From 503b771314cd7864e924d7df51cf3a7595430252 Mon Sep 17 00:00:00 2001 From: Olaf Hartong Date: Sat, 20 Jan 2018 22:21:14 +0100 Subject: [PATCH 1/6] newer sysmon TA --- .../add-on-for-microsoft-sysmon_605.tgz | Bin 0 -> 16544 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz diff --git a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz new file mode 100644 index 0000000000000000000000000000000000000000..381eae0d15114dfe7214365cd88b2471c950032d GIT binary patch literal 16544 zcmV(#K;*w4iwFP>2>w|B1MPhWTol*yI4Cw0CC0?A%ZUnll%om?iWEUlc zNC=Nlhzm;&g~ei2D=aE8DIuzTGAuy=B<@5QC8ssC0U)P$w`Z{tu{{zIdL^k+5o(Im z5C+gw1Eo{z2~r~?q>M&}-y-CUjxg#eF`=WhI!0!c!eTKC3f7g;dV`M6Fv4vy{D2V`qk%Jo=)MKPZHKj3F;>GB!5R)?6Tpg`Y8VDv^L+J>B z5_pj|Iz}ZXNFBx9s1VX(*c(`C)X2bVQbr9F5etc} zNMzFnC5D3=bSEMh9l}Fv)M**OF(#_=1I~?+h=n3TUC|RRv@3p<$))F&5HOBz*V8U~Nj0T{U0KQ-hz%c13JqHnh z%%C)Y2vQmhr5SVqo~9x1!Wcz_3wRg)(urJ!qYnOqG|8f6MhHts2>F8rK;-~zX+1;) z;H{?hdc^RE&#(}nVXA>sgsT@%}6E>k{WHjg+iKL1f zU|J(p84)Rf5E2^3K&WUn4O<7}2xqr!$XG7Yl@la^ z$%DX&%{$1#u;?Zb8!Zh5ib2S+-BbWh0DS<(W*ru4FVNF0tiAOR4whXtC8J5gkgFAT zJB86@S}BEWP>3)_dI)lwNd#yO*9~3(FzMKCsYw}7Bv~Y_A~RH+{0sDw7;00@;zsF+0&kRW=IB?rJZN~QtZdlnL=0f%@7sfUB7L82&wZ9wh^ z+=F!$Yzhq*l!a_1EmaDX0T?U;m;-=h>ZmLl4JG7aKpIv~2ntY`(Q$VG1Ut+^X<~uF zS&q^JPC?WsL1T;x2?cnKR?r&IiuIUV>tjw&$<4%HOjweSr5@yFcI*&%cGl2QYLe#V zlhTqp#3_(2s2gfZN2zjw9B48T;W7ZXKt9osYRZ)xbQ&lkot%`SNkS}`BYC1)AqA;J zF>=$WheB1(&haIVxTOs6A}eT*Cm<_u++51z0fCu~3F2WHYl(1>7)%@V7I^+XlWma&bjHbI%XA7aB0<|(~9`btz z1&ApJq#WaVqxL=o>$A@B}xSZP{#meEQX_yL8=fRW$WO38f1JJH7xZB zC*g31~!G1z%PHlM+A^Oj*1s1ROO3rPd2o zIGA&d6r4h&XpUrS;NgceAGTI_TT4iEu|SQOae;u^kZ!=nl^XSEmPakBk-lWj$P}dU zOj8q;!x6!}uN*&uuIRP2)W{h1KzP-pE)%Lgoyj`lOfE`KD>O*=16G7%ga}(ACqiW< ziUss038AdIi>yW1!oKFa%}L+~O&%cup?*|bG)gD|G8q)$CtxyCNRtDkh3%MxP*3$T z0{&6KW~B_EH=eGc!7C6ytcbkai4M@Lg3X5V-RCSTBGHH^SC&^xbY=u%Ce+Flm?a4T zfe5HV0M5vYLv{f$4nZ%0g{P$qfHEBW0oA9HWz*2s&@dV|H1c}TV|eQZtR9^LI!;V3 zsWRlc$#oRCqk&c;Dc!0bG0~Aj}rTafHIxgTfN^5`u23!sU zXCeUv_1GbDCA7G&g3$x!Ism35vnXWcaR?zlnvu()od+fXN(Iy}{ugKzMrXhS!|MUo zP-d+{q-MCDK@#9G;#wuOS`~CR84Vb8L}jSESk$B{k_Pm~bp@RRR7608)aCW221u`7 zPwHqSopK$}KAcBG(cIi86nq!GD{zAu4aLrgK>Y!WgtzL^YnCr?9l{4U>$qQyynk;n@L-C>%YGS4cf)u*pCn$9z0>0W|0* z%CIW%aVHWeVPwc1HLWIdO`6S83jsYybGD6{J}Sk^Lqh`1M$niMC^^JO(4ql<8Gc4K zcboAP{vJ&xHn~EGASTvQQxqO$IimtT5uV>U-4)2qvo547?x_)QngZer(Zl`*7*-l| z5h^XA>C1bE@UrSCiRK4OPog!NM!7aK1a0ELjmeaTeiZcIaZpDGSqQifvr^U}Da07P#=pI{+A2c23YR-=K*h#8ARav!j^h zZZTAgG78#FVu3M%Skzz=H@0s$1W^J$mMRrqCd&M1LJeRVTOhUMFJ-@ zNr}BMsK2bqEEsQOJYZLv5Ap#Y!sNU{3&k8AR<@AF$~BA4^V0??lfmCQ=Z#mr=?Cq1m=PmfD9!H6N**= zp9$LmI-@23VZyv`-J(PinY;>QwxVD?HUKOFUxJ~4K-hi=QHCKo8d|MpR&EIvyeYI- z!jcgNBUme9G}@Q14D8Yrrh3M}tP?fQF$e9rsXi^IK||q>Zo2unq57D6S^LZ37pc=kb;SyQN!hF zhz+1JusfungX~c7P6v$CTE%BMY2wC>oefHu0x+fg-H9+-k6b6XXe%dDfc**RlFJJL zk7`CPc3_d`4P7jg8bG6noEK9ROl%r3R`&HKR9zshFlb=uq6%xn@TJ+{y27{?Q2C;e zL?S9tM6?e{j7sE)n-Y~28JCao)8)duncJ*6&;n-1+h>>R8nksB2FI&VPV9FB!B@+jt)s6;*%5N;}XO1 zY>QV5Rd8hi;I9RZ(rDEIt;}Gr(41Ys$mtlZj)vwr>aZMe7p#K#&!lk$@lqUZ)a!vw z1iQS#^Ij`=aL$bz|$6lTDX-gz(59J$Us9WR5Y-@q?D_eU+or~g>w1G&ja%k zb14C)vf@|x7)n_13z_7(j3DAJSFo|cykWRnhu6&EEY8o>aMjq- z(M8lW@;b(dOK1%{m;${jj2O6-x+czH1-q?cFvBVsMwU&hgt5a+Fex)yEeWH9&?YcK z#N{NdGV1VbM5^RQjmfw{lVAy%AaE4`GOv&xxM4~U7zgqpG|(*raV!izm`=*FXtYQw zXVW);1h7Qlk{ej?SONmvi4ZBA6Cf2h%?n!&F-_D0p-53e)7@NLEf)(*U2fy7P^pq( za1<0pI?Wc_QOp(CZE_0f6QJr4hNMPH;ZA6A7?jn1xrpy5wFah^m;z#$tSSz7g2_;^ zQ7B}$ctEuSEnmFU0{R2xh4rs!PJ{9eMkJFBJt6E$@&rTl6aY5$4`sAyRD#tI-sWbP zMNklzEryEJq(%|G$kH*bqL?(gDN-b012!fMeI{Ct^)nQBEboXma-KFaN)Fr={06X$ zWhI2pNu3&LBF?zxsb~^sqfTd9En_3cKqmvQ96GBwh$^;@8)xLQ#)hdwxsU=Tn)1ec zwtyQ2W+RUaX5jGHFgUN4lm>^Mhs4K&Dp8#S;Si!|0nn(qZ2E#Qbq_v6sAThNN#IKQ z$QQ(H8ijc@fitTaAT>JRh8wu3hS=oE%V|m_(-UBV0K$%yeg<5nqyT4%`t%d=iVsC5 z*x4?ZVy>9nD{&%tal)owgqdm zP*(K0K%eLE3!%uV#|QvD0bW$;;Q|$|&BjSNEspA9z5!eYEmrJyAv06UO~%~PY6fLW zSwSnL9431Bq6i>|0@qLni{M;gzVgW?zd$qr-wt1@c9ut#a6_&LiJGJ%t1&M#tN1}NbIEAUB{uB{;m&H;gvkLN2kUe4L= zw1)LNkuKy}h_`77lbg?Epzs)J7Ng@hmo#wv{h=IFHrLq=pp0Jm7?b>c#s-^Y2Ehno zXx1rBaFsw<;e96eC)(SbrH#mzNKs}ea9oY-7{DZ;YZ`?Sa2T)wz&xO_Oyy(4BPIh~ zZ{06<`+qx|x$OF@S4sK*Du&54YW4r-{tsWzvi%?b$W_w#t0@C1BMs!|Vt~Ih{{Eh2 zB_!C)v?w; z7>rIwQouJ-$>2UB80~GZV`TcwT)rKF#|2)7CY~PHcnV+v88h601?eFJ!(~)SxvT|? ztArO~=uD~;1w#~+?xSBa=op0zpg?hcBWD47gaLOVkU(@KJb>|~B_v*AXjuDmHSroL z%&re4I;&MFv?d&e;-VQvplLursf@|ivjgK1r=@i4LLvty5@*L#Ic^3TI13Cwk&pw| zgtE6!)}j=ZNMLC)y4+HS)1Eh%G0G(&%-7{QfWs8XlGISygq$J`MjZ}wnHWjpX$IN{ zfet7gay;+_5m@Yl5K`cD^Nx(W89eXz!AQ#0!u=3B7_DPXV1zUd+d*$llZmoH0K3sL zA`Fcp;Zo`#yRud@&R#Vo^_XGg^*)RupdSp(a}*!NHnj}zH7F%WCsoT-Kty2H2Narg z;H$!PG%+s;(5*ComQMeZ-IaWNcOkTxFkdl|7#Si#|9biQ0S7ZCJ~AXR@I~D~ze-hvN{d=9^ zs`>s+)P1=+u?$X$g+T}{N`(<_hT`KDXlD#cM&uK%092If!sbhH0Ha`3Hku)2T*@e$ z-3Z^6Ge!-15ib6dc-f?VVq6$>jr9!BYpfz9{0V@!frrUvxx0Uu(A*mzPw0c#T7^0)zm%K|sS2)d?j<%Fr@0s>eZrbX>+rh0-lnLa8bhp6I6I{QLAEd z(Go-=r2|;Qqzn!MkjiXQCj(s}bVdyd(}IS%=@BhLp!6OS#UV(A4jAVq$A-m<;*)WS zaE%_W=c4yvlpew0Q%X7d`nki%K2U|Q0BQ;z8J@3DA`sllO5qf2E_;SWuyaf_n{uFH z6x?cxy~*NYqxBi!soot+4H6*WF8Bcb@8Rjg%95L(o0l8wa=5{Wbrwx!yXB}=ZV0>^ z1mMAUkEKRDwva;+H837}obE?UGlALxmb6|ECJGsniBLuj21OQ4n-XfFSi~c1Tkw!o znDCehv|Shv38Pbx8oD>1_sOVeX)dBI2MjixL7A2s5Z~%E1xTinty_>#Un>5#!_`XGp7BL}- zoxmRt1^;@4`LZZn{DauCLy46A$8wFAj|X@M?T^+d+%%K{8Ut=%MwA0J>IPLLtBu{j zkh-zT+TNb^a6e8#aEwoK`yCCrocaT#PYQ7-LiA|eR}3jjD>uLGz6S^ z3EBY06gcVtSV4~l-VjMM2buE(=xzrA$8oanR^lF&!_yP&z5}|3JU*XveaF;PU0|Bi*>x~KpG+Lo5 z2LfwNcndOcZJ6VR(ud7yi}NOcy$ksci9X!%g9brEQBc6GQd~ILuxUz#a!vUJO_)q3 z&9!J2IgKc$VW6duJ#bn_E}M3T_UePqnWlPZq2vg*6GJ_KV?#9bDm~B|GENLd3F%U( z;bCQ#?Xaphc~P-(N#TKT`$;a^+{2~n0Jjxx0Fkm=FW3o!Kb3)R1)vTmMznHIqH{%f zKLKxoLm?A5j#|cmlfYC+*OM7WHU)yz;Dm}yybDqZlg-s6%!7vJIrLGopd4hFL;<0R z6G+&tBmfdhEnwGjX_Slw(Q)UxhBh!VFzrW$wvG&MnKzX!Q1WtQPY_t1PYy? zN>HP--jJJ=aDi-z&$>XUpbZ;pTH~eyBv&DEVXb+!*1&hmg_J`lfw%S8uv-j6X&$g6&clM+F4Vv-L?Z)55FllWK$%P)DI3x( zRpYnej1H-iQj@GT93%oRs3;hKY7+^(=@69y46Z?`)(5v}<6%((E1~dy1czTRLZOY5 zn;RHd1@atZI>bMGE(}(n`1Av4oV&RRUSfBi=?Q+Z0CGBKX7g3U5KPo(MuWVfAQ7uP zM8PZ-+9dK#@EO)YBCY{ZFz>Rq@!)HI?7P_*A*(mrc$hE~^eP;q#%o|Uq|KinhFl6I z4P**C5m}7N2$eqHUvmrp{ar?^P%_Hc8f)W$s(jQ72GE*Xo-O+;@1REh`Ws3Ql;Ur_2e=v~<^8pnGYkx)`U~~r zyCg-%#hSg)#>0%k&6z%l+p1p1_ho$lKg#z!kF(`qKBcfMB%#nq8RM5R{{I%^n{zm_ zBt0xmNnlF9A|L5uLEwLDXFHaxuvh%*p?6Uccu4#?P+KyqNjWQ!iaww0Ppo zrHf9UeA~It{q5)1|MKRxzcFq0Oy}(VAp@LSU#Gg<+_Gl&5{dVucg+>W?p4|~t9vqF zsa?BDcUJnhbZvTbN*hJ_YT8|f1v`%PF0e^>Bo4pqm$pQnwXRN9fYJ9*0OdWxX^6{@ z4Og{|n%hNkWI~kvq{>6`hYb6o9rLwlCRuA4O;kFzuX>9?p7NNT%e`M+Q7@?a)61&z zh}{FqhT7&D!&cchRUpou%aJThQva=_N@TVMUQAh5u2 z^USG{ML(=eVY+vJbNtcMbLX^c{uIT`s#pEcp6~OIJg?Szi7LMLvy|G+pXA5UZSx2E zC?oboY;8T>ZNIkj(dU2ser>WMJy-wm!ofnf;HwwN@*S2C&ni~i(B)O?4@*Zc2uWT% z|MknCa@yP(JNox8YTNAlBGjvX(ABPKUAAs~`cOUd_|e85r|wO>xVT_#ep6;Q@{PV`sJBQ}J zx;ruc=<(|Pel-04{Nib5Ue3eAmoG1hYpg!8FMR5Wd*1666OxmcG=B5j+=n?T&t=S$ z?V~rwG~PWhZ_=%4Jx|H>x(DZ8E`C)%d+^pF7cXA??T?e8`;YH<^zx^w!d;Cii7p=2qvo;gK3PCK!o&RA9R!DszydD>3-{oDBJizf~Ds#|L-wQK3j zgT%U!j#0D1>QCCbLawNI^xE|C^SAslWHdAP-OIkg6`zl2{jTfQx8sX;ZhRWGa=*R* zU6*}pLD>og|%{hB>;AoHOl6SnQpn*LsYo(rQKb zKDS?AzP01=%jH$87PT+0x_0o<%O}s)zRkVAXm;x--yK^2T}+PMeDi!w3n9GYFEyyg^g@x{sfz!lLpsuyji@w;e#>uZu43{SsjpmVcf%==RMLk zKYg|J*;>Z$T7^^HHe5Ym7my^XIPh>*>%`N`>kN#V>3(%@C&;`aXLib~Yg@jW zSDi~Pqw<%ez1!1gXIfh7%DWYlHIMGq@eaLjAJEy(Yl733ddhMWeFmOB;=E<1%cS+2 zmJhpddG#U3p|$~42K1E{O;ae6W7iQ4ntXSndCj4dCOQmEJZICS&f<%)bDw&Oh}voG z{nieSpV7z3Zb^(oPDH!S>zlaLI6NlF&%1ci<;n9l7$eFXlK$A`X+zjHY;R|`c)?_O zclm<*6)Iow?XcF(x%0i%bC(BB?0O+_;X;KhDZS~C3eE#hziU=SSwM{i`yr<6@>h#s-L(VRWFuTH~HR{F;D}GF!D>&;s(Jj8!n6U2M+8i5^ zG~>jq^~1kuIOF*Ki21RO9cxYQGA?5D=>6|n+cd85mf4%tECkM9QQ@&+Yufi1{I5-* z|K-<*?Z0%doKG|XOSk_d5-%T%@4t9SJblaTzklQ^!TyVc|0DbF(s*Y_n@_j@YKpP_ zcP90+uE}|0TIT%I4g-HRwyNDx8ny9WQqiMETVIzS_t+upk@t%+uVaFprZ!)i^nLzA zZBF?rHSJCmD%Q4{QyekmMx<`B++4WuP4RsFgbm|d0x+t~k zk-|Pbw)cAX-N2$<2OSeS)=x1^&##v6?cUV(<%nLr99!KPxI5Y=qhe^@v$Olh_uY2j z`Oi&WG>R%OyXhP$-?Q=fiwi*$Z4Mlz7dHrr@JfxAH6B)H%lzPsmB#b^a@tQMrb>^b z&0_*c)vcN11GB5?bEZd*xmhu+T^$>5Y4xxs1n@Xey(kG56Ul7=1;4|6c8YjkI{HoH@qmGx#cgW85>)H65d*Wt& zj~G>VHynD=U~sp=Eweg5*%g)=-}cdzU%IZ{G{a_mkIec}$|j@UR5+P_&9V2NPu|@v zytK+=Ve@e|U$tI!>g(RWSIUU4;c@ZHCXha1->>kd=TU%q(I`p^}X zj{Naz?t}+HH7<8>zR{N0y5+&8=X=gwUiYleqc8m4w3~U(ujw)Wh-%R{caZ75cLvyv z3bAS0Zd#Lbi9386E_JFrsAfZA*}Xp(4ElB7={|G922d4p#>aaG?Y6(XbPFS%sPECg zjeW%`d3NXbs|Mrr*)2x*me29@ba-PH#$t%TyFP+s-xd3wr>s` zeVZH-l)p1BVBkpiRUs#AoHj=+DxBWI<51_Tg@wn~$Tw|zY%JK=zE_7{vSHu!bhdTv z(`-!s%q|DsENtCoWR*4N?DCp8>f-aZc=oM%>iW6FpVp1Lz1*)jYP9c9T_fY;M=g(7 z-@4z6dy3=Fy1RWn`tZTCMQ8V(eVy0w@RIJG9>sq#HpFw?o2pT|700LFpF1!hvd->m zM+PidV4u2pm78+?*nl?&syD6Fp^4k%7P*6#L??TWU9w2gyhD1=8f&XhFQ{GM|6s@F z8QTNq_uI5>_W5ld5$h&7wqIAL$$}QE6MH7qJlG?mUKlZAaNeah^XOrjyQW^Pv}#lG zj{Q!Dx?SFJKEn_{uZM4!qQSPc1}zd57fep9>BNuIog#Q6hAwuk!_zd;~m`m#3vr~y4Yd*@JTMS zDirisUv2M&_Ns&x@!?}^quck=J-?$=JbRuqAnS4Q{k`W4Uc4xJy=ujS6&sq}?Yyqe z#bqv0*>T15ZrHV(+)a1#QVW-heHPaauDp58(8}@8?>`tYw`kLjlUH`w#5wua4zJi- zR!{QPWF3<=wTy&T4$BmUmUB8C{;AAMomj{ANv$7rh7>*8lamx#ybH=$`mPZblE= z>>)#wrZ|OFoMJODeyA>?xKVM#2aOxtZx~#)m-G0QuU2$l+%vh4h-^oc4{L7wKeSZI8in8eF|(A zl^=H_a%lTwOX8L~sGBFxlb~Y?c8dSw!_*I|gtS`M^BUA|zr<_b_hU{Exm_@1&-FcT7Kx_Sd{BGklkeA@n=1Rd z{fLu;N9vmHuF~c1;s9g*fc_U`9fN`?(|bUX3fP@H4<=~zbYrJDU8Z%vo?aBccDDRuUa>&xpm zbgX${SI^Gno6V99++Ah*x#aDg-EJPfJp0w%t!Izkzti)q`0KN2N4InwJM*ir4|Tpb zCae0hd5!Nij@ftmpwfS6=V?t8y2bgkBEBrzTsRBUbS!L`Vkc_K9ydLIJ4;d-SuBq zZdX2aRMdgqIfQ+v-R%i8!aQ3=kE0)`sLeC5gK#me9TeS-UC<-VExX6`MIr|A#I z&ur;o_@H0A_j~;6 z$Eu>VjTKuCDz32IM!GTK(A?(axq%KdWK+q8&0@6Ae!hEI9^AHdP>`GY<-wEF=g)ur zdURa>Uh4+5ay@kA)_%`=UriQ`Su{2OUF5^Dp@B~AMpao>^h2MyJ-siVQM^bTQl-*Ks(r|fE_%?q7c^r*0Ex3S0Egk{C`cCMY0vHOX0qXs`ufAUSynj80L zR+D`9P313F{8{T@{)q`!CyuGK=69Q|3+*nEGbD!=I<{OsamADsOP1_j6|=zoK|ST= zcJ0rfJKZ3>qx+za?P8oeFPNy!xqc}3`(`~CYF7O4_3m3=pPTG8ZhVdOHf>-2saU)7 z^^LuE-`ws`hF2Q%oy)K#Rgx<-a|z6F@T;?I#LVwIl~Y!`*u%Z!gkdgKM!C*DoH(`T z;EEH=y$;%S!E4KR<0g!3`Rj?U<>oq_s+^;X`y+qKujLk*h>e$YM99G?~yl3*R=(;n8EL>LT zIzC`=jTNm1L?#V!cHY&a+Jf>23%v`5eChMkuM3yQuRU|7Q9z@y&0f7~zINV#mwOLR z_n0?-Tbth76C1=v3=fwaYFwl&zB4=)N;B z=f%Z?iv1n-H)&ALcHp9}-#$y;zT?N%Tj$K*x%qkTEPYn+fPz(wHZG$ zw+Fuc?eY1Yt%3vl?-;P{%fp2a4MU?M&h{{#ztX+i{9|i8uFe^t&wX5c?`GWLCw-@C z99wj$knd;r^V9Z;mlwOlJ#I63<)C^edN#VBma(*Qz?DI(ZaHi})AeF>m(`u@Tto*m zQ@&r2kq~=bsbF-vA7353Dq1I99){-C_1~tT$^qSH>anszO(mi;fp7QXK%mQ zRB&-?!Ak#4hwol~a^xGQbHi+#4c|K0)&IQm$*R>g@7DLPW!pZ$rA_txa!+pdJCt$n z-Qy{fn$OIrd@`@f@)hShRru=q!?%YQ#m#RxXIuY=+53mDjjO)nLgU8K`?tQ?&~wEU$ZYc#HVUf|^sK-CB3(Cn0g!?W8SW!CK2`nl?ajttsu{E;O8^)xMZJqShhGlZbDQ1`Q;Ml(x-kTwT1?y=j(Fbz#ektm%tZA6#VD`B=fcDc$mVR2wAm z{5gqSzvkTZlv|4Fw|<%T_Q8vL3@7+YYTda!S|m;MoVy>?jC%aZJ3X zSK^4_zfGD~oU-AY$fn`OPK}B+N2(W&U%Js_d|<%wAlDSf0;1OPM;Fh&Ub!|l<-EWD z(g(2~?#E+2c5Lp_?aKMuW2TO6>HS^1$w$5%IAv+~ydD|KXLDo$@4gTPcKKp?{W`(1 zBkM1moZEHs^jCEef#h1cKS$rdT-?3$OcWl zYcCG$S;2Qf$nK!P0vk$Q-pO{Pc7g3sKhkjMx6na5YB+AR^@`t8)Tqyj3+D!FY&Hd* zXI8$e*gUlO;^2CnPv>8ro$HodrO|$yqXC-Vqngzkx4yvhY;MCvt7AP~?3;CN>9oG_ zQ0F|`dI{}*58v2fbE7vkZO$^m8$#+1vYFwvC;P-D`bWR7Z!MTow08CRf(FiAw)&s# z*fZmcy3$7e&0P!Pwp=M`*} z_ILMxKNKA4lN7VrW~p)EFW%cKE%sVEAuDmgFLnEk8dt;hiwe~v3EK!Fif&i!)z<|B zTpV7n(>rMfN*>gCHu1{hGe;j)e5tk@u%Z8>u+~??Z7b!EJTQM*^QDI_&1=`3P)o); z9XxUF?&f~O{Wh%b6xjDit@ra@JE#9NJabB0pJSP`cTHO!tZCi5&(p@gc#nTNGAi=W z-AeVB|GYVbdb6cV?91`;U8(0^2emyrep1l@J?y~#&JAFIcj=ic6uQqJFQ|?2}0&=$hrQiEBmKTjLe{FT`)j=&! zwOcw&)w5UC{7o0MLCsrVbL`x9zH)M<-y1vDxmx3%?X|}HW;94Ws+*nLEwpHl|Ab3( zch;yjCheZ;c~bX7OM0!Gsd2a|*}Romx7kipuz&o^n_ZS)oDk*e(K#$`-lMhmA}28} zey?T@b;y`fL;j?(%zxUDkcN$;-wfZ`pxMD;HyTaazpaWnGQyqY8&t7f&llpH|WN%W@5`=5%~?W4%iUqQjz*n|8LjHh53h z9%(7NL)N~$Ht3??y6&}ppORaLOqh`AGiyx5qCA)DhAk=Qr(QYyedR$LvT9Dg-Fy01 z{zG<#*bSI5smGAGGkbQYU*27p)-B2J6)-RM*{HlR;osP_7iJLXhv3~|!6&rwf%Sh+KTv2H z|Mf46|NbLaYMO&R+!CVK6G7;^Cqy8TO0*!-#OPo{3f-dp1O%u_<)H1nLF|4D2YdY4 zy&zn}!QR0>l{-8RC1}Hs7P?FIS)aQR{@b~Nc0P9-Xse`$`O!R0y+hu2I8Rfr2*L3@ z9?@}eos#3-{xjHp#_=!h{6DiH{Dd|>Apa7e04(L-%hR(={{M*!ads&DPBi)zW;&tP zULqE;S+@jEKor?~iA69Uk-aBiMxw~xTP%vjTWaAhN)7xfw!M#7#O|3%gu4qx_P!=y zd=9V3-cKyT`#{j{CXv0rScLN<@og)yh;1o>Qp59Tl9W((MD_t6HuAN z)6@ih0Lmn02*X;S3kj40p1zvPeI^_4jz%X*s3=^^TTlxflR@Yy&)kn53u-bUQ^&3$i~=8wKGv32-eh zPg5=MGW@te$@L`G^^%xU;QE68g~P30qOx;d|7Wg}^gnC%!2|$wRKTaU@ge)q$IHty z|I^b?Ql|g^i7Qn_8Z}ZSr2}S%@ObhdcvuGhNDO=IgVt!khXN^Ku0PzaY1(>-wVQ)I zcTh+WK1UGSQKU2zsB{3ImVpN)Fr0(E6z&O42f)+0vwwmJ_yI5kfIY1Q0??;(`++G4 z3mtUmV2{5V6+}?z3qLaSl99&svuOO?7QV8I%%D`@))IMmB8?mKd5x?8f~z$7w>T8& zZ@2Lw`_D(>ZE64cO3LiNf8$$T}*mF^U+^{FX1hLkDH*7jTk4N64txO_o@uVsOsWkD;;f&j|`iKkVG6HmM?N)^hNhsVcA7_<~=Ju@T+Hjaip}rE zTm!Cx7TA>t{3ssWu+Q)@%HWBJglBb8G70lg<^9kVl&jt9$NSjL=fn+q{Kq6k_x>` zD)bSF;rXJ7zg&fcV971OMnH4?@li~6Fs@M=+JL?g3y_4-5|LQM7!4WlEOqdc*5F?} z_$m368M81F7{g& zm`SJV{Lge3%P?kmyX1rUJa z%~PK321^p_E|iFun5A7DdRc7Axnd%g%4W5Ie&JP`{cj)@pTqqBp#SgdW3~R{ z<>OUm|Nj$LDj(zzDk&1o{t_;(u*X|Vt=C*i0%Z#Fnlv*14wyHv>G2^breLWQEtv~n z0pD&}8q;aKvSn@bu=Q#((z!I>Aw4V2BdkcwUgZ0cJ2C zF0Q^cRbgaG2ssQUZ$LAg8+Hy`_&^BKSpqneZ%YFKqsNlFAT;D`S#fcSWt1A$dafa2xrXATDxSU~dgv4R9DS;AriaROlM_Xj`F zIkuK1I2_0W&=TX46GFq&JB4=vl_OE9sR@_1ZE(flQ~)2e!Zso92bzfaHa#RPj8Aw; z2#*gBNlFK;hDHYQIWQKHLdym%y;woR$d`qs!KvMWKi(~^rL(KKcw=O6`zNkcAmr&5(KT#Jq`_5Qt%}S|S266j=7NX}#-Ow} z<%NL~D_75+{eGZDfDQ(H#RQD=^C@^8CpMt{_0 zSLn^?`Vl!fU4`SULi&&On++0VpX6LsP3MzmzBGM;i&oI&On$+Qha~^3Ui8taZT9x{ zYv%S;FHqv$A@Rbqy4pruZLHTB IPB1V40R9qT^#A|> literal 0 HcmV?d00001 From 9a42d8729e0c0a4d12b7e923910b4e2f080b3212 Mon Sep 17 00:00:00 2001 From: Olaf Hartong Date: Sat, 20 Jan 2018 22:21:42 +0100 Subject: [PATCH 2/6] Delete add-on-for-microsoft-sysmon_600.tgz --- .../add-on-for-microsoft-sysmon_600.tgz | Bin 40960 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100755 Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz diff --git a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz deleted file mode 100755 index e44e316f21cd531b0542b1cc0f1d69bdd498fe26..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40960 zcmeI5d2`#ymB8m;vC7|}!*wc>!$Z{N8L#C;BgtcCbd@B}QTD70B0&lfNpJyDvXaer z-`{)P4S8CBEUv>y-ZUp?@@)z#Ifo15k< z`MdR0|E{iW*uUJ9f2Og%y4Bd&SZna$YGZS2W9uuk`M_|@oo<|tf&|domtm3wz4qLP zxXELk&WFC_zS~Fk_l`&ZmA*QkL;rTz3C6wAgYf~V`B?flo^Gu}|EFtD7xe#4*km64 z51PCCM`!yFwm$UV+OYCINB-Bg8jUS4|EsHw4d}nMwb}T}tUee7cTDsjF8}7fe>=mV zbs3t2s1**b4J#%Ihe_NXw`8)4+n7Atj?z&QU5w?v2~vX&jRs-cT-=(oP@hgsgZYzq+`Tm4 zn7G45#B*_L+z$t%X}IEK2C!B3R+**~;{Y z(Pc0)EZR*11`fKqUx$YR0AV-inSGsl28i)MHmJ~tCSYUC;-LTyVA8E01AqfC3R6~M zX%IR};$FoBi2$b;Jq5ZVyOF!&L7QQ%xQ`>^W^xajn`m@t=dlac%u5EzK8NFE7^kd~ zVKpPTr%~C>QdUBzW;t51L*tt;sX)F2DhUt~G?&j6Gm1?sfavm^1I2!&7)VS%7zEu= zh$ri&Lac-yA zR(m6~^@BEwD_kd+yTYKP73KzVX!I1FL^_XtxjzFEoTWiL#kYY2568bL@pff3;VSz|s9jNQEh zKPsu^+Hl+(Tf%7E5%a0jtOkCuu&bkKJslv_Nl0 z(P{KK(HCxZwA1OG)kwmA5P4&ehQlCHP7%DQzUzlc*tfr@lG(o%=Hgu9ds>dhfT8Ja+< ze9i?=EsLjeqQZHXwJ16&qLp=d;rELWAFKl^{Pt#7ndL5vIrvI_Ep^l?rkw4m?B){3 zPW(BimSM)QhvrUVlySvCg^K`>L?kK^TnyM=zmJ<^?TZm9@K9M+$`B=Z8l~zIs<5a+ zK(r<_^^_@cQ%$Y`26C9NauK}Tg`v|CvlUDhpsCMfNYsqNe(L#HR5&(wj0#MGmfA@7 zgyj;keAZhL!O+bXkuFT))kwBE;Q}GH^Q{Eg__(bxrXARH#lGrGt~`TO47S(pFnsUL z)#P5iu460dFlvqCafwbbqA{ZVMU>ltUsR<#Z;7!&?12; z%4)5gIsMt~DgQd#wrosz@l zf55EKg8BtGhwKs$Zy1hn20i;>3VQ7u3}*#qA5@j{DLaDl;CG`Eko7=b}T^M|vVF79|ZhT{vyf<+j0*b89v><%znQwz4; z{9?`uaa+;N&uoG^%QLzanmEr4Bo&+)OQ7`vfllCCNcHbeon?p`4iT)>5ORpcP{xFP zQgkU+WyK8bUJKO2U59X&0bY`Ld7exfN5>tUdv(pj9_lyM|3-aSUwjS-lj#BL7VFcf zBO#5Sh$u^3dI`Mzs=;vBlW;R0zy>M<#DyNTRxgMM?d`J#)`Q1&l7e!`_2vNSP17KW zR608e+K1g+{S*0+E*l9ZmeUo&;CLXWUYa}#-nWKJ+x-mf)I3Zrcx-0k`sr3P;)sqSeb84MIfyz z!ekq*cr5;ty@v9E=><3GI2y@Tdm$d77y~gSTcS?5E zbR|p@@NB$+IgHri0ME%`(rwStNivKxDmP%2Av3tFnNz6$Ey&B(yeO<`6E}(z4R4^k z#_vM?R*(n_5k8QiLp$5((X)vxFDfo$X<-%#-9_w$y>*_+m0N|ClW>H9i4&+#7eaV} zULcy@Tw&iH*CGv#L7QF}AZ}Qm!Zc3Aa%sge z!k|4<-5_eiI2dzW=NKw(t3ZMIv~~NIFDIDH+el%p$pn;%I=P+^liBq--g&$eCq*W8 zs|DWIGkKQF+U6PV14|-*#XYG5K?G>kIJO{ZSB1^U9cV@={QC=oqk{;=&gu65}m_vtd!vVB@}ZsKQB(k=&*i;@oT$rct$_(!e|#rGth7 z=ozkCnyn&c5(K0E#uH)%C>AkRF=zR~EIlK_EtYixMVa2TZmTBitpgwl^+FoCKnj_} znLnA#gA6)&9zRrUhW9t;#aC|cLi^d0k$6*?fT6R*C@4WEppg*0Fpa2K#o!Dvg+M+# zmzivxPnLF5_$W&JbTt+;5O@L>yl&i9>q-kBxryYl+}ck^0-jmbAa80Y>M8-U$z6oT zo29g7UJuBor|Kkx?^&o7N%*U=MGl1Dfb73G9%E5RX60`1hf`N>1E>aJ6F5M&VgZIA z*42aYyi-UpIIjwrS-7IxXx%N`ELcdn&ohjjg6VUV)f^m0@kr2`Rc{0ulCw5smY~0@ z!8iKZf|iak2jqq|rm$jAAcE92if3DJm*l1+;U!K*_7Cr3y^ zi6^mjC5f(zxOXLxEmWa*Kp^M2)G{3dpye^+;w7ldU8o2N;$1<_x-V`MlBp%rm3cIh z^$L?~$?1!O!zEaRy`}D|Y2D0q^d$70l831YITb<(tsaR%Psw~rfk9$RvRI>-nQs*u zu#Df)f;pXPaZuSzt?+Ip9x~WVlh;E~SA%@_T)_lb)%2A5Gl?^aJ+U-A^&|c#37p$Z z2r^J%PYqx-FCrmUt_GBf8oU6m%Ys#Mf;rijjJb;*DQ&ckq;%YFG8$S`N}YpB2~K$S z1=@ko6_td_FYlb0=2_W%yK~k&^T_?NdH(A7^||?R=k#>v=)AdqW~jp#%JRoADZ&42 zzHc7w;qJguY#8aLlmNlJLLrEz1_G(uKr^?EB8Ld$z! z*I*G+{5JH5_YR`qg6y&|Uvq$rn($i8ned98gImP&SZIhxr0q%X3)(OrRVJ#^8S%^@ z?DitOuU5EHQP+qRG|@P_&Qdsjma$d(ckuhNbrdA0--|A^Y^lI?B_EO1E&P%I-Wmzd z;;D$1n~@KzJtxcu&t78!K;9gX4hduP6ey1)Py_?E zlz>ifIbA8pwe6%L`!bniM1dRGAgg4v>5$tKU#rGe>EzT@Y+_-Yju9QoKFCX0VixqO zn?|{-K%_Y}aSxSnbPw#x-kfK6K@92v&r;{UJ7k5)mbeF}XK};vRR# z1KSUygb*VLJK;6ENo?3JRRC!cDB{B|9Huai@S!;9O8-nHWlAGUrUz|`n-JPzg0>Ij zQaM^~>1ekxD*@ls%uY*Emm+sw^9r0hxo1}piXSh@-b{(B+eW5Y89d{MiK?SkSW)*v z9LUyXEU`1JrI}8TP{EANh~u|)Le(dzI)yMmgzP4UHVx{uA9-x}F6`66l*uD7ShNZY zyX}+MwmCj=+S_#=(Qctsgfd0_h@h(~5%0xq%9-q%c|{)#k&rCqz!8KgKI44ie1F=} zLI~q&Jg{D@ge9(+CtJmssNPB`ALnXR;g#Zm1gq|GKaUj=ySD-xShrQPx-g0Oa4PVE zUx%Ach8xO(ge!Igb!%${b2A5C5Wv2=pThehk{K2q7>M&&TTfiI%w>+z$>crYK9@wr zO_^|ym<6wsF z@F5Vk0FF3Mb&=XK;uq4LRQjS^!a<26}EXlxgeCUnI9S0 zOQk?%pO(}h85pm{B}XV^g>O)-;@+xGv~DK4$i{uXvON%?#avY#b6f~0jxZq|A9yIC=DjRt&kHtdZD z}m-`F-ZR0#`McWy+MkwNAG|_x=t$qy6bVM72?idck2fz-f zZ(H;*(dM$R+(A!g_f;$1(PzE*>R%EA^ZNgLaeOr%rvHrdAFluZ>H7NG;{4BV!7%ga z-=~B{bu)M<2Ka>YKc4;@jm7z&--7&K&7=S6{?6Xver@!A^e`aYeg3Dhx&Cy+pZ{sB zt;zYnr|X;Ri}ODZgZ;Z_f&Pct`Oh;w|7otbYOA$XV@lOK{wU-DuHaraq{9qzW{o3v`NR6oW&a#g+3(kt9@2}Ivl zN2Ga845%bYdUP=^H3#HO=mXJowB+IW${~8a){rPc;wH)FupOFdTm)qOZ|Wp?=t)Y} z~dJVlbfItZn5d;ZZoak;PWp#ZOMzRT4=;%WkwRFCX!So09!Ih=aCo zYjYh~GNwZhln#&rCFg=RyLU+vSY#@HZ(Sk2}}DNAyYh%Zo9OBJLr*~VhLGm$RuIJvw6}+za`OPeV#QL zj(ffO*PlQ1o6jHGSp9;rjZ$f8y|z|cFWrSqsWwYOr9(56WTTapuQ@j(+a^6gW3M*b z!BJVCFPNn}a72&!pj-QV2sb}}=$6~t+MRoIq&L^(scF-ej^;})dTa@8h3KI1{JAif z}h?&!PmGGzJP=$#W1N{I)x>wQj#msjboo^OsUn7 ztClv^&jtn{=4iP4Hvw`#YuvhSzER6JUs^g0{>o;GJpw)h?zap%E<(;Pke$fUVvWeR z94ms)UPkXl&E1kShjO;^V^4R9zEmY36|5B7I_LnyY7P732vAx&(4f$aY!Q`?5Y>g= zU^rc(0}7e--R5C2p@Xnca9-MXC$6lT*7g$ao`%Sx!mg|hsvUz^hfn$wB8WALg-$qvqT9{c{@(84p7dEKQp2XhNoH3u5WddE4M-_S z2y~^TBI61DbvhKAl>~s1*jx~BHINKB;;bDfTENQ?gt3ND_Me5KI=pGWOUAvhVYW?L zH(ZB-#oNM_<1zOA&eG$+OpH8~?^U{G@8WA>bCA2G%7hgIlnE6yy zhz(G*{qH910aW-qHe(%At9Clm4W1(j|*Mb%5zkxmW3U;(-WGPkeHB(a#Bp0wajU+`Lb#my- zv3_F?k@6@CUU~}Uye7z+_JX@~Va4VzVMkhGdViC^#y1nXs7DSbu)7n^<)s(ngcm2E zhDuBR2qk5%%dj^TlrWJx-D(7uZ*;mp4;fbr+haMni~Yi@*RMr`vporLsx7lDl4p;K z>hg$a(5AVg+5@T5c&$oCM72NUEe%V{K}U>irgL4@D$?Qw$EAJC@=D&c*`;M(BZSh@ zcrZ@IMiBH8)tah!+mwl=*@Of8;?8JbWc37>ocV9p%Nn zW$OvizyWjkcS=l)u%lx(i@eaHk7Aa|^*9KCO6Y_qW|!`tSNo^?My^Vw z=We=`$8jp8d8(R?V>`xP0JqL(>awV;(@vs+hyCI9V+Mw z#F-vElqHzeYQb%NkAy5xev!R5>v=tU(n7)pvODv~-k{XUCCrR`Ue6&b>}p?I$AQDO z-NTJyD6tso09gBd$-67D zX@f6Daoqca&7J&A8{*N#famoI26vL-SXpvnIpq7U0Smr&-v8l( z@9*G~hvfT=#~tfqPeU6d^;~=pVj~Aq?8wd*5t+)pyR&!KW}^V^V~X5N@5<`;r{!nRN^H6S)T$zcvD50XF9^uVJM2`GZ$ zZ5uK_Dm^N_@y$b;l92bT)mrKGLoY(|$i6!*t!L{z^cuui^gvBkgMYuilf{))7gV}> z@bA}N7AnH^gX81xU!T}Cr(oehq5Ej+-v8h{`JYR|`=|Qg6L>?;*UCDB3tx^`d>#mLXmgUlVrF>+Q zy3%CN`%*^b(nh81azkglUYi@6`DB@|S}tu>$~NCYvL|SlOHV6h>oD8PuPbF&3pgc9 zg)%z76ctr2eN!o)aym{r!`({fnU1Tee%y+-@X0k z{oiY5b#3+O+T#7sUyAmR8vmvjaC(c=OBkr)@q}%I?At@4uG~ZylQhA|=^2t(l7Y@l zp{oczD!CLe4uSR=sYAevov(-^n4hMhZ7MP|KREEH1OTn8cTE1y_o-}i8h9M)1g`8U z6Qu9R#Hs*M+wqT3;XpNPlfIT(Nn6K^Bm20#2~!Fv+qN6)QHgh8lGWdyfnCmnRpY^< z2NSH1!u~)1p*iHJd-+$_D(?{ZY+&#A|JS_yd;7mGzyGkX|DTQWj~@7@pZe;ntIQ%e zt^$pludhoM7T7LNdcq&o7g;u$dqGvGtdg0phl4HV`$5-RE-ct6%klKWjm_yBThlkb zp1$$T^o_>q%$=Ea8f!Dptk2xpn7K0pUgPP^GhdfiKAN;2_26CdPjUyH|K%>gee&N} zpO*i|#wO=K7V`g5B>bX>-VnvAh)`{%r6)7#Q_*d)+Zlo7^qSh*+^*sUQ|L!WaLZcm zF9K^Z_&379UGlFPkS`a1{oSWKe*bBGb7Lm|$FD&xce^?5yIk4pSt z%kk;Cb2-ozBoe6>+dNs+uDDAVNBB!^#qk%TAieUR%EQUUuo;cHysSW%3^-BzjcZ|6%8#nkKDx{BFm#d+A+sSh&yY z6D3({PnW#nLNW#U_k0y~mZOy8&;#1YmM5QEsZ3tG%jR$;pW&TL$J!@P$j!R%Y$rMk zlxbz<)edc(F9nyFp1Yc4ad(LNMs^1ze|SxXq9ogfe(Uy8_p~8E@G%E%xdcby(Dlw4(-*^C)h`J@*xAR4*9>xo6j!0`UkQ zakLhQ<F{K=P=XC?+TKm0gt`)y)y0M<8c z!9AHj;6i-QMm(aaw>dPQc89mi)9$eH#e{3VU7mJ+x69Mc?{<0G8Q(59W*3`rzIkfe z`{vfP`^~Lc5M~^3p8C2hJ#*Uix2$4RDKFQaynXw2W%*CrwI|DOYj1C!tUUg|<+nF~ zTzR|#|CCoI7J}-UOt>z0K|AKRxH-#hako*{Qx%-`Cgvu_B$$(l!{T`5@lw zBwfsBuXY+TOfDzJZLEH9+}h@r9mxkbmQNF-w>IXF=6wo!1P1+ic=BrJ?3IjnHzy{T z2K%=#e~sV$oyq^MFV6pe4EetJnKzRG7;<{L|K0viNVaXvZ|=QVe%t=zifgXo5{rL) zdbo4WBbkAJ_Uv&(v%8b=TXD7@?CAhMo4+i~=59^TrNLiurUUd$&(C8o3bW{q={Y23 zEKYIGwVy#h7bcMF>G3wsEY5JOk*A--T@_}rcc$m@5o&R!?_JdTVtMub8@wLt{`?{+ z&%P>5?C(ua?SkFn%u=4;wMA%g-|;x*&h{VhSO2u~hkB8cg-53+wqbK|UM2gfM$=R5 zk=-l+?C(v_TL{35lketn`3nW~dA)e6Fmd7b%-lATpP1L)%I0*Jh50Nu+xs&Ux)5_> zMt3ip(q9+m^iksUeB=^}Q}GkAW4f(wHFj(6L87y2#tWS)%rHqV|9o?AdSb~;6ldO( zvw{*sda`?H<%=Q*JZ>=6nhG)UW#a=Ta<#yB_6RP)pzJ}PzGu_^HZ{PWW4^{B+* zDf>7FP__+v;fs~jVuD`{19#bf|6YT4?!5+|>jhx{@A&<1&J6Rq!3G&$`~c_wuWv5; zKYulnPfYxV!-?0rs) Date: Sat, 20 Jan 2018 22:22:17 +0100 Subject: [PATCH 3/6] newer sysmon TA --- Vagrant/bootstrap.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 4d6ccec..0d52387 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -40,7 +40,7 @@ else /opt/splunk/bin/splunk add index sysmon -auth 'admin:changeme' /opt/splunk/bin/splunk add index powershell -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_forwarder/splunk-add-on-for-microsoft-windows_483.tgz -auth 'admin:changeme' - /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz -auth 'admin:changeme' # Add a Splunk TCP input on port 9997 echo -e "[splunktcp://9997]\nconnection_host = ip" > /opt/splunk/etc/apps/search/local/inputs.conf # Add props.conf and transforms.conf From 99b7f6290fd1b61f8286c0e578e09e3685c42d01 Mon Sep 17 00:00:00 2001 From: Olaf Hartong Date: Sat, 20 Jan 2018 22:26:51 +0100 Subject: [PATCH 4/6] newer sysmon ta for splunk --- Vagrant/bootstrap.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 0d52387..5010b11 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -40,7 +40,7 @@ else /opt/splunk/bin/splunk add index sysmon -auth 'admin:changeme' /opt/splunk/bin/splunk add index powershell -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_forwarder/splunk-add-on-for-microsoft-windows_483.tgz -auth 'admin:changeme' - /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz -auth 'admin:changeme' # Add a Splunk TCP input on port 9997 echo -e "[splunktcp://9997]\nconnection_host = ip" > /opt/splunk/etc/apps/search/local/inputs.conf # Add props.conf and transforms.conf From 425c94fb7eb711e807631dcaef319d20c9a5bc25 Mon Sep 17 00:00:00 2001 From: Olaf Hartong Date: Sat, 20 Jan 2018 22:27:49 +0100 Subject: [PATCH 5/6] Delete add-on-for-microsoft-sysmon_605.tgz --- .../add-on-for-microsoft-sysmon_605.tgz | Bin 16544 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz diff --git a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_605.tgz deleted file mode 100644 index 381eae0d15114dfe7214365cd88b2471c950032d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16544 zcmV(#K;*w4iwFP>2>w|B1MPhWTol*yI4Cw0CC0?A%ZUnll%om?iWEUlc zNC=Nlhzm;&g~ei2D=aE8DIuzTGAuy=B<@5QC8ssC0U)P$w`Z{tu{{zIdL^k+5o(Im z5C+gw1Eo{z2~r~?q>M&}-y-CUjxg#eF`=WhI!0!c!eTKC3f7g;dV`M6Fv4vy{D2V`qk%Jo=)MKPZHKj3F;>GB!5R)?6Tpg`Y8VDv^L+J>B z5_pj|Iz}ZXNFBx9s1VX(*c(`C)X2bVQbr9F5etc} zNMzFnC5D3=bSEMh9l}Fv)M**OF(#_=1I~?+h=n3TUC|RRv@3p<$))F&5HOBz*V8U~Nj0T{U0KQ-hz%c13JqHnh z%%C)Y2vQmhr5SVqo~9x1!Wcz_3wRg)(urJ!qYnOqG|8f6MhHts2>F8rK;-~zX+1;) z;H{?hdc^RE&#(}nVXA>sgsT@%}6E>k{WHjg+iKL1f zU|J(p84)Rf5E2^3K&WUn4O<7}2xqr!$XG7Yl@la^ z$%DX&%{$1#u;?Zb8!Zh5ib2S+-BbWh0DS<(W*ru4FVNF0tiAOR4whXtC8J5gkgFAT zJB86@S}BEWP>3)_dI)lwNd#yO*9~3(FzMKCsYw}7Bv~Y_A~RH+{0sDw7;00@;zsF+0&kRW=IB?rJZN~QtZdlnL=0f%@7sfUB7L82&wZ9wh^ z+=F!$Yzhq*l!a_1EmaDX0T?U;m;-=h>ZmLl4JG7aKpIv~2ntY`(Q$VG1Ut+^X<~uF zS&q^JPC?WsL1T;x2?cnKR?r&IiuIUV>tjw&$<4%HOjweSr5@yFcI*&%cGl2QYLe#V zlhTqp#3_(2s2gfZN2zjw9B48T;W7ZXKt9osYRZ)xbQ&lkot%`SNkS}`BYC1)AqA;J zF>=$WheB1(&haIVxTOs6A}eT*Cm<_u++51z0fCu~3F2WHYl(1>7)%@V7I^+XlWma&bjHbI%XA7aB0<|(~9`btz z1&ApJq#WaVqxL=o>$A@B}xSZP{#meEQX_yL8=fRW$WO38f1JJH7xZB zC*g31~!G1z%PHlM+A^Oj*1s1ROO3rPd2o zIGA&d6r4h&XpUrS;NgceAGTI_TT4iEu|SQOae;u^kZ!=nl^XSEmPakBk-lWj$P}dU zOj8q;!x6!}uN*&uuIRP2)W{h1KzP-pE)%Lgoyj`lOfE`KD>O*=16G7%ga}(ACqiW< ziUss038AdIi>yW1!oKFa%}L+~O&%cup?*|bG)gD|G8q)$CtxyCNRtDkh3%MxP*3$T z0{&6KW~B_EH=eGc!7C6ytcbkai4M@Lg3X5V-RCSTBGHH^SC&^xbY=u%Ce+Flm?a4T zfe5HV0M5vYLv{f$4nZ%0g{P$qfHEBW0oA9HWz*2s&@dV|H1c}TV|eQZtR9^LI!;V3 zsWRlc$#oRCqk&c;Dc!0bG0~Aj}rTafHIxgTfN^5`u23!sU zXCeUv_1GbDCA7G&g3$x!Ism35vnXWcaR?zlnvu()od+fXN(Iy}{ugKzMrXhS!|MUo zP-d+{q-MCDK@#9G;#wuOS`~CR84Vb8L}jSESk$B{k_Pm~bp@RRR7608)aCW221u`7 zPwHqSopK$}KAcBG(cIi86nq!GD{zAu4aLrgK>Y!WgtzL^YnCr?9l{4U>$qQyynk;n@L-C>%YGS4cf)u*pCn$9z0>0W|0* z%CIW%aVHWeVPwc1HLWIdO`6S83jsYybGD6{J}Sk^Lqh`1M$niMC^^JO(4ql<8Gc4K zcboAP{vJ&xHn~EGASTvQQxqO$IimtT5uV>U-4)2qvo547?x_)QngZer(Zl`*7*-l| z5h^XA>C1bE@UrSCiRK4OPog!NM!7aK1a0ELjmeaTeiZcIaZpDGSqQifvr^U}Da07P#=pI{+A2c23YR-=K*h#8ARav!j^h zZZTAgG78#FVu3M%Skzz=H@0s$1W^J$mMRrqCd&M1LJeRVTOhUMFJ-@ zNr}BMsK2bqEEsQOJYZLv5Ap#Y!sNU{3&k8AR<@AF$~BA4^V0??lfmCQ=Z#mr=?Cq1m=PmfD9!H6N**= zp9$LmI-@23VZyv`-J(PinY;>QwxVD?HUKOFUxJ~4K-hi=QHCKo8d|MpR&EIvyeYI- z!jcgNBUme9G}@Q14D8Yrrh3M}tP?fQF$e9rsXi^IK||q>Zo2unq57D6S^LZ37pc=kb;SyQN!hF zhz+1JusfungX~c7P6v$CTE%BMY2wC>oefHu0x+fg-H9+-k6b6XXe%dDfc**RlFJJL zk7`CPc3_d`4P7jg8bG6noEK9ROl%r3R`&HKR9zshFlb=uq6%xn@TJ+{y27{?Q2C;e zL?S9tM6?e{j7sE)n-Y~28JCao)8)duncJ*6&;n-1+h>>R8nksB2FI&VPV9FB!B@+jt)s6;*%5N;}XO1 zY>QV5Rd8hi;I9RZ(rDEIt;}Gr(41Ys$mtlZj)vwr>aZMe7p#K#&!lk$@lqUZ)a!vw z1iQS#^Ij`=aL$bz|$6lTDX-gz(59J$Us9WR5Y-@q?D_eU+or~g>w1G&ja%k zb14C)vf@|x7)n_13z_7(j3DAJSFo|cykWRnhu6&EEY8o>aMjq- z(M8lW@;b(dOK1%{m;${jj2O6-x+czH1-q?cFvBVsMwU&hgt5a+Fex)yEeWH9&?YcK z#N{NdGV1VbM5^RQjmfw{lVAy%AaE4`GOv&xxM4~U7zgqpG|(*raV!izm`=*FXtYQw zXVW);1h7Qlk{ej?SONmvi4ZBA6Cf2h%?n!&F-_D0p-53e)7@NLEf)(*U2fy7P^pq( za1<0pI?Wc_QOp(CZE_0f6QJr4hNMPH;ZA6A7?jn1xrpy5wFah^m;z#$tSSz7g2_;^ zQ7B}$ctEuSEnmFU0{R2xh4rs!PJ{9eMkJFBJt6E$@&rTl6aY5$4`sAyRD#tI-sWbP zMNklzEryEJq(%|G$kH*bqL?(gDN-b012!fMeI{Ct^)nQBEboXma-KFaN)Fr={06X$ zWhI2pNu3&LBF?zxsb~^sqfTd9En_3cKqmvQ96GBwh$^;@8)xLQ#)hdwxsU=Tn)1ec zwtyQ2W+RUaX5jGHFgUN4lm>^Mhs4K&Dp8#S;Si!|0nn(qZ2E#Qbq_v6sAThNN#IKQ z$QQ(H8ijc@fitTaAT>JRh8wu3hS=oE%V|m_(-UBV0K$%yeg<5nqyT4%`t%d=iVsC5 z*x4?ZVy>9nD{&%tal)owgqdm zP*(K0K%eLE3!%uV#|QvD0bW$;;Q|$|&BjSNEspA9z5!eYEmrJyAv06UO~%~PY6fLW zSwSnL9431Bq6i>|0@qLni{M;gzVgW?zd$qr-wt1@c9ut#a6_&LiJGJ%t1&M#tN1}NbIEAUB{uB{;m&H;gvkLN2kUe4L= zw1)LNkuKy}h_`77lbg?Epzs)J7Ng@hmo#wv{h=IFHrLq=pp0Jm7?b>c#s-^Y2Ehno zXx1rBaFsw<;e96eC)(SbrH#mzNKs}ea9oY-7{DZ;YZ`?Sa2T)wz&xO_Oyy(4BPIh~ zZ{06<`+qx|x$OF@S4sK*Du&54YW4r-{tsWzvi%?b$W_w#t0@C1BMs!|Vt~Ih{{Eh2 zB_!C)v?w; z7>rIwQouJ-$>2UB80~GZV`TcwT)rKF#|2)7CY~PHcnV+v88h601?eFJ!(~)SxvT|? ztArO~=uD~;1w#~+?xSBa=op0zpg?hcBWD47gaLOVkU(@KJb>|~B_v*AXjuDmHSroL z%&re4I;&MFv?d&e;-VQvplLursf@|ivjgK1r=@i4LLvty5@*L#Ic^3TI13Cwk&pw| zgtE6!)}j=ZNMLC)y4+HS)1Eh%G0G(&%-7{QfWs8XlGISygq$J`MjZ}wnHWjpX$IN{ zfet7gay;+_5m@Yl5K`cD^Nx(W89eXz!AQ#0!u=3B7_DPXV1zUd+d*$llZmoH0K3sL zA`Fcp;Zo`#yRud@&R#Vo^_XGg^*)RupdSp(a}*!NHnj}zH7F%WCsoT-Kty2H2Narg z;H$!PG%+s;(5*ComQMeZ-IaWNcOkTxFkdl|7#Si#|9biQ0S7ZCJ~AXR@I~D~ze-hvN{d=9^ zs`>s+)P1=+u?$X$g+T}{N`(<_hT`KDXlD#cM&uK%092If!sbhH0Ha`3Hku)2T*@e$ z-3Z^6Ge!-15ib6dc-f?VVq6$>jr9!BYpfz9{0V@!frrUvxx0Uu(A*mzPw0c#T7^0)zm%K|sS2)d?j<%Fr@0s>eZrbX>+rh0-lnLa8bhp6I6I{QLAEd z(Go-=r2|;Qqzn!MkjiXQCj(s}bVdyd(}IS%=@BhLp!6OS#UV(A4jAVq$A-m<;*)WS zaE%_W=c4yvlpew0Q%X7d`nki%K2U|Q0BQ;z8J@3DA`sllO5qf2E_;SWuyaf_n{uFH z6x?cxy~*NYqxBi!soot+4H6*WF8Bcb@8Rjg%95L(o0l8wa=5{Wbrwx!yXB}=ZV0>^ z1mMAUkEKRDwva;+H837}obE?UGlALxmb6|ECJGsniBLuj21OQ4n-XfFSi~c1Tkw!o znDCehv|Shv38Pbx8oD>1_sOVeX)dBI2MjixL7A2s5Z~%E1xTinty_>#Un>5#!_`XGp7BL}- zoxmRt1^;@4`LZZn{DauCLy46A$8wFAj|X@M?T^+d+%%K{8Ut=%MwA0J>IPLLtBu{j zkh-zT+TNb^a6e8#aEwoK`yCCrocaT#PYQ7-LiA|eR}3jjD>uLGz6S^ z3EBY06gcVtSV4~l-VjMM2buE(=xzrA$8oanR^lF&!_yP&z5}|3JU*XveaF;PU0|Bi*>x~KpG+Lo5 z2LfwNcndOcZJ6VR(ud7yi}NOcy$ksci9X!%g9brEQBc6GQd~ILuxUz#a!vUJO_)q3 z&9!J2IgKc$VW6duJ#bn_E}M3T_UePqnWlPZq2vg*6GJ_KV?#9bDm~B|GENLd3F%U( z;bCQ#?Xaphc~P-(N#TKT`$;a^+{2~n0Jjxx0Fkm=FW3o!Kb3)R1)vTmMznHIqH{%f zKLKxoLm?A5j#|cmlfYC+*OM7WHU)yz;Dm}yybDqZlg-s6%!7vJIrLGopd4hFL;<0R z6G+&tBmfdhEnwGjX_Slw(Q)UxhBh!VFzrW$wvG&MnKzX!Q1WtQPY_t1PYy? zN>HP--jJJ=aDi-z&$>XUpbZ;pTH~eyBv&DEVXb+!*1&hmg_J`lfw%S8uv-j6X&$g6&clM+F4Vv-L?Z)55FllWK$%P)DI3x( zRpYnej1H-iQj@GT93%oRs3;hKY7+^(=@69y46Z?`)(5v}<6%((E1~dy1czTRLZOY5 zn;RHd1@atZI>bMGE(}(n`1Av4oV&RRUSfBi=?Q+Z0CGBKX7g3U5KPo(MuWVfAQ7uP zM8PZ-+9dK#@EO)YBCY{ZFz>Rq@!)HI?7P_*A*(mrc$hE~^eP;q#%o|Uq|KinhFl6I z4P**C5m}7N2$eqHUvmrp{ar?^P%_Hc8f)W$s(jQ72GE*Xo-O+;@1REh`Ws3Ql;Ur_2e=v~<^8pnGYkx)`U~~r zyCg-%#hSg)#>0%k&6z%l+p1p1_ho$lKg#z!kF(`qKBcfMB%#nq8RM5R{{I%^n{zm_ zBt0xmNnlF9A|L5uLEwLDXFHaxuvh%*p?6Uccu4#?P+KyqNjWQ!iaww0Ppo zrHf9UeA~It{q5)1|MKRxzcFq0Oy}(VAp@LSU#Gg<+_Gl&5{dVucg+>W?p4|~t9vqF zsa?BDcUJnhbZvTbN*hJ_YT8|f1v`%PF0e^>Bo4pqm$pQnwXRN9fYJ9*0OdWxX^6{@ z4Og{|n%hNkWI~kvq{>6`hYb6o9rLwlCRuA4O;kFzuX>9?p7NNT%e`M+Q7@?a)61&z zh}{FqhT7&D!&cchRUpou%aJThQva=_N@TVMUQAh5u2 z^USG{ML(=eVY+vJbNtcMbLX^c{uIT`s#pEcp6~OIJg?Szi7LMLvy|G+pXA5UZSx2E zC?oboY;8T>ZNIkj(dU2ser>WMJy-wm!ofnf;HwwN@*S2C&ni~i(B)O?4@*Zc2uWT% z|MknCa@yP(JNox8YTNAlBGjvX(ABPKUAAs~`cOUd_|e85r|wO>xVT_#ep6;Q@{PV`sJBQ}J zx;ruc=<(|Pel-04{Nib5Ue3eAmoG1hYpg!8FMR5Wd*1666OxmcG=B5j+=n?T&t=S$ z?V~rwG~PWhZ_=%4Jx|H>x(DZ8E`C)%d+^pF7cXA??T?e8`;YH<^zx^w!d;Cii7p=2qvo;gK3PCK!o&RA9R!DszydD>3-{oDBJizf~Ds#|L-wQK3j zgT%U!j#0D1>QCCbLawNI^xE|C^SAslWHdAP-OIkg6`zl2{jTfQx8sX;ZhRWGa=*R* zU6*}pLD>og|%{hB>;AoHOl6SnQpn*LsYo(rQKb zKDS?AzP01=%jH$87PT+0x_0o<%O}s)zRkVAXm;x--yK^2T}+PMeDi!w3n9GYFEyyg^g@x{sfz!lLpsuyji@w;e#>uZu43{SsjpmVcf%==RMLk zKYg|J*;>Z$T7^^HHe5Ym7my^XIPh>*>%`N`>kN#V>3(%@C&;`aXLib~Yg@jW zSDi~Pqw<%ez1!1gXIfh7%DWYlHIMGq@eaLjAJEy(Yl733ddhMWeFmOB;=E<1%cS+2 zmJhpddG#U3p|$~42K1E{O;ae6W7iQ4ntXSndCj4dCOQmEJZICS&f<%)bDw&Oh}voG z{nieSpV7z3Zb^(oPDH!S>zlaLI6NlF&%1ci<;n9l7$eFXlK$A`X+zjHY;R|`c)?_O zclm<*6)Iow?XcF(x%0i%bC(BB?0O+_;X;KhDZS~C3eE#hziU=SSwM{i`yr<6@>h#s-L(VRWFuTH~HR{F;D}GF!D>&;s(Jj8!n6U2M+8i5^ zG~>jq^~1kuIOF*Ki21RO9cxYQGA?5D=>6|n+cd85mf4%tECkM9QQ@&+Yufi1{I5-* z|K-<*?Z0%doKG|XOSk_d5-%T%@4t9SJblaTzklQ^!TyVc|0DbF(s*Y_n@_j@YKpP_ zcP90+uE}|0TIT%I4g-HRwyNDx8ny9WQqiMETVIzS_t+upk@t%+uVaFprZ!)i^nLzA zZBF?rHSJCmD%Q4{QyekmMx<`B++4WuP4RsFgbm|d0x+t~k zk-|Pbw)cAX-N2$<2OSeS)=x1^&##v6?cUV(<%nLr99!KPxI5Y=qhe^@v$Olh_uY2j z`Oi&WG>R%OyXhP$-?Q=fiwi*$Z4Mlz7dHrr@JfxAH6B)H%lzPsmB#b^a@tQMrb>^b z&0_*c)vcN11GB5?bEZd*xmhu+T^$>5Y4xxs1n@Xey(kG56Ul7=1;4|6c8YjkI{HoH@qmGx#cgW85>)H65d*Wt& zj~G>VHynD=U~sp=Eweg5*%g)=-}cdzU%IZ{G{a_mkIec}$|j@UR5+P_&9V2NPu|@v zytK+=Ve@e|U$tI!>g(RWSIUU4;c@ZHCXha1->>kd=TU%q(I`p^}X zj{Naz?t}+HH7<8>zR{N0y5+&8=X=gwUiYleqc8m4w3~U(ujw)Wh-%R{caZ75cLvyv z3bAS0Zd#Lbi9386E_JFrsAfZA*}Xp(4ElB7={|G922d4p#>aaG?Y6(XbPFS%sPECg zjeW%`d3NXbs|Mrr*)2x*me29@ba-PH#$t%TyFP+s-xd3wr>s` zeVZH-l)p1BVBkpiRUs#AoHj=+DxBWI<51_Tg@wn~$Tw|zY%JK=zE_7{vSHu!bhdTv z(`-!s%q|DsENtCoWR*4N?DCp8>f-aZc=oM%>iW6FpVp1Lz1*)jYP9c9T_fY;M=g(7 z-@4z6dy3=Fy1RWn`tZTCMQ8V(eVy0w@RIJG9>sq#HpFw?o2pT|700LFpF1!hvd->m zM+PidV4u2pm78+?*nl?&syD6Fp^4k%7P*6#L??TWU9w2gyhD1=8f&XhFQ{GM|6s@F z8QTNq_uI5>_W5ld5$h&7wqIAL$$}QE6MH7qJlG?mUKlZAaNeah^XOrjyQW^Pv}#lG zj{Q!Dx?SFJKEn_{uZM4!qQSPc1}zd57fep9>BNuIog#Q6hAwuk!_zd;~m`m#3vr~y4Yd*@JTMS zDirisUv2M&_Ns&x@!?}^quck=J-?$=JbRuqAnS4Q{k`W4Uc4xJy=ujS6&sq}?Yyqe z#bqv0*>T15ZrHV(+)a1#QVW-heHPaauDp58(8}@8?>`tYw`kLjlUH`w#5wua4zJi- zR!{QPWF3<=wTy&T4$BmUmUB8C{;AAMomj{ANv$7rh7>*8lamx#ybH=$`mPZblE= z>>)#wrZ|OFoMJODeyA>?xKVM#2aOxtZx~#)m-G0QuU2$l+%vh4h-^oc4{L7wKeSZI8in8eF|(A zl^=H_a%lTwOX8L~sGBFxlb~Y?c8dSw!_*I|gtS`M^BUA|zr<_b_hU{Exm_@1&-FcT7Kx_Sd{BGklkeA@n=1Rd z{fLu;N9vmHuF~c1;s9g*fc_U`9fN`?(|bUX3fP@H4<=~zbYrJDU8Z%vo?aBccDDRuUa>&xpm zbgX${SI^Gno6V99++Ah*x#aDg-EJPfJp0w%t!Izkzti)q`0KN2N4InwJM*ir4|Tpb zCae0hd5!Nij@ftmpwfS6=V?t8y2bgkBEBrzTsRBUbS!L`Vkc_K9ydLIJ4;d-SuBq zZdX2aRMdgqIfQ+v-R%i8!aQ3=kE0)`sLeC5gK#me9TeS-UC<-VExX6`MIr|A#I z&ur;o_@H0A_j~;6 z$Eu>VjTKuCDz32IM!GTK(A?(axq%KdWK+q8&0@6Ae!hEI9^AHdP>`GY<-wEF=g)ur zdURa>Uh4+5ay@kA)_%`=UriQ`Su{2OUF5^Dp@B~AMpao>^h2MyJ-siVQM^bTQl-*Ks(r|fE_%?q7c^r*0Ex3S0Egk{C`cCMY0vHOX0qXs`ufAUSynj80L zR+D`9P313F{8{T@{)q`!CyuGK=69Q|3+*nEGbD!=I<{OsamADsOP1_j6|=zoK|ST= zcJ0rfJKZ3>qx+za?P8oeFPNy!xqc}3`(`~CYF7O4_3m3=pPTG8ZhVdOHf>-2saU)7 z^^LuE-`ws`hF2Q%oy)K#Rgx<-a|z6F@T;?I#LVwIl~Y!`*u%Z!gkdgKM!C*DoH(`T z;EEH=y$;%S!E4KR<0g!3`Rj?U<>oq_s+^;X`y+qKujLk*h>e$YM99G?~yl3*R=(;n8EL>LT zIzC`=jTNm1L?#V!cHY&a+Jf>23%v`5eChMkuM3yQuRU|7Q9z@y&0f7~zINV#mwOLR z_n0?-Tbth76C1=v3=fwaYFwl&zB4=)N;B z=f%Z?iv1n-H)&ALcHp9}-#$y;zT?N%Tj$K*x%qkTEPYn+fPz(wHZG$ zw+Fuc?eY1Yt%3vl?-;P{%fp2a4MU?M&h{{#ztX+i{9|i8uFe^t&wX5c?`GWLCw-@C z99wj$knd;r^V9Z;mlwOlJ#I63<)C^edN#VBma(*Qz?DI(ZaHi})AeF>m(`u@Tto*m zQ@&r2kq~=bsbF-vA7353Dq1I99){-C_1~tT$^qSH>anszO(mi;fp7QXK%mQ zRB&-?!Ak#4hwol~a^xGQbHi+#4c|K0)&IQm$*R>g@7DLPW!pZ$rA_txa!+pdJCt$n z-Qy{fn$OIrd@`@f@)hShRru=q!?%YQ#m#RxXIuY=+53mDjjO)nLgU8K`?tQ?&~wEU$ZYc#HVUf|^sK-CB3(Cn0g!?W8SW!CK2`nl?ajttsu{E;O8^)xMZJqShhGlZbDQ1`Q;Ml(x-kTwT1?y=j(Fbz#ektm%tZA6#VD`B=fcDc$mVR2wAm z{5gqSzvkTZlv|4Fw|<%T_Q8vL3@7+YYTda!S|m;MoVy>?jC%aZJ3X zSK^4_zfGD~oU-AY$fn`OPK}B+N2(W&U%Js_d|<%wAlDSf0;1OPM;Fh&Ub!|l<-EWD z(g(2~?#E+2c5Lp_?aKMuW2TO6>HS^1$w$5%IAv+~ydD|KXLDo$@4gTPcKKp?{W`(1 zBkM1moZEHs^jCEef#h1cKS$rdT-?3$OcWl zYcCG$S;2Qf$nK!P0vk$Q-pO{Pc7g3sKhkjMx6na5YB+AR^@`t8)Tqyj3+D!FY&Hd* zXI8$e*gUlO;^2CnPv>8ro$HodrO|$yqXC-Vqngzkx4yvhY;MCvt7AP~?3;CN>9oG_ zQ0F|`dI{}*58v2fbE7vkZO$^m8$#+1vYFwvC;P-D`bWR7Z!MTow08CRf(FiAw)&s# z*fZmcy3$7e&0P!Pwp=M`*} z_ILMxKNKA4lN7VrW~p)EFW%cKE%sVEAuDmgFLnEk8dt;hiwe~v3EK!Fif&i!)z<|B zTpV7n(>rMfN*>gCHu1{hGe;j)e5tk@u%Z8>u+~??Z7b!EJTQM*^QDI_&1=`3P)o); z9XxUF?&f~O{Wh%b6xjDit@ra@JE#9NJabB0pJSP`cTHO!tZCi5&(p@gc#nTNGAi=W z-AeVB|GYVbdb6cV?91`;U8(0^2emyrep1l@J?y~#&JAFIcj=ic6uQqJFQ|?2}0&=$hrQiEBmKTjLe{FT`)j=&! zwOcw&)w5UC{7o0MLCsrVbL`x9zH)M<-y1vDxmx3%?X|}HW;94Ws+*nLEwpHl|Ab3( zch;yjCheZ;c~bX7OM0!Gsd2a|*}Romx7kipuz&o^n_ZS)oDk*e(K#$`-lMhmA}28} zey?T@b;y`fL;j?(%zxUDkcN$;-wfZ`pxMD;HyTaazpaWnGQyqY8&t7f&llpH|WN%W@5`=5%~?W4%iUqQjz*n|8LjHh53h z9%(7NL)N~$Ht3??y6&}ppORaLOqh`AGiyx5qCA)DhAk=Qr(QYyedR$LvT9Dg-Fy01 z{zG<#*bSI5smGAGGkbQYU*27p)-B2J6)-RM*{HlR;osP_7iJLXhv3~|!6&rwf%Sh+KTv2H z|Mf46|NbLaYMO&R+!CVK6G7;^Cqy8TO0*!-#OPo{3f-dp1O%u_<)H1nLF|4D2YdY4 zy&zn}!QR0>l{-8RC1}Hs7P?FIS)aQR{@b~Nc0P9-Xse`$`O!R0y+hu2I8Rfr2*L3@ z9?@}eos#3-{xjHp#_=!h{6DiH{Dd|>Apa7e04(L-%hR(={{M*!ads&DPBi)zW;&tP zULqE;S+@jEKor?~iA69Uk-aBiMxw~xTP%vjTWaAhN)7xfw!M#7#O|3%gu4qx_P!=y zd=9V3-cKyT`#{j{CXv0rScLN<@og)yh;1o>Qp59Tl9W((MD_t6HuAN z)6@ih0Lmn02*X;S3kj40p1zvPeI^_4jz%X*s3=^^TTlxflR@Yy&)kn53u-bUQ^&3$i~=8wKGv32-eh zPg5=MGW@te$@L`G^^%xU;QE68g~P30qOx;d|7Wg}^gnC%!2|$wRKTaU@ge)q$IHty z|I^b?Ql|g^i7Qn_8Z}ZSr2}S%@ObhdcvuGhNDO=IgVt!khXN^Ku0PzaY1(>-wVQ)I zcTh+WK1UGSQKU2zsB{3ImVpN)Fr0(E6z&O42f)+0vwwmJ_yI5kfIY1Q0??;(`++G4 z3mtUmV2{5V6+}?z3qLaSl99&svuOO?7QV8I%%D`@))IMmB8?mKd5x?8f~z$7w>T8& zZ@2Lw`_D(>ZE64cO3LiNf8$$T}*mF^U+^{FX1hLkDH*7jTk4N64txO_o@uVsOsWkD;;f&j|`iKkVG6HmM?N)^hNhsVcA7_<~=Ju@T+Hjaip}rE zTm!Cx7TA>t{3ssWu+Q)@%HWBJglBb8G70lg<^9kVl&jt9$NSjL=fn+q{Kq6k_x>` zD)bSF;rXJ7zg&fcV971OMnH4?@li~6Fs@M=+JL?g3y_4-5|LQM7!4WlEOqdc*5F?} z_$m368M81F7{g& zm`SJV{Lge3%P?kmyX1rUJa z%~PK321^p_E|iFun5A7DdRc7Axnd%g%4W5Ie&JP`{cj)@pTqqBp#SgdW3~R{ z<>OUm|Nj$LDj(zzDk&1o{t_;(u*X|Vt=C*i0%Z#Fnlv*14wyHv>G2^breLWQEtv~n z0pD&}8q;aKvSn@bu=Q#((z!I>Aw4V2BdkcwUgZ0cJ2C zF0Q^cRbgaG2ssQUZ$LAg8+Hy`_&^BKSpqneZ%YFKqsNlFAT;D`S#fcSWt1A$dafa2xrXATDxSU~dgv4R9DS;AriaROlM_Xj`F zIkuK1I2_0W&=TX46GFq&JB4=vl_OE9sR@_1ZE(flQ~)2e!Zso92bzfaHa#RPj8Aw; z2#*gBNlFK;hDHYQIWQKHLdym%y;woR$d`qs!KvMWKi(~^rL(KKcw=O6`zNkcAmr&5(KT#Jq`_5Qt%}S|S266j=7NX}#-Ow} z<%NL~D_75+{eGZDfDQ(H#RQD=^C@^8CpMt{_0 zSLn^?`Vl!fU4`SULi&&On++0VpX6LsP3MzmzBGM;i&oI&On$+Qha~^3Ui8taZT9x{ zYv%S;FHqv$A@Rbqy4pruZLHTB IPB1V40R9qT^#A|> From c9b826fcf4cf90d82554350bd15b88f6f89e01a6 Mon Sep 17 00:00:00 2001 From: Olaf Hartong Date: Sat, 20 Jan 2018 22:28:18 +0100 Subject: [PATCH 6/6] newer Splunk Sysmon TA --- .../add-on-for-microsoft-sysmon_607.tgz | Bin 0 -> 16666 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz diff --git a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz new file mode 100644 index 0000000000000000000000000000000000000000..9ac442f390d8aa6fb6a1854d7ef6c88596ec9703 GIT binary patch literal 16666 zcmV((K;XY0iwFP=Xee3$1MPhWTolLmI4Cw0CC0?A%ZUnll%om?iWEU{qp@p@y%+457)4{lsIj;I%xt;6J46%nHUIDT$9@vIo!xo! z=Cyh6P1%GX7d0u>Q8XpjyU;nbn$oyg{lk~LySuNqH-`TDFn`@WyqLf2g-JX;Bp&WQ zp1wXln7hQ=-QCj)^Zut1DeE%OdRzxkk>Qy{dGCSO_bz=gn^k9Zgai%)`}PjCI8|23(hedAPfKy|`WL|B3VNL;ZHLQZN(JwT3jwPmppu{{!Dv=UdTFg1Z| zFg@t0p3tdj4A;moDW#DywJMN68FQSS)5i!FOdOt=Ez123U^aG$w;h z5;8132a6}93=j!`ucHhKCFX}wa&SX}_b91BO=$Gycu_hF#H5rqM@K4@dW_1_5IPK? z1S*pH91J(;m6VR`huUM|lvP8o#Pt|xRH4H`MU4Wz#L_{40HMHDSSSK*frLQ=JBY9+ zFkFhDa998`fOlCi6nKF}kR)iPX+TiDj#7y+Tt{#>DulEc_6C+3G%`?4N~wV%Vj;0F zVp*hK$-rS6bj89b9l}Fv&}k_kF-EHL4CiHrQA1a5~%xt`>0(U!4^^`i-ghy zpg55L6T}``NopY^IVlI!)Dk)=1nuPQ-qIO0M*;FMgy#Sm^uQ_sd;t#tn{))tK?ESv z2@N2Elmx6afiA$)$nqYPL4-Mhy6~4y<@UFlB%p1{Kl|xsFnUhf*c30a$Yi0;EDi!#8nGpiqg5y_I7)#*hbr z6PtFBg<;lBpf*|(Dino~W4oyUk^uSuicLB!v|ga6nT++OAsj|`)r5@1F@26!*zF`r zmtkQPvOpoi7}+5xX+{+wHC#7%1z1Ei#t?*hbkjV0+I(Vral2o{rOyc^agOGS~)`ejq)J zt%6MA@HPG*d@pl8BX1iUDa@J;4Y-VM@o{0T3*kh1$ddgQFZl z14%*D$3bJ13MmDsMk+`RXvLD}miCylQ*sma7h~q+W2pzFndKb<&yE^8LXDHWeiB+- zha?5k1$9GB=m=E~&;v~dB3wF<7APkgTunH0OecXM(#dft8YIMmF_I^$1yYbY1SL0e zJs6sDc8o8RfmRtc59K|b0K}97 zQoP@J`MA*@6Y+f#v9Or&o;S;&5}^VLsH1=}7DFzi<0>RaSvpuxgPae8hNV6RwLnO8 z!bm7cCp~Rc7DRtqT<%cB+b&@n;6Ecyz#@_=SXl*JN&rnTWbv*L2-Nh1niiUHFyfiloQdDXZs1DZaa(L3T?E`lZ%8f5!{C_)|~!j>tC&{&D00ljfd zsH?6bOBFWrula6s8u&q%M@T?uAJt}!VoHEaIsxPfxQqm{iM|FPKPuR) zlmhf-hHL2X3e=A=L>{hK7wA^OW`p_ebDk9zZ(s&jR#wXlW&~;`w8{h+B{2bkFla&m z&d7^HegSX}K`()arzP}&GMxAU)2EVUk-nsy+6P1Ij^f@ka z9Rco0;MiqSQfSC6Msqg)gAH=g7N`MqObg}M!qOSdxz>;l>H;bPLDi~oAn1Gvz?m6p zX;i{G7Q(nq=;rgb7&*%pEtWByBiq6-$Wy?eSR5MN{{ikefogRnZ63R2i$c4Oo?X_$jjppLUA-DmqR}f3<87-m|x~!U{NTYo?#4c2Utg$^$L-h z;d%y1!0?D`71wH2Fx;dxfa!?J&~~w?NmV!r=*_$<=p3LT0wSa?Z#OkSdubZikw`n` zI$(Xch=w4!u}`S@PP8)!gDDNcj)=hg0gr_D>QOcG3S5Vn2$vmg0s4%SXNnx#L>6QP zH`cjg5pu|XJ{F>ZrGhfeGeu7-7!+^?4j&^U#|G|B#sQ1>t#uSlyC8zWZb&Hu^q-h} zzm4I9b7I&S8^*LQeR2>H=smPLwgGz{?ej zBZQeDSJbo`&oNpyb1MYwAj$bQCibWtFAuQa{!;viY#KH*L->0v znb;T#A%Yl1OHB|Am*tcS#6-;a&e<-1Zk%<(otd5*fTSrPz7Rbo-T-VRK^LLX61u*8 zbO7K9w4ixt;&_pU zFk$GfK*S&zIHoO21ug3cJy0+)=Qj&NcoZD~jLbVHXqa!%C=g<(VaCx>%u2Tynnf7_ z{U))%nLr|{H>w-kHzoy920rE{6<$Wqjj^5_41}DFLJln$WnecUIT?-9>5T&y(-X^~ z+LUNAXK1u|{1vwBP0%Vv40P18eu#-7FZ!|DJ2Lfj3SP(b}LKBos6b9{= zC7A{MM$Q8hO7lrR5JMP)SLmUbqQmMIvRFALxp{urz-2P{TL9l(tBJ&LhJ}g$ICh%bG(=!7i2=w^rZS;y6^NM_KR{0siqeQ_L^fzhO2Y6LK@?1o@cE4#b1zbm%o3!r-kZ8I zditZJ>_&wnK}W8Ex-ra)jA5RB_8<7OY3`q7jgR^n%G(D;&0F+mwrTLlX5 z;4p$vqYYp=7K$X}}XWq$8GsfuB;t>1l`!pfd0~ zq@aT=EBK%TW@;_+vz#_@d}Bw0GKK(#QogQO2uY*R2~OI|u_WMs0=nezO2DI5>aN4rEshs8xicL|LOjZP3_ zQK50c;Q-5^&JmFj2|bVqg+(MphsHC@2ZC4_u|aWwVTqAJaae3(Tx?8yC^OnJvxO=+ zvjFhdf<{R+>wsovn5fWHTma{ElvYPV_Z)Rt4x|gdg5=L=aRvEOCfi8Uz$b#;<;*on zBg;-xQj!mo8Kch5v!ZOQaH7>Rm}O+Ioh!KKND3=Ol6X3)LX+naaOA~+`=ik#JQx_D zNQIJ}07npM3sNoIOcoFzy)b2#@1N>aEASoOZAQd>v3tJ8{4%7mrNK!)A-Bex8CkxA+ZsWXAsgk0YEGWu! znoPE%oGb9#3v!Hx{5l&^nNQem~d4eH&3IH4XhgP&`RD#(M-sfhgMNkr# zEry2FXhspf$kQ>-q8Kf@F;gTE12!iNVm>R${mX(n@ z$8~CCi8$w)r=n4v4LY51wv5dj1Dgz@au}>KNmQ|A-Z(vnbvBG0%7GLx(v)}Rvjoy8 za2t7C7y%BA4uRupSBUd}IYN zyNtp#o4~o%6wn$S2*dSURzqxz6YOZ0 z!wD0zs%+FJh@@RHrw~fhnqMy<&`}P!gENMrbrh!3z`X#H09mdw4BLXaS*R;? z4zTCh{6r`U>KO!pod6Y8G@PJf-e&WpoE1m!GI9f?40^0g*oE9oEjJi*Q>*EOamfmr zA>}ZkVMP%@4kfOk4Hm(%!gS`7UHk&k1cFEM^YJX@xOrDTJ!4FA;5w-i&R8?TV4O_! zaF=*v@miHZ1K1v+kuuL&sgMbRBvW}23s-<*PVfbOk)?Bc2!abhpyo5<6`L>T{B}~q z#+}F(@*>3hG?+2Wr_xb+3^&QqagvMcIr;w38dG+yvkO2ORrwf~{C&;_yT}ZJ5#-P; zmo&jy0^tkqbGbj!-{w4RM7DT>FhPNnYUIZNApu>}C=5WtfDZu10gd@mJ~lmKbkJ$b ze!1HI+pC!?uD^Pfwf-Lrpg3?s|JD5;l8XHwpXDlx|7iM4`p<0x`y2fC@bReN|L3^M z;(uIdP)Jm$t3F%*&$RJ@{XZUF-j@3B>s7J;=W|?u|4}^u;}QR{OdnTwS6^F~axT`n zvNih~!!2$NLJK|pL6i+VYYi4|%m!e=FtP&fHC)t-CQo&=Kh~9018-6R1JDqdoen2J zY^0LGeMB(Z+gV4+=!_h`9YMqeDnl2K20oqwctD19SKvXq$pE_yDk-;W!R#udLKK-n zbR%Gjg3x_*CB2SP$N&li7dLVquv-WSC;Tx)N6Zb2rZO=P4>5GCeYrQ8Ia0W~-XH6( zRwa>|P?(B~q!j)}hJaETl|{3Raf{IsI(8zF0~5}yjwiBR^dtxtD1ag+2cZdJYn!M= zOH{&vr%CB@%4H`9jX@Zp>t%|r`I`v@&8H?gv0=S`A6E}|q4y1mCZnXZD{p8J@d%BJ zfp!BX2QAG8U82ETSsE3E%TO`g03^iAr%W=M;}s->QB+t&XkY=+4Kq16H=kZF`WVJ^msqtqY28xGuz#bMz5P-2?8fVi%C9!WjvGO zL1<`*EKE+|dV`Kh5gL_H;%)-k3xW14A95^+qY+ppe#4}M&KLx`n!xjXFK=_Sa4(4t zW;)sM0U^z#JYl4($v`V9bVwb9Ptq@!f^cqC&jISbTVp z1pVvb?E`}IsMzqJ`0x**9M2d-ZJ9`OrjkLK(kLiMPo73JOdXEPAGNy@UHUTiIz-T=7t$2a_Sr(69Ur;GzG>4b`ZgQ zF@U$8hso{`aQ!f$xf&l&@Q;%kukz>|MQY#z3QKCU_VHUUCMB!|;~v?MA-58zl}x@- zpggWT{_zA+rn5jJQ|VTgE37rBRBr7)6@cHT0+6_WG6V@vc28H2_uGC8vcu&xFaa!w zvdWpGOcKW+Sd=FtXg#}Fp4-TP!M)Es+4TmPO>+Iz9(aE$03QAAbwWC7)E=euh^VnGNkT@RHD85Hy9(Y?FnCo^dO5z!OKeJZ`|@GQ*9#iA3kEV0vbK z3UX{L?VX^qVCphBB1)JsN0qtPLbHXVkLj~GA~Ta|hU+{+kJ+`M2P2D=jnYhgdoV^O z(##45;MpVul^;|HqBZ02=Z{5bz|a6}M?w&?BV7_BPzD?>b0XlB1g0cF2p~qg7zA-6 zd>2g%88?Qj2@qwOSg3}EbK$5yoZ&z)_~p2QsL0hF9-jaUprzoE z;pGY~qJrCi31;~^xAKTZuzOS_yIey>DY%&^TcgLt&UB=Mr?e}hHAsO#xZnlszni-k zt4l6EE*>sy$l(IB{h1_@<&v#dxghW^5P%!sJ(e1=jE5YIsKMYtGfO2&X$CMmz>}tF zFi^;lP6ShGz!X^|X82 z>4b5b2FWd*AwYti4uNY=8L498V<LvLqYTm2PiB)G$c4G1n!E_k<5Bj*aokV zMxAE&5&%qjXG$Qs>?sm(tq#p22COm;36r6Lvzowi@JkAfIJ+8MBL)>0ZI&z*Mxzoe z0HfV7aF019_wGga>X72xmbq`!rcG2(d^hmNO~F?WGo4a~6Q>YcmX*lZf2`Dac)5W( zXm7bj;i4h*&>3(6BcdFbQ5R?;S!?V9Sn9$WYg=13!u>b{!3jRj?G@GMaOMw?J|V~z z3!>4SxfoJT&#Z~3v!L!6F&4@hvJi0O#YjEiEAWEhek|i8FgM2xi*$OG@gxi^R^Zhz zehxDfq4i){gbFl7IM~|8ar3?aKNIuzQE8SWfD7F0t3Zp(OlFWFQrr?rEd~4*T*tA^ zG>Sk6elX|DWRY@xj3%A{HXBmT80|3j5+*p&$^$L%&Gn|7HydlsK(T2U7p7%f+gNzC z0JCBD(+J?{Ch>t1=8L(YIeL@LM1oE#45W;i3Px!z5NE*llqjPGkJ8}RpP=}kN>?=I?0`Aa8=SQHKd)lB-K&KU&a-gu5gf}At*M=!>Xz8^nZJ9MEz~6;(hg2W# zmO@O>5Cl|ki{(KaY}hoRLhE$-#jS85o;1g-Srjy)oQ9s1Lh)dh#N@C`7Ev+{<>rj` z4S2AEt=P~GFu5TTMwM=8{+(G=ix%@sp@oMpvtq}XdSet79g`6154Y~*pp8-7GA9tW z!p$>McH0U&K=3D8@T~yU;lPMiJ>cj}7Cug3HV~qe3FM=e(lZO_RLIuj=>~TB2(Dok zqhv5UNR@D*z8Z&X$f0`TZ7 zLBnbocE>B6ci+4S3(ZgK&$$}b%fmRkwnHXVwds7l6pOzZqO-|kUtzW?&J(0 z4oX6$WqE>f8i*rKSqNw+EvW4Z5H+6Hf}zw2dI?%|HX3q~Vop#jnR7xADrmEdn$)C^>NZ@@vcHt7KXST-jJE@$F`mO+W03~C1eb*Rh=(7SxmI7{q z3#0fNELEo0$)Oj`!Ei_K!idE2NxH>SOtn4WI7~2{5m4WfHEgXKFROk@TH^Hw?4-jz;hywYLwSyb~ z=Ev5}Vi2;Z*}=_-nV?sp3~IauW>eby*=s1IP?A8Wm>?pPQW>Dp=lg5w;lIDjNEFIO zneoOtxS>}*s)8Q0rj}>P{z@Ix$X~A!@|SD;)dNzE7Bv2~%ISKFQvHSZV|yfo$3&Y{=-_4|;HE;Kz-{xdkoyX` z{~wimUdGvSFrE^OE+nATNQK~62>$<;;G0S~@+95NT}j|xAqO?Ed^h&rUZ?e+y2_eX zQ4@L`26g|`3edl?{?psL;{5;5a+S+}b|JVcEck>r%3uEp9)dy>{(DH=y(`Xt|14K> zik&S?Ytb|ofX=R!f2b)>W%fd|DeH(0@-)iJATPaQBi_=>KQAM#V;Vv9oOiManKBJR}bM zb%g&{uLSWf`?|*;C`SriNx$SF6$(!Yvbs%VvWBcnwkDFW9%uj{Fd5us&;3kZ(HYY+`RIa7ntzWS7Xum?MxJTm9%RVVf$B4N-Bu6Jk*iNoKv|#A)FFH|Qi)P{VmXTPs=XGh<4t+C@H(z0wbbJc%59>&?l4c+bjjCbd}Px~uQoZH?;$ z?%1*6%FQJmrY>rFsFixr)VSkol!vU2O|5b2ZB}8|!*v(W-2bRnr9E~&mDkQVzFmK9 z?)mX+=JkGa`G<~I2WVF}3cC@J_|>9*g_=wGPPvg&Lu$yDy%;-#Y;?33AEb#nu{_*w zTB6^!9ot_0w!ptofAj3=Q6)dDOrm=Ceski{({tyvYyK2P&2Cit@ZJptN1xYfzeE+= z?^#m))=vsz$c_cMUdpijVcXhIa5>{-=X z8+*J;{$c5u1wo06=f8gWQ+9_t|Uo|1##=@A@^Uwc^j~sRIk?b9?*)!t3^!Rqb^6 zrZZ`Zj6ZKYy>oc(tGkn8kDaJJ;79%M&o7>#=4C%Ta{2P2nC9w}`$MOlyyv-IF)=Z5 zN%J?q&3%}ya$iP0*)e8QRP#N#`IB!=?{iv4>mHnYx%gG%tRdTmUc7kmw?9q=A2_k| z(aWD|j-ZO)EEso5)_=$4IyGZgt!UFNzg<+`rY_;jvoD;k_xQM9o4gTAo8pBBkL{>- z`EHh`*P6GF_SWq9>hMY`fh--~qIH}3%_Yk9^GmDxj!cPvFgm7Hi|ik#^jUq`+rx9l z=uLKet1qLkjT}|<<$(gt-9FN5KmRu4YT%%UXHS#%(@$<}FizEaNRdxHck8LYe;ZqS z@#GO64eM(`={ltO!7VOY(VBu8>%R(ENnZjIu%;qLDJ1(xV`JBIn$4Z zMBh1fEp23tb}M@Kzy131t(}iwF0Wa$q;qA}wL_0yK6$qGZO;8gdF`Kke|Y`(QQ0<^ z&>|)Ahsxt1S&0R*Hxb1&_XMo1Z(iaqO|<_qP4=>cu|aogE+4tR2{=WA7es{&@6g z@wR8veK$W?8nk*=)vLC(r>93~FD-+3~6A0vvhgW2V-qr=Cyya z+AsCO_=mgByQOS-`fA&=wUp1bDyMsGyn4{aFF{l__ef^@_%q8JReM)euPs7`B zGLP_C-SQh+SFYvJ;F8nmf+Z>M_V(YEl9IggZq-E1qk9cJgYVn=b+_@D=&-esveG24 z+%rcVx6X2!yngfY;TJBiK5ReC+ONi-@1!Nu6^g{@by$-Y-=Az$GKk3#U3q#wPf9mQKDrW!^?ZSY>^}AG_VH zFzcqBZEO}Vm?G~jUvR%l^$Xrz*19-$zqfksa{oy^FT^igsE{S3wj5f;G55^7RyCA` zofdvme_kc~i3`@~z6;E$v%GOq?y9`K?h7;e3_H8{WU0E3-_vnt-SQ*99BZF@?&$D| zk?Y2fQ#YTGpLhKCHmy6X^&I+Sfco4|N5$6IhZ0!yKlyv-;tj; zMmhUn=$Zu~-{(DW(GBRW8gOlMT`SKSbA~y5wdJs*lOn{Xcxj!6QNv3g6Xyzx94EQN zwi_GLyH|(fBNJwxoV|X;H%(`rI1n~J+P-VODLuxAjTv*`U3;tMRo+tjGFt_~@hc)U zI%G}fv?2f60Qz5kec1m?^~nB27qEQ)Pa^T~^0A2jJS+Ua&vKRF|AoWA}=VBP$pBr{zAAEv|EN!o{zuEj?y`sdAUB9G^bT zzqu!F_1#f}>h8wFFPaSLHKc83_b0nUl4CnQn)*x6wVP*JO-RdV9HDG6`c0Knsn_iL z{rTkG-Qr8D+!nSTZ}nCCRj0r1_j|SU$U1HpzdT{z{N#M=iA%5UsCJ}zeZ1jt_59_F z2d@uaQSIm-ujWpC5K!lG7sneNv29x)TzbCu+~sx8`ak-@=S`VxYx#g^UsbHU(W_n+xMCu9&&C3`}wd%zys%S*RX z;z@Mczz()mYvkLU-=A~o(bIY!r{*l~&e}{I}Pl3VRw3+RmY$CFI*sVooJs@ z+9p_1+%RwZiWN&%#7&#s%Asy3X1CFCOZ(mTo~Lw=4cmSB;E2l6PB*$t+)`=JgPLRB zDt2t~A9EWY8c?t+#xHl2>#CrWRt{Uj78TFv;&!fE~*pETiw5_d;0ph_@CB|zrEb2G-8bRPd&q9 zV@EF!Ti<@bi+hR_&w9IjJ?6-vqLQM0MX&R_9$C`6+oRYo#s#^rds8z)x8lT%`*U;s z!W-Mj_b9A^Dd&%p-?q?4EYD z+N#ZoI}bP zU;NI{>f32+8?BwzCu@>MIjrj3qMxm7I(5>vv$v@7_e$sg2Xc{)_7eR^PH_SoPTF_a6+JTe5lQsVh6JVjR5d zhgR(;Yb5zz z$2?<3g!heaHgCg)-7Tuj?D56WS;K$Xw7buZS8$!E!8XIS)1;)eA@h$-K(@&^!x{<&Bq{rUKZGQJQBf^ltlzP|mn>6mc#AE-4v1f+fE*!e|`rbE-MAPd&sK4^bhBfD= z$-eG9^3;$~x|Vxt^tikD!P;X(S1IM8-^j+i>H28N^5XbgH}1?j-=eaueZ7p(7Hj|b*;M{d6K?<>ycxQp@B{B_FJ`o*7}iEEGeg|lMUE#P?E|VGe`4jS=cUTPLHz>4-)ofVLquSd^D-zd~)b1X#G&bPZ-UA-L z`mv@cWmDC*gG;OIu##?yJ3O~FelFK;rfeGCv{jV$+0S<`%L6;M4+wBkzdUqm#{BuO zUyq3y*mvEacFu>d+&bXi=&LEBv5Te^ybFIgF4*6p)94z@N`B}+w~y!Lvx*n-Lu+&% z<{fukdFA%J#yc-{a+h7Lwq>D1o3tvc_88LU#w{ytv}^6u^gT};n>G1)#*=SK*4(&1 ztCr;ZZ>oQ};?H`A3QkVEI%#aRHNRVJTWE6$pD8)K(7x^RNh_wVSh8f#s;C974;m>i zcj|op+?gh!U0nxv?G)wMeZeGc_VvR#8(Q^Qs9EvD*L!Y#eQt`!_z87VJ9K>cr(*4{ z*EjaveRF#t9$Ibe_fEr?)JUw-%E>?7&Zoh$k+U{*tE8-TG0nB>#NkdgMmy&niJ#VI zNYzP|UI*;H;IZ}l@e@b2{q1fSI^eP{82FV*Gh{{g3#gg)d50Y>nw%b6oeqcB^hz-#cY@WW$+57cMJy zp5V8*&Wd(}!V`u%I_^%ZwV?8$V$Z^%UwZxY>%!%+YtNo-=GSaot5>gDubnsO<-S8R z+~&>S-l5-)_$JX|BSIyIo0lj{@8o3_Zm#dUR59b1Re7`aCC0TVYJBt0MG0p%x&D0R z{*9jxT0f?a40~=<=j&;nSg4;%!^wNEO>Uc$TkU!ED9L(qOCi1P)$6nezqfYly~{uQ z#l=I416>ZZXi~{KcTvx8pC#_t`D6QSbLQ{b^1NRrof$Z&a1~|$U~x}-dn`lU($015 zr9%DEvX|2W|iINby7cu!yjtG{gBTy?f0+zQ*n9oI!NXIOORM``8NBM2-Hx+8FGluQ-Oa{HbSNWf z!-Dj<=<7-arPKZR>d-B>cW=+s@A&4>($r>=SzYE@^;)|4*ev!7Fk+69%K+#GN?{ocFB zQzy5cm0tZ+evRcT&UdTw)%AyOk1UFr-*nFQfe*6|j942}d*_Ab%_9$Nd$Y06@Rw_L z2F@LjmGh$X{zc!%+g4tDT?|HtbH3x+H1;mA-_Y-7=fggteogQ1X|N?leelfmW+Tsb ztvs)>PSg93?wdtZ7j<5tp1V0i?3fFyM6vveag*sXY!f{=Z^JS_C@0{Y5I-Brd0BD8C0<2 zh0mn)*7M}+FSb7>ZQObD{e`Wkckr1ovQ?w%iwpWJfAjEdYqyT?UMSxE@$!XYev|Kf zoHMh!oT+s2)w=z^X>y)rK7FcsTY9X>*Z1+ok|(#*`|jxZ%kDd z>-pcBvFXO_tC@K{x^*m8RU1@1rPtvvkM%k=VE3F;%ag9wwmEjJNp9TSHY>kv@}Sv( z%tsU6{aMm+ev>(o?c4gDP7laSDm;?c@ffvc=eFmi#jo$(d#T#eOME`-P|`Yoo9+&? z!cR;~b^mejH(TNl=6S82_A>rSm~`pk!n+qPH4iOWb*9dYjYYbQ{I@_)7W*!_Ja_lr_eT<&%aU#JpyYq%#M z_%P|F$PCG@m%ej$LW=^m!>`wRcOSDN@khtNgQKHoUKsdlLFBWaq`$ZF^c&^4&gsah z(&Ja#MfZ6z;D=rbMKA8>t;~C{v;VV>^^;QPAKTe8(f3Hdx!reAvRTMw%_YHH8Wz`R3ecNPY{I4)k(H-6-Z z-zLv1P1^WPc*{^jw`Qf9qqU1CEZyWb!QbyhfOC?4Ay#ksql-naSFVjtI`8Yd^g*xpQ$om+bJx^lk$*lFY1dVb$&%F!=#r!MWCpO&tCHb>_7?hBEBk1v)tZV(tfs`0`p zIX$P$=zC-Gfq}l!{U*B3o8w$VSN}@X)Kd-S?CiZNX4imczbFdd?fCJ>?X!=aD_XH) z`q(GS#FJ+o$X|G)_wE`ss?M7EIBluZpWSThp8E53Yd4z?aW>u;jym)_x88g9xWlgv zN5r!N?l`nQzLn_h`-juvA*ULRA=kfsI$`Opd9z=9H*i<4Geg3j!R;VW(TZ}`DuQSXjO0g`a<`joTiIbN4q=Ow(8#2VSV#qj``M& z;yV2vx~a>SW^d|R6;Xj3gBlLDn(47O>*OW!N1v~6Etp!ecJ=wfCXPL}`4)BUlm10R zX*1u}&V?~sFC7w#9jf0PaQRY{tM%Y{Bm9Pnk7n*HEQ$=cx*|=pe|yQ~s>8y^Y_vHw z*wN;qy!O*y@5`F1Z#(-A{)tRWTVFX`juk(?`nBC)9bU3ibY+sw-S2kSu-jP8U|kh! z+iv}e*{>|kj6DnU@U4L~z+tZzv4p;T* zTeD#E1#Lj<_SfvYcbu=BQtkKV_6@Gqxo3T?`Tm(rl8@=~a(V@q?Dd^^Y3{B%wZ^90 zQ$0`UeRxUVm9sQ*})tdicHA@ypvMGX~DTx>-#w zp$e9K9bL;|$<*pczVl8UdbMx0o{1}M>Ub25*mv$p%8q?KDN)gSrL$YnaQpP5O^1cl zpVo8yf!s}l1})qEHni=T`8!fO+I-);)zreTA_J!QRu=brH1$T#ldpOd=pAp#XKl{t zSyb5AZtA)^*GCtRs4bpem^!_x-w!p=cipcvZ4CmjhS_)-0nByE8n5Jf@}uO zoSZf^=Iq`*sh9UOBy~#)`ufd_el|LPZ0I*uZAPCikzATzIkLHX@t`{HcXJn#+ntW& zJB`kNzRTKbmuh?Kue=l!)MQ zxqYrU)`Co9Ar~i6f@rj-v zbA3qvy}c~--^0VZLjOO@T5mu}8E>Ep@IeP(~+@{UxlUBiMD$AA(|Z zmY6T`3abzr89IF9Bf#)3&?iCRU6zl7@^5pv{Hr|uHy(KOX>EK!|Gg~E|MqbA@~jyD zKg*T;H(YEW`Yrz60abRkaiOs>aS5!XF*_WfP9Z%bWn%W0^&_}jbQ%YDqsQqC?l+}{ zdn>rR3?c`eqs85$lWYhcC_HIN$KRpzjaAIiC|nWHXN|ET?rUewalA; zLy1cSzu^(R>>a7r!eb-3Tlkyc@#GF6F(RsfUx&%Dvkm<=DAI-2NmEHJpcQjuc!X9^ zu7t;7aZkd*4TNKS4jz$mCz94sdW}J)ax#6-S!{YQ<{EGow7^Z<6RBr<5CVR|Ey$oI-wpJX?T6sGS!du|-~}m86N2~-W);v! zv5Z|T1BA12v`8cty@H}AflhiQ3c<`A}9Jof=LbQ>JZ4)^BdP+*E z*hgCS_I+)cp%`rxAnukIBLaOyC>8nt>}K>X22#d8HqdBqQzFe{Wju}BSRsOY9S~9m z0tN1Kuz;H8uDr+;Oj%-Mo*N1fnWrz1XqlCmXLZr(RiYogJNlw1}Kd zWZnl9#iPw6`p(LVE=5ZK@X6!)#LmJZcN>2PXu^2ED+H9;xWqNPrSL6^+s)>ZNcmIr}1&-UldT zD)faFlrE=CNh?d##Fz-S0sj6~sbEZph#MlzAy`UZnfWdN0eG=I<=JkqB(dy5nRtm= z+Qp#CVsptAW6?wwYX!_VLqhkM|82C4F^LJWi3!o6NlaOYARS>*5EO4b-O0|@_`L@g zzLXIXBXnU6_zW|t#yTM8HP|ml{QvI7|NW~x|DVbEe0l)zq4;0o;cM>y`$*g?{Qu8! zB@3N@H@A;;|79eNqFZBHO$Uzx)q!9F6iNPf)#ZQgDmVYf@3Q}o&i{IP0G&6V|MjVu z|NSgivS|RG0weS;q1}NNcVNf9K&M`^w$ALqIp7uyn=x@wK?%a4(%;`vg7Rgi@w*Tj z`(-Q+8h0yz#uk~wLczZfQY0+k;4n7=D5$_32Fw`oa)f;8Wr}#1?5%|~Gv$`ZGGVhRrc9X;P4?adN2bgi9&M^>{Mp?w2#yE= zEQ)vGWkK!&gu#?u-20YPg_$WKO)81(2dbyn6*W zB{R|qP)q6W=`odi!wWrJjbI}?CRuxJiVc+d^&Kcq5W5(&T(HR!7ccD5Y)!uSs!4`gSnCN<3KXzEvj zRd|q}=_=3v<39V8%6|6g?|OkBUjJu){+EZ3kEFu?`y5v?Q1Vo>>>A@rq`)XotHN_q zRTTTZqyQ|P(kpF^>q0?^#Z<2?`wc9!1RYHHiZPhy=a*n~A@uC`7rDc#*^du!Umai< zg}E|Q3d{{x#{5YIrVB1b`9~MeNf4R=j__YcVZu7V(V|O^96owvFCmFkxF*9EB4U9v z_*X?T6B#a^-m*?I?tu!|GsVD8+S)Qa`KOstJ{$g9=>H$3{J*V?|H4(4{V($fzfWl6 zL-ya@$Kw1CNk#nsc`jb-#O5h>TZvf2sv9%=L5OTU#3JZqviB%z6xplla=rM*Xkh{u zi+|AG6W6$X~#>mVt(RQ$6qW`Wo;%%sj%9_(SZ4lg#T+Nj=)9>mG8~ z@&>vZ%$d;pCLkGJz@d}%^i*> zd#)8YUlzmZ92CN~Ywi*?R&@z!`!Z$b4&(gF9n$xire-$(vVHHVbKiTxsm9m5zr?xh j!