI&fRqXh;Ziq;9;1F5Qyy?-*&E;%cxQ?kig4#iBQLGf%2%#}LWS zmG2XMkp#HAh#%h%6ew_N1Aibs#k_Yvl6>PejQ`UxU7*fI_eE3a#j4OFm2fpcHV5eS65urj}5u^z96P>?Lm8DjPkDz8(B8G(rc7aGMEB>%Y3a9uQT9zbH%AF&gbjL0M8G|I7R zhGX5lrZJR4U+gc#KG<;lDKEL3$1mivd3*+*?#GUzAq0s0WC)YnqlXBc`A)EFXvo## z1o7vT6FkBG@yjzutE&>aUtpl~Bfv(?R0iP0DoTt(h z1~LS#vmL>!sJOB;F}Q-+yG(miJB7;N342q)$mZ=!sf~V(3k6hri{f=O?3?1olG9FG zXJXZwVb2?FlFt8I3Tdp$62jg!7s3vL1T0CfCB!MwU2cZc>pD}82YPT?)e427Aa;@t ztK#A=n*?7)D;Btpa8POCX)9JzzYz+ze^FUuBjp9Zk<-(Yt(!#6WTK(rANvi;D@f|m zxLVQ;k-a=3)aM2Rs3S7UI2YecGmw75+F&;h)DhvK%7rsSL-Yz*En+=N-67{zvmgB4 z-t$DVFfrNZWW|u|2;AFA^@J1v-FTf6&`t#f5vjmmlkXJh9NT5tQu>CzNLYM>`VGX@ z#S-&rP?PFYd%bn6bIYS2hHu27cpRsP%Pb4?bNu4*v>ievi+NsPBQSOLN>V>7efn~y z6n$;U;p1n9p(|bkPsoWId#wzF0e zi+8qZj_63Nal2XElF*jHa3YGjT-v^zz;KDLXgSf(>$|JW#bYI;v_5^-4NhCk-)3)e zAnjuC#*&$_NH(GcZP#OM{8lXmYIAsEu9|{xv|l1?yqx_jX%r74Mz>~aT#>YNtOgmS zA^KFKq@_^G8QoF#?+^5%vRcxD=%oeG3zt!wjv)v)<>!Yguh<3pV-t)Ftz7kSw&9|6 z0d+>#?$c!Dea7GP4j>xQvh%F!vPAS_6%1r~`tqWLhn7cs0ezVatX!|Qn237PNJXa2 zP*SrFXS5>n(Actk{<=!d2~KSip~BQn536C&Rj`Ym zxZG3;b=8QF9NsWhEVv)wZw)VnR;(g=f>vME$bq`5R+3hCHPD)PvAYz-D)irYQFp~; zeu2M6VSxdD#-j7Gqy1_3P4;2{Q~t&0BT;5qg@vuD0ORFo?$F-y`ImD*w=;$A*C&&W z7;9YKbQmtDdz}&OCvqOJ-|q7m8oNyF`eGYD}*r=|AZuz*$(#45&xpha-FV1%F57QQ(1Q z=FP%oO?L{e*)r`#1=V$!*I6T&2UYJ_#sQ?YG7IwQNcBGF;rWPuj}AeV<96f!~>^vLRA!o1*a5+ zqcPlmHr@XLl|J*8>&z&2OiNVw*qrTiDd~s|A~rW1%?IxVQ4aK5X9$FXsfd8VO_eHC zB|qaWT3H}wZ5(oeX?W1`EQ7@(*7Ty&#UEqYS=TxDIfGS*kVTg8$xmRXh47_zX5s;c zEhW($FFNe8O=$0^o~oo>wgOXXcV?3W;>LtP*rMUaS$7M3(q*65{xg0h(*yC(yOYCA z!I1A;f#;n`Ljzwf%CqaDnbNCC%rJzb@Ji6{ML~(ch2~yEb~(6|aV(#Bh58}#G$E;4 zgnseAQ#f4;bdNlc^DL+`MMKc5&ql-xihI+Gh=W?OYcC-fNP+t8r z~)gWHJO{T`#+D z6{c6qxlTe=EQ%^!ROLbR=|a=KUwYpDS#3QiWY@$p+og-Bk_#4L6!TzgMAlRzjI|S^ z5SDL36bq?wFKqc!ryMOUkPvF+Ec<)JZt`HnkZ|ML)%(ld`PqBtH#Kf|0l(Wpg8@BK zZDMteSy#^5{5=B0vG+$L;L17YXO7E$eA=b1XAfnWL()3`q!?{s*kVejXl-HtS@hXj zY2RG(zaGRfG$=CNf0WUra_M9s66aa!e(H(97Jn#i1^P8eS;7C2x9VbR?jpeRp!-Q- zWnXwgTZYZ~lLG%O9(;p|d@M_g=n~7{G{k_fHKkmiVKSl|&zDQ&S$W%H?)&T=QM}Kd;8|swa&`P8X|3Q*_a+9C4U+U=sL-HM_=IkI~6!+em?_0QCRAa(hQOp zJxZrZHDOpiO3_0)DGqZ>Y{6zT;#e9fqgag}wm_8yXH04(mOqX%NCKd7AJhbSnp48% zu@e?ZO~h1ru~Cz==E86mI;;;%rKBYjH`4lvY=)3jfV+JO_=Zqk_gy&9Bbg7>_880( z3QAHj0aq7Z{4lVC{X5+IsjHkbjpDSwQr6*;lN&jZkS*)uq+IwI6~Bv z>WFmFOX53oq$!vzjzNtO*1W|KirN8&hA^xHWovjNI(IOAj$b1>d2d4abf``^rPPl> z7IQ7(D*&=odZI(`J3W)J%$Li_F5Rkst7H^SSv9&#zi2Q=*cJ)Hlm^X0C|c;?kD9!I z&kv8fH)v~L!UL7^m|pECULYpuFxb&eY#Z;NM%IE>I1S9;2E2>V4c(BzQQkZ^?=ttm zpM%E*h$KPv8xe=}oRy!cNlQFq9*^RIICCz#%T`qcM(6xD=r#wMa7wX6UL#wmv#;V} zVW6a{)cTaR#sHIb?-k9n3h}5CU)ryy*0H4EuKRHyOU!{8ZxP7vOQkl1NcUQn^&Bsw zRio?_lpQ+McyNdJ4%E*{DznI)ygGU5FIuLdP1dhJm9LeWt(7r#4U{S~e5worS8??q z$R(55uACmH-a?`#+FCLN5P~wdCI|uP|A2)wO`xZWVR4R>q>3tO#xP9y_?;DcsXO>Z z^kMV6N%WdZ3oIdwJpR16u!4>?kUf`Uas-T@%rLl~PWcs!sKw8rnAIKVY#_4Xs}7_UVMqxdxZ0GZ3<(}N>q(lAvn(S z_Ng~P#>6_FJU7(pA&~Vh5(Jvo2m(!O{HG*MuY(Q_a2&i-m{pmtJcowq@r99=TX#tuv~rOlOFgRJ=(1An z^u`GO#+2j%&P`wE1O(jO?|RXKuR7p2Qu`i(L1mWQ2*wrXU}BWsd=%#mwQ6nXd(ES| zQ`Aq}e9RWV>w=p3$n7vx5w4YfPhFZq%CB8+V3=TbQ@IZv>jMX&%KpgE2QP>11eKBg4*L@j!eprj z#Qere-}1E8jci24Ib_Ru%m>_o2b+Pm%OQOBLY9l%4QYXdRgo$YE7zg_EVl6d!#^RJtF`rBo-Qch!jE z7|cx7)PE^0r80=36vY0YwGHIx_lzsX)XOOLw{+U!XI+eV#vL0v28bzuH-LJ@j(3d0~H)9jkr(w*JRs)$(a82(`# z+Oej%&HUy3JVSr$^>_W=CyN+*OXSqfn=GR*e}#+Lfcc0`9Lo|%y%dO2=IR5`Y&@(V zytBS0FE@HKv!q+|PwTPzUios{Ql-LN$I<*KudfYW3JdZ257{R)dO6WEZyQ`5?_}js3Y_%R#}}&*-kQH68azbO*~sgky1NEc52P=60#Ky3i*Yi;sa+}gAXXjn)uE&z(b}h0b;6qfGuoymOnoPimVfx{9sJ~jp3jz z=L?BZPi3#4NpsRsX!Cnl8I~qFghdIk=wYZ_|32wA1-Ck7c2Pn3^NCuv)pWbR!U~N& zh^S$S*kx?1iLd0(ymeUMxqlN~N(y7P|1r85xP3U#5&CQ>xhUUc9JyFM2z~h?G$f02 zl@*6{?l70mqenDRxum(zf=I>u0kIu>!1Ue2QGS>7K$OE}><`M)!8eW&9Jp(${erZM z=UhA?1njkR6QQv!iYU#D%3ql3iQI%Se!o6Mq5gK8tcy~!*eSLO)@J{7AnHa27Ql22 z8y8m5XV{oj{_PN{5C0t|2`VsqPs(4TDar1H?>ns|4T$*i7qK0;@T)z4L{D=*(7C#1 z3>-Fs!f}#|+`nHa2h%wE31AFQp~QUPTE`YFmAcCy9lL6t^84L!H{0P~4|Qi?CEr1m zdWvgufWVZVG>Vh;4VZWNV$JZ0ofVfIqLRYf+|9H;rh#__cglO1eptC9PA%j(!|)TP zpkE@IVSOA9!qhQQ$}0u`^M#*(%i3T3`f#=K=ENKNhvH9t>n~Tzr}J}+9Wq3B)@E@0 z#1FRz^Cm14RDnZ+Jq<^Vv!AKcv(}=yvWn2Y2IEheibf0y%>si7MI+$ItW=RC+r)%k zLa_j$!~VO@c(Khl6#ZPPlucvv_NeS1&OY1}(TGDpE)0S=ZU+P;g-I(xcx587OCehQ zuM<5ena0A-qBWJNIidFxqWMvis>?2xbG(PE#?T_&_OJbMSBZlVTB&oC$FP6e%frqThBDT(WNYy{8t$nph*rh_kh|$sIM`##=d=Mq& zUD$KGj1myq?@#nJ_vHL`+5FbLPW(0>c5u&L_aFr1Y!CmFyB%_40eMol1`H#X!LAgl z->UQN?5Tu zfDa_0fdW^x>tVT6ua(5f_&ze&P~2(6pq2`saOJs$vquiWwQm6sUk}0mIm-T%aApFK zLy*oTEtTs3!w1NEHbmDj>^G9}j2aaB^dH)R|HY7pGnt0WjXMOVfiTp1#f2c-S%Y(; zr3d4Kq=zz$AeU9nr;}b-!Z({jMl4u#907I}y6`p~P`Bvd-29Puxr;lIbXlk#qQ;SN ziOOYVtVw_PHI${>Auovr%O64;<|#Q8LMKyRI~W6Mr2BvM#+j>&vMy0T1!2u|kVh91zf9=Uw&(y;frOZj=^oLSPC5l`Z21KTbq%VxhMhm}}; zPTs!tJNz9|Q^CPx#lUoP5!fr)DsLD=OPOJ~dg9Uz3Vwk&cdi3ex$P0wrn+NVwyA1b zHoX4;nN%~BFpz0Q1Au^BF)52^(fsk^EF9-#jivx9Tpre@4`}YG$tkOUrBYUDQVoVi z6yIl-Ly7hLihQhu&=~AiwK~Bwn!@hKTlXd|Y#G6PEiH3AvK2SaIx}(1I=Gj3l=d#l zWjCYezL_Sd{T%MnGjiV6MujYe2)=nykhrOA65@lU_O3*#F zIdFI^<7LVqxYxU_U9SjeX;^B5D7>V{<5$KSEzeqIC)oGAXkH}rCS!a8I!nxv*>C6$ zq?}Fv^=Ih(DWo6x@M3+i7;{FbpLj;dQ=MTfQU4>{gy;JUg@I#CFoB-GA33a~?GH7U zT_NBK&1@CL%F@5Kn{i&s8DUoZS-25JE_9c;H8PWRuVd-jV(=K!BF*7+q(83g&{-v> zudQ%RqItDCR-q4G8FqtEk=l%ku5#yX{vH5=vzUZT?2LpY30N55mv( zKNq^O?KmUH6$_!1Km(+6x4_<$+buB{a; z*~=JyhNQV;;w~Ih&+lY019cwsb|5dhYNEzlF2W03UkF zszFug^8sa|cNo9MY*OatigzY99`O3?eh8Ek}nKV(LUjkV@>Ol(N*Sq@g2S=!4*mG%@(s z2SnmEW3~54Ffout1VZp?V*TW?Ue#lJdWC-$Kz2f91QxMHAFR3Qgpw1!EX60nzt1$> z2J$Ul=`hb-G;kNqTIXo#PzvSW(@KT!{LJCy%>7g;CApoY#4C*3v<^>GMG8}mOKp^% zRYkzV>asJ!>S8R>Z+kkp7!eb$m+>f0Y8W7@go=j$4F7Jf3#4KnBh&Bm#f=OHb)NkH z{W-#M&H8OU62kRl5q)trSzI`c(gprY9!n+CH?KPd#X;EgY{kdF--Kb;iV!4LwYjJ; zN%miaY{yoG$rK{Yk%{`Xg007GsVHD2hS7 z4I%|mkUD^3&^eaf@6?0Gol!=TK2_eS6mtvzN|9e`$}xdHBp~KRTR`*?F`ghF1t_zk?EVbL-6xju27(W2wh3| zu2yukKQ^WRE*ZI<52b{B<^S2+9D$TyK);igXD-&GWU;tijRf;CK2%ue$uzC~sXIbZqt*f!1`eGJ2N6dp5YQuL*}>Oe_0+ zRQYn-4Jr)E0#Dl7btC`S>>?LU7=!z5FcD(FlW=tU`TnVSz6%MDM*nK>?qdFJ7`#W~ZV z^1kOemWUt9p-jOgKB`9;z@9C$`L-oT_f7<$X{W%O9Zq=J z5(CIgi)m%+bmGoJJ3U0*k;LJHdX&0@!ibL|9cT>2npIqJ6}y9sCz8f?{F}r^$6zf2 zaQq$Qr%59u33tipMgOYjOQ~20!si(`1Xl6%EVjCzO1g@2OLL_{QCjCY=AIuaROq-a z?yoojgKibs)*P7hX|puK=q}tO+v?&@)B&dpiHNPD*UQym*7U1H&Mn{5mWKrXtiF8Z z@;`FyQyUTAlkBmx%fYGa939+fHxYQ#TtM-$aw;85l#YP3Cs4Y0&W_-Vzol=0D_VRq z=U8N#ve*5)RUPz1jUPm>p5Jm4g?}`sUQC~__g>MIpEH*8fu?7g2Fw0(6b0D%DTAEsH0H(Ps`_F5ndgLnJ>*Vr|%>eu~ZRpJy{^ArG1k03#%PS(ybII(K9!77EnQ?DlRD{|dRdNr!f1KS#W zvz=hC0t!2Tly)Wf&(UMhy4{u!C7a0m;F|YT!qK$iY=mjC0^Mtgjj%1L4{)N0j>GRV2l#EfDl2B*(|aDv=m~ zk%%+!11**sABSVXW76HD`rHgGowYjOYrEj!nQfEdExywfFsfh7*YXq6+tYe`c2_WN z}biypneaW zCaQAcuV|dB$`31KM0(S;X%AC&3cew*+SQI)a*F#D)R(K%Y&!rm(gBW5fM-w@1C5P{ z!`0FLqx+AYG=vvWq)u0Q6O_SYb|3sgU{Liz026^k*aUJAVRcGh)!uA&t*->CttxI6 zPp>v0sYmqRCdWjuIHQ5I0*VJZLr;NwNVfNW`cMM>=&6CBxKeL|N%zleW-{P`aDGYc z7Y_SWrp$zYLv4?mi3rM&kb)Nmy?;hn2WxzmS{)sOcaq%i7sN$9{*4B&vR`PZjP2k% zTNHs5tl@Mz&+KB3o8}rtL=Q>y7hlfz=Rf4&Ee6H-0=lzoMuj;q z#q_gEY=R4toITk*uUdAXK@jFpaBTP}5MmAg*_9uVaBQsJf)t2wY*N>=pL(K2p@B`X zT0@ff;^0GOV%xAFbYR>#&?w9gJL6d4CzvNCm<`&Q;U>_|j7z9{*Aa*6joWC-0=hWrtrO`uFx+ZU~n9n!cDVX zI>{`YEgI+<3Yv+-n3$OenUzR@f$w-jt@4t_r@{8_&4c5@8W4~+cYBYD4%j09e_^SZ zj7gaS49bFp#W^4#9Zv{on`SeIndgwgf#4nn))mr#2BW4?7h*%~%@9D+g{g5^6$Vpu zd-TgG8=h-WBE&!D^U_2lyj`|tXa857k?pe2pLkv^aVx2`-882LlNY}~L)1!2u@O?b zHSWi_;0K|r<@40Vfm6D1&Bu&)xAH3ZrhAjb>99Ho$MWXonrgm1lRPxB+?@!)O@z%=gB>GMt%56#h&vcL7@_l!{fJ(F|MOzW(yT3R}c2 zCbOJz+5`C0Lm6kOzJfF`W3q>Bxos5DPlSfBf|Z{{`d7nw6{GDmpIp$dfR$)dC=;#k zo-GIRb$rL0kR6(*BL~D@x=PmBhoQ3~pAYpP^Zc7eoWZ`5Q@1YLV1Mo%K%|a7?Lx8v zV#~36KoOfgo6O8G5~GOl>E0=t_U#xHg*qh-D;w+4o!FN_lFr`%xd4hzA*Bo(6d?y+ zwx5QqvEBG*b&u7xs=xz7BiHcz&ykF;&#R0Re)lNuNEsAy(5WY|o4x(^Y*#bA?aJ_a z_4t930PAHRw{2Ya;&rb3>O21JcFk%b#r$eszER22x8Mg1*91k}uIcxJ= z8U`~JLuF%jeK=16V7se@+E`*L$)d8`moKjdn_B}>^3N!u1Q9ee1fPOR`(YZbcu^|w z2{ucrz$@@|HcLvH34Ekw0l}6+)4X)ShrBQm0~VQN%Y$GVVjmctV|uIPFTh@n0IQS( z|I7O{|Aww-ryESsqe;pG@;6Dlrnd+9%PUBb{<+~%Ra2$2pToQ=pXbsm!v|B5OeAu) zE3iC@s}k9<-GG*SsBiw}dLSG?a=suPyMO#kI+& z(A<$iEdwpC4cmVfSBzi@yfm1jTGm5kkLULsxGsZ0*g+ISb5>n3o9^51g$D0ji4v%I zRCE4=9`jqp?Kr?Jw32uta>#CmXXLmNe)hDWoI6Ve;2klQf5gE;y;f&(Y+LHF@ZN{x zZB*w^iS6#0`*Vfjg%gmMP?vz9v+ggKy^S^4LO%@X0lrW|=Kxj06hoR!3Ai?n3f?!K zbRU(G79GOvtotCP>a5(29GOtM-}8*rSdIT-aGm&YBAGB6yp`Spd_m;Mjh80c8arjc zkDK|@=8Ed^Sc;3&(qfd$GRyfXDgxlrq$wk?b%5juqoHiplFMA5e_X#F-0fZsM}4== z)6kEWmC%=ffVA;17o4rN_hvr~=;5)8n|AUzGk(AZPlXBZEkA3 zuL~D-7U1~U$@7~&{ib5zfOsD+D?}JN49h7>qY+p?rZ4nrYcVo9kEsm%K(Fu;fs$I5 zIg%+JLGl3S<%fEZ!h$wbc(}!p!aR9k=C6_*lz8q;q^EQY5ty%t{drk;8c_WW!E1 zbVs{oRb}wiG4faO_=O_jruiPUF<)zFHEY#3-V$r_-KMd>zsFzS28lJG<0evJmkg|< z;MgF1jUa6o-Fm5T&h1y3n}46USXW{*Zw4Ae+H%!z1_H?>;8;E2^B=D6WxE=&X&@mU z1QU3?Ex;jdKbkYzf&<6{ahriQs)65q*1b(c5yM4Mb)sNBk8c>a>3aI;nty;0w0<2V zJ@Gv-r3>s!^aS@3Om@ugut~kx-+cb>YybJA3jCE|WwN75;*~~HDq8FkD1cfkMMJ6R zsidYQ0$BHc`zXY{Cx;t9(Qp1l4BLlXAk&Kjya4EnZoIFyUWf^$Bu-T-nG#cc68^TX zw=TDbtr**H`=o=_fqirgh?n+F6e$fvMN<1g##U2|dJV>Yrt99tYQ`C?c3rc=Q@zaN zkhc30EFHkT>u3`(kRJ!HqPBz-^9!;7`@_l2`p4L6M+$TWK-XisuI@J%OKp;7m+&~n zu4#iAS>cZNU|&y=>h~-bNIxr}3UNsh;Bq9>mcl~*id%H!8I{K_^=_X||KG{q5ZG5( zm8m>2a%rHt(Zoq-%hSO(j*0*cW~oVU6~~#!w{c^wGR{kWQNxtnl`;;--x#l^E;HsxR*6 z2x#y82Ga`*`e;OxdHqGaE1nc~hQ~E>D&V`!Jmboo%w3yN7iT&wp^x^WRR3L&WCGNb z5O82jiY97`EqBTE(*)YTCjV79o~Ao!mVA7mQ)2T@FltnXm05+2jOOE(M) zNx)2PX81g1sLXTImjj$HXQI??bt=#EY$cd9gS_S^<=(W6C9wpMa}+8|uXPUw%qYEj zpUSsUy9CPpX`PRQ=FDWUfmoVoHWU|mwm+S=cEb>EB3EJ6lNal`P%I<^jp;EU>sj%F z%4LxjhkL!tWf>Nwi|Aq#7)T8E;p09^?8?nw6nfVRV54o7NrRi zw%q#U7qd0Q$(YKijX6l3%GLmBL$Yxfr$gaZf;T}xn=~73M21dw4LRVT2Pb$~(ecH> zb32nq^1HyB=+ZD;{_NLFnHSfqu^D^?PzidEMLyDiA{7jhDJzOd3NCYe2)Ia!CUgAo zfuQg(V*;r$)6ffmY*Iu>O;F;W??OJD;ikF9G;vbQ@gQza7_ztD-78ws0P;n`+=^*Z zm8h>ka1I4%?59m{S81!WtI`H=z^p13pA_^!Z0xH)Ql`4d&EGNA%Xyq?-V~*|)&y%} z%XsZX<=f3wYre)is|u)(to?yGis-DjA^3vJ+=B+%+?bSb5fdsHQ8Ob!6DkhT0*3GL z=taLIeYyU^$z8{LZ;0S=0)xj{NLfF!*AFLAGgf%=84!Do+DYt%*oHcZGFy=WBk$CtUB4=P{Dp|sPl^9K59_D|9h@3_0-8dU%r;eRy}%a1fC7LpC!iD>V#hWG0!C+ z@m#{d9!q%DWOXj$DF&FALYwd6F(i@iq76=MB<@r-B*?~Dcg7i4*5IzfY1Bm#(%D>e z@S&stS~)%l&rH?NxT2ZJoAMu=z>yl1b6F~ISJ2y&4l@1GegTR3|HEEa)+sb43Jln# zSy1Qu)>XqDabjwApXk26`;%5CUN6lOS?i{kmA?ih28jEwf!)`ht>% zg|(+G`(_t=4L%ejuLZ`}`j900shyOK;gn$M(T&kP>KVo{8V%$}BWixV<^4?!&C0M; ze%6DNLfahij-5779;zJqpdHSC&PAZHNPu?CIl2}5JmqYVF%ip5wf}S$-s}sKlpvzC z^2BxUgd>bpYUTyGxVu%S-3R|hv&i|yY#Fg*Nxz73w;!P{pjEDjMRF@4<3{2Q_dSED zlXxker!jb?GuHi-L$z&N!D9>gjjrNpo-9p4R8T{}9weyn@uwb!XwG5sAl);L+yNsw1cpj;8WiB#9Q zEGtK(I6p5~)unVxpS6A-ZZfkz+eNCcS-huvcq-<1MKDDS23iV1JP3)@Z)0~)?0snt zUW+1Laep4bcOJA4{~zHfECy^Ukm6tJ4A`#2lSpMCF@fM~@yr-q-cuiGMVVqrwfr1z z1|%{f<5UmQ99(gNgE?$Dc0jdjL`ms*vu6F|rkdps>3^l@?fBDi9x-)<5G908Q)H`g zAuHoCXhdV2=RxTVlm75Q{ZEdbZoAgs8u#)r{ue3H7+F3kBo&xI?92Kwf`l%6U^wM} zk6Kn{0|phye%3kzhMsPEOWZv`IB7mE09-0IHfAyGmGl#Ok!lDHBxFDO2emdVIG|b3 z#+>*HijJ&mf}*5$DloXy=OqI|7BJ9O(l^|rMtxS%7ak4ZkVah>S8LkwG4YWQT!-^& ziYDXF3$XJ6Kz|l57{=}mVuC%92OE9F$alKZoV~D&l%*tJ`oUFiBC)DH9YrB z>}bf13U12jX|<6NXCXn+1L-1Aybk*Zq!SCfAdU*66U#&~P7o#K>~A0*ymVqL0}>)D zqNBj4>{ye1awA)BrjJyNIv*M>BQ`JUkAh?LE?2GvI7y33N zY&Z~_Xxk+fB_79&88veOarbo=gQe-zJ6sMQFT!8@M7sDV-u4 z?(y~j)_N8z{X&x9|8E43{uAUC3p*)^3gQ*ZHR8g(uypbXv|{*p&{Z6ol(0JHSDBjb z0c$A8E3}VXAR@tE&=wu_nh*ryf;~eJ7ZBqj{KEy=>OQ91$Vu`{t>rw9J$IRdj3Xq8 zrG3Y5QgL1}VJJ!?pxT0&` zdZolq)pDF^b1?X8pOb^DL-94s(0?9K^}9Vj7dF+Po^gqO&lWEU6NZ%xc9BA3Y&?#b=9bN z`XG`yGsJP(xu$I-Y@pi`E@gM&a2EcmHChU)JsV(Y?Au|Jq1&oqY5 z-LIg@j}4DIg9~Ds;RM(mUyd!f{n-z5zkU5=J!Rp2Cj|NXM@&(meKMQW9wVsO-$IGH^;3@QMLo)y4_&wcjpe!9B4>Zz(O=#-Zt5hR}Y9}~Z6Jgu4h{vV@k%cQxamnnZo@z1B>sc=OF4M*|Ec7A}4e zNcgd+U~bJmfN&mg#NA59P@UzHl8)Z{<{XYB9Duvo59rdVEghadtG)Lwc z_r>l}R`W|#_C;lgN#IGzRMZFk6gs<)xbV>bTKo4ecxK{u!4w*8UcLRmF@6Z~lN%eZ zIfj#4=QO4TkxcnWj`)hCRouMN(CvJC?sJdNJsLVj8;Cv6m_K5XSPB-3fG)b1O^@9= zd{PyA%W_)tx0c5943jV>D*k_iTYOa0?xV$8^7QSWe7~v5#7npH<>(J2OUDg?l5Uai zUGrpl=0s;%0@eSfM1)Ud=i4vXC$&vBLbc9Xb9E&?nly9q2p z=1S2vFmi{*(*J4e$-s=Z-d4C?UFigz{wDap`tqzoX-Pdfn5%mK^{fK4O!{F(?A0mN z9iuIcEd^J8pAjl-t~ClMbVIy_Bs@re9o~Yv!Ko-T(!Ngo45k^O+@^9Cd6NY=?Yj=H zHe8egXWeJH(Ah({XBAhuz!Tgr4{L?|2mZwJ?9RP5OaA4=z4`CdfCN>oP6L+wi{%sy zkyAX`Ge|wT>?G(Dvvs7_Jr^0@WdwwMCwCzlEu99a1^++lOT73jQU;Kx;qu`wt|%J$ zv!@_OV^o94cuhO~XPfbwW2{R%>2@qbb{>P6+TfZ^bGc5`*C6m}BacLwb6J9D$Wn*f z9`m9187S}f-zbT4t9;(DxJ+AA9~W;csZ8^FgRk_abrn`-NJIwag5+|XAG$t9q)&_x zhe_G?@Jvztks(x>GPVzyC0W@oU8rq3bK)DlyhDabwxxa~EJEJ@e=Aa9p2=FN?3bnL z0jcJb(F#MIBFj=6)Zte=9=Cucp-xR@?sJk<9Jq|pjwe1siziOaq%zdAEHhE~C86EO zh5Al`r!&iUwKCe+Fwl(B+2Ty_zp|1!9%*Sm7_uhb*%a?Ci?Jozbvw7g)cyW%V4Eqb zM*kahna;?=5|aQt*($VDp$@HXbBy^XkVB?iJw1(g7Bh1d&<%t>aLnP{uuFf3tvF>Y zk$0*pb&r=cXTv@FAIYl0dF1`bYB7qRmNXwXQzsqHZWC+|5ANd*dcLV#LH&`f_n` z?JJ<{rwq*ntCp+flD67&F$Ya_3EFfaO z1$D8Jt@^diu<~J}D-(Z95n^zu{_#9Z>rsg4)?7^lGo7UF{Y#L#z!0-oE=9xtpv)if zXyWUQF8gr|myyRWL{jk%Zj&CBMrk|woei}u zXF#*TT7!_w_JabK^UP?O;eXU%hDEsyU*f7f|AIw&UkVjDJkPDPCDTFa2duk|0%9&s z-5;jk;LdwJkmmuyvkmfa=FR{da5crV!8^Lq4IPZ3yWRhdvn4LNxqq((@-yZxN!GM3 zp39Z#+7eF+&Sx$%UlwuNi+|QGW=q=^0!N-6g@R>lJNn5w|7#8vJeHAf9LQ^$>c5^j zoxe0F=bCwIz=)?fAQo!NHiS+_PR+KJuVcHPF)sz4{{Kwr=dAMI%ce2|g7(kXN|5>j z;%#?w0Y^0!%-2?W5gYwAK5u-6)PrX&-(bHL69`jz9@}=(!hL7Y+y0kvb$W4nGra=c zP5&lBH2VxmC)5f}%Bo-_{J7dRQU)JR;rl-XDrXS*`x$;ucMbGAV$W7xq^#&%WcSx> zq>DmA=zzi~DZqR!>GCxWBq`rm0)aF2{J{SvK4@VaZyVzDN90yOu<(7DZ%G!IuBIAi zsu#{YbYx3h8E*Z#%)i?d9-t_7>yfqQ(R#x!_*e`G=c z9U4<_t-&<-txMokkoJuA92rv^2!9LEIpq_g)hyHty0l4jM=q1;;1O217140CZYev3 zRcgfrRZX(G90?EXHfQsN^Vg?p_q6@pmY}pu*da6nj5N?tXv=J{&?m8>__KSS*74$m zaOI5V;O2a;TNed7QFBd<<{bO{9xmBnVXV4)OP_jUJIU7rhbbkVM*iXgZfyU%YBfY| z;eWS;Tu?u~Kkq+#k-K2s@*y7xHu?}F4QAv-$_XomnrvR`+uYuAIbh~q$b6YhkC2_0 zORdPo&=#h}tiM@u6--2=XhX@DzE>T3fS~8(G5@rUShK!Me@1ysS7T(tP?3wYEnc}_b(p>Wou<(P#Er$0Y?R0D*Loq17U9TpG-kH)bN5l+7!wZ~_g zsI<7})TrT1$G(1WiJr4=7QwD4ID$Pa^5ZjemrK`3AxnhM3n2&fvS<@cHr3lnos=?p z@&Y6Ao0Y%1Xs32%xn8Q6tKp*Cu4)az&b{>Ixa8EW=tA}QH+3@)30JLa{Im+UdXC!1 zO}B(^Ttsk(?H~znlc0t^cfxAjscp|p%(SJE)X4JfsQN_5-y>nF-U$9`p3ZWCY%VcbS9& zl)9(_fPmgP;!CPeh3WXq?JhKb!qv=)-JL>4Is+~t4Rvr&F{)bnh`hK2IXrdyDS5ZN zL(w&B@;}_?n2Pz5rT1t(${%Lca|#eNXpT7KPs!6JRR5$?`a&z*ao)q3bD6M{^hXS{ z^_k5auy>ZY{#vn@w{H_ko8UmM<4#JOx6HkW+P_t==^DViD$XJE_MBC?#`TV93L_d&$qtJC%%3K0-n>qUI0Ed!klh7Y|B}q z6#Sqx0^8C)p&i14A2zy;!t8G53m(sLkgQ=`Dt0eLt5s>cPzA8yh5e1Dyv!PoASYld1p)(V>R-|zl8SbSKQdh`EzQJd}(sEhQ&KrXfKmIF~CG)u!`;A7iEQL_tuB2NRPib;jn^wqK z$?%}cxML4Jp?C`O4JAHLjCOW2auUz?A27^ntdvR3H59tZI+RUh{XP^ej>fG@)hlWk zyG10#4mozwaIDaIq;7(@Xsf#?)sC?qzrkYj2UeCDQ`foFE|63Na{>NgMd1<^O z+E%VHJZ_GSgqSQvbv(DmgcE>=V<8;BtYuw-G1ME}%5=LUvTK3LRdoWB@DV)NI&fp* zJ?1&xNt~t?W+1tZ7T)rAMw|+p`3<9Yi*M;mme>+XH*w{xHk*_5^aRFktT6Yh^TGr7 ztI@9+vB|-(hnZAY>=cfWB=@c<$5?WCcw}qY_r9DL;;a{jv5E1jh=;#XeXle*z2mWf z^ZxPW^)7ChXcihyM8r)&sW|5z9iY%rn#SC1mTMc$((8!?V|eDsE{ib!s;z0W9bM;W z=W!6bKMXkaC+40f3cW#Z4M{JIT_-qKL5}~2jlRC9DJfbSLTvxRC97#6;#SraaCCUS zQK8aHJ4gn_gFKwxh9|9uAc9I*bFwiB+aWt~7SV$8x*s1}01iUw*a!+#L;7Eo2*l)WmIb}&P10i>JdN0bG<}%SMxO$J;WtqOm*iZCy_s_s=w&6>+oKR#V#;0DtaA0c;V!;7lMVR0zGs{|Xi+MNa z40ve7$xSvHTugVRWPsujIxv)Rs_7|FRoBC{tTA~a5z<~5B9uyeAz>&WIXd>45b*4> zv(naRU*A2R#nA*a(4$YOpHw0{h6i z^KI7h)6U^fpVsxDpFEG9vl>JAXs>EvCW|q<^5%J4e~b*`0(uliZBT8^nKXwxf36wQ z1!(7p916WJwcqK`*T4vQdp{Qm1u*Tj@~m_>`uXegvQL^!(&p@wE4L?P$-azOf(8J$QDe?|5`saF3QB zX}?qPx%6kjwFk}es_&k=p|y)q)3uASY9G%Z=D;$(iEqz(7q7hsEieXRhe|!3VUW=! zqLB%z{_YzkF(&l(iL!T-MGYVXpJ`*QBJ>IalK8GW6$-}5pkY&u`Bjr}OE9DGJN*JZkr6;n*ePiJqUBR#-={Kz0NwWj$mW~W@ zH0@@V)Xr;X3ogUL8)$2_$15 ztdEvk!c#b5mJxAjDzdGsh5BfY^}I}3W=fEw*$ zl^Tb2p`>c#7Lmy4e)OfzeX-L%*_smZxRM}ENHkgp(^%Pcsy*n}+#zww1s=D&o2uPx zNha}ZAx=}I;YGB~+q>c)U$6X9jK^W;FgB2F@}6XxyAOwdR8kFTR!?&9hq%m7~x>t5(gI*mN5X69Vi* z{C2JQvvNXu8~&rI18uq-NV6vw0v;7AqNCY-OC)^!ls`?Mt(`N+IhQOlDLAWm|6AT# zb8%*P>z@ADBha{wlZTLcC;sf- zJWH@Fpg{CVpr%D$j)+$oy`DWP3*DfB%CV;quRua{M4o=fJWZUacSkXFTNtEUqG*Wb z2I%_-UM_}QOCxwp?w+0u#mo#R%<>$&cjIYzX|j)5RwY#@)v9w`kAl{U_rbh5zFY$q zeB_FYZ;R~ZYrqY#ITt43M5zr zzINW1BxodJQ{(oTCW&Zly%2+jMKYO3luMZ=8PIxCG0zwU5=wlf2t2Yw-?r1DUd85( z4o%c9J+=Wmizf@UjJk^zA34WPuo{<@m-R$$ts#}EiwXGy!05-+l`fLrZyxvt&Y<69 zSAb7B*1zqhr|}Xblj`r(P=E5}VQl3cqH5LJ$77(2TO&th0t@}j8eFk}b}g&YPfsp~ zW(`0RJHOU_S@WBwC8{Yw^f}CB<=uKXkO~rDMUgYf5@aEfq=RVj3k+d)3+tVyMGuJ1 z7yL1gvMdAiR^Vqy5-HJ9DkdB0Bc-liL>a3ha@&s*0^CA@7T%+-N80Ja=wF@{=yoI< zVQIJ0%8LmI8PzVA-yHOg@hPSOV_TUtY*aLykpr>9VoscTn`WRDCIX~1vf7$N!^Slv=L&c~E88be zY^;5UOxM3D{CwOErw=44v1c8E0E;Yrlx4jJpeLCY>-}1Pi6oVjWswX2=1hWv36pg1loE^#bMyNr=?d ze-BX4z0VJcg5^X&n|T7zmJyrr-8GYMT>uLO`zvC-p-ALH!fHHFn3OwXWO${;|M+RFO#{+O_-sR;)V> z!K%dAss^oxtAFk3q&gPS2!quV9G6+KOCvklxsRXtZw|nFoI;$$Q)3lv|0<*51cV%; z(#gBplf%eHjf>M06QOe7q+ab?_QsOY!M0XGo3hlqZZMLxI%VDUl^8S}HMZ(+e&PE$ zoChZr3Q}3u3{Iqa*Ht{^cNlnCpW0olFSd`}&#Kt5YA?9zq7?Zn$lIj~n3ffA`((C} zdYVQL)Gy%+KoS$tKD&Tb-&#z2pbTPzM>dx&Z1OnSFJjP+TOkZO0kIy0VvA_|ND>L` zm?`kx2BJD>iCpuPU9RL&x z^Kp15g|WP;BsuUe?Y^xqW@QrTu{{jsd8`z1{i*=Ex#A4S;NKr~-G7CFm^$fB+-pUK zA%@b&nEZ3Fd!s4KC6$OLxo1K8-!92+E^yvSw|4ubYT;Ap~l;K+6oz>pSc4K7x%n>tn7}V17%^7RyM~#;&vfo}&pg15Y<*rh$*U4ICFu z!(l+Vn>Mw;TO27x*m?KGbBtq`A!{|O4#t;!H3l^1XP zJM9|Hd-24+2f_nkc1x|$=XOYojR@gJxIUU9wu6~u-uR0hJ_F1gJF)~9KqNZhwjZFi+#3WsfhT7=vp37+ zF$+J27DpycKH2{UnkwJ2lT8VA}|A0|2l!7lY9b zo2d(ITlV>Z;qdW4Ny24tBSI2_ok=M{?rLb_-P-O6v*f@Fnl?k0S?6x9J(dG_ILuzs zv?;>gJfsuENI9&G{(mCgc(mF&p~kF;E?eiZ@NRl4EC42WkYX}2aTC0Pyoxl_K~rd> zfXM;EFOjO5Zza^`J?@15eQI1EViqP?N(E~=6Lgh#s>4z~Cgv-On2)uU4ypN$*bo}V zKv|P#NjdyIewyu8S{frQ-JAE$e+;=`&oVgbnjNGh@Bl@omg4k*gXi&5M_;NhdpETl zC!afQDMo}$|G502z?#!)7cmz2Jc^I2`*|7L95r zZOKOD>+m3S%lnR(e~%)3U-3nqUcy*)KGf`5#v%`rL5QyKRnb87xSllb*6Lb|ZbEeU zzH!Ix!boPYURV*JmX%XhG>+AMXAIAgWw}I=^4$<~y{xD&ch1->8-@A_juSgHs~hO< z($x9fn_=CY7$7S=D1Ah;zt6^W62tYD-fIabz7j0d_fsW0D+z_sbMbcR9}2UE$@Q*d z%!Q-7`ujz|+Zr@bwg;x88)XJwtd0RB@_fd6Qbca%ndSh-f++Ld1Il5!bjpAXz?Phx z4mOjiv00i3kqo+gDCK{glMq}YU?-AJ0cG2tDwCSlbu5bnvV}=pS35pYWXK1E-F?+?0fC!*X_WkEf z{aqW8f^oMc3%-@)=qf_l2;S5tb;i~ii{6m}#2tS?N? ze2Di@FOA)tqO%K5{Cl3!JFzLX4lDvm0`^8!8llH`bCI!eMzLM?!8R%!n9y(DvIuEZ zH8_n7tuMXq^WrQ38<1rOtO(VfMudSEBbc}!BNaXBwkKw__tH`~S5j}W@*NpoP8|kI zVpZ62_YI`;Dh$w+xJpN(zigS~i27LEuZT?0M&<|ZlD}PCnumy{k(zt`{K${VsUv9K z9Amp>zzK<~pi=wn=twjxCqK%v=(?!Pi~-~Q+IRGv$ox@{5#Or=^g=86A*UZhNEMWv zCUVVLv?Y<$`A4ntq8i z>g|)eD%cZ`)8g`MabZ)}^m7CYO&Q&8WhA-C+R?MO7KeYiKYB`Iu$cr8#msn4s>Gzr zRH3ve(J%BLQ1T)tK$^O%^aY=0t&K6scm$&NqE6a5g1N3m+khPz_G;atUqUj?A#abb z)n!Mom%6P6BISVw0BCvbPSk1Qt8Tv+KQbTU#Rh{sgWp#~8x48)BQHB6mPOc-M{m|d?DLlQ1$fGPJ>bapu>q~UIBNW4;Z|*X-fh z06bB5Sk|;*^TE*CDhgXkn{gi#z_Ph)Kn(x8DnXYy5S+pY48lu?UD+P0qFbF;4MW5^ z|9ESyEF+x4s?Qk?f9)PXykj0?-2oSgAKabfWhX5TU6@z5k;1|FuAPR#E!P%cA|lz) zKqHefvCi|5%wTSju2vRe(-$QSGMNfq;fo^9sO<(dyPzw>*%o$JmiVFI6NQzTNW$!( zJ1b9tuu<9zSsOVE6?6La%p9o39xaPDGcg3+A5U^8##l|_^yV4B@qhz)lVv(aT3O#G zdT!@tXAPlr6u&D+6f^QZp9Rz&@N@1@IEju>@`+!~o&X;PNfF|o_3%T+b|B)$7YdIb z<&?@;Wf0!k(s(fLWtu`;UKQPbH*B`ksH$3@V50fm59V4~m^>mS7!P4=NKd zsrY3t=de^PUbOjuLJ1=es&SaA92M)z3Qw30&TC`>y&MvRCD?zkM2~8rVw0ilh^nns zXoysJt5bjUQ?)kGDO70pV;SS!(TM#C4qs@6`jr6@|8-%wVfC05N=wS->cjl)J^2Ei zy=LI2eMb`Rr(4;H4jckh<0&HZBT#=Shs-YCAC+=OlmH9DUrkzgr=9=@JcvO@{cUvo zk$vxg>Z;@sB zuHY87x8UoFe+PddynbiGvvuUGVFwTNa7!GqJ>2$442yVbFaAj*LEU2moaDAv747di zY)EeI2S&T>oA7E=_)*uDadu04+BS25p{t2KezY<+zoTerr;;;kDluT6syn>IpOjc# zjV$`t5+PcYqkxm`Fj%Bt|Hnvh^KIo+M>wO_KmAg$8bl>l23tOIF`l|@yOzF$RkE2i zrKH^m-trxv!jK&M-ntI-<(s9+hO-Wx#j60DMiKu89q0gYDZoMsSQ$EO4%+fpR8%h! z<#ioUfDH;><=q>bXI}GFg0FGJbeT%xVOzVRgf@t#e6+61Oyf zxyngmZUjY-ZuN`|KtD*(hxVyCq;1GGL8elsT`!eo@(~H2>5TweoNnQdXJb}(m=8rm zXCC24j23Rj^l4&4LTe74eXE37s92!fL%+fAb}-o7ciUQT+JBKu)IPnb5HZ-ab`AOHX0E!pk)TkY~G{2wf z#pwuGwH6_bG>)BpgXxK89`yT$(cIaKY0xH#Jlxr9Xc9n<(`oouyZCMEcB95gQ}0!B zJ^OKe3dfYC3^71*E&)opXKUZVAR%c|1$$7Ck5genv;J;p;i#mqgf0_|aRVP0dDt+<(|YqpM;<;oeGc(y`^YXm z%{h`CWQG?1HgZZR*1^!hBmmoCxROX61*c)Zm(DDNgAejkKo=ggfWXUATERwG6YVI` zR&h(w<^hZ%{bpBFVezq$>9vrN0o|KD?fn)YR0#Y|MHrTV`*IYPes+)p*-f_BG+KuB zaL9+_>!>wOO42W)y2CS_V*h$_K(avP5;;1sO|Trn4L?E~)GFnaa^Bk1?{gd$q%%q!c_zbAoUGrk_Fxg+5y|l*Y3srU(;Em8_aWrI8 zzlU0ow_vi9(xemU2-gD7Tsf2)%E;8YB(*3Cub$|fa ze6O)dg3D2s3wuaXiO`MBzj6RD*3Jlil`wXVPWx}uQKMwD_sx}=ak*pjTv2p2X}6wt z*c8j8FEwq6Za2sk+q7)iF)g!q&Kfe9g$BcV-hS<(D_!FIE^wQ$U;L{FE`*yyTpyuT zq*14fMuH#XO809qq0x`RP_K|6`-eVYs6$ykznDm^X>4vd`w!8{cCHn<6DkPZVdHxS z@`wNwqg&(vWw+ftg~c`Qw5Zc91$XDf8Wnp4K>hL(kCxijKTgi6li;Y`eZ98NE?rqj zbxA^wre6P$?OG0!Vka89Au=#??&e{{*N1(ppZ#1(FUeOi$>LX_#8={X5HX+DNzgw} zE+ZZ!0Wk@M4&^Osm7)yskf)YT$i8+8_sfbL3Q5+IX05OclYOl)57H>GHEY4ex1G<% zk1R<6&7$S08=ZrQl&(vDKc)-{5Hy{Z(ERPXwlv8t>`lT)(>04DJ;tLva+3%4(m7T; z;=Z!)EA&y$gz(oO*T=maP;`n-*;;t{BhbIaWf*X+DXg0Di@;J@Jbxj@hQ}0}gUA&_ zA+#N2bYXGC=1NT0S;OG5e{(B<>Q*{_(tXb#W8CMik#!C^9_{Ab)#l;(5?#U`N?I)sP|STh4(SV`Wwd z4Em#OI+xNTll8g&LNYqWJDC?=w(5DX5DGJByo%({R+@A=kuVTYd~gY*&iY9{U2^$} zalzY}(1sD?;us)h*W>L+ib4QY z743}cwJ1>UdwEyN8T7^|iXi8({vL4E@a6U!PI17Itc306v{wR-(xmn$WRm`KUaX?h zzk<#B-<~Y5X`&G?)av_qnOY>5cQ)EpAb$|!HIV5v6-lC*-!YCjjKYqzKU=TyB}9P4 zUNh$<;DK3cKa_~lM77Z2L2PI;vk>RP_=f1iC`O7)`LfRCqo7dmD7s^mWZn>&a3gMJ z@m>hs+7Eqe9^WxClR$+85eK6)lORH)L4gD_)WO%4TYEs9jkAY0%cm4sF58OKxHQcd z6ibkXWs$%D{{@2DokZt8dZXW3l`{2tlw%?EUd+-TLcgI_a*jh~7q|z_VQ@fRw)58R zUkKGm%Zeb-Pr4yoo93KdMU=rIT{CtaYuSrqyKR#)?TsX?GSv(qR8iCH@ z0#$b*@z%Bi)%XDg17XegLxfQ)q2eO_%@Ic0Z~Qo1gYwjEss56NrX*0{I3_1+~)_xK!ERi z0@4!wB#B0E{E+b^O8wFe8eZPGl6Zm<+XpG84#mS?O1s&{Kom;4hw-;+?LCwJtTF|WUaO~~~y z3X^5+(UrkycKZvzCFDAp>W)MzkS0}g?uSh*%fb!usqa1Z|gelAdM&`vaUuoLLakY$mqjeyD;6DmkRciTLIo`7y^KTn|}lYbKhVv-uJqiv=~ zCsEVpP3?9$&N`5BBgY=%f6gp+^-v1irr_s{wyMREd0ZrA0w9j|##X|Q$)h`isFaeLyzt!m6Fje#eD)n4R1 z*q}oq(D>d54wnxLi_s1UlcF5feY3ae-pH+>{$(wI5P;%QV!*6VOtD=JX8QmY(4wbN zm8OG}TuR16|L$m%Ugn&dY&Z9&8Kv~Z-(4GtAoxz7znxx1TBwMI!$PBgq%u!TZyn#< zK8}{rhawG51m80%z5R{qekL+XTGh4#A=6w|D)}Eq!3ap?%@Ke_OJXI{ZMai=MQZNbobPiK!P# zFs}t;fNuJPAq4d&@>3KAn~D8^pT6Q)_vG?fQS<3aS5*zTD8)U2 zXSx!*`LBBZRQne_C9Gsfj_j(w=A%yg+{3g1>$W-zH=QD@*9rR%gDp+ftDWo7@$VR^ z-Jj~`97aBU*-Gr_*t8X{cIQsXFq|REx@2Zv+6Av=f%#na%t9b z+?CLzTFoU{CEew{Y^|LI)0swXX?Q<8jMC-2ccJwjTe=8P+f;HFtK7iu=L5%)-OFxkwda8N) zL46)f!eVxudNjVH)R|`m;14&3v3ytRtL1X8WCe~21sYl^N_Z3w7)PLwf6x3TA|5@B zY`$TH@LTP!FK^;mE`7@$J8Diu_eMOQ5#)?S^&dYZ@YoiRi?7#tSM)AzM7%8gTgZAb zj`1~TrBiLGh)3|^&cGlQU4b}#A`#{Zo38jl^53l8y)Byzz3wLg>wlkFo^>761uPFD zz(%y2L(c;aMm!+JV)*ema?7B)lGgFs}gxUxmKY6XI^3~dk@ zK?|Bim7Pb3+Nji%ZQDzDQOqvjxDXV%-eh15b{kyb1$AE#7WGEQWJ*+quPrtPrVzCA z&&=?Rh+7e*Od4HE(yq1<LfvT{Y{UPO`@h&ag+@8Kk{3OXrT}TFaWrDtMEFMD& zZ}I-GkEc=$-6s>ap;(`d{#G0KtHVNLDTr=FTo@~5(n({8Mn{`y1EEQNfdHKz?t9-Q zE|IzRMV7-DF1YStR%x@HE|i1Fzk)(=PgNnGFa9^5X~jYhTPYicCO!2J0?HBQg!zV& zhB@?}mDvi158SX5Dln6#4h;K6yaB32u$qw$N;!Z zY!+BQH%Z{&-i#`H^omol92>-mi>Vebb5WfUJVlL=oD3N4F|ry<}a&U?#Vf5`V)s4EGaKXQiuJ&J5~v1Q26_U zb!_g|8Vya`Ek3Lv=oEs$R$CQK%%ZXPzA#KH_Nx=&7&G#GXjx01E0Bu+U02DA&9uq?11nEc+QUda+U@OFhM8{OzsNkm&7Ri^FYjpv_N|z-R85*sHILIjS^TiZ(a%X> z^uN2AYWx>(FB(=nfb1XEs&nt$DVH=foZ!8nt8bJA#=`47PW=Nf!lQ}~I*|yO6WB+QF-;Cn@nibq2GLNGx zw`HgZmvjS=dzzI17oF{+hZmnz z0}l7nfR_`C$WceeYI>`5CgP6u0POTIeB2q@VJoWr)Tk(?TBP35OIJNqeX zjawlu4rs~Q@oDgX0X~S0B(st0t>YSj`r#p96RVi^W4Yqsp>Hs8uod_DZiRh&967d> zja)ZW(5t*)2Tq-40e6SLl~&S847&He_VvClr%;*Ok^cHqgecxkacf?IdJRJUGdO}P zMTKWCNcM4hZDYacU=vTzC&GZ=OF1*J8Wwk*yhJllF$QBVJu@zGD`WwYAv~o(0vdcC zq7UNjdwPd+6^#BY#XWZ>@`eUkINUkQi795o3d}J@5~8aGJ41MRb&R~JuY~3viLY;| z@`a_QqpcRIt5vjcFx{^GEn83>w||h4^IF5Ywy9@3Ue?FOe*vYl5kWisW$0h~bSl}O zfA;oPKhH#CIbGo&5Yr>kyA?2j{p0UG+4MOylOVHy@*N}thf>``RfjVy8nz@MaUVVQ zN8cWfah({?kB}Jy(=+Z&TeWV1&8hBT1=+P8F%T6WGE*ZSa(7qu)&v`ygGi}l^<1Eg z02E>zThM}|=?+H+2kvENO$usmvDZwH4VIA8TA(bN+MkHmbAj|d3Xn^Q!-?fp;8!<( zjx+7vXOI0wV}i7r){dX0Vnu{O^LQnv{xMi^!-e}1}CR}ohihzO^Rn1S<^wvfmwNjRGV27(JP1pP6cs_qvWIF|v1WW&(5j-9~i zD@yZjFUe8jGtHbsa|}wqo{S6$4tRdbkBywD6ULqPmJGlrj*%PsxBH*J1_x@U8;+XG zt8B$d|9az?T1Lw5un3qnbq39wCk5qay07Uk^H*Ji44}rGa2?#6kt%cLt1sj#cIyQR zK_)Yp3?k(YRY=`JLIN(|$YwiYj!q8&fx&X%79}{)1jEY|<7U`lliZ?f+Ek~Ux8!$| zct6G@fwXa`tQ(xC(Y(&mlkUN*BrdeQMt8Y*B2zDmpKjqkRf(-#=W!}Th>G>pK61$Q zyu_P*9I&5cwSfsc0*?t!(O7QV3I~*bB*Dpa8d}3p+rmPYUn{+>DmlAO4;KR&DF*Lu zZXqpjnvz-cqm+$OvYK1W1nP&0G)G5+j)tz4i}_E^f;+}4n!ehe7!u8=N!w31uT>3R zAhB>|45x&v{PY2m9q)I{l%I&u1)yRboym6^Qeap*CgnCWq-bMoElpR2$ppxAJ$Jda*fB7Uvu2gu+t>$tHZO(AD^51yzF2u? z=G?6AJe@oAQs8psSuU;^99yo%1@2}RmIN%D?Nc( zn;iyC-Oo}@=dN-dOx?S^im|-wUX~(Q-=ERp+w{K1ge9@`6EqpD!+lTEvUe%ZND+IN3kv$F^x5?b5Uz?X}`5n>zuO@Y3mN92xOvt?X zkPS%**6Y-Mh7vq;aCjO<(hD{+jvsh8TIdqW=bZr#@}2jViIWb8G=t^m;mT(d4!A+d z%g7Wi(ACGAR}HH^?53ETRcU@Z8#dHgEA}muh$8blYKF(O`>AxIM?gmesomv6l9~=W zsV;5?ORsq(l!(Z3Q(O#PZ){2DUlFmzGQVz~+=t@^c~GSB*o8bOrl!ziW^m79tx+Pf zM}JvW6)>CbmWxoce8VqLG8p9Dhhkjm8_mc4jRGU!#u%Vl^Uu`d;PB8`Il+P+ZVUyk z1%wjIMcF%r-$6o&18{sjDUdx0id_hT$44|e@NAA@tOv*1VpZI7mDZG#r+HJJU!-cV z3o%rz-g*{wUhPHqf@r63Yqiw@m+8kuJ{jzg@xVOmczAVH_9~QK;`^sZd$?Kl$}QzE zq)>^9t-GA<6I(y|9R8Ow22pth3``d;>t5{Q+T4sE~JRwU|y6RJtp}dr;D~t5QmHU8abhrnzf89Gxd@MTz{veVw#>Vmu>7z4Eo^oCDJMCRM)W z8z_qw^=Hg$K0S_k=20#Q8h213MdBD|!L6J%7;j1ZkQ#zefU& zheBEo0K`oPsJwUCU-h3J-5-p(A3{VNn|M~|4_BtmRm7h0lW7i@D;ieDaB6f`tu*hO z3SWPN1RWIeRsVA!MWS`wGGx3MoI8t=|G+plL%X#Ue2C1NB^?Eo$_4@E4m*9shjTc{ zfuSmA6P+#cghvm-_GsG-f}JEDWlyKOxg}UBgoeVzFBKM(0=irR;+dDEwmObP%ud7_ z{FCXH)td|RHH|tw8RwnL2&dA2;J$d0FNuiRT!zA8r&Iega7u_ZTSUO*&&}~<{(>6o z%J)yZ&sA|)zP{Fg9->CZD*!1EW=Sw$w!n(b1JT~Pu`;K$E;7$-50aY@q|pRDlnj%gWb@Y>19^8i_F@tnM^gY>(hEcXhkM}myEG6e>eWz= z`5D6GaUo>T)alc!ZmkOc9<-PcOkc5Mmz|A`#KsE7->Mt)^CvF;*I#2HNn#>mcb6fF zoaxjTbCOrGnD##T9=PqV)P0U`&~fZ(C5ck{uJa=cML#Z!m8n6JLd;pR&0;N1ZfB$0 ziJG+GL_EaeUTrP&xKCIRV?Gc3Fn(}7$!64q#V9y`)L4Jb8BXvF7idblix}SuLz1En z(Rn*Vo@m8Nhc3iIx?-q#+!Wq2f<;AjY2ORhJ0301gHjezML%j+gb2K%GEM9!iF32hIKfjKZn47Ro|iu=BJYUL4{&aPh9fwCC`N0C;Rgn`<&wx)_p= zLpv9fLH2)md+VqwpXhH?MUh5Iq(tfN5G0h8&I8gSaL7Y3_AQA^SgoMO7NOwwi zmv9IP>F(w}eD7MnweCN6y?5RB-hZC;dG?ywd(WOd&+OUrJo9jPISX_7DiS78leb9e z4t&Y{AdtcE?jsNFGhtY47o*;eWet_O9DRf}Dy(=$LHa%DupHKNQGxk|-UU%YE^WCF zY#ljq02_ZC6G?HD!SC&era#bsDJ7l9C)iq*R;~rnrDVRL`BS6x7T`;zVt_c8W@sUG z2nVa?21(D0iV>A(3K)`fQyeE*bhxd20%q8T;+iX}l&sSE$1B!fe;X7Q`hT)qkIf?s zaH@dSjxPjsR8==Sj!|&>Oy|b2Utlfav#5uuZ8Uo?Ekf6NtOXAJB)hPxZ56&9Qc1YQ zelm~Q>?kA;teWWZPJ1qV$OJ?pGR7`SpDX^L-OL!ZIQ-p+_c_+O_K^^bs4j81Eo2uj zTb^Aft~9)9Si$|~q(im^46m{S1C+=wM7@UkI2aXHLY<_<_tuin4Wfg+V&z&ubDvXf z{~U{M8b0RMJtR3p%Ro&u#uC?pM|eundq3d9Tx%hP1)ne;iWTpD01nPnp6}i6mvS6@ ze?nahbsr5fp38pA4LXi{D^`8r7n<34LeRA6Uh4qObGGtCjvvPygGPB{)RmoN8+!e3 zniRW&?Sh%_lMw5xJMz6Vyk|r$%sR+e9RKoO_ANNEx=Jx*tVIw9|MGuZgBlI&3C$`;x zyF417E6rlRh29W!zj#|^^Py!SgVn*%3dcx<<@fENv*w#q27j_cUA2^bK*~v&{7aoh z$Cs|g+_0Q_1!=9PHabi)E=hLEpH;?QTwS7{{ZshbGpROM0}vi9(oaT&w2JIy*hGv~ zCA6;M`)oCO%~K@UY!AdY?+8$(J+sDugAVWYpTqlW41Eq^WnD}`>2L6Uww-~#sD3{qsOCw zuTI0qB7l0lwYjG5isSdA&!ad-4dl^OdRNOinqa`iA;BdVTBsZp93p_Nu(zodSwGSa62hD(5I0+E*17UkYLej}ZR&~Tnnx$s%Akr57QlZA1 zoWdqmIEOtzHruBvmQS2nv&WJ9KfgK@EWBlP01VY}jHd8OR`~Z4a@3dqus>5s+9lSQ zW({BG=<1u(R3lXMipBiNF;?(3tiwRPqZN8@3H&|X`?mAqKApOsnD9C9+>7x%oLJe^ z+l7?tf~T?rCMVqYBL&ID`>6-;Be>i>E#JG>ONfgXholFl{_1>GITWA&*m~Sr4u`UB zh6jiu`R?^r)lm3LEYGPTrM}@~?+?8Qfnp1=O|}BdpGpOVT7OT3%BGClqq`?RV6tz6 zvwVhzw4QV9eebhr%tnSU>;pruTu7mWAUR>lI`Fm9tSAJ>geP~uZ@U}0Ry zQ4I8R;VdnhuJ!0W8y0v6HBT^C-_QK4@Dy$xk3j&e@AEi}cqWD;OSZNeGe#Rg|v zKZ(iyOh?JALDb(@SyCiFex;CQ^VCKNQ!Y0P@9V&~%959d7r(qjR!cKadm)^B4YnN> zK4o5R0Nrl2lyUEuN2C-DOOwB;{Q2+cD{EcZXbp5u&eu|q%_b^LE}EEGKmfx4JfkEz zFPtB8-$PB`exew|?hA@rwkH0Uq+6Z#Xk%^jKA)>k>-%x#{vPC?BT4SvCpzuWKWR=m zKQF|V?nU~vXc4SFAUVV*gr6_9SgeUDX3(m%{Qy!tv1A3FWylW9yEtuFIwb^Y{ps`d zuI@`0FuZdv2|LjNU#sBFd-ef5FNDse*RPoGl{ea*jr$UOt#mzmYD_)dDCP4Btvecc znJ_M%(z1(h@Vm$!TuOmYaRzB!9bT*lT!zFl9LpROs|*=KpQqiLgKVJ+;_p_}C>hGs zfwEEtAsR~sEmu5KnN~WVqF+33>k?Ic!xyVUXCLPJn>-kzD%}4Vzk6?GI`!@4Kyk?M z1gqjyo=4c@g)67GuUsw2KE3$c7INiipPrB=Z|j_}ahi<0H_7``Ra zn_~p6<4Y6Hh-0L_JtM*iHx7-x`U8i2D{Vzh730+FW;64}>z1!TZmw;HmN(B*^&V+$ z>A_!;z0~h7243;!7#j6d_P)g_)B;mj3#`D%UR+3WJjL(_ElH?AJ8~d(5V7&N$rwDl zbQjAqc?Gqen!-xS#9ghUJz)zTEH4V49Tnilk*7(D<$S{B+H{JHYRh^O3`Xq zk$p@S^Lw^Zea^zJHSBzFEY-i`G|;^5hXK#t`rerq57$j_;Z}bO&*8{d$reaNU@)V| zzE*+@N>kt&&td*^0Ea13QZG;MoHUZ@cu7lu@9?-HMo{G~N0^%X0Qh^8JUxvjy9gZ7 ze>N}E1TJv^J=a)C?Qi55CUrRmZ(#KGp5A}4Z^d47N8yTrnTm5fZ=8n=9xr*Bu=u}+ zvaYuOvE*f!QM=F2y%CuEVdQr#*eT@0Jepttn?Su4#Lz5!Kcyz@`&QY5=2|-{4eYHS zc8b@>qn1e}?dh8;B`raY`7~mmcG`cJv}V0)u4W+yYMoa)Gc)d)iu^wM6x{UrnZPT~ z#Y{U&oJ0|wXu3zSaxr(7i|BBrlowhr^3tezj;u(77B}s^5d1^n{VimG*_#h7^%<=UFzk|);hm~YI6gfQUXoE_<_`Er^6Yij*bijIh&y}P$E%0$z znD-~AjOVWZ3f@`mXbiaOsVe-{xcSYMr}U-ZD1uI<;rGZ5-H^0+b9TmaFc=`5mJ)wO zm?`pZ8xmFavX-ql(W$R8eeIU?axa^z^xn0Y%U!o&JkDt!8C!bYoV`y2im}Wbt%xGp zT}yDe=k7c06 z=F3e;dwDLT8G?}pC~G+c>=yXFdCB4H{RS&_Bq*fwQSeZFyi#m{WcWi0fp0mFNC+6= zj3U*seH;akgFh)?NP!Q{r*gTcP}8qK3oFOhq2dxp#O7_Z`NF7~6d0Owh;cCm7Z%i~ zKAchiK+?w0ZVolKa9?-ku*f_-_<;MF+r3Rh*0QB`C#73SZIq9OQt1TQF{12H z#`m-PsuEE*+uI*%zK?Ja7PJOZ?HhXfZy!SoUB|F_({`Uv_0G_X9ympob@i&Or&^;j zMJMXMS`-}EjFvwO+lgsF`Us4o3!dp6itr9pUiv;#wY+E~HdQ?-Cx>#`@9z~`pZEw} z?z)WwB|aXpc8obRYF6M$pIyc)PlscoQHdc0Y`S^K30cPeT5ez}K@re(>fkJu1`CXH zCa=SEdbBkya7CdH@@Talfrt^L~RAJm07e?z}blwkVkjL5cee+9aC>(&0{ ztLE2z#|LeMGF2BGz+)zId9#rIHBXWUV)GLv@F`K(<)u=u7+oIRtm$m=3U}Ei1g8TO z_n+$nt=HvlTM$@k(j4?rSMngXW94iLx5R9#@t5rv!!6q@+b_{A0qF#1N15qQ{F_9y z8E&>8siAhylV!c0u5GKZoci*28ACBaJM?bI8gFwb8&t^xhLaYt8?}YNw;)0-C8|vYTS{wbJVkmCb zKh?&0+WFbry!u(^GUH#g4ulpxb*HCQ2tp&{h`umiiIcjV!=5x#1&9<{pC2#zPS7RLBA zHGHb^FZ25#b7UQeMB!iUnJ357tXVyp{l4L0#*qz3-8(5XpcGM?UgghG72O7-Y3smN zH&mgl-otvMx)wb{)=6$`EYhb?H6n9R;srk(y#CGfaM6TLaN zG5Cj3BNEs}b9KH_SmU>KYLV0AlYUxuy7AoJ$H$wK-y+?90ql@CzoZap`9f_-r(r<0 zmA0na#a|^2VTi$6?f9Jgacxp}7qAujJgN>E2I`g|1QTL}OW{18y=?a=zIq-X%^)nrJP^zp)R;~YYPc)F2sc&Eh>0# zLPch_f3H#b>qy!QsL}2LN5diZr&@i{?+$&x*U;KaTEFs7cR0g6bR7*9(tB~-t4t;8 zyeEMa1-FG&c`T(SpJs5lX;hThPkhv-$*rob$*^83w3!~7gJ!GZg4;uG6N7PMdWcb){p60_C zMyHr~N{Y|O|7-6ZcXvUI!d3^p0W8b(q2gYb9-~S2lPNNp@40A^^6m!;#?aNFn7YzP zuJU!Q-AU~B@mhe3tt?8Gs-PhL&>NO>s#cwm3btnzY!8D%1br$?cQ>uej2Q2+y*Z7q z%jvh)n8{`YX*7bVffQ_^uGed|#u91k;zoNblW+E}Ui=Nhr_AoUh;1~R-(IxBEJ2zl zeC!((Q?Gd|!oRi%94g=TEE)-DMEn{?FGnqun3aI)atk6vg(8+Vq_E;`OJAje@R8dL z#E)hg{WVyxOpCD(Mp>vov9g&pnMzV6Zht988K$saN!ZcqZ#K=1NOw6XFnq!Rf4Es` zopUi{Io>1qM%QaRwQJwCHw^5*&Rz~$QD^wzeC1EJ9v$6~{1NRkoOMLHIx+@1{xUd; z4ET}p4{Y!`*x==^UD$d+N&DAD>~`I?(9(17k<}Zxf9Le5 zYWF2G{K(Xk5;o&1=@A2m-YFVUQyBkrw?P#{ZMJ9m}B>UF0eH@1R zgc#l&y6>#(7H~HdenJPFnoc*Fg@JD@$9S);PM~E(x4kN=Y-j&A)OpX>eFsUB=V^=1 z6P*xiyRPh?h4g+j_7=PlJ=nKWjUkj|I6fC38CTIevVP_Kl)x-kExay+Y`M_p(eNB} zOx`H9edBd2c{1(srhs0-M*q#D)Q=^D#ryv@(4F-|adWZgrPZqp^gp%p+$P{!SeQ`l z^*lbUR%2Sp@KK8IEUoj`G%S&=;rQl6S}@XVs@nhg5dAgA zFnfbwq3*P~anTJQ^Jh?mH=wmlPZW~BseHgi>PH-v64dHCii_}Hdw7l#eOq2d(V!Uw zEioP}4tbB*4~i-~5KmNa@FA0Qt=e4tpnTFXva#=f+^gdDjwwZUw#kby%JPy`WbYj? z8EigSm3n1SNkVh(`6joEnH49?mX(c0n`px(RZVj_h;;Nj&9v$b5~w5rpC+YaT>2bS z{CK(N8cCx2yV3I}&p$<#1(07;YTe$5GuTK{3%#!YSZ7GE;urrRqQOK>I0_uM9~=5! zWzy5C9g&`6$<47&l0s%fGu3!v4}0GUZpU0?I4u|1P=h_vrih>3{!zS@Z&A`uvUBEk zIaheqpWDfpeU^I#Ac;)XBKs_)|D&{*gAVLpJhhlXJyJR6IiN^tm^ng(0Y6P=YKZPY zx8gJCIBbYw_bAkKkQR=zbu1>4#_zdSPqE3&;e{3vgy1l-z+@!ze`7SnT*qA zHuS&y{+d7copUBRo5Bdx*I5KLdJ|tgedT?sTxgwE!>z+x9YCg>A!(+WyL$QNhL85H zCtJ0arO89qk@fk~8<}djE?spOano3O$!bAH`iO zx%rF&C#V%Qksw0;Ch6_8s&gy`aWD!=PkfxVyL;AqMFSe-k7^8@i=@2G(5t07Q*GAy z-3u|!vW%vsqK#c}(1L4$)QyFO$^J@}R>`kW#0_+ZoTIqg`msZ3u`f^`f8{(wBfbMW zHHj8R&n?}Ync55OUT#hFo#bGsuI>5G105zS=pisNT#_};Qx-j{&GVal>Sv!It^e1W zhQN;sfXs)U2xUo6*u@YG7TZ}N9(D!!*}_z1As(Ao*#zv7UY8xMgPn#PvH*ear9VV` zWwEi&OfKu{ebp`@;Qxx$a6A8kcGi6>5D<1!i%nlTOr-&m%D^b8FoxXAv=r!4ij{3h zC|nz@p#F}bw&}9Ab%qjs4SK#`DKz59D>Ppk{X=5jqt2tIzHI^Ksr)3)B({^P_mj9P zPWXWL;lH20g8AZA5)#B2%DOU`Jxk8cD^n7^j=y_H=NDElJ@9I78(?AHt~EyD$m!eSo<+ww>$W+U-Yqq z(_Pv1?QKTS+Y9OB?d!%taL2nx82kO_Cu*mvpwd$HeXl{K0eDJ8{l~;Iy@H58mFo@g z*fQ!;B{f{9wbWpgH#2C4m!(kLV9!u%DYRI_T4Pgq*AF*w8x3Z{On^$nBJ6C-{FxF~1y zE7X-E9MS+tP4{kjO2%rtk=td);KiuJ$3CUtOU|z(tRanvXO>dotLT>te6NF}d<{*w z4i=3~CsfIsJz34w+wJwkrC&1`juU|MGD}QaqStk+j8TgNlfG&#BLe6_3qMSh~!j`=M>RVrDO- zQux|^M?yrcl5gj+PhWJWxunv!%S4Z%Eu^1Fu^*fvp0r^QyC%)SA-H!7RKv+OOZpR_ z-z2oIHFKsuCLtiZ&X&ur5g$G};P`BsY5{qI3EHiYL|$bY(Q2L3S{Oh}*v=R3%M1*B zl3mL;5J~a2#uRq@wx{)IkUOd>iEADvT-8RLlcmhE@B5g+a3x?U#%L9J^hH3H(L(px zzFRVjB1gTZn=0JEWA-Qz#pC*>1p?4K0cUz*y|U4G&wLs_fSu5!(BFGHICbUoO!kd^ zW?lY2^J%NVHLkMPYh6F1EATToYu#c!US=zN7+=e=k{!3*Robpinw%fn!P2dG4O%YK ztY4LUc6m^bPIUTy<3yw3FMrSD#eAU_CrcfNFHf#h{gp%hn@;=iM4eXw8!eAtT>5pY z)E^_c*?y`lpgU?crT&fgl^zWBVd)C;gB&+Nj=J+8$4rUoW{0uU(YeJn$e;9$Fo-1G z+llLC_B~$*dczgiP|Rd1(!c_JG++P^v4+9fYgZZiQr#5=Bf$*N&&471XWe5VD~D0K z?0(g!3rB-`FQg`b`}qz6MST)qF|wbNGdDQg_-CuE{G{M6lU?h|;d4`+d0!r$b@;`! z?=tfzR>{OK)GvpLQPi-LRYV(VnhqQv)}_!~C6|L$ju@uxzrt)+8}6f5^%wr>w7Z>V z{$g|uqmfUh%>$3P_@&mmxcnkhdvdqja$Wk}Q*XwCTh`Zr@}h!xckgf>g2->45c=Q~ zA$swNE!TCGn-s>8EE+NR-2U~XyPAmnW=fkm!lPT8kk-S3h&OE~1zcXVc_z6?$)7;T z>ySdSHL9_)^d%f0@kFTd2;Gv|b$%ke2nkYSJt3=iT;(RVmexNoHFl#-=p?*5MGW4< zPe0HI0}oc{70_%A7jrF1|5}|F`e|z=vzwGm7P*}>bB!*V8ahue0UC;Pba+hDP4#|- zS6}+E?~@OiBShO)HaiMboKH?H6sy{k;A zDS7via(JLG|8eP$8b{3wuv*D1TE6G=oyoNT4u@aAABS+=RMsf%j!W>Hk8fQFZ}ZL` z^cx|@YAh7RX3N2dXl;*gG&E}FPpwd@9yuFJtZ{KOc?AqfC$N|-FcpVPGsgTPJ<4P} zUJgDA*1ic|+MpqlV9@_-#N(uW!AQ>B(;CS)*KF^GhA7zAnT(#+H)T{^F)Mns<6Ua>Cx5M30(MXdfAh zzYQyS4nJpq9AV=AVLgUwwbzobndn*8P{PRjR` z%dc?0(ZCNuA~*-}z*iW1w`-}HxmqW>&!-y}Wr+3-K>otXax)gyuac#KXnhu9d$(P1 zmejpGG#;+&=4Ry(!Kf(u%w%vNy>>jp1c^W|MMPS`=bsMmC{)F`2sHuqv$G7u8z!k< zj1553N`G_}0y%pNnFY2l%pUU#U(L4RtJxg;9x@w4Z-!#pWzBk~N!@Y}?JEj7*s^}^ z6$-kc<9a4y(>=5Z`qHlmCr8C%@IlfJ11cIppI~m28{)2<&RCVHWXYlTGC*N!tulwQ6-sW3go-PyO(Nm&WET zdod`{+zn%0*-b;;#CkH8%1X9u8(V8vW_@U5F_fjv7D(o)uWFZCW`}-KbiQXh&mE*5Vh0{q;eN8uGFxJ!>-Ly%wLN3PTjbpHTrJxw$so$tvu=@j zKa3J}GN_Py$xJxAuo4`-$Culmrn=5fFB1xg0DdnF8MlJw^tzo!6DzO!U2^=go98YI zy{-6o!aOI$VsXRXGqAZbMcR3lufiG4Wt{Oq<2oayIsGM4drnt#Ii!V-n`}jp+{miT zeo{lwE7egy$Um>yR-X+t5@ohTs}z3P8gdAeq3EO$*$d3fREY4qd%tYlKCuNbfS;#n zhu~kpYHE)wZ4XSKsDDBR+|ie4%h(ov-=}j{f$z8v^v=2>4RnXcOB^8xxRJ7+HXKog zfd^PT`*M^lfeSY1UH)jXdiE72RC26fU2XhY#Rm+ez!aL<^^dIS5rc9d{e*j%);@WA z#k6cr9DhRTY}3#=zUyH5kgvY`frjyN!Cs7#Mn?yqUqfm?YCJ=!+^~agwJTiWi;D|t z+=->fR+JrVOXhM?ee!nL2xUIHAzD;mtvxB<+8dv zFE^pPCl zaZw&rt+ol{a+%a!eAc{RN~a3t8sSAHllFe+uy!?4tn~rPdPk%hdRbl)#&Wq#FAR2w zk;w`?y#kzO#)eWgbloh$=cJooCZ}^{A@gRn@|yRKvPKg>9rK#K!-0)v`W&+g0pH8* zIY?cK_zUr{R%m%+V@EFc%>f{3v>gwoiOtefvT3`F2be8ImQz>l5_ueHTQNCG{QN?61KCIb&IS^}3XgT+d-(%|usv78UCBbfmAEWI z)S$oj`O+#%*rDB>6C6d=*qWO6LrFk6()gijKgW=}l~ z=Ci$%oMhw)h%Z0ELy*ewvZVxBBR7RC6`sib3e$Cbv+HXFv&GJQt^&d&dvepCX-{MF#hNQFs{Z@l{CSuJ!&je~ z$X%_~Q~sB0hej-JNw~7|Ix0rLUQaGpj2(?c{!%ClVtcwsMbls%&&GVHO)2P_F$OVW znMQwnn{JL{^uo$L%LGDLGZmbt*SmWv?_C?j=)K00E4nr*83kw-Rw2>}dv7j7N^*~j zug9wW>#s4>Vj+ca9H@L!P^f2n^hY;JbBf$1DGTt9#NSZq>Ym?N@hd)sDm7IOaA z{=xyO%Q$|_1Z(!;k>10nX7&^l=nC8O~+Fc-mcoIUzVDbBmYuRhu8B+g`s7xB~2e?BaFu>ez8 zCeEX_K^DOQZWfFK3?lnQMehUaqP zJCjp?iQS+YZ`KdTTgVx=mleV!=l^Xp?`nP+H9x*?oE+b*TVdjM{AU)2R!I()NY(TC zZZjv77>QT<{LSMuXELiSub({@a^y5MxVGp&f4_88mGG#bNt+=m!*O%&n~AY4Dzt6i zGKLv-UkTQN>jy=P{+kP>LfJppibtLuRz*z7*B1QWrdAs3ls0<3hUXz3?7Rvw(G2s9 zyUv;htFLvOli>0-7_0>6MMx!*Yd^?LQdn~nI;yRJ_mlOC-joMVHcyI_h5w}%k5>&T{_ zw$@dw_at$4^0|IrMye8nv9Sa5x%}--zb^Nm$&;`9CMp7(VSsnfulYiW*C&VVB{+kf zlD^8#=?0PHUVrIT8jl7}KP~fde~z-NtAy3D!8r^3ZhpA0t3|Sp)y@+*)D|WuUEnvo zs6mp;fV&Rqmg~=0_pzg zM6Z^1)r>}eq5!norH8pY8f_!?^9gN&85XScO$2;O+;w@NU8tPbNq$mL_Ch@@)4iD- zV&rX7Q4u~WavF)Z{k#S_3+5+>>1->NBV2-1ZJk8#H4QJuhWWojxaQIMlKG|CAA`%6 zBd?@!aCan&y<#HgebuJGTRTeDOjSCVZEl?I;^MS2u<2rT+y(jd99*GF=#^Pqh?x!P zmNnIrL(?~L+B`T})9gn;Hrbv@3exgiwpx(daar99zJ8i^@)AKeBI#dtG;A79p+R9x zk%r^h;L_k-jGzHid(GR`0h1wuoB?e^mAG63PB1aAVGOMpijmGe5*1R>sA9@}NUGb0 zv$sNH1@R*VIpKkv_{0VUGWw&! z7>c->M*B&@wc-^QzZSS_R&EPW+35@PS%pC_|kAfezs zjJ|*Q6y13${~D?r8a98`&wc$-5a|HeT!oRZ_I@Mivv`N->s2>di5rShnyrK|R(@WD zTs*7#F40@TrpP@}_vcqC!XI}dLrcnGSBxTUHEsynYwnq5$~TN>@gCTsJql~RNihVL zo#0i;kjsy0=PQ`Um4_!~Lh~M6jQfQM^x_)_GpV>$1C9&6h>%LHcDn%AB_XkVXeVVB>}X@!TLh^N^H-FY_`sqhYQ^}Z&W8N)OV}#KTI4`8c25*1#V~)>#uig;~`>F*=j-H+Ie=j(Gtr0F` zA~1+<%XtXqUs||agu#Twwq2c2trcU(5s_d9mIM{-8gspZWHTr7gSe~k5o9(p37BJ= zaA``j@||&Mah~zxA9nY~_FA|u^q+Cxjg=!aOu!V-i zmNurR8my3a2474(m~smf!31O8kggyb)EhBOZd)&7Qn3BC@qO9t;rj{{;EL`iw~m@{ zMa?eF8bN!Ps*c`YTby|K3G;RV!CM2uOh*z38h`GHLRzEj_zuB6}bqHU(c#4GTB(%1)V9mYRSv58c`QqNv0<_sf&6Cpnh72n3z zlcdGIp$Hz`V>+-2I@GYMgB)+4DzA4gN8?8`ktchuab_0{ozt?N_lRX^ zXh;px^sXT~dP})A;*%0}YkxZ89GH@CueoRKb$*Tsc@~_WUG(<5pPunfjrv2*{F^X% z(tBqJ5`44(e;gT;)3IzgB!lv1kO4X`cGGo3GK=b{H5lRdzv*c35oTp9bPH+wK^_{AidP^acDb$xWnBf>MvM^gJ+`N|4gsoAmi=^Qx1T2!~KQfaqVvnY#DA~`8532Nn(h|;IN zQ!xruvHDKMsADJX8IuzR=kh;LGLMTu0?_!2TxDWwUB6u73E|<*;A^?N776;D;Hkq< zD=)DA^Sk=?1C@yyGs}N)$vQ7QAAG&MJPPxN`Ic;`3QK_l3fu(10ymNWZs=1&mc<`h ztLADG*`mp6jSL)W>w~S1dOZ`V4{^9Ps#sFxD)Qo^LfCKTTYR$tA$gpO^KAb6D3T?9MCire$(6FS|CHm~z8q zTfxCIonc~Hw4vK~Bt)Ovd-Y{%MMkw?Y7;Iwu)glP8wlo|b9?I_i#i+qgQfN4oN7Q; zy_qXN8-10fKo;Uh@~Q|MakLOLJobU?nu7i(ZnPraC&cV6+HLQ72qy2sO|0Y3qqs}*hQ3XRZ$72?vHZ8X}obykaI0yUnpi-G8^9< z_rE|B5K%fbc=1;qy`=(N{sey?R1?F#xhZLEu+~9MO8P4b$qnD+{D}nUO4DoX?^jl$(z!>e^iW@pL{mwMyC9#)o#aWaqzNr(hGK~ zgb@V;*&Av)+dz>?6>!B+#IlOLzXUtZ9rQnioaLftC2vRXE<32imCjBecBf+3Rb%yF ztcEcaIOw*TH~D%4v?S5qz|IcPCA4!4%AVKvPUD~0$FAIt+sCGvft!Hi+oP#He^n*D zjy>xdYg9yU%!M8_(J<1cLbKKuSfrEE1i$IuxNx0|w}ffz`80Yu>D(rtnh;#xZu)r$ zi~iOtJx5(0MEVpa`Mx|RRW07dq+b>Qnvf}18nVF|kqJ14i11UJZw z-BzHosz!AQE!rSzB63|pkaK&AUGzFsqWj&?;C_&@B70O_`XzbCjqbnb zsm|QYn5(KljOhd2GFt9#ux zm;Y2onorzN7m4CcbOeRphS{B+MsuqeJ1`gsu-WCSCzf0o3^(DPV;H=`@3kC*Z7~X1 zU$s=+pCF}Pn7(I=6Xgi|oy_?^WJ5>!YN6jfLG*@HAO1Cy6yoohguzY6G4kNg$1#w= z-%mbZ-OY|Ch4}A9LcyxjykJ$G=$D36#r}8;(*b1WSd*cag68kGO1|9PyMgzZ1q{+4 z(~Dqckf~n_$h25uL2u#t`}Dm6SHc1{Po4V56U<`l^B9{XX=HnW$Jm34XJBzlSzoYt z8K1;m@t3rJ_0>$2&fjcV^U{76XJ5rI+|+vu5(gD8?oE2@j6JTNC@YotU6Dq1a=-An zpq$Y0mu0(OfUP+DE?5+MQVy(NE%ad0yQPAtdV-`d5-jQnYje&HwxxIc1*#TkD-PeE z#BhNV{K3%qzg{qbiFb^KR3(aR3)7$7G(lzsaf;PKAAf0s%uqjx3nSli$2-D&b$H|3 zp4;Z!-3x;E51--}45(rAP`=MdC$2t*~xv#gkLbHhOJKdzB!#ZPvA)lgzCfg1{%?$JPaPx%jxV@KJ<<( zScGApQR;Q0iO&Q}lR*h~=CTe-FaC5P=MsQ`;+Xgb&OlRol#juKHaVTM%7K$HX^t23pgjf(#yv$?0HKJw!$p5ZhzFr_y5uW{9hW zO7*K517POuU=4H^av>q0GA6#2GZ03P3Nv^xBd7DE>S1kU0i8XzCzYPU4Dp#zX)-9n z-dxs6>BUSJaxo#GIwroIGth}16=CpTSx)C!)x)010zP}}L@GV&8RA#MrPH7Ud-Ha% z!fY3EDIuUXCccw1(2f2XD%#+|mYmLus)yvlr8qT=e?V4UoPnuu8Z?F+{1qC55%6j< z7VxI|edyn8btM`yS@QV)S-lA#Ws~ZX+m^PW9kwu^}R5Z{mP%^NCpyH?}!9< z#5abrW8(Bqtm)Ur2V&X2CqCVW--rS3ASc%SQ$9*KG4Qz6Nh6QEV<}Ue8?Q??!}wWD zM9Ud319`~4nKIXg-qoK&^})r?v@od#9uD#lC#WIU;Mw;;h8nRYCApP@uiO;Lz5I>l zc6Zd~|A?!1#I!pi95#nR4R@WxAp4)o696;)@si710?60FMPc4CmzR&-k=*B1! z!SC}NwDg%F{F!CPYAtAaiAlzer2QJX8?cpv2Sp!!3u6FKnaC^Dv-C}3x4|<*dS>>! zqN~jyR0AQUmp-q=WY_4IeYnv)1~1%f9!w2fP^f{d20fEOR%uWFEA%YgcG=n#^4jE1$H6-tB>?h{Rm^k4XX#YS zE~dWr-|nbyCI0^-QvKhEhreCKpoH@*VzB?ug%a4rNC);^7h2PA{xy1|uhn7mb2H)v z_I1ZQ(dltO*Kobp<<8ma>`LRUmW`2vdtLwKl4QdsvJ$-lD4v$h*}1FT?zJ~A3D55A z`&UfOxq8&uc$C##E-{}Xw(SjOwwb+yk8++RqLGF zwptl*aCYrz8f||t;B(T$q$Vn#)Q`Ilth(rh2nkBIkn*X0d?ml^ht2|h7R zhK)s96~A}PYG=Z8%zV?K))DFMB%fxc*okR#^g^M2m+w$4E$X|+j_ zrb~I4g#!V(8wRtt$EzPa{2cf8c%YC;3(f?`BcV+Fj&7nS%>%{Hem_;!uGe_~0qB!1 z-NFSv^Dg}@WYUHj++T{0_u0hMVNa?!xl*6N=Dhz~eH=jXQuDm(=GqgPZP=Q6Z`?xE z709I7nknMrtfjeNsBvOI}a^?6CF z>+jlEfAOUSZ+>W@`t5MPoYk8$Rt)-Fc$y#yU1>?t3W=ab9}av!4#Wqe$DlKS@h))_!XOnDpo zrs(m8;veepZ=)0eSmf(A4F-OAXLMJBuRE|kjPQ~%m+(j`*x0XMv7UleA5?xQ(u}NY zu%Bj-ebgg^&7Gw9$xJOAHlLJ%PYBV`nHb19V8g}wQfr#mMk^J0IKfkGdIraT(#oPg z66MsYUV0mor;we3wds#xHVtIw5O~%k)bi2S=q+}Kb##Q&Kc5b|pc`y9Z4t)%cNr9# zI}7#0w&PqZ*GDGr$g2v33)85$I7Nu`sHAp8hDU0dpfs26|47Md{{4CRM*=Dyg@XJR zSd{taDSSJOqb*$U<@uhy;rkawelnvOds3w}BBjGUtGR@63g;h(v%=|V{Uki` zl(_L0+*(?sHi>ZQot&}};)Prvo=fv6J4!LF2hnyeVo0kC=@Iwh+6hpHwbgTe{q(8r zRaLiG|AT8fVQO5$t<45b%c0Lc-=B%_4Lr|6lSPfR*PFiA`alQ=KiQ)K{{3!5__x)4 zR~IQkg$dyys-c@uj0mKP`ItM#2UqQJXwo|uG5LPmvtYp;k97XGbH8u$&#I|H1#v?; zN5?F1mkhXjODS+5m~B%tjvQJ%nnMBN?fpwud73f{i|?a8%-0){Aw@bYdrIVf-_uQB zAR#N=-_Mo5zuX_}9q_Rb$kxD4e??^Kpn%1Dl&)NRyJp|k+ej6u*(4d8N0;9t@LQr! zqx|-fcbxEBO4=&$*Yx@mB#_^`0Rwh?+b*rv+4ZbMfnzgYgS!wo_$nAyGwWZTE(XYE zNrp!YXHck%(`$*Xb90bB5q5neN@P#WD(N4aCsL65M)FtmFT2?NpMdFZ&U*$<>!ok0 zu^AG;_qge5p18Ng*J6LdS~ZL$udL`IhF@k!_&DKbeE%DSC2e{=fG2^(dt}0`?ij4f zQfHbMCP|#Iu`%D$t=aN2J2Z=If=poyrx*?~=}466L14LAe#fc!@~CgDHY8S8b?M_f zKPlv;YZ0m{#6H4`88+8J;{?K=P5tB=={pQU%2 zANae<{#Bz!H=Lm)^~*X#DRTZNBV=SNG~+=-grBC{L&?enri=cN!TEWcAK)9y_jP%5 zo1ymXI72QW8Cc>O&wi>~6(O~@Nn0}YP{T#G5tBKxo9vodfl~s2!jCR+ATM|u3Kt+O zb31x@zdsYE9^cqKexCZ47)#ptldVsPLFo`h%@MD5I$-r}p-5r+tFmFEX&!IWrsf|P z?1936#i38aV`*z%&3@{R&J1pgZgtcZy~Nxz%{xW*xo^ra1#y4-LqTc#jf-kn`EO!K z*8)72KXePX3$^0FhRTEUlWWLj zu25X*eh(x2;2|4fg~7n6n5sI0+URztN5L;WD<^UKD;|57ct)UlHO7LiD-3DbYosYHr)5gjD+_KB zOZUh;giPdqRjZdo881EUAC%ZYH(qL-OAFHYBeVdE!3(1%MPO(kJtULA{hyuw)ErZE zX==Tq|9pZvdi>Q%TC1g*A5kl|Xx8Eb5hF10d;z-5zaYn^!HlmD-+(}>p zMvRO=;%L+H?<{q)v$MeQUmy7oeNS?Y$Z?I|={Bb`R$afPi%(6YS-_Lh`bg`E^jt4| zQ2S+!+abxS>RuZHeo=^zPi%=ylgTKMT zsp!YWFiK$Gp;_UY%jhkqQePR}#OA`pmkZNk}LvL*j9IrgaAq$9;rEFd?zg-?xWX%K}|K^{x;=ZG4Y17#dS#0!W@ykfw`G5h{ncJsNoO?j( zgph9mSPCd6yqkwt6Vt3$V4^z~i4HaAx*xQpE%knKnpMJ%uE{pmc9az>FX)1@|I&)3 zj?6>0odh72i5n#DX!xWo`qWjG7K_ZXG{Ou+>a?~_z{(g=G*)O*5o_Ieyb#HEL+L>m zyL*edDK~>Mt(;-$R+3R3SvP^oSaQW0V!1F7w$_J*>9u0af25Y;@fRuTSK+!^tQ(mz zE2XSob-lE~-J`euZf~MlMxReCL2SdQysNh)3V9IAWvfUT$!=!(A360E!@uoIQbUSC zV7K}7RtFepk8_K9;~ZWubNkZt1h8HFvY5yY!4of9P;pJ-FP=E&J?WhoQe<^gqf_Ym zg!q~Oz4}WD{KwO&l=30|bzF6-n32I`ec_4VNfmgvKl6ztptMfJb4d>jb)Yh-o#W!X z8Zm^K1~pG%8#pB6oN4DpzPEp0AYZg&8}>U@C$}8|ORDg}M-KMiCkFfDKWlB%<+3UsFb-25tVc-2twuWDN>}|A)CQ0qHE+cm zYTd5C<-9o<`&B?+qd_KX4P=ZL6_Zk0D`Q%|Rb2RHbIfaU=67O2mrjra>}_W3+kv=n zR?MVVHM&o#I&ym@VWixA?Xk3tK+7m*K2nw7WpK?TEDAiQ3ul&CP=h=5Sm3~=bXA&j ze$biQwsDzIt+;JR(2`wWIX>?EDN*9_KIbg*hAaCzGH9c z{)UT&xX9b-W(0F?l^5PzfI(bR1w$ z8tvHUKdwIC)aRHO5Wp$=#9yHD$n*mzduSquK_s6bqWH(LYkrl0T~*H|+;BYi6ML3! zvjLUskKslu{wCZ2(_1DH~ZQyI7!iW6m<2sv;(pG%b8 zdTE~z*cyCK1{G;E0a{3|QEMcc8D=rx=gGT!3%y#cM~Lqv)H%c&=0)5pams>dEDh|xnWEV&`0rH&SUssae)s8H z*d60n*f)JI>93|{g!D9GqM7$hbO~a_(T81^zd1YF=<$NW-t>x8KBHCbTA}H?x)+SH zgUP0ZB$o;4rY#ClHO(8sOv`ly9)iqXr*MCklov&xM4ue-WP15?>Oz)@POYHa43Y$t z4}T3IeBY?yCS78c9e%QsydWw6+}v%rF;^6#9AZVABR550o(5u^o?8?(vGFQhDA9fF zLYg%&A1|yEt%AYauD>Gjlr%rJlr&IP%IZoUpXo6n%8i=u{!pU+H7g{+inGU==|Or- zz@40gq&8+P{2{bRz6_Ynppn$HSy2K;dDzc4b2+%0tU&0Z#617 zjTV`T2DPN@cKX@t*1Q8ixn$mUp%J-OvVNCVDJDjnCjv*qZgU9OqHDdvN%E`iEFs0M zNh*Su{RQ#yn&_a0#W$Z5-4dah$4a|%PLzF(9~LTuFKyp&A)eo_$H|5u>YVYdY;V>J zB^`WQ|D>4I);Ur-*2x2UdQX>7U|Nl6>#KjO-SUIz*Y!~?CpwEwyEuE8n(i}hu^VY0 zXR^-HYziiMc>8$6dm&WYm-MW;#G4&s77aE(aj*_~zgy)+^#JlA3E>l^LEF}cpm-4imr&LLbg15xGHKc3iF`NZ4J*al=(29CEsC z(M$9Ob{rCl6YRCfUZH&|g?l3{9&;M}s9Yq7H3x>3p#K7~NNf_6_vx372gBzC?J=o_b*XxTK-@TyHT5 zx8=*L=iILY-b>FD%XT+!GCakuWi7q10eIJtU=q8!=-Ga$kR=ime9f*+=@emg7}>r19vSQyLD$-0}9deC$eQprt?* zS@Z4ujL*?sO`V^JKmPvLA8a)hj+RmA=O3FsmJ)P6AvtJ*->9|~wH&Ygzd$e?UFtsr;Do1#@Jtce}=^d+0Xu)naNgd&4QLQ3#y+;l(FW9{!f%7H^)nAl%^;PtYtx=W1DVnUVexNO&c8e zc9+x3feF|+P3X!G=~E)Zh8rhjUvv2Hi`RUB zSYMZ-IkTVx{AM|7<0aa##6s>H%oDfsag7|Te5D;k39w^2DJwu8avH%CDwaPJTTRk% z*5Z0#ic0}uy!jxCevvJ+yTVB&RG+t_m1$Yu%2@UZC3_UqszQ17Io48YQVtED+!*<{ zo@-;|V{)++tH%y;_jWw_j&mS8JQ7I#JoHAps=m=-#FlLeK0J9-HmrhMuK2-qVb37z8q8G%VuZh5dqTed+Fv}r z1j&3HjeIyInS$3)I)a`zCRgwx1vRR|Jwlpm>@DTXkkm<(CVrA};&tJh#~w+?ODLgE zQKoj$!D|{~^oApj#hg zCdY;&Gb?E1fFN-VzcHc)`CJ;1k!#_bbIMh8e%&wE3h_kSwCC`vd@%6(tC!V4dJ2g} zD9Aw6EE#waXiaLa_GWMTCjqSVD2uoAPDGWH#EVZz`-PO%LfW1u>(l zbM`Q)H1H@Q#*>YVhvh(^Z|%s8*A=pfE2%3ZOY*opq29~wxeXRogz;qZ4=#NXUNE&b zfXdDJE(#Gjp8c(_oTE}=%2e$B>GeRnJMoob=sP)vQAWN}8?qRk=P{wTufxSx*KNh= zZUsWarASe~6sb`LjU#NqxGVV8kuki62i#N-M&^*%%K zFBXf$WU*@b>uMH&XhY(xBHNpBi&6??#IJ5974Jth-|TpQr<+iJc>q*7Pr>>*Bhg`F zH9ynNheh$Jn%D3HcSqY~zWCOm z+J~0Fa+PT1&g+FHUeSDHHyMwL-Ba)q>p^(7P-^~y`uRasp$Qo(xAb5~t=0Gwq}`t$ z$O9mR(1tE49vv)@zl%a|Jyw5dxETeC*GL0(>bDo8L~q$sx-qYw^!Aro5@A87`diu? zySpb0_@Flvy-zbmG;A126t<{Gs!UcZhSE2~9IRx}iREym#_@KA2-F&O*bh&MMYV&0 zZvz+W0jyiR0};wd#OlCfoA8*mjjJHNW&3#|@j0uPsYcEoK4sfObd=e9Oid<(Bxqwg zGcN!LnfpN5m^85=CTolSf;@Lc+|HRjqavSDA#N^h&>o+ky5*j3D+u;N(A5D(bzW_bVO2G@nf74Qpl4bN#$1|dSM*o}Fw-*SOkXH1>12NHK z-W26dM2>cYRRUtHYPQ&CBF`&nW*e`o5<&+d7QepOxH$(l$Dn@pB5_Q|(A$kk)l?o+ z|E*8xPD~<}nZ}Fth)&Szxn;C^}w{o1Zi|9K5Cw>FWR7irPOI29Hdi@gM^`xEv*fJkrxIjHeW_A@iA_XVFcj)M9fVGQX*EF96OyGpgAR4`}*OGh^{A+w4TSvaQ+vCM9)>!QWR6}}z=XReBkj8__icI#g8DpS#9_#5amR26BeAovso zgH&H(r!k~F_#G~1l#9}4GS0%`Ly6`=nI8oN~`t9zykV2Y<*Xm`lz%EMWxB)5=1edUxAdgGq zTuR1}k?uUeY>$|4gw@c>5fAsteM&Xnciy^q?XY85x_D>QB#*^sJEsu0?U$YIZWO%z zbOCE7MOuH=*!bsm3gW~s4oIwI)X<-gy5U&kX!Wfghzd@+X>NRZ3L(BG_HQOzug}{= zw>X*fJKEGp77~|l&LPdT5Xs0AJySagz0d#3Qe`YfSvCEX&G)Rs3c;YP8f?TN?1lj?AbMR@9G+eeaZ5^i*!^%@XU()U98#4`Aqx> z?)UygMNhXsUZpPy%;hUMk_7nL9V;HtF^GEe-81*7pFKSZaf^IsiUtIHO3Y~eL}u}f z-!JFnD@@;$87%k1htkK#+IV`2lrc|%iPp~i!K98$oo zLmjo>-z1szej$K3EK52-7$6E6umF#L$H0sBw~#vJ!FknNyDMptU1HRg^Vu~855!7~ zb0h=vaE`CINTAJdxH!TNKvY-fhcYorcY!fFnhmd^S*a~~*ui@Z1qN+HC1X`Hs*T&% zrv-v2eYM^Uiv49yx%quGB85?k!{DgR7!jW#$bCA}eK0(A^_n zo%xi2coJI;7?bP+p6$=#j_MxQ0%o-|Biag!^2^9A;_43YV&cWkF(~TVk>8y&|I~7O zR32Kdu8xkXcz)8W*T5{JW~dP#$x*@O1-lGG4rw zK1PpgHze9~lL>!6qTBlQ^Pan(s&wvkGdP12%9&+XHN#Fkv1oiJ%1(5?vi^&K)QO-J z^~4dnGU?mKmHt%}U<7d)+L_4bcFZT(%4Jn7rx@c_3aGYK<}(BC(+r=vE?C*5x;Aj$ z%!B{fH5B2cE0-oH{Fr7XFvFj2Po>*x>HSx*Faa_HO*ydG4Vd=HUskxrJ>4WOR)Rqdn%s*7%$;-Q*SRy?^ z3;=?>;dCgVx1{G&P>TiMy%0Yw=jM^@rW7J`(fX*`81ujpfNeuxPGte&EGsm^WX?XE znfu!CWBFUcI3FNBHy`>U&EdJH)f01q+-#hQ8O`$>^0x*xP6#u8E)4TLPcqQFc*kHI z61HSj=^=pGm4I@LVr?+9DTRHUVKZNy3Zqm@7`G$*ewl;*5eI*qWZ8?qo zbd~wa#HX^9J;*3hj9|NChP>{^i?A-P7f4ILa_uK+H20IC~S8RLlXqwoSt#m z=8xs0=_uO8+aLoZTWT=uvR9=x3p|Q}>1LY1Q++lRB5J4MYnvD6K=rf!{M0yAkGdI| zP4cQ0tN6u~++Rm3noyS&%5}Tth3!v{j){~QeJZ|xbwPb`flm8ntJ@d}P14PS)4TF* z{Uj!izAG?o4b3NxZkh-L9ocyb&m;jKqNEO4hDI#y@gdY&j3F1*hNt%)Bn5wZLXFMj z!*&s!VyNM>BqSj48cx0H5b#gQ!9D49Oj7!;0?ETZkmN_+ph`G(DAi7UT{WjAn8JzP zw8r2|Lh@N8D0T1(7Omw7BW9+Kn_H=SLUuF@AOy2prcGn|)Erj%m$D;OC<)G~>BrVH z`~xprCq#XTJp(S>8#DG3+JPdFF(KZs_www@AF+OGO7N!|m)Lfxs8}LkOeNBfZuf7i z3xw2IZy&_PULf7nIJAeW7Ggi4!oODba}T!@J7iFL__0}#Y9Xo6=Mniw+w9ig#dNjL ziE?)>Pj4#v?Mtu5oe0D$ZBX^5{De#P5v$*QTaX2#a~y;c_^Iv~_n}c?nSsXaNe34A z-@ix_UN>+;)7?WlH%E0$fOY}C!A69t`m~3%#0fW-!{HP}D~5Vxv&8q9p2QUvA#Ahv zdwd@*SXy|8=NlHKWD>+AI?i)h<<vGonemEB2EK@@KNGB znjv>_zLM5~T=R#bzfn6AQjOAV-fDTj`vX>>(DC@EjB;~@R>bYZv1RG)O1^&wccDH!lOt=H7omc$f3t|{cEIYHFjq08zY)`j~wNvO( zXs~JUKz(bFm|BlMuYfLz`GiWfujXCFd&ZYht!P-oRPfTeNro4pI2Q4-dzaBQB>uOc zfErozR=I=nD<%k2ENiYGs9)tE96)RCo}+;%kKh>2js!~9$^@C9fkNrke`5AqgowHW zS1sU-qr~?rDuT6L5l`2Q+${BGKTsXxOn-Hs5ZKac+VmVeGMKR-3@J?K#{;RWjuK4G43PY@Q7GF1|E)yS?M=8FU9^M} z;^<#_Yg(~DzYw9gX@_LU|B(6k{a>DaGy`zgy8^L(ZA zm}x>DAI9N{a=?t9S|Nlj8x;9HR^jMy4GsD{ClviVk1>n*D3W7>`y=#vP8v3+k7SZ( zgg%_euzRaq`MbYxgywpQtI&^YG}xhE2G@so@x=$tqeW=8)NfZR>hJ0f3QOV%1+i?O ztFYwkIOyT+zqfy||4a1RW+?+0fQNsVzqTccym_Sr~*`}YNS z7;Xz<7~*%a?f;a(peE$xX=D(yiaabFKK%brhYNtA{vYr6HW0RSBVAP+z(M&R+HW3` zZ}IRjFyp8&|A#g}0+2j|jGx}74Z!*DM%nuZN=m diff --git a/workbooks/alz_checklist.en_network_counters.json b/workbooks/alz_checklist.en_network_counters.json index 4102214c9..b7ec6132f 100644 --- a/workbooks/alz_checklist.en_network_counters.json +++ b/workbooks/alz_checklist.en_network_counters.json @@ -778,7 +778,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query9Stats:$.Success}+{Query10Stats:$.Success}" + "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}" } } ] @@ -797,7 +797,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query9Stats:$.Total}+{Query10Stats:$.Total}" + "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}" } } ] @@ -835,7 +835,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}" + "resultVal": "{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}" } } ] @@ -854,7 +854,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}" + "resultVal": "{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}" } } ] @@ -949,7 +949,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}" + "resultVal": "{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}" } } ] @@ -968,7 +968,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}" + "resultVal": "{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}" } } ] @@ -1063,7 +1063,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}" + "resultVal": "{Query9Stats:$.Success}+{Query10Stats:$.Success}" } } ] @@ -1082,7 +1082,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}" + "resultVal": "{Query9Stats:$.Total}+{Query10Stats:$.Total}" } } ] @@ -1120,7 +1120,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query22Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query17Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}" + "resultVal": "{Query22Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}" } } ] @@ -1139,7 +1139,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query22Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query17Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}" + "resultVal": "{Query22Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}" } } ] @@ -1213,7 +1213,7 @@ "style": "tabs", "links": [ { - "id": "07e83af3-57c9-40e0-be1c-1cc73dfe8820", + "id": "ee2833a1-a75c-46d0-9b99-90995ba5ac2d", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Virtual WAN ({Tab0Success:value}/{Tab0Total:value})", @@ -1222,25 +1222,25 @@ "style": "primary" }, { - "id": "b6f41a58-ac9d-4e51-98c5-ea060e0e09ce", + "id": "b73505c5-c836-4793-b4cc-0236113e73e0", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "IP plan ({Tab1Success:value}/{Tab1Total:value})", + "linkLabel": "Hybrid ({Tab1Success:value}/{Tab1Total:value})", "subTarget": "tab1", - "preText": "IP plan", + "preText": "Hybrid", "style": "primary" }, { - "id": "bcf151b8-7eba-42db-b445-a91e287845c6", + "id": "ea28203e-7116-4743-8e69-0d185dfce42a", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hybrid ({Tab2Success:value}/{Tab2Total:value})", + "linkLabel": "Hub and spoke ({Tab2Success:value}/{Tab2Total:value})", "subTarget": "tab2", - "preText": "Hybrid", + "preText": "Hub and spoke", "style": "primary" }, { - "id": "286405de-f504-47d0-9a2b-7b1771b5931f", + "id": "aa790c2e-0829-4799-83cd-0af9e9c94d32", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "PaaS ({Tab3Success:value}/{Tab3Total:value})", @@ -1249,16 +1249,16 @@ "style": "primary" }, { - "id": "10ec320e-1bdf-40ac-a43b-ffbf9b7a53cb", + "id": "fa4f2eec-c68a-4bad-a29a-c929d9772e42", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hub and spoke ({Tab4Success:value}/{Tab4Total:value})", + "linkLabel": "Segmentation ({Tab4Success:value}/{Tab4Total:value})", "subTarget": "tab4", - "preText": "Hub and spoke", + "preText": "Segmentation", "style": "primary" }, { - "id": "715c5a5f-3938-47c3-b862-ec58b694f66d", + "id": "6617fd8e-0e9b-4e9a-9562-06263cd9a56a", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Internet ({Tab5Success:value}/{Tab5Total:value})", @@ -1267,12 +1267,12 @@ "style": "primary" }, { - "id": "9b3b5315-4c94-49df-8e65-9bfde53efd4d", + "id": "41eb4342-7f1b-434c-847b-d5f727276038", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Segmentation ({Tab6Success:value}/{Tab6Total:value})", + "linkLabel": "IP plan ({Tab6Success:value}/{Tab6Total:value})", "subTarget": "tab6", - "preText": "Segmentation", + "preText": "IP plan", "style": "primary" } ] @@ -1372,22 +1372,22 @@ { "type": 1, "content": { - "json": "## IP plan" + "json": "## Hybrid" }, "name": "tab1title" }, { "type": 1, "content": { - "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext9" + "name": "querytext4" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1436,20 +1436,20 @@ ] } }, - "name": "query9" + "name": "query4" }, { "type": 1, "content": { - "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information." }, - "name": "querytext10" + "name": "querytext5" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1498,42 +1498,82 @@ ] } }, - "name": "query10" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab1" - }, - "name": "tab1" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + "name": "query5" + }, { "type": 1, "content": { - "json": "## Hybrid" + "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information." }, - "name": "tab2title" + "name": "querytext6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query6" }, { "type": 1, "content": { - "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext4" + "name": "querytext7" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1582,20 +1622,20 @@ ] } }, - "name": "query4" + "name": "query7" }, { "type": 1, "content": { - "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information." + "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." }, - "name": "querytext5" + "name": "querytext8" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1644,20 +1684,42 @@ ] } }, - "name": "query5" + "name": "query8" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab1" + }, + "name": "tab1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Hub and spoke" + }, + "name": "tab2title" }, { "type": 1, "content": { - "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information." + "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information." }, - "name": "querytext6" + "name": "querytext0" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1706,20 +1768,20 @@ ] } }, - "name": "query6" + "name": "query0" }, { "type": 1, "content": { - "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + "json": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." }, - "name": "querytext7" + "name": "querytext1" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1768,20 +1830,20 @@ ] } }, - "name": "query7" + "name": "query1" }, { "type": 1, "content": { - "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." + "json": "Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." }, - "name": "querytext8" + "name": "querytext2" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1830,7 +1892,69 @@ ] } }, - "name": "query8" + "name": "query2" + }, + { + "type": 1, + "content": { + "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information." + }, + "name": "querytext3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query3" } ] }, @@ -1934,22 +2058,22 @@ { "type": 1, "content": { - "json": "## Hub and spoke" + "json": "## Segmentation" }, "name": "tab4title" }, { "type": 1, "content": { - "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information." + "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information." }, - "name": "querytext0" + "name": "querytext18" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1998,20 +2122,20 @@ ] } }, - "name": "query0" + "name": "query18" }, { "type": 1, "content": { - "json": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." + "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." }, - "name": "querytext1" + "name": "querytext19" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2060,20 +2184,20 @@ ] } }, - "name": "query1" + "name": "query19" }, { "type": 1, "content": { - "json": "Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." + "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." }, - "name": "querytext2" + "name": "querytext20" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2122,20 +2246,20 @@ ] } }, - "name": "query2" + "name": "query20" }, { "type": 1, "content": { - "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information." + "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this." }, - "name": "querytext3" + "name": "querytext21" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2184,7 +2308,7 @@ ] } }, - "name": "query3" + "name": "query21" } ] }, @@ -2598,146 +2722,22 @@ { "type": 1, "content": { - "json": "## Segmentation" + "json": "## IP plan" }, "name": "tab6title" }, { "type": 1, "content": { - "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information." - }, - "name": "querytext18" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query18" - }, - { - "type": 1, - "content": { - "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." - }, - "name": "querytext19" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query19" - }, - { - "type": 1, - "content": { - "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." + "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." }, - "name": "querytext20" + "name": "querytext9" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2786,20 +2786,20 @@ ] } }, - "name": "query20" + "name": "query9" }, { "type": 1, "content": { - "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this." + "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." }, - "name": "querytext21" + "name": "querytext10" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2848,7 +2848,7 @@ ] } }, - "name": "query21" + "name": "query10" } ] }, diff --git a/workbooks/alz_checklist.en_network_counters_template.json b/workbooks/alz_checklist.en_network_counters_template.json index 4a5f50c5a..147b5451e 100644 --- a/workbooks/alz_checklist.en_network_counters_template.json +++ b/workbooks/alz_checklist.en_network_counters_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Success}+{Query10Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Total}+{Query10Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query17Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query17Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"07e83af3-57c9-40e0-be1c-1cc73dfe8820\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b6f41a58-ac9d-4e51-98c5-ea060e0e09ce\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"bcf151b8-7eba-42db-b445-a91e287845c6\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"286405de-f504-47d0-9a2b-7b1771b5931f\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS ({Tab3Success:value}/{Tab3Total:value})\",\n \"subTarget\": \"tab3\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"10ec320e-1bdf-40ac-a43b-ffbf9b7a53cb\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke ({Tab4Success:value}/{Tab4Total:value})\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"715c5a5f-3938-47c3-b862-ec58b694f66d\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet ({Tab5Success:value}/{Tab5Total:value})\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"9b3b5315-4c94-49df-8e65-9bfde53efd4d\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation ({Tab6Success:value}/{Tab6Total:value})\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Success}+{Query10Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Total}+{Query10Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"ee2833a1-a75c-46d0-9b99-90995ba5ac2d\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b73505c5-c836-4793-b4cc-0236113e73e0\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"ea28203e-7116-4743-8e69-0d185dfce42a\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"aa790c2e-0829-4799-83cd-0af9e9c94d32\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS ({Tab3Success:value}/{Tab3Total:value})\",\n \"subTarget\": \"tab3\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"fa4f2eec-c68a-4bad-a29a-c929d9772e42\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation ({Tab4Success:value}/{Tab4Total:value})\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6617fd8e-0e9b-4e9a-9562-06263cd9a56a\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet ({Tab5Success:value}/{Tab5Total:value})\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"41eb4342-7f1b-434c-847b-d5f727276038\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan ({Tab6Success:value}/{Tab6Total:value})\",\n \"subTarget\": \"tab6\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/alz_checklist.en_network_tabcounters.json b/workbooks/alz_checklist.en_network_tabcounters.json index f1d3ba1a5..bab6ab57b 100644 --- a/workbooks/alz_checklist.en_network_tabcounters.json +++ b/workbooks/alz_checklist.en_network_tabcounters.json @@ -70,16 +70,16 @@ "style": "tabs", "links": [ { - "id": "34d85edb-5614-41cc-921e-6d8799f040ed", + "id": "99f6ced1-3725-48ff-9c2b-204ef4a1e6c8", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "IP plan", + "linkLabel": "Internet", "subTarget": "tab0", - "preText": "IP plan", + "preText": "Internet", "style": "primary" }, { - "id": "5b00ddc3-d5b6-4b3b-9940-58f4b0e1e31b", + "id": "48149b48-5e11-4480-9f9c-10930e974e00", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Hybrid", @@ -88,48 +88,48 @@ "style": "primary" }, { - "id": "10700cc4-a0e1-4175-b40b-a1ba29983df6", + "id": "dbf08e56-7960-459d-bfb6-940ba2d85825", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Internet", + "linkLabel": "Virtual WAN", "subTarget": "tab2", - "preText": "Internet", + "preText": "Virtual WAN", "style": "primary" }, { - "id": "7f31508c-63e9-4612-bb80-21daf3d5c7b7", + "id": "8db67660-784b-4bd2-8539-1fea260aa601", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Virtual WAN", + "linkLabel": "Hub and spoke", "subTarget": "tab3", - "preText": "Virtual WAN", + "preText": "Hub and spoke", "style": "primary" }, { - "id": "37e10656-8c70-4bef-81e1-63be8f4503d9", + "id": "5b9d8901-5308-4fe2-a83a-ec520bfbdca2", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Segmentation", + "linkLabel": "PaaS", "subTarget": "tab4", - "preText": "Segmentation", + "preText": "PaaS", "style": "primary" }, { - "id": "6b9db623-fee7-4997-aa68-e3871ed06131", + "id": "6b75031c-69fe-4b0f-a48f-046c6aa0147c", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hub and spoke", + "linkLabel": "Segmentation", "subTarget": "tab5", - "preText": "Hub and spoke", + "preText": "Segmentation", "style": "primary" }, { - "id": "85482b61-4c03-4527-aef7-823e11ca2196", + "id": "07aeb181-fba3-42c7-a108-4dceb64b3198", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "PaaS", + "linkLabel": "IP plan", "subTarget": "tab6", - "preText": "PaaS", + "preText": "IP plan", "style": "primary" } ] @@ -153,9 +153,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query9Stats", + "name": "Query11Stats", "type": 1, - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -169,9 +169,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query9FullyCompliant", + "name": "Query11FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query9Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query11Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -181,9 +181,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query10Stats", + "name": "Query12Stats", "type": 1, - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -197,9 +197,121 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query10FullyCompliant", + "name": "Query12FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query10Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query12Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query13Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query13FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query13Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query14Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query14FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query14Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query15Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query15FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query15Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query16Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query16FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query16Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -220,7 +332,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query9Stats:$.Success}+{Query10Stats:$.Success}" + "resultVal": "{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}" } } ] @@ -239,7 +351,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query9Stats:$.Total}+{Query10Stats:$.Total}" + "resultVal": "{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}" } } ] @@ -273,7 +385,7 @@ { "type": 1, "content": { - "json": "## IP plan" + "json": "## Internet" }, "customWidth": "50", "name": "tab0title" @@ -314,15 +426,15 @@ { "type": 1, "content": { - "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information." }, - "name": "querytext9" + "name": "querytext11" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -371,20 +483,20 @@ ] } }, - "name": "query9" + "name": "query11" }, { "type": 1, "content": { - "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information." }, - "name": "querytext10" + "name": "querytext12" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -433,305 +545,37 @@ ] } }, - "name": "query10" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab0" - }, - "name": "tab0" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + "name": "query12" + }, { - "type": 9, + "type": 1, "content": { - "version": "KqlParameterItem/1.0", + "json": "Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." + }, + "name": "querytext13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], - "parameters": [ - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query4Stats", - "type": 1, - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query4FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query4Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query5Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query5FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query5Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query6Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query6FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query6Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query7Stats", - "type": 1, - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query7FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query7Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query8Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query8FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query8Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Tab1Success", - "type": 1, - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "criteriaData": [ - { - "criteriaContext": { - "operator": "Default", - "resultValType": "expression", - "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}" - } - } - ] - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Tab1Total", - "type": 1, - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "criteriaData": [ - { - "criteriaContext": { - "operator": "Default", - "resultValType": "expression", - "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}" - } - } - ] - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Tab1Percent", - "type": 1, - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "criteriaData": [ - { - "criteriaContext": { - "operator": "Default", - "resultValType": "expression", - "resultVal": "round(100*{Tab1Success}/{Tab1Total})" - } - } - ] - } - ], - "style": "pills", - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - "name": "TabInvisibleParameters" - }, - { - "type": 1, - "content": { - "json": "## Hybrid" - }, - "customWidth": "50", - "name": "tab1title" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab1Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", - "size": 3, - "queryType": 8, - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "Column1", - "formatter": 4, - "formatOptions": { - "min": 0, - "max": 100, - "palette": "redGreen" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - "subtitleContent": { - "columnMatch": "Column2" - }, - "showBorder": true - } - }, - "customWidth": "50", - "name": "TabPercentTile" - }, - { - "type": 1, - "content": { - "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." - }, - "name": "querytext4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } }, { "columnMatch": "compliant", @@ -763,82 +607,20 @@ ] } }, - "name": "query4" - }, - { - "type": 1, - "content": { - "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information." - }, - "name": "querytext5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query5" + "name": "query13" }, { "type": 1, "content": { - "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information." + "json": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." }, - "name": "querytext6" + "name": "querytext14" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -887,20 +669,20 @@ ] } }, - "name": "query6" + "name": "query14" }, { "type": 1, "content": { - "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + "json": "Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information." }, - "name": "querytext7" + "name": "querytext15" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -949,20 +731,20 @@ ] } }, - "name": "query7" + "name": "query15" }, { "type": 1, "content": { - "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." + "json": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information." }, - "name": "querytext8" + "name": "querytext16" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1011,16 +793,16 @@ ] } }, - "name": "query8" + "name": "query16" } ] }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab1" + "value": "tab0" }, - "name": "tab1" + "name": "tab0" }, { "type": 12, @@ -1039,37 +821,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query11Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query11FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query11Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query12Stats", + "name": "Query4Stats", "type": 1, - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1083,9 +837,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query12FullyCompliant", + "name": "Query4FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query12Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query4Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1095,9 +849,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query13Stats", + "name": "Query5Stats", "type": 1, - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1111,9 +865,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query13FullyCompliant", + "name": "Query5FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query13Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query5Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1123,9 +877,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query14Stats", + "name": "Query6Stats", "type": 1, - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1139,9 +893,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query14FullyCompliant", + "name": "Query6FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query14Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query6Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1151,9 +905,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query15Stats", + "name": "Query7Stats", "type": 1, - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1167,9 +921,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query15FullyCompliant", + "name": "Query7FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query15Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query7Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1179,9 +933,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query16Stats", + "name": "Query8Stats", "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1195,9 +949,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query16FullyCompliant", + "name": "Query8FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query16Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query8Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1207,7 +961,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab2Success", + "name": "Tab1Success", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -1218,7 +972,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}" + "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}" } } ] @@ -1226,7 +980,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab2Total", + "name": "Tab1Total", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -1237,7 +991,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}" + "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}" } } ] @@ -1245,7 +999,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab2Percent", + "name": "Tab1Percent", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -1256,7 +1010,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "round(100*{Tab2Success}/{Tab2Total})" + "resultVal": "round(100*{Tab1Success}/{Tab1Total})" } } ] @@ -1271,16 +1025,16 @@ { "type": 1, "content": { - "json": "## Internet" + "json": "## Hybrid" }, "customWidth": "50", - "name": "tab2title" + "name": "tab1title" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab2Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab1Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", "size": 3, "queryType": 8, "visualization": "tiles", @@ -1312,77 +1066,15 @@ { "type": 1, "content": { - "json": "Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information." - }, - "name": "querytext11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query11" - }, - { - "type": 1, - "content": { - "json": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information." + "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext12" + "name": "querytext4" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1431,20 +1123,20 @@ ] } }, - "name": "query12" + "name": "query4" }, { "type": 1, "content": { - "json": "Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." + "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information." }, - "name": "querytext13" + "name": "querytext5" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1493,20 +1185,20 @@ ] } }, - "name": "query13" + "name": "query5" }, { "type": 1, "content": { - "json": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." + "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information." }, - "name": "querytext14" + "name": "querytext6" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1555,20 +1247,20 @@ ] } }, - "name": "query14" + "name": "query6" }, { "type": 1, "content": { - "json": "Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information." + "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext15" + "name": "querytext7" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1617,20 +1309,20 @@ ] } }, - "name": "query15" + "name": "query7" }, { "type": 1, "content": { - "json": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information." + "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." }, - "name": "querytext16" + "name": "querytext8" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1679,16 +1371,16 @@ ] } }, - "name": "query16" + "name": "query8" } ] }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab2" + "value": "tab1" }, - "name": "tab2" + "name": "tab1" }, { "type": 12, @@ -1735,7 +1427,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab3Success", + "name": "Tab2Success", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -1754,7 +1446,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab3Total", + "name": "Tab2Total", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -1773,7 +1465,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab3Percent", + "name": "Tab2Percent", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -1784,7 +1476,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "round(100*{Tab3Success}/{Tab3Total})" + "resultVal": "round(100*{Tab2Success}/{Tab2Total})" } } ] @@ -1802,13 +1494,13 @@ "json": "## Virtual WAN" }, "customWidth": "50", - "name": "tab3title" + "name": "tab2title" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab3Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab2Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", "size": 3, "queryType": 8, "visualization": "tiles", @@ -1904,9 +1596,9 @@ "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab3" + "value": "tab2" }, - "name": "tab3" + "name": "tab2" }, { "type": 12, @@ -1925,9 +1617,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query18Stats", + "name": "Query0Stats", "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1941,9 +1633,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query18FullyCompliant", + "name": "Query0FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query18Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query0Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1953,9 +1645,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query19Stats", + "name": "Query1Stats", "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1969,9 +1661,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query19FullyCompliant", + "name": "Query1FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query19Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query1Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1981,9 +1673,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query20Stats", + "name": "Query2Stats", "type": 1, - "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1997,9 +1689,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query20FullyCompliant", + "name": "Query2FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query20Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query2Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2009,9 +1701,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query21Stats", + "name": "Query3Stats", "type": 1, - "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -2025,9 +1717,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query21FullyCompliant", + "name": "Query3FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query21Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query3Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2037,7 +1729,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab4Success", + "name": "Tab3Success", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -2048,7 +1740,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}" + "resultVal": "{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}" } } ] @@ -2056,7 +1748,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab4Total", + "name": "Tab3Total", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -2067,7 +1759,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}" + "resultVal": "{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}" } } ] @@ -2075,7 +1767,7 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Tab4Percent", + "name": "Tab3Percent", "type": 1, "isHiddenWhenLocked": true, "timeContext": { @@ -2086,7 +1778,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "round(100*{Tab4Success}/{Tab4Total})" + "resultVal": "round(100*{Tab3Success}/{Tab3Total})" } } ] @@ -2101,16 +1793,16 @@ { "type": 1, "content": { - "json": "## Segmentation" + "json": "## Hub and spoke" }, "customWidth": "50", - "name": "tab4title" + "name": "tab3title" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab4Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab3Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", "size": 3, "queryType": 8, "visualization": "tiles", @@ -2142,15 +1834,15 @@ { "type": 1, "content": { - "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information." + "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information." }, - "name": "querytext18" + "name": "querytext0" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2199,20 +1891,20 @@ ] } }, - "name": "query18" + "name": "query0" }, { "type": 1, "content": { - "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." + "json": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." }, - "name": "querytext19" + "name": "querytext1" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2261,20 +1953,82 @@ ] } }, - "name": "query19" + "name": "query1" }, { "type": 1, "content": { - "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." + "json": "Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." }, - "name": "querytext20" + "name": "querytext2" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query2" + }, + { + "type": 1, + "content": { + "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information." + }, + "name": "querytext3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2293,50 +2047,206 @@ } } }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab3" + }, + "name": "tab3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query17Stats", + "type": 1, + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query17FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query17Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Tab4Success", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "criteriaData": [ + { + "criteriaContext": { + "operator": "Default", + "resultValType": "expression", + "resultVal": "{Query17Stats:$.Success}" + } + } + ] + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Tab4Total", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "criteriaData": [ + { + "criteriaContext": { + "operator": "Default", + "resultValType": "expression", + "resultVal": "{Query17Stats:$.Total}" + } + } + ] + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Tab4Percent", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "criteriaData": [ + { + "criteriaContext": { + "operator": "Default", + "resultValType": "expression", + "resultVal": "round(100*{Tab4Success}/{Tab4Total})" + } + } + ] + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "TabInvisibleParameters" + }, + { + "type": 1, + "content": { + "json": "## PaaS" + }, + "customWidth": "50", + "name": "tab4title" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab4Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", + "size": 3, + "queryType": 8, + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Column1", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redGreen" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" } } - ] + }, + "subtitleContent": { + "columnMatch": "Column2" + }, + "showBorder": true } }, - "name": "query20" + "customWidth": "50", + "name": "TabPercentTile" }, { "type": 1, "content": { - "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this." + "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." }, - "name": "querytext21" + "name": "querytext17" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2385,7 +2295,7 @@ ] } }, - "name": "query21" + "name": "query17" } ] }, @@ -2413,9 +2323,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query0Stats", + "name": "Query18Stats", "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -2429,9 +2339,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query0FullyCompliant", + "name": "Query18FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query0Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query18Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2441,9 +2351,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query1Stats", + "name": "Query19Stats", "type": 1, - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -2457,9 +2367,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query1FullyCompliant", + "name": "Query19FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query1Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query19Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2469,9 +2379,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query2Stats", + "name": "Query20Stats", "type": 1, - "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -2485,9 +2395,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query2FullyCompliant", + "name": "Query20FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query2Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query20Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2497,9 +2407,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query3Stats", + "name": "Query21Stats", "type": 1, - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -2513,9 +2423,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query3FullyCompliant", + "name": "Query21FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query3Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query21Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2536,7 +2446,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}" + "resultVal": "{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}" } } ] @@ -2555,7 +2465,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}" + "resultVal": "{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}" } } ] @@ -2589,7 +2499,7 @@ { "type": 1, "content": { - "json": "## Hub and spoke" + "json": "## Segmentation" }, "customWidth": "50", "name": "tab5title" @@ -2630,15 +2540,15 @@ { "type": 1, "content": { - "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information." + "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information." }, - "name": "querytext0" + "name": "querytext18" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2687,20 +2597,20 @@ ] } }, - "name": "query0" + "name": "query18" }, { "type": 1, "content": { - "json": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." + "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." }, - "name": "querytext1" + "name": "querytext19" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2749,20 +2659,20 @@ ] } }, - "name": "query1" + "name": "query19" }, { "type": 1, "content": { - "json": "Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." + "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." }, - "name": "querytext2" + "name": "querytext20" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2811,20 +2721,20 @@ ] } }, - "name": "query2" + "name": "query20" }, { "type": 1, "content": { - "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information." + "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this." }, - "name": "querytext3" + "name": "querytext21" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2873,7 +2783,7 @@ ] } }, - "name": "query3" + "name": "query21" } ] }, @@ -2901,9 +2811,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query17Stats", + "name": "Query9Stats", "type": 1, - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -2917,9 +2827,37 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query17FullyCompliant", + "name": "Query9FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query17Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query9Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query10Stats", + "type": 1, + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query10FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query10Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -2940,7 +2878,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query17Stats:$.Success}" + "resultVal": "{Query9Stats:$.Success}+{Query10Stats:$.Success}" } } ] @@ -2959,7 +2897,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query17Stats:$.Total}" + "resultVal": "{Query9Stats:$.Total}+{Query10Stats:$.Total}" } } ] @@ -2993,7 +2931,7 @@ { "type": 1, "content": { - "json": "## PaaS" + "json": "## IP plan" }, "customWidth": "50", "name": "tab6title" @@ -3034,15 +2972,15 @@ { "type": 1, "content": { - "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." + "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." }, - "name": "querytext17" + "name": "querytext9" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -3091,7 +3029,69 @@ ] } }, - "name": "query17" + "name": "query9" + }, + { + "type": 1, + "content": { + "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query10" } ] }, diff --git a/workbooks/alz_checklist.en_network_tabcounters_template.json b/workbooks/alz_checklist.en_network_tabcounters_template.json index ff79fc7ed..ed95b3277 100644 --- a/workbooks/alz_checklist.en_network_tabcounters_template.json +++ b/workbooks/alz_checklist.en_network_tabcounters_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"34d85edb-5614-41cc-921e-6d8799f040ed\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab0\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"5b00ddc3-d5b6-4b3b-9940-58f4b0e1e31b\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"10700cc4-a0e1-4175-b40b-a1ba29983df6\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"7f31508c-63e9-4612-bb80-21daf3d5c7b7\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"37e10656-8c70-4bef-81e1-63be8f4503d9\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6b9db623-fee7-4997-aa68-e3871ed06131\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"85482b61-4c03-4527-aef7-823e11ca2196\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab6\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Success}+{Query10Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Total}+{Query10Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab0title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab0Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab1title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab1Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab2title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab2Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab3title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab3Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab4title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab4Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab5title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab5Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab6title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab6Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"99f6ced1-3725-48ff-9c2b-204ef4a1e6c8\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"48149b48-5e11-4480-9f9c-10930e974e00\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"dbf08e56-7960-459d-bfb6-940ba2d85825\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"8db67660-784b-4bd2-8539-1fea260aa601\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"5b9d8901-5308-4fe2-a83a-ec520bfbdca2\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab4\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6b75031c-69fe-4b0f-a48f-046c6aa0147c\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"07aeb181-fba3-42c7-a108-4dceb64b3198\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab6\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab0title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab0Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab1title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab1Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query22Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab2title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab2Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab3title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab3Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query17Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab4title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab4Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab5title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab5Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Success}+{Query10Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query9Stats:$.Total}+{Query10Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab6title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab6Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/alz_checklist.en_network_workbook.json b/workbooks/alz_checklist.en_network_workbook.json index 317091a56..8329e8280 100644 --- a/workbooks/alz_checklist.en_network_workbook.json +++ b/workbooks/alz_checklist.en_network_workbook.json @@ -70,25 +70,25 @@ "style": "tabs", "links": [ { - "id": "a5f272f5-6396-4923-bc6a-e75b5a8bb6b5", + "id": "cd3aca28-b016-4a24-947a-643a4c2af387", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Internet", + "linkLabel": "Hub and spoke", "subTarget": "tab0", - "preText": "Internet", + "preText": "Hub and spoke", "style": "primary" }, { - "id": "0ac8752b-e9ea-442a-9522-f02af89b45a7", + "id": "8edf1cbb-92f0-4e3f-bfd2-8aea041199bf", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "IP plan", + "linkLabel": "Virtual WAN", "subTarget": "tab1", - "preText": "IP plan", + "preText": "Virtual WAN", "style": "primary" }, { - "id": "5d8a00a8-c917-44b1-bffe-07147e5cd0ad", + "id": "eb378e76-01d3-4a51-8062-e160093995e3", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Segmentation", @@ -97,25 +97,25 @@ "style": "primary" }, { - "id": "4798c0eb-6542-4fca-a5a9-5a7e938b8b64", + "id": "70af1a96-4073-4b33-a445-e6455bd95d2c", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Virtual WAN", + "linkLabel": "Hybrid", "subTarget": "tab3", - "preText": "Virtual WAN", + "preText": "Hybrid", "style": "primary" }, { - "id": "b6f69f78-ddc3-4368-8e45-219b5d9abd1e", + "id": "05c56fe5-649f-40e6-8535-f06d61541ed8", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hybrid", + "linkLabel": "IP plan", "subTarget": "tab4", - "preText": "Hybrid", + "preText": "IP plan", "style": "primary" }, { - "id": "e19f6153-ac78-4d1a-9cab-bbcd0fbc2f7d", + "id": "3d874acc-5197-4c39-9f23-4ab27e25f2f4", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "PaaS", @@ -124,12 +124,12 @@ "style": "primary" }, { - "id": "91837681-a4af-4db1-b731-6602704c9314", + "id": "5f031f55-207d-4f9a-bc7b-1450ed966670", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hub and spoke", + "linkLabel": "Internet", "subTarget": "tab6", - "preText": "Hub and spoke", + "preText": "Internet", "style": "primary" } ] @@ -145,22 +145,22 @@ { "type": 1, "content": { - "json": "## Internet" + "json": "## Hub and spoke" }, "name": "tab0title" }, { "type": 1, "content": { - "json": "Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information." + "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information." }, - "name": "querytext11" + "name": "querytext0" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -209,20 +209,20 @@ ] } }, - "name": "query11" + "name": "query0" }, { "type": 1, "content": { - "json": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information." + "json": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." }, - "name": "querytext12" + "name": "querytext1" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -271,20 +271,20 @@ ] } }, - "name": "query12" + "name": "query1" }, { "type": 1, "content": { - "json": "Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." + "json": "Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." }, - "name": "querytext13" + "name": "querytext2" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -333,20 +333,20 @@ ] } }, - "name": "query13" + "name": "query2" }, { "type": 1, "content": { - "json": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." + "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information." }, - "name": "querytext14" + "name": "querytext3" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -395,20 +395,42 @@ ] } }, - "name": "query14" + "name": "query3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab0" + }, + "name": "tab0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Virtual WAN" + }, + "name": "tab1title" }, { "type": 1, "content": { - "json": "Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information." + "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." }, - "name": "querytext15" + "name": "querytext22" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -457,20 +479,42 @@ ] } }, - "name": "query15" + "name": "query22" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab1" + }, + "name": "tab1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Segmentation" + }, + "name": "tab2title" }, { "type": 1, "content": { - "json": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information." + "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information." }, - "name": "querytext16" + "name": "querytext18" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -519,42 +563,20 @@ ] } }, - "name": "query16" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab0" - }, - "name": "tab0" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## IP plan" - }, - "name": "tab1title" + "name": "query18" }, { "type": 1, "content": { - "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." }, - "name": "querytext9" + "name": "querytext19" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -603,20 +625,20 @@ ] } }, - "name": "query9" + "name": "query19" }, { "type": 1, "content": { - "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." }, - "name": "querytext10" + "name": "querytext20" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -665,42 +687,20 @@ ] } }, - "name": "query10" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab1" - }, - "name": "tab1" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Segmentation" - }, - "name": "tab2title" + "name": "query20" }, { "type": 1, "content": { - "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information." + "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this." }, - "name": "querytext18" + "name": "querytext21" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -749,20 +749,42 @@ ] } }, - "name": "query18" + "name": "query21" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab2" + }, + "name": "tab2" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Hybrid" + }, + "name": "tab3title" }, { "type": 1, "content": { - "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." + "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext19" + "name": "querytext4" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -811,20 +833,20 @@ ] } }, - "name": "query19" + "name": "query4" }, { "type": 1, "content": { - "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." + "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information." }, - "name": "querytext20" + "name": "querytext5" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -873,20 +895,20 @@ ] } }, - "name": "query20" + "name": "query5" }, { "type": 1, "content": { - "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this." + "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information." }, - "name": "querytext21" + "name": "querytext6" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -935,42 +957,20 @@ ] } }, - "name": "query21" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab2" - }, - "name": "tab2" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Virtual WAN" - }, - "name": "tab3title" + "name": "query6" }, { "type": 1, "content": { - "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." + "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext22" + "name": "querytext7" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1019,42 +1019,20 @@ ] } }, - "name": "query22" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab3" - }, - "name": "tab3" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Hybrid" - }, - "name": "tab4title" + "name": "query7" }, { "type": 1, "content": { - "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." }, - "name": "querytext4" + "name": "querytext8" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1103,20 +1081,42 @@ ] } }, - "name": "query4" + "name": "query8" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab3" + }, + "name": "tab3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## IP plan" + }, + "name": "tab4title" }, { "type": 1, "content": { - "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information." + "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." }, - "name": "querytext5" + "name": "querytext9" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1165,20 +1165,20 @@ ] } }, - "name": "query5" + "name": "query9" }, { "type": 1, "content": { - "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information." + "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." }, - "name": "querytext6" + "name": "querytext10" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1227,20 +1227,42 @@ ] } }, - "name": "query6" + "name": "query10" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab4" + }, + "name": "tab4" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## PaaS" + }, + "name": "tab5title" }, { "type": 1, "content": { - "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." }, - "name": "querytext7" + "name": "querytext17" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1289,20 +1311,42 @@ ] } }, - "name": "query7" + "name": "query17" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab5" + }, + "name": "tab5" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Internet" + }, + "name": "tab6title" }, { "type": 1, "content": { - "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." + "json": "Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information." }, - "name": "querytext8" + "name": "querytext11" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1351,42 +1395,20 @@ ] } }, - "name": "query8" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab4" - }, - "name": "tab4" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## PaaS" - }, - "name": "tab5title" + "name": "query11" }, { "type": 1, "content": { - "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." + "json": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information." }, - "name": "querytext17" + "name": "querytext12" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1435,42 +1457,20 @@ ] } }, - "name": "query17" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab5" - }, - "name": "tab5" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Hub and spoke" - }, - "name": "tab6title" + "name": "query12" }, { "type": 1, "content": { - "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information." + "json": "Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." }, - "name": "querytext0" + "name": "querytext13" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1519,20 +1519,20 @@ ] } }, - "name": "query0" + "name": "query13" }, { "type": 1, "content": { - "json": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." + "json": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information." }, - "name": "querytext1" + "name": "querytext14" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1581,20 +1581,20 @@ ] } }, - "name": "query1" + "name": "query14" }, { "type": 1, "content": { - "json": "Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information." + "json": "Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information." }, - "name": "querytext2" + "name": "querytext15" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1643,20 +1643,20 @@ ] } }, - "name": "query2" + "name": "query15" }, { "type": 1, "content": { - "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information." + "json": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information." }, - "name": "querytext3" + "name": "querytext16" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1705,7 +1705,7 @@ ] } }, - "name": "query3" + "name": "query16" } ] }, diff --git a/workbooks/alz_checklist.en_network_workbook_template.json b/workbooks/alz_checklist.en_network_workbook_template.json index 2a6f5a4a1..48dd01399 100644 --- a/workbooks/alz_checklist.en_network_workbook_template.json +++ b/workbooks/alz_checklist.en_network_workbook_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"a5f272f5-6396-4923-bc6a-e75b5a8bb6b5\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"0ac8752b-e9ea-442a-9522-f02af89b45a7\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab1\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"5d8a00a8-c917-44b1-bffe-07147e5cd0ad\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"4798c0eb-6542-4fca-a5a9-5a7e938b8b64\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b6f69f78-ddc3-4368-8e45-219b5d9abd1e\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"e19f6153-ac78-4d1a-9cab-bbcd0fbc2f7d\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab5\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"91837681-a4af-4db1-b731-6602704c9314\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"cd3aca28-b016-4a24-947a-643a4c2af387\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"8edf1cbb-92f0-4e3f-bfd2-8aea041199bf\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"eb378e76-01d3-4a51-8062-e160093995e3\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"70af1a96-4073-4b33-a445-e6455bd95d2c\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"05c56fe5-649f-40e6-8535-f06d61541ed8\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab4\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"3d874acc-5197-4c39-9f23-4ab27e25f2f4\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab5\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"5f031f55-207d-4f9a-bc7b-1450ed966670\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Consider the limit of routes per route table (400). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium for additional security and protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]"