From e2d30fa90049e0b5dae27f4b74ca6f9d443ef9fc Mon Sep 17 00:00:00 2001
From: Bentley Hensel <bentleyhensel@gmail.com>
Date: Fri, 22 Mar 2024 16:34:21 -0400
Subject: [PATCH 1/4] Threats Tool

Signed-off-by: Bentley Hensel <bentleyhensel@gmail.com>
---
 api-tools/threats/README.md                   | 115 ++++++++
 .../images/api_permissions_required.png       | Bin 0 -> 21135 bytes
 api-tools/threats/threats.py                  | 254 ++++++++++++++++++
 3 files changed, 369 insertions(+)
 create mode 100644 api-tools/threats/README.md
 create mode 100644 api-tools/threats/images/api_permissions_required.png
 create mode 100644 api-tools/threats/threats.py

diff --git a/api-tools/threats/README.md b/api-tools/threats/README.md
new file mode 100644
index 0000000..5f267d2
--- /dev/null
+++ b/api-tools/threats/README.md
@@ -0,0 +1,115 @@
+# Threats
+
+### About
+
+This `python3` script utilizes the Kandji API to fetch and generate detailed reports regarding threats detected across devices in a Kandji tenant. It enables filtering based on threat classification, status, device ID, and date range to provide targeted insights into the security posture of managed devices.
+
+For more information on the Threats endpoint, see the [**Kandji API Docs**](https://api-docs.kandji.io/#d041043a-ea47-47d5-b6f1-234ef422494d)
+
+### Kandji API
+
+- The necessary API permissions for executing this script are outlined below. For more information on API access, refer to the Kandji [Knowledge Base](https://support.kandji.io).
+
+  ![API Permissions Required](images/api_permissions_required.png)
+
+### Dependencies
+
+- The script requires Python 3. You can install Python 3 directly as an [Auto App](https://updates.kandji.io/auto-app-python-3-214020), from [python.org](https://www.python.org/downloads/), or via [Homebrew](https://brew.sh) on macOS.
+
+- Required Python modules can be installed using the command below. This assumes the presence of a `requirements.txt` file listing `requests` and any other required libraries.
+
+  ```sh
+  python3 -m pip install -r requirements.txt
+  ```
+
+  If installing manually:
+
+  ```sh
+  python3 -m pip install requests pathlib
+  ```
+
+### Script Modification
+
+1. Open the script in a text editor such as BBEdit or VSCode.
+2. Update the `SUBDOMAIN` variable to match your Kandji subdomain, the Kandji tenant `REGION`, and update `TOKEN` information with your Bearer token.
+
+   - The `BASE_URL`, `REGION`, and `TOKEN` can be found by logging into Kandji then navigate to `Settings > Access > API Token`. From there, you can copy the information out of the API URL and generate API tokens.
+   - For US-based tenants the `REGION` can either be `us` or left as an empty string (`""`)
+
+     _NOTE_: The API token is only visible at the point of creation so be sure to copy it to a safe location.
+
+     ```python
+     ########################################################################################
+     ######################### UPDATE VARIABLES BELOW #######################################
+     ########################################################################################
+
+     SUBDOMAIN = "accuhive"  # bravewaffles, example, company_name
+
+     # us("") and eu - this can be found in the Kandji settings on the Access tab
+     REGION = ""
+
+     # Kandji Bearer Token
+     TOKEN = ""
+     ```
+
+3. Save and close the script.
+
+### Running the Script
+
+1. Place the script in a suitable directory, for example, your Desktop.
+2. Open a Terminal and navigate to the directory containing the script.
+
+   ```sh
+   cd ~/Desktop
+   ```
+
+3. To view available command options, execute:
+
+   ```sh
+   python3 threats.py --help
+   ```
+
+   You'll see options related to threat classification, date range, device ID, and status filters.
+
+   ```sh
+   usage: threats.py [-h] [--classification CLASSIFICATION] [--date-range DATE_RANGE] [--device-id DEVICE_ID] [--status STATUS] [--version]
+
+   Fetch and report Kandji threat details.
+
+   options:
+     -h, --help            show this help message and exit
+     --classification CLASSIFICATION
+                           Filter by threat classification (malware, pup).
+     --date-range DATE_RANGE
+                           Filter by number of days (e.g., 7, 30, 90).
+     --device-id DEVICE_ID
+                           Filter by specific device ID.
+     --status STATUS       Filter by threat status (quarantined, not_quarantined, released).
+     --version             Show script version.
+   ```
+
+### Examples
+
+- Generate a report for malware threats detected within the last 30 days:
+
+  ```sh
+  python3 threats_report.py --classification malware --date-range 30
+  ```
+
+- Generate a report for all threats that have been quarantined:
+
+  ```sh
+  python3 threats_report.py --status quarantined
+  ```
+
+- Generate a comprehensive report without filters, detailing all identified threats:
+
+  ```sh
+  python3 threats_report.py
+  ```
+
+A CSV report named `threats_report_<current_date>.csv` will be generated in the directory from which the script is run, offering insights into the threats detected by Kandji within the specified parameters.
+
+### Note
+
+This script was written by @TheBoatyMcBoatFace on behalf of @CivicActions in March of 2024. We used portions of the various scripts in the [Kandji Support](https://github.com/kandji-inc/support) repo to accomplish this.
diff --git a/api-tools/threats/images/api_permissions_required.png b/api-tools/threats/images/api_permissions_required.png
new file mode 100644
index 0000000000000000000000000000000000000000..7c2aa84b24c923e57da67fc34a48684328e04738
GIT binary patch
literal 21135
zcmeIabyQUQ8aIxlpa@C{NEm>04l%TJOG`@)3<E=hG>C#A-8D1}jna~0&@lASpmYq~
z`5VtY=iKvNx$F1u`>u6aYi2fk?{7WdCqK`#cgS;9IYI&|0t^fcLIrtg4Gat%4)pQ&
zo4Dw2eLGt|3=D!Iu$0tu1t}@|=T7z@u&pHqhI~kTBHnY&aVmdAlK|{Zg1>)Ue=0o;
zL*tos))6DiLwsVzuz*Z6U2<Iq_JVi*74)o+2+9<rs{@|a$f&n&zGlPhs((RD7VjSL
zaHZK}tM_ax?WE=WWb%`9Uyt97%znW~>Qrn*67^h~57tnskr5$z^LRHfxBUqmKEM0g
zOUxY@cyWV;_teW{mM~Mnr`?tZ*>ZJdA`{S#n8U=t$w~X%J(r*3O<?rcFj|lVBllkQ
zItPMOWtS`tY*r;1N2lgA$QP;X^o7)%OH=Ge7F(P)27Q#!1IK$97NWzdh@XsE9v!q#
z4Q_g1KI~etpNmOvjtl0|r?{Ub_9%{NkM~}4XY9UFA2wL^4wFLHkXQ1(*TM8sacz1h
ze$5eA?5p6IWGdX1M@;X1o~ef);!LX<tua}eK6}}J`_?PXOU*R4osc9`C@!m8kjDce
zaj>m^=GAQ`g2u5yk>rhS$|b8;LA@VdfeWg1vXj22nMS;-DSHBVW}~)LnRikd`!xq7
zs6<RD_?5EI)VETMt<Z=KKmHIw;n{!~J&4&96`fDLAQ&4Q>sfH1Tb&WAyx4o&GoD5{
zFgWwdn+TzoakH@H>5!4WQXDzk!7|)K2}P-AIyk1hFVWYAt2Ap$&@S*QC;)F8`*KAJ
z&-63Z3l&i@dal?Ov)wSvQH=q`kMzt!v3=6^lo@^GPQA+mrEDd(7)gzlLvlY+7ljQs
znMpu);~XpMZnEJQl{H)t3{^4=`YV+ZZaR!291M0b!w^Bp1iuFigFMRrLFNtZOnjGs
zyIfMjl~}5u2~lGd*Z~g2Sman7^0=!Kw-W+KUSf6NoV>&v!wQw86ufyS(0mTt8rw?Z
zR^9EgK!eO%BAB9?bdA`L=S1%Z)88agr)S9}085@mF<anp(^GVi>;^x}y8o0`@%5W1
zY<)tz*SlGm1@~Eki?U3zhMwPYAzOPxE78<XypMZ|{g{g~zm@944G}ufXXP=XJHZsK
z3fnw_)O`W9tuhWc-lR}}gSmAFiYcs?H*$CVJLtRK@tXy45tHA0^X*Z{yZd_Y7aqQq
z$I*Dt_ZZbdlZ!_wD`w_!pCu@Q`>UX-H`m?!93V;%JBT&^zVrPdfAH6-)_pTsE|ZU>
zCBRYA^>>!$IUg0q7RL;2A086d(0budzD2b+xBqbH5|m04?Zcx8RBA2#V)q@@KJtTO
z4(RApr!GQU9xCu%cs_9Zfj6TVMGKK1sUNK$^=#yoMASp;yCpY`-@JGo^&$GXyx=oI
zxjL2m^kF26A*a%EX2j8Qh6+=vB~SQC?C+h0%s;`2dDxjus;c<Vj-D*qMj=r?Qo-KR
z!otPkfyFZmY@T(?P>YCe!|2uc6M3B{sZn|hf)#HX!wqGcC441(m9n1SehQ6yp~z@S
zotNSiy&JbHnZN?!=uTMdEQ@82wu@?FKU0i&3g>K(Ghj<(*L~`)v6(;hK}3B<BAo#d
zZNh5u$WQ+={k#BEyH(?%{6izt;xBjK783-9zLLR`QIknGi})$|{e7s9)|(<FOZ88~
zD#MCv3^w9~a=f`8!OT_O6WscEcG3#!owCdt;I|qfgL-+imeS)A$)#!ejYcPLoN9OB
zLR8L4&d1I*J%uo5ufC)%LoxxfX2o<xm||iVlXiU(+@@$vbwqZA$>u(Qq?)*T(FSjr
zqmU4h*Xx?n4NDa``Zg83_Mtw+v*48FAaG4!SPsAkXaq=8o$+zl+=j3~>cRQeo1-Fd
zp<I~}r-6Ics8L|~!Rs<<tHGfanSK7#cQy4jku}l{h7D3)hV9Rpo>}Fn!um*zVmPD(
z)ZJ^L#hdTa6O8?5Y?`Q=f={J=f_y73jW66TxUr-Hp9c2ghT{eXu>{$Ewf#!<wOy9<
zv2Ko~ESao(xMSPxd9C@2wp!(vBnGh-vG-zA^FI{A3O~EFfR{x!M1noOc#!RFCP()s
zf%HHCP}5S^(&Z9$FLkd;FEW)**l+p#@Wh1OmVJ<og`HN9MgLSET4h_~ZEk7yy_)4?
zJw)Z>VTG~Pw8h0l+i;M*^XH{z_7VQiZk2Y$C<<XO;g3e8(@{<7K8-$w7oxb~cYDUV
z>VEpWI=H`Bc4+&NlLIr)pT}=+f%T+mz#;?*Ik*fzn>_!NiO_3Lo;Tc_nt$dV;(juo
z*RDMoKd=Aev_}OQzU<av=MU~tHl?*}cB*xtXh1eZete(@c|jpUOk^J^5_v~W25}Q%
zhJYIbjTMXm#*b%eW{Mj*k6-$nd%K-ZnL|E&+ORo%SKhQmHOntvVUlF>ahBJQ#P6e@
zGsc5C>JO}Qj+wrhTpze^Vt)*D!x6>jzimu@Zg7+1iD2%N1&;#Dm9_puE}OBK506c^
zzD|Fw4HggO3XPJklI@adlhKijknxZvlRl6}L>iO$h|03d5)YBSj|>kJB^9pkcm9$7
z_QJ8o@ss29``Z+yFI-$dPW-I;Zk5=<{)0`3GBP|eRQ%pmGRe2XxiH2LB#I=mb!?l)
zn@Z`__5$|rwt6_{h@JqM$e-L{6k<XtQYpHra46G~f586!8p$liY{_h1C|RgoNCH*|
zyRN?3Ki(gDCSzLk!LD#=kW5KfCO_Ly9l_IX>6H-v?&4c8PiB}5rAjiNi(vgj?wE7>
z)n2Dgmd?`;B2FirWCW~lSfM3+dY>#8C2DjJIg7c9>x%VtA>}h4>fH&QRZjG+?Y>Nm
zy4J5djUJRA8T-A$0!yt0%?jw-vW*=>HHY(;9)zbI2>FP=x_TbVn#$VOR67oK9*<0-
z!x4A0{Ww!$-;ES8o~ibJfBxkhVerYI{KDcyb3lz`@?Nd0ZSAD*OFU?>gWQoS5*B=m
zl%V3)sT<CQ&6vt8toCd=ox!V&e1bFq#ej<6Kr!!f+DyP}?c19X-#fn>F>Erp=B?!!
zD7GK&9nOl)xn<TU=diVG3?W`;Y$bXn3TWNeBBlLC(*rzi<f*8*plIV92_C+)NO!8i
zP_icUz_YG&qPhO`-Dxxm;1He*TCtuQFlZNv0F0!JBp{iQi*$JH4DBZ8R9BEA{1%c@
zCQ2rV+G++%DSUJpAVJ7VElU+k?UiDd0#rLohuXQ>lwI|n*B0?kSSj|gz@~j8TsW4e
zzMX9B<xogd1R2Djr7E#Xtp2{w4%9&2pq-&bNteURsClf<R^0FVNmp`lgsz&2xgn$x
z>fZDt2o-)hYv)(K^<mw*4(wOCn((!BsSgLX3~iW!ewue&-ZeU$UN;Ibf=%C@KHB;|
zz5WT&Abw1bYF!W3BWkBB^$YV!JCeRs_@Q|KC-b|1rH(X5I@cg`j@l|eSVf-J`EXwK
z9Pc^%^*ML#eYsH@uqIjD$}43oRcp-VJ#eM5@8m6b#QC;G(S))Icu+ezD<GRKcWUz9
zM6GfBROi5ML^##GG^aI3Z5G}_N7sFpdHQ2puC4u0O+5p*Ezz&dkK@$rJny7<7THd+
zN<#7|B8eA3K)>>ugyhC6O&kmcTo@VjhJ?PLsHPe|-vteq%$)en{*)+#8^!}yEP88E
zjG2P6XVpJ&_G2*?U%I?)xG^@NUk_TEE!6YTSct^zFEsrg7VZsndvLCqzkF<edI`rJ
zESX*PyWt{(z0p`;@(}I3>R7%|0I8^8u%M4`V%!J@V_>6?ZlFI@=nn=4R!k5E9{Tql
z`Xil*`PWq(j!dk-jxoOfx=~V7N<jhrt7-0JX$f_<ws#q;VJAU%g#>H8aCxDk3^cd5
z<1n?bH?!n;W#{m#35LikAo|eG(#4eim7Oir8Td-{(I0mJ(Z|0|b3UT~;}#c)=%W`Z
z&*`P?oh<43Ik-5u9*Ggq)6<JMS%82V(z1UxNB<}K$lArl0m#Ye?(WXv&dXu%WW~uX
zBqYSi#ly+N!;Zd#-Pr@`V)}|5>iqa$o&430w57AT6WGB8Y!9XX)vu|Uy{n7pqes66
z`up!+^R#>g{`W{w=RcQ)ULfbME1cXMT%3RRjczLP>n!j&_?4xto;27FO&;_ZV%$Ok
zB7fZf+m(Nh_>Yz^{?U?`hyR~V|8eO*n`%2-I!W2vp~rL)`}fxT+4!Fq|7<A2`D^L_
zAjQAv{Kr`|p~VP9IRD->F#;UJ&J7F<2@C~kNv&5mP}6uW+TTY%@6g<A3Nnr_+K(W;
zQTRyyE-@J?S?eXK7ZQPq*xkTsxTzS=I4C1gv_Ipu74=3{{urbtl9=icJ4LM;bL#}5
z-zj>OCdBLP%LEaf1tF9>K5oZSym^g*d6VA%_b=>di6DBaTT+r3H?WB%e*Y@L2vE8t
zzU~UK1pNy3O+(yiR#S;<yQY_zi)p#OSK^z%8<>fbM~e4}ub&oi-Gcq^llfyBuT}j&
zTlP2I!+rDnYJRN{o8yG~nuVa-24s@ZJ5aimzq#@78cNXnOIT-OQ}TkMO7wUY^83RA
zW)yv{r3tZoFsAx)&SFpU(~yXWowHS}uDan&%d#{*eErj2C7J6R^*@mhXSMMjnEmOe
zGL#L{*SMaj7y%16vG1AOe(KP<zrE0SXY;@84B5>m&G(<r-7~&^GzoeDdUNuFczmwg
zb@W;#(1gPJnay)O{d0pb0=kEv=M!Du`%QWD9!MB!$zHoh0mH=f4#`wq`vKSQ&<%Xz
zy4&yGcU{jlQB>%eX-XxFT~8l+dNk+Ua8#$fp0hNh&@;1nI)r!qy0D)}%<<53uspt=
z0c>s(*C`WPp8gm9@&Co|-()PWCyG2FdS-=L%5>MSi#Q5RQvbSwu<MBOIi9mWOA60p
ztLf<VspPYWw;7FdTQ~QXIyddL*ZvE)5))YWJN2arxmko$0b(5I+w#_)etoQZGD1h0
z=*z8+e;t7WSWP|)TNkS3+)x&!2z&e4lB=1l?OH+d@5bB-Oi<lxrD}ZQu-f=g?Cy0$
zsZ+#p5mmDCtUDTZSQfk=m?&A@wm6U@#~>miG9Vsl_{mA3^)=4o*;Y&9ZAu>ba^t3Z
zr5WTDL=Ob%nbgwvU0|YKZp?;tAKtuq^Qtdzp|vfX+U{zxJ25d$$hqqcK8Xb)U39Qe
zlL?X-<0EV**Z%FDSZQ<4LYyXCwfnT!Ag`yIfx$j~Dv|H5>t&+_0b$dEw_?W4$airx
z4TtgvEMz1bHW&G&_YwpmNjZ|lTY(`)f}U)Kha2KgwONf5UjWLkp{*~zb^mT4k=O@U
zlUF}*JXZ4(pO`dzA2zhjHwGs3xwcTLg7R3M!n^HTE_Bw03u9Lh!ds2z3dY_$G9H&F
z%dwrY=aU?Ub@XsmSWKlAf^qC!v-j3=fmUJ60wTkN_SM{t@fJV7*GJ!5=G07fwg$F*
zPWPk9+4VcR;#pCP0a$nw;vGI`hbKjwr$RJGM}a||CY4JJ#V8ab*YN>D%A)TzgVXkQ
zw9>>o5#MLc$G%avlONY(Ak02ylYP@X>><mi&PxyUnmz3*f-Au5ZUg*Je`m<giv-66
z`fc`_0xJXldE|r+xZTkC!i)-XleYB++)2LFLFPM2xU7{Hon~q#eisLQi+m>{-p3zS
z?z8BYv7uL`>T;V%>^ReUbUymAoW(%443FE!i)4PglrTDR<09?igq0>w?x^NQ>h+20
z;^A@=lTdQ@H6NgML~taGKKKq@eC2Xq2rgHwW<uEub|Ghr#Ne%U@@2PP>9p--Wg(~i
zBs*coWK=sij`NzyYqQL$^$&WusC*mB4p3qe9uis}RzM*ZdgoQL)Mp&N5)L-F+an@}
z!a*#+WoiNFMp{iq%hhEAA7r!#mxOFD4L=F2*WgwvdNpcb--!^vVk4yDi{dtK8-u*3
z;7sU)33mgKhUV+Hsrh@--F;VGjY_o2kww}{RfKlBa6jP&wo<*ywwYo(CM{^wfsQb=
z_YRGaQ?7CfpMq+d;KS(#_r&|W@%ryUFU9uzrQFUZ5^=$?Yf9zoNmb1e>g`n)o%ax2
zE=9*Z$-Ik=$*QPg>!rLD8w?%P=^+XdSlqmZ>&c;+udGq!(Au3s?zgs2*=d@OZ0Dr9
z*_+N@Oscp<x^ax!q4{0F>-2Fj@%4eYR0huX@Byz@OF~u+)li7ct~%wuuSXl>nxSN@
zjKOzkVz!#kRP}3Y!G5Y4V(hFsB~eXYM-z~V8r*Z8a$|OZS?@}eVqo&#G9s~^)=Sxi
zMv)LBUC3E>v-u3_r8bnWA`_UD;d7Ww=*@3C_I!7#cbyWHF5>aTd8sFTOMzy%SQi0`
zTT607O)$JAAgeGR*-B~k*cjtJS%_7$b=W&Vny7s!e<&3+#=Yvi?sF=)Kjn<*45Q@T
zAg+N<+hiCKdXvG-#2tT1ua14pk(QS3Xs7eD%`m`9N;Ck@QbEqfYsHzyhSPoUl$RE6
z3;F)cHNvX2*vTHeTv}o*=C3>#1E)L?bQ!}Ha|Iq7!6p@2&p$#q77!GSMiaAUyc~YC
z{J_>j-4bJ_$}2tFN-;pxM4c~9p<Z=Nskm#K?LgsD{ozu?v=<7Ptlgs@qhepO47NuF
z_43#cXoS2I;rQgd7)PbeqA;DJEs8vNIZ&a!i}-2j#KF=vx;mDhN6IqirPAGWM$~a!
z_z{shu<vCwKIo+Mo-zGEoPte{<5ofmu~99r+NPmK_KRpipB<dvck-r|1l$j@&D{@R
zg|R6yITWIDwegF>x)<p8w`ON?9|N$|-$SM6jrcNu*^I6V%kEsIM2_8-s|$qj<>`94
zoe}IysZ3z3J~`WqmsnX;f)7MJt1briQc4S{r*Bj7$+svTtc{?C?R(R2=f*u%|DrSd
z$r*l|R%8rU2k^XTs4tPz1bQ|a9-N(%L$aZS6$gNfRs|^b{<NKG{6we)ooN*6%vza9
zqpBKaKAH923lF0LC>ndA00Z>4HgWQ?jzvSAys7@#xI)w;#gDyI=$*f9k=PyeQjH{f
zn|d(x*mew+I(s#As?g6*)LEt)1@6{6<t=Vb3d?`rwX`_hIH`cBZJef4v5olWf$V1n
zK9=G?N{C?q+0<7iEQQ3vEq3?yG#af<KW+8(X;i#WPX_p9rG-*p8&{acS3zf9Ow>Z5
zvm^cLeq*1_&p)Q~t!Le#=54hI1;q;6H)vA{)U`r^d=TG_+3A#n)D8XgyfXHOM^iHc
z5poFi-yM&D?z{c|Inc&=>_=E&r7eZcrhxret!Y-V`P~Eq=tsm@t^&zf;ZW{;qWi3m
zZbkCvXmTsX1GGh#fhP;gV5L&^)UW2JZd5^yB6ml0P2$-NYQ|Wov|Mtmb@Ir2YtB)%
zvl}04P}mZWA3sKYLQU3A(&t~?+e(Di@Ipq}PFCR=(pZ`6$nshMTHfdvyW-#L3UBHf
zv1(m80F*S5v%~W`rTQMHkp`0&_VvDbBz!&TqN#EG4MFRkNhz)ck}ACpE^fCtqr}<f
zZuA(`X;q|Hm6$XHHPxn{4Bze|gN%lN+-wG>r-f_43|U!}sH(#e#^-fTC|vM(ZkDxd
zF7D&*_~ucI6<LKvf<?>TAeEYMAb<m8RAW8$yel;mPTsrrK-4$1WU@}CNISFvw-^Lk
z+pDpekgu@pHOsJ{&hM=$19@;5)(ql03Rgi*Cs_;&{P8O`YxUrV*e%!4+l9s9J01tD
za8k%=Vf%!@wZ4|5YM4Ov<#Tw@x{E2h-DFL5M#|z!iBTbwVmwQ{1%3a_%5pjSbO`Q~
zYU|1RnLKiu3|?|33~H*B?cxCdw`;F5J8)VwYIV&Mv7F(@LFap%wGy}28Ot<D*ZY)4
z0Gej3I^e`7GKfnKuwISZWt1-n=+2S*%23;B)0CD?84L9B%0z1IM)}QF4wXUAb0n46
z*V4Z$ABns3yV+@pmQzLos|}PAdXhJmPxb~5hfcKXwG@`0E5@@yBVG40j~A_9y%7a`
zu}B8W)UplI=O@I18tWMg+?jn;@G%o-=pX#%l1kK*$_oPB;vKC02OCyWqJT8#h4A!y
z)3@aV<AIh2?{ROro>q|)ZcaNRMBNB#H?e731SQ*#mq|{2&yO7ksu`+Rpz|pwD;rT|
z0h%<C3Cx=LV{D2>Era8R?G2o;J7tnegx)rzxndbm%mr*|yT>8tgRriH6TnwZcsnFh
zC$gFyrnA*l?DeSk$(e?6Wzc*LO~XQ1az$Bkw0;e0%1(SQW%Wm*fy*AP5$j$nt-EK+
zpiu{ab&xs5G5PsGHFs^w&T17D#!<Fzc)7j)PN`^XtXi%sp}sABw%R@8Vt5s`qm*v=
z$u?;D>ydk9a=fPzyf}j&QfM=<Lo4X=jaInDg+=%p-6+3>`H?wzRbDbMNT1g4-0|c`
zFx>)LMrtIb2q(bI`h0G{oiA^1*~w;C#>S9H_at&=5N@uLI>ENYy^kHdGRjTrS9?j+
zL`<<VskmTbKJ|oxK*+5r4=Y;-mG!2p%d=f{XNtAZ>5Yk0Q&ZEQ#hjw$GFVYm3&Yid
zu7MBPsotm*E${^Jp^A+f+_D=A*PX4&i^^t`(JC?*+On|@DAKC33rpUHPg_`_y-!e1
zYP_2!l>lZUpodYU{-iGrM`@v?GkdDavSCG5%&P}i=rV3)<vz9bF!Or5a?JvrX8z=)
zOMR{TfGe--5X=YfPS-G{v+WY-?XG20@z^}t^o$k$oM*gZ_;EKnTQ3<aC?e*qlJ3O%
zNO&-=<5db^wk)S`-OeVJ^!Gr8zUh|XUCP7|%MONpOjseZ53X5`cBY-?KHq5Y&BJ8?
zyo4vmQ*{jQe#Rmilb9=Sxnw!rLtE|8GMd68>&_(ZoZd9=GgK{#V~NV!1v9GV^~qwG
zE;7qS5e9VKxbt%&orHe4L;;pv>I30Ye_u9UXa`X!;A|=r7Dn3}rLF{ahydN7N}x-y
z1N%<K_(@qt%4%V9LcKyXu6Ff`i*t2<CP<ND`W4)+JD=yft^fSS?J{BTx~$M8c{@_~
zLVu)Za{~nQ+)$nFE|tk!?@m_n<RE16oTZC-$bYNy2O&VEZBg|E+Rx>s=YBj25O5`^
zCs!FAzH}W*&&p|^bk16`&(@sO;U5}G-#*O~&Z@QZi1nBm-<_Wu1E{zj?Tq%Cxi1tM
zHHA*!w?0{`&K93YfZnefz&2$5-4B)UB)=&{?#lyZ(R)PYvG)z;29qDjY#}8fd3<)X
zRhznStgoiwt~w}@ene`%6+Afo$@R1rBm)eP+*%Kyg|xxThA91P8fxZ?IeRe(iHH(0
zaR{&{;^CLfmGiD~dPF?cZlp&p=Uc7Zu>l1`-(d%|^Cm56Tc^H{m6!5VRn*w}lb_R3
z74+DQW(`Z2J(EE;i8$`&9;Y%FC1;+NG+*Xp+OcMFJJSB{U2MxqnCt8F;U-Klh&<w#
zWGnO?vYX>!zF+p668aUaI#d%F;s<oQ)V3{-oVK?)UlTK-Zvx;O-h~(%tIUbqx;FL(
zvuB>cdQt^AOM|1WuawEu;)37*PSaoG&E@;IKn!`br&L@go?VMD+|Wfw;`LwTAOE)w
z(5RIF0DSBBmH!H24e!!BtP(s9zaAO!PetPo)5E#!zYEW=xj4x9f6ikK<NGgw8kB&z
z&P6k}=69R+Yc8M3&=5fx*Wk@-DRi@rSz>NbMdg2s{>Q%kZ>N9b@wxo}vG;!p=l^8-
zH*NMmMfMLh@+ZIi|7!0yxPxP@Qg;Ki;2hWMXnJBfdgmo&$7ZH|hRn~FS+70r*#z(X
zCZqqtmnC8_f82$~l;n^lv20S1#9wa}=m9urs6L<H=UT(+?{9)ONEc?=_pYB%E?OIO
z4-e;a{-;R%Yp`u4w7oJ>*1F!11`Ly;q571G{kPYl(ioV&XsCYweTd@q>x)YH1=VY&
zHebK4&zxv$_ur7{8`v6}zo2@XA&TqQb<BV^hMed+zyAW&qYbUHirwk;>$=f`b`Va#
zOEX+g6nT|jP<^3_$@S}+OGGQ!mZXAffpHAXLbRFY0aUO47x&`)9@@S5e{-|noNB*U
zWac2Iz56g#z&`r+!-pD0!__gICStm0Q!Q8iX`){I1N>-MkO{7uk)RL@R}A_2Jy&KA
z6f&xYdcWKUi$w$1UiF0BIykq;<7~$(Jkg-Oq_T2YiC)8~n|hv;<-jH01#qmf^0pIV
zdRn6bGI31`X%HsyN7C}#XRXnr;>;l4)0g0Zu$!{6-=1BvAXqU?n6~c9*kdt|;)xXQ
zRg4*+z+DWeUjgd;xtGr2?h<R+t@~~D@nvG<)loBHirc1VVwKIfVKeH=@|=bFRCFTj
zs>CCrCz(gVdL@thfRI{1G1aZsh$jf5m=Fg~KaX_T=<mZN;Vhh+m)7t(sgprtq>tl^
zkrj#jr3MV>1YsNxQoCZd78*uqeOe#sd>s!_;Cy+kYIGjcF_1TqCC%d8X%z78o&2iH
znNfu^k^?+ll*ecLVix=BGt0J~mPL35p2CkWZx>sQMK9L&1Bt|Ij=ZmWb;WoYybc;o
zA|8mEO-?kpXLz4oL~7*9n|kd3z!OF37VF47dK~H13_onGTIF3BXwQh7A=>AYoLnZ^
zn4xsn8ul2k1IM!IS4pRPT*@R1T+w-4O*i}Ea9*Igy@-=}tzzV8*HAv8=GVwb0O`GL
zP8jD~pxRci?{O!b-}<CSQ>_bW;=>`jxydoTRsYoj==+f9z*pkVgLlGBUJEPSP6mm>
zxi-D^gH7!h6;2~IN(Dpl!B_lUw2(tkuxhQ6mX_9onHoF&$;0YMx7wO&WGDserVxC&
zJC1{9IbBWsN`s0Y%&1~em5}vS?p0Yh?O6kAK5~a7cdKD*66kffQH>;_%5knVwx6zP
z@(HRz35V3=S*{LR?oLqKPne^WGEBdBX&-u>oAlKISPz<fw>nHTnG|!VsY7c-ZF*j)
zx%P53)mqt4Ce|#gnVf~6kf@11cBSU45cf&<RlV~-#Cmf0wi00khkoNQ$iNf03+!L6
ztMnq8gdbiE`3E@tcs;AoYs~KW?srw0Yme3^;N#0gHa(CR5<EU50}pQ5|Khwm!OE#X
z&U;|cJ@@eI!rMgS>eenrGS&|9TjUe;`5-l$1kh;7#{;Lu9_CL@i@U7r{SAoYc0bir
zjtsx?SzHOg<NXojENL(Ch|@xcx?U5gv~haNh&pNLfH%iHn}jB3rq*$u@$9x&FEG9u
zG7@({&EMh7*~r%Z<?BJk!mV4C8K-Qgx100dPZEgvx~`42rW-X{6kZtC`UbA-9}77z
zhj^~Os^&Cm(NucobHE!ghEKwzv}5-DiF?`9Zu^@M9*6$&L)weH)}IVY=4ab!=SOqH
zg_^tD^J+<-m+lQne8f!$d^khyC+`&RUXzZHpvOnkMFAsk!IE$a%pBF?4^QPbZ||hG
zZ<;?DueVEG@eJF#*m`VW)s_)!c^qZ35a@n3z7-gJC$XVnnwe&@wsICQC-kb{-~Y95
zdfz;awaKlez8H{-eT6QlH=PC^gv({(cVMYk@v@9?pMhVt$+12e(<IM{VfE@ee0MK$
zw(~tg95R^-dYxOXOuv^5KO5Vsb>Fne$a2aHJ!}wfAt3FrFGj<L)4sktBgn(O9HN;@
z;~}_e#ca#PWia;H;DN0B#uylmilhNNV+^CV+d8ouwm!SFktpp84k}2Qnm8m+#Ro1V
z27p*DrJQybI;A&%UT3KNId6>C?dQcPF1u(__JYFRg%M8=7<9jud2jKpWvKa}q0A>)
z$Qh)zt;Bm=g~sZKeW5cI<G%G5N?2h?W3O;K9k}Uwed=V**1I8<3r_)g#F^)qbHmYw
zf>T(%m_;{vuL|zZ+sUWPd<d;=LJ+L0o4ua3A>k3o=s7!D9YUpZhuWD`o9lL>LCTDL
zuEISQ-VqPPr1O(LuBK!)xNX(gfw_3TRAmgSZjBV{RvrM%okNm&e5I!A88f|$nYJOE
zyMLHFi96|fOwsCI46=QA@v^x1@l(m63RxwWS6}s>i(&-+qgY{%g@k^dhtR}&yu#9U
zt6R5ZKP-E8(!T3-q&v_1Q$@NnTn$#!j>dPngoA>|=z6(^nU@y36846j_cE;q9;Gii
zSs*rr4#lje3bK}q#myh^*uI&X%7-=DSI7Z`xnsvgr%HL;XS^rl%stPK@y|pXC>zZ4
zjZaBPNaiaiHQ{QhJJl3M$lb(NDVfRV&VEXVw&S*LR)MDn(r`rNnR(;B=Zd;xh4_VC
zuqRrDe;#4Wl<eLvfJstRX*m<-u8p~b{U7+5yjK7^k9J;g6<HQ4a`u8#chb4xBL@sx
znH*+va5V~Ae7o2S5%AG7#Y|4+x8HHm&6dXZD$$G(zgUs#Okgj5Am%O2sFM7ML1i@G
zUC4Q<<OoSB+LwM|_8gJH?Yld^>?Q)VYtSl$pr}&n160qQPWO|K;rA}e#xqqDic)L}
z9WD;s*t_IZ65y&*$kjvOqQQG;#XRX&Gox~n1@BAOqSJ<p8FHh_3Qv@$>c|su0o$pk
z4endf?lYcWRbj}NHe11Tu{$7G4->5)U*}ojFTW}m??!Lc?Za&IC+j?8v-jqu{)SuR
zi7+L}>XeD*W)QEG)^$L!Df;MgTu8908%)t?NJF4)hl8qM*p<yyw0nj~oQ0-me}2H+
zw>I_jif5vJ*F|bp;kZxnXi0SX(P7kU9L_S>>a?-qgEL;)>1|oK(Yk&jH;6Z5%kRO<
zU?(vax1yKhJRd0w>Um!sZj9%8ROV~I-Aa{$iXnl`$6b(nBsAujjj5sy#VrSZ<qA7L
zzuR7TdAZb<AyNs$H(R!7^(x(9gix`wEnrIXDa(t3%qI8l(NZ4EH9pF{GeNc4WtBPJ
z!feW1MDun`Z-P%ff~3NHnZrxz^8DkvJ)^5Q5?$O7uuo5HJM`5j*#zHw9{}z9hu`T?
zjnAbmLO5HnNqgCi5SK4cKbi!0&iY>E5bCehCtRV<bkd?%^M&1~2eg;2DkY444+tyG
z4<sA*UQGk5?V5Dh_2sLJw9%mDtoK>d193-@zKa=?s@XT8&g@e1X0FdRP(Yl?h9>}7
zLaGD~ZN<~eBhizM_m_k7o6tiyE1xbW(Av2j&E#Y?Ps_<Bo+JN+<LS-lu}i+a{o3dp
z8LTusBASYI|A<SwByf3yruIa&ow>W^Y>iLD`K*BtO7(}k3(BlytJ2l`U}UUhalF;m
zDOWG^YIUzlIzyZjh%)HjnaB5<AXw5(9?V-rU3pD!?p}_OsEsr4oN}BsU-+q#U0eQf
zPWlV~+<l$l%3x1B3!ypn^3ymNoYdMmrp3EMONvJRQ+J+dWoKtEyc<tyAAiH>D>_Xn
z3>md`1A3f83J*jJxoLqeFI>X=qN3^o)U3RjRMWU9lPR9KZyNR$TKKJbCg2g#R*b`E
zG{3=ceGc*<M#fx6I2Fx#L+N`SY$Ap(z1?hj6@u_%>0f-yg-IQ0GR4K7Bw5xy0!#{S
zANxmKQkVV9B|8E5=7*krj|0XNP_V>V$N_1DvNH2#N`%eft_n6`3M!_EWL`KVGLte_
zCX`h5gQ$rQ`16j_d)&-x@LvqfPKr7k%tXTV(HJAIqs}tXvzYQ$*q{C&F)1cQ02;OG
z4C?A@YFMlvT+CGs*Vm{vW9UqJ=oVO=5p?k=IO0LGMM-H2U*cD}$c~DUMCj#`*5*uM
zaU2_Y!w$?j0#QZQPkApm@<Hs>C#RI;$6#KAA1_|z+RlD5u+b@wtGO>ZafVJeRhabx
z3!gWaEO0@hHUC;Px(ut11v8PV%Jz9}e#fJS=#nfyz@If)5(EUwsQ{@{qI1dJg+6xI
zVq^?XH+lEBRn0uj)WgB~!v<Rf>u3qj)yq$ERHGqA@5j6Z>q$dM=BAn<@D0%qYDKz5
zHm}(~D$P8piKuiJegJR$yhFldIoGdVVY<h!X7xRkH0G>fmP6)NJ2YkaQ&dl2Go3F3
zUJnl-B%Wy2L$Ahm*0haBzqx?i5Te<#*TT6t_v3N;4=VyfGJp-T{*zW+S;?}u;)C1w
zMFuCD_J<!ko%T?kcyv7V*!^*q>z%B@JV0aj=&#T)@uuMpx)8)#$Zvorxz>7>fv5xj
zPp`Jl30pNC$bc1e#WG$2LXW+|bn<mq!9}@h-vcE>$-7Fl>I9K%2>KwV{_%^<;wQO`
z{SycDj#MrOUx_IOMN+dj)gMLOlX-tu(%o5gR}ihZ8xJm*?@^_w)B4OonT@MH*pAm|
zwyB<LimhJdG+yiu`C6K6&NP@bUxGh09&XHwA&-4?t=xsIMsFgWHm8J6R*LEJq*4<!
zK0Wh51X}Sc?c{0?ynGpOZpu%b+<(7Ft5J1gcJLXxgy<!YW@MN6`^0Wt@k<sv13)}K
zyS?H{jo`9Xuffx9ozi$QqFK6SZ!;4`Qcf0+UBk<i`H+KFz+e76J$C>r&_SV}=c8`-
zpC`*i0^-+oCVR?idhKf@m3%OJ)4eN>9y30Mrs9jh4zM}O8{y{PW-#aBeNmN+QO9k!
z5EINlJxg^Cx<I@gQ@fo=@y^|m^;};V)lBWN$S8*Of@9^!4E(hd7AjJg&_g(bUvncr
zWI!k*AtOa4nc4Ygz!18W>s4FvjhQuVmaY!RSc{(-ym@ZnEE*lQo=I9ET(UqK@u<O~
z)$o5}E_3w~{kR-}r-ckzY>KZF%C6Y^>Hh^2fH^+6`)%ltpp$HSVU`z5;rv4-TAdK-
z9zF;73hB0h*vh&$ptXDoAN10b#gUi~^D1ea=b%?ZyuK{YomsOeSLCGMCq}>?idYpr
zyVJq>wf&ths54CuTB2(Jtg&O5blZrr$G!dW;M8Y7p3tV{aB4pNEXJA3>+(_Z%hyHA
zeKMVd)x}D11N#IvJ)X&Yu?vvDR=J@%KXjZCB4ArHl&@r>`DGM&rkYA$r0UpmRMv;C
z^0@02S+kdl&r`-V9>L8`k!!QKo@bt_!zhue)J(@W#o?TbsCK(xOvTqn?60b=Iw&b6
z*S;*YW?V$kOpF<zYos2VGb+b#zmxB@d<}z5*7C1^)rl9k>Wc>RE~i|YFN`$Pg@7E~
z)(2;1a*#_LFCNvmExRr%Dy5POgfwHZ`zc>`D{G3gG;OZhw0K<&0yqJ$>RrCu49xFZ
zDvk34ww3>O+@|i`ocNq4mT6Qw=-ozSe6Px7{b1<Mzi8je5XGRh(Z&|d6yb$?c&VEq
zFKv-~F#|u!ancNwJ$wO=)h*TfuE_~msu~~u&Wmy9oV>qB?t<Cb&eospGMozAxeHyo
zu@H!8;Z6M#7rj~Q9(93tr*kfP{)tuJ#$cl()~ETJn%(YqAKmIdU8)#D^<L(i9yK4S
zhJ=Yc#0m=I3+Q;}G!!l{1|mwPpIO<_+?a@oOkrMO2qlkpjJ=GZbiVv3DNLwi^I>bK
z98bOlnNck{x}yp2E&{AC?#zfj0Rm-xk1gwzyT#gZsT<sEAEV7wLN=(k>yDkie4iiE
z^kA8iCzVabXk7!|1<`A9d{1M)z7(G4cED0$u}IYbf`iQYi*(yT24%*z>gk?UaGJ!K
zoK{_$7F@>nq%780(Sd$vM#g@Z;+}e69!E|Vt{y5in#AV!R!Mfl>DC#5BbV(aavj^;
zBnv;z8on2I>i#XOCzz7dbuO>tcLEc!*<-INK9T%^UIx6Rc<QVI7XBvFohZLYojNvu
zBg5McSvY*a(xmhvoojVslYdL|fyqNmb@gSG{Cqk4Nl)>Gh?+wazLpKKZL{82LtY%=
zYKYyaSg#qsT^9pcZ$94@n?6Tr3V#f`5(g!Uv-|eMaDH$oGXrlzZG4ci0U0NBi@f{i
zBCBYCk|^B#RU=Z=)A~Iw`}%N+O?xhr%XBAE%ef@K-8ht&8ZiISF|a;+{#K+Q2QrcM
z@%zNmiU6fv)nN>aLtDMPmzUlj330a#;7RLR9_*T+o`esL9=0Z@O^z2p9>^x9UY*NZ
zloCAEswatCRh(+rdsDn=aU$lsjDX@G^UC8k)hfzV1xwZR$cO}V`REw<)KbalF+yy{
zpii#7Sr?V@cM`7dA#qiJl26@nD|*TS%KSgo@d^ILv$`1)dFy3~)Hb6DI7$@V26RnK
zz0`ncQPAn}&B|7^o4vcQkbHoc5`-(oH|mrz8$aq3YR1lx=zB13*ALkW2-KK_yeb#j
zOS(Ahe#f0n4FC@mcIh`CLo+XiP3jfGak(_J1&4C0?FbpyTwJy^D)lW9$XK}QWab(V
zuZ#gNEi8Me3Pu>9nhb173G2rSj!1%`DwDw@%cwX<IMhkpRRQ61MwC*xOlC`huH7j+
zC>$?T#RmvSG3ju0;0#pD3ZxiKS0>RH#O{=6w#2fq+t;h}VO6(`Kat1kPPrH#$Mylt
z{ZoGB&s#uKYl}P+A#{yTtUV}`rb7QfEIyObZ}&)DMYo#EcF<||*84+rlQFcR9vjUw
zgMM>Fj<V%L?cx{Bere7}(*vT=x!qX+x75PVi6lqpoKgz@aDl%1WqPFq6gt|$>#8R(
zIN+awyAYaG{iu3@SMN>A_>mu{2)L5uAPt0<F6JXkWW@Q<c)j4%#xSr<wKJVPRn&I0
zu6g=kQm7oFV-u8DW`8pM*;HfF!oo&2yDYvC;#&5iX{In`12MiwkutXl23udMn<ype
zk!ZCanq>rw+SzdNYUaPWayG##T00(9^4Z9jPr(N|jOAU)&w=~bB?5DSuHwPTGtF0X
z4=Ev|qr<B|w^~kOjx?%_-5vf$ZLm3_w*5M>XLLfRvs$~+ew#w4nT)7j67wh};h*Vm
zi4+10{?zjQ#y#3kR}l>={%dv9E^>Io6$-qFIx(+hEQF&Op1a!$+o=@3SU?%gWJ)!i
zc(gCwL88~@inV*2u{nQ1GWQu><)vku)n`|TPGy4?5go7bL^ag3@=WY>4X+Z*gNzsF
zl$_dOsH@&MM|EdZxhMB^WO^Ito`iWCQ008<(=C+CI>BOhmol%b_m>RbMVM}SLJ6pM
z)H*i20HPZd1d5A?2qYCwqQz7nC1&!1cD&iSR<He_j<DaR26XQ91>5E*<z*Qtg;t21
zqr2xcp31^@Iy)rp(jE3379nOmc7Ny!Q&>u2@_aYgWZ`ZlIXvY}GI({OJwPfLRkv?g
z)mbw9(&i4y_S8p6BpM+)i}*xL;&(IA8wubbN?{wk5_whb;eN8=)!!SeELL*zgN}gX
z#ys|)VEz-OxzL-2Yq6+_O2p-pb>>fhm7|vl-XIiPRs9iHtSM26HOrUmD^7UXtBgfw
zLB|uDJW<k(xeA?ujM`T%^WD-!)}NzYKI;9USh60f#QNlL@}{x|iz^X6H^O1xa#62N
z)y0}@B&P{wU31?my8@2n*4k7bNN4TN4}F)!{j;93pMB6(n#r2DomhBxRm<|k0k>-o
z9ifX2vBqTcYMbXS%0FvYza?@pNPi@^9R{-%?&B=YNnKlsBnJ$F$Lss@fr2tvjVY!=
zYmuFYa_iOBgU?xXpV}9%kRBECF3HalwN#jE!Y6woR@cfQ?`?D-n!E|CmCKW1I!0F-
zUnBeWgfmqAj3#Qik0L%a#H|a#bgnYThoAb2!o@QF!i^=IuzwZ&5BrfH6fg8TJKBVq
z2w=Zh&AAlEeI@sEBm>a!;IC&z=wD&;(`MWg2~@Cnf?TwLb!c;ZV$Xy;S!)B-e+mO}
zGivdfbES@VFka@1>6^estU8h&s`8sZL*;(+fc-2p->yE)7t7d;*u>_YKPq3>rWJR5
zh6W##SN7Ul5J>l4&tXea7iSt1Nog3UJoUz^tf;E`*_g8Sa@bXdI;gh~UHCl?Ub~!?
zQTfwup-ZuT-2J$o%(Uq6-NKOZfZkB<Zv>%^2ZwJ`4X(_j?Tv#2^Ww`)PLK&KY{o1C
zGWs;Xd7a>C6j&W%galrqb^9}048g3^=KSpC-q`c-2);^9zrU;2B@}O3$cM;+c|9=Y
zP$@EySa)X(cbtjHOQm`c<}pkC%6SY~v5b3<a=}W9<{1&K>Wb6zbln`XVr1ULSj1bo
zl!GFT%W3!o*1+9Ane!j1Qio)83X7AZzjsnDBGq=3EM-|Sw!CpKE9~;?kxQe*=>W4H
zqUo~CcDi|JxsIGo4@&WxNX4SPtF`5V<9$Newuj$`bi-Q5_j<Kpi%`NXbPzMRyyz~n
zu5CBo{I!fb-i&6D3q30F6HLk{$GnwgZ@6(g*Ddb<wfDaum;#CC7cIg2jf{)Tm5hTd
zl|u^`)Ae<`U&=X6WJAf=y%h{D51kjR>u&QlxI-tKyV3FCt&TI6dS^?c%G7*bz}mr;
z@1yDZszgO(;-0qXNMCPC?em0EeO4dZW^wJ)VL~hyXMeZS)Uy$j{C?%pj#99xudCv(
z%ozPmY$q!g#vkg<SKMqjgRFux&2#@j8-Iz3TiDujJSd?-C^p(>03q>;)T^^u1N*1h
ze8~LH1|;%uN6J`rCvdfVs;jMLZw&Obo;8@<t_hNp?n37me6-a@obR@)jllq##hR`i
zaYC`P(`b~;&RzcC4436s^rjmkkyY~XN|=JOTGwpB`?+X5NZ+P^kkb4)VMOacrV@1r
zog&5URLT%?4;U`i{95^Se$AEIa<{6*vVF7ZmxKMO@CTtr3sgmTLL6NfC-?PnPejzX
z#pRd0dv<O`CF*(EE-g)g7M(HUqbK{RH<k<;z!L?=X-xZ@Rxx0|uS=!7!;eKpT@O*>
zPfaej-;11V`wY%UOxkX%@k;u{xAZ3MEqAjryr-zvOHQ#XwCw0`<Uy;1!R6?)yypSu
zhiRKHPtdVZGV^kS?L|##ieh{yavX9h@&lykNlWq+2C$Fjvmcb$KOH24SoFLp1SJm0
zS9XK$tWGso4;QMB%;dCOrU}XY;kk?D;=Y)ys#EBSV*w-7QiYHat7!Lr+?Veb-^Xm!
zilAyrHL#pry{Bf`$iy8B#^oB+linh)n)=yx;0w;8G0B5b_q~hE9~BUU*nq_5#6fEA
zuVAy>&9$Ly`30{p%&kmvPJe`@+pc!TmSPU+dwJ&Q=dse<uz+^Fni?wFf1wQn^Y9L;
zA>)XRaS_BE#Jyh$y7Wu46E9#=-G3r@e}OaP$3O5fVr<M3M@no?)Alk^#$$5Rz*yh|
z!d);|iQ%}$Zrd$2d352T<p+FRAoZMel>JVHHh<<(&wSHDpK9#{22w51Z%?Ebo%2x<
zW)hh_p!XH05}c~AgQFj7nbh2}=lu>eZwu3?dwByPWP-Phkn4WUz?!=net@!^X5TB6
zGsntA*@I0Z_ktG>rhu~+aXRQ|%y?t(!$L>2k&8_=?}cH8RTda>QsnBSyX@v<-ZW7$
zgMEg3n-YxWUoLV{z{j_YdxwTyScP8qJ@l9tI%wi#FsZY<s~OpWL-Jy{ny;F#NLOwx
zmHq>|;#RqKW~wJ$Z3U@Fl0?Jr**IKgEMx4k#9gS@RDti?7p`e^mU4I`LL$=iT}<l5
zjL7aP5^G`Olk;G;IrX}BsT0nmNwp$!(#!AE^-a@d7jL8@1&Iqx%&XZ$jT!|Yd?TAu
z((kOU?s)3hd~UrdYBk}zo+q{|kJvo)f%M1y?eG3uG;%4>DHh4?e84RY-s8|DI(8~S
z?-Hcw;DE*EVqdZ*8YQwoK>T|fR$Lr<k0Gz5*uiKojBp9Y53yv_`gxR-97C1q!jC=p
zG8gxLDjKhPPLjTdcHn<fc@JS^X%Z|Utcdm&`j|aS5I;zJ&4!f~Y0AYCanEbE8t-$B
zct##=K6LHzO!jbEj$!5ny~o9)7ARmHS7|eyKXrX#Fv?c3J*(o&7rXcAYCnNWn{`~m
z+V$770o4FuUW1yFm>~;mn=9ZQD;fpDh)YrTtYtam*)WgKsE7f4-Odi>Wj&Ca#Y8=<
z!_@-nIcbk5{po6HcL)c)S>v^xs4&`H>SRyu<=ffFH$kbLAsHm?1#a{jA5A?x`TAwU
zGbaUBZ#}LE@01oF(FsgRNiN)4Z4xlqwwPk{d`$8C<7@%N(*A`%!RL<<u=f?3*;`za
zyzn<cAiiat?pmy%G0jgZ^v}Cb_9&2;tU9?-gbCxfmJ&ghs+W+22WStAp@Pg&)l1Ch
zAcw*L0D009aUW7CgtQ&ASQj{USFB$K(cw{Hmm252wg9wB`-Orcf!{m7iFh5RId|bQ
z13oO1!dOZvL+HFOVa|%rq&P1>8AsjXnNgmesq;v+;FkQ#rf1fk)rx!*syZ&_w2`!2
z0ZOy^pf2!euyAQcMifx2`5u=D5LMTsY=l&P4qw?nc*Dae^-S7rYucVy>A;sTeQl4F
z({r`KaboXs7<`q2b2<Z`9UH12S4T$Jp>QQ;4g{}B#h2*>ypPT-KEMw=|CDySu^v$D
zAqzAg^**uMaq_qf!Lti8d-cuH<D!Mmt8BgXGBB8-3!8`cg1Tq2(Jr{DOfR%KwA{BU
zy^K<53cF(|2|$~eYE<V+BWndyHbJcj5wfhMM8GDiRSUWpmU&YO7edI4+6Nj|mH<M%
zaZWJ(O;VHqx@uiqkFdtZtxz>@G)xW#6n7Z2h8H0aXZ0sDALP#lnfGQaheqwv%j**g
z$a`%@z}u<=0QOr8x15{XPKLoJ=51>64GnH_)Hd2AFvaq9yHic{LoL0)q=&m3^Gztv
zBw)N>|28*|+fS|4>3LPZl*~Wjj(-?wdWY|~p3th)|D@wQrjrn;E3_Qd8ZK;86|%?F
zrCJ$c9+Hcc>F8IV-^jZU^E<a6xc&LAIpY|c*mQ?gke>L*{c45{Sq@d2Ej5#il>_vH
zPVyv`JCRWA+*WzQJ_c=2uZcBWDUsC~#h_hj(Z{wfU{}5F;%TL2tic^Z0+cc2CAaF+
zqo3%*9a=J=^F~8gr2~wW8dxRu#`(DTu8*nNxhc#xtdj6SvPspvL=S+r;;2q+-)Za7
zZ^Hmt*UCpma$3ku!)ksvcEu){N+wr=231~@PoO3}FCN8w)eO5zN!R+i1T-A5G3<`g
zL_QsHUr9rrPSk)5*Sz-N`&T=<l-zEw?cgs4zQhP=GR8WlI`9{Y+iBqaUSU-igWXZ5
z{I#}v>+{0_y56om4uR<xYC7m=t$w*xqNRFKDbcT{u$$AeA!f9^>q0<1@9!!O>oK+>
z;dRL|&&5>@RH#Q1TY7+z^<wh?5WC{mJwJ-|q@-Is_N^Mi-=`YVoxPR18A0xwt8TUS
zMuD1GzW8Kt)R=l(X&z-kifLg(?0O_9VQnHdo;9wP%+(z_9k!CJdp2&{mfxl<&@zyj
zRpzHRl%xXVmOJ%5j)&z>Z&h2(yUiV_xMLuvhnX&ghAvn1Q^Ki-xrN_x9uA|6)%h?A
zQyI~5|Lm!E-)Zt`Uo#Dtmht-0$KDScj#f+!mrE40gcSz|KJlCeU3+&p#k@9#f;(hz
zj8Zk-+2~Hro_K5?xT7xe%9x=792F+V*VJ0&Vjbh|KS942P3_ma00N@Se=u?8?=b9q
z_Smyf%f?N_x_ckW!-y=IePZ8o9*3CZy9tMIdD=VWkoj>B<sPMgyMW>P0!agGVlW-p
zbA_UeH=BE|#=Lg`ua0Js8I^j8&1)-K%R^Ruj6g<{qZ1%JVDMdsyfDoa{-FnQ2)v(?
zd}<#ydKM$9+OZuIy7UIbXX66{rawmul51%FA!Up8vy#n)^lsaNg)li@9`kJTjUdsT
z^|L*rvqA8Zg39a>oPF)zM(OXPR(fJu$F6eID92R_%`PpLC~@U_cW}nb`T7$j4fKOi
z3h}w83Tv0gNY^9Ox3>I%(QlZAJCjNqUO~4Xy3MD*SwjazV2ptVsM-8}8N9uoS;I_H
zsWeBk=Ad17;ALKHz^Wm#a4%8QCD`dtyyu@n8%2xLQP+q$TMq)Sd4^nWT>9XM(MnyT
z=7{S;f87~sQdZeFuYLYbgzEQ5!CwMM@ltok<r44n{IzBB#9`=AB5<dai}5c|@9$9P
zSJnC8Cv=_O|62de8h>uo|J78JkO=55*c(_)d*A-=xb~mV!3Qi5{Oe^69!ttvPVL`(
z{>grSWv6b^NA=-ghH&DN)`dkxM9(wz$<s#<xLk6)^1hx^n*7^H0A&R`GJZ-0Eo3my
ziQ~>#D_FVr-}$cp7^UnMcAVp?=N8}JAlH9T`565|hE=S$n*Y)6&wrz8(2P4Ynlbac
zPxMQ_e-1`hL()A>yS~ygpo$D#L0WUUAMpps_}iD*uR=_TAEeg^)UV*T6fG202XOam
z2|>L55M2X`M*#mTrTKrF8+yB6b+e`7P1lN}zdupH6<&z!v?ed?XWy^)<tWIgN|!x*
H`TG9@Fq(&U

literal 0
HcmV?d00001

diff --git a/api-tools/threats/threats.py b/api-tools/threats/threats.py
new file mode 100644
index 0000000..98107f8
--- /dev/null
+++ b/api-tools/threats/threats.py
@@ -0,0 +1,254 @@
+#!/usr/bin/env python3
+
+"""Generate reports from the Kandji Threats endpoint"""
+
+################################################################################################
+# Created by Bentley Hensel | CivicActions | CivicActions.com
+################################################################################################
+# Created - 2024-03-21
+# Last modified - 2024-03-22
+################################################################################################
+# License Information
+################################################################################################
+#
+# Copyright 2024 Kandji, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of this
+# software and associated documentation files (the "Software"), to deal in the Software
+# without restriction, including without limitation the rights to use, copy, modify, merge,
+# publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+# to whom the Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all copies or
+# substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+# PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+# FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+################################################################################################
+
+__version__ = "0.1.0"
+
+
+# Built in imports
+import sys
+import csv
+import pathlib
+from datetime import datetime
+import argparse
+
+# 3rd party imports
+
+# Try to import the module. If the module cannot be imported let the user know so that they can
+# install it.
+try:
+    import requests
+except ImportError as error:
+    sys.exit(
+        "Looks like you need to install the requests module. Open a Terminal and run python3 -m "
+        "pip install requests."
+    )
+
+from requests.adapters import HTTPAdapter
+
+########################################################################################
+######################### UPDATE VARIABLES BELOW #######################################
+########################################################################################
+
+SUBDOMAIN = "accuhive"  # bravewaffles, example, company_name
+
+# us("") and eu - this can be found in the Kandji settings on the Access tab
+REGION = ""
+
+# Kandji Bearer Token
+TOKEN = ""
+
+########################################################################################
+######################### DO NOT MODIFY BELOW THIS LINE ################################
+########################################################################################
+
+# Kandji API base URL
+if REGION in ["", "us"]:
+    BASE_URL = f"https://{SUBDOMAIN}.api.kandji.io/api"
+
+elif REGION in ["eu"]:
+    BASE_URL = f"https://{SUBDOMAIN}.api.{REGION}.kandji.io/api"
+
+else:
+    sys.exit(f'\nUnsupported region "{REGION}". Please update and try again\n')
+
+
+HEADERS = {
+    "Authorization": f"Bearer {TOKEN}",
+    "Accept": "application/json",
+    "Content-Type": "application/json;charset=utf-8",
+    "Cache-Control": "no-cache",
+}
+
+# Current working directory
+HERE = pathlib.Path("__file__").parent.absolute()
+
+
+def var_validation():
+    """Validate variables."""
+    if SUBDOMAIN in ["", "accuhive"]:
+        print(
+            f'\nThe subdomain "{SUBDOMAIN}" in {BASE_URL} needs to be updated to '
+            "your Kandji tenant subdomain..."
+        )
+        print("Please see the example in the README for this repo.\n")
+        sys.exit()
+
+    if TOKEN in ["api_key", ""]:
+        print(f'\nThe TOKEN should not be "{TOKEN}"...')
+        print("Please update this to your API Token.\n")
+        sys.exit()
+
+def http_errors(resp, resp_code, err_msg):
+    """Handle HTTP errors."""
+    # 400
+    if resp_code == requests.codes["bad_request"]:
+        print(f"\n\t{err_msg}")
+        print(f"\tResponse msg: {resp.text}\n")
+    # 401
+    elif resp_code == requests.codes["unauthorized"]:
+        print("Make sure that you have the required permissions to access this data.")
+        print(
+            "Depending on the API platform this could mean that access has just been "
+            "blocked."
+        )
+        sys.exit(f"\t{err_msg}")
+    # 403
+    elif resp_code == requests.codes["forbidden"]:
+        print("The api key may be invalid or missing.")
+        sys.exit(f"\t{err_msg}")
+    # 404
+    elif resp_code == requests.codes["not_found"]:
+        print("\nWe cannot find the one that you are looking for...")
+        print("Move along...")
+        print(f"\tError: {err_msg}")
+        print(f"\tResponse msg: {resp}")
+        print(
+            "\tPossible reason: If this is a device it could be because the device is "
+            "not longer\n"
+            "\t\t\t enrolled in Kandji. This would prevent the MDM command from being\n"
+            "\t\t\t sent successfully.\n"
+        )
+    # 429
+    elif resp_code == requests.codes["too_many_requests"]:
+        print("You have reached the rate limit ...")
+        print("Try again later ...")
+        sys.exit(f"\t{err_msg}")
+    # 500
+    elif resp_code == requests.codes["internal_server_error"]:
+        print("The service is having a problem...")
+        sys.exit(err_msg)
+    # 503
+    elif resp_code == requests.codes["service_unavailable"]:
+        print("Unable to reach the service. Try again later...")
+    else:
+        print("Something really bad must have happened...")
+        print(err_msg)
+        sys.exit()
+
+
+def kandji_api(method, endpoint, params=None, payload=None):
+    """Make an API request and return data.
+
+    method   - an HTTP Method (GET, POST, PATCH, DELETE).
+    endpoint - the API URL endpoint to target.
+    params   - optional parameters can be passed as a dict.
+    payload  - optional payload is passed as a dict and used with PATCH and POST
+               methods.
+    Returns a JSON data object.
+    """
+    attom_adapter = HTTPAdapter(max_retries=3)
+    session = requests.Session()
+    session.mount(BASE_URL, attom_adapter)
+
+    try:
+        response = session.request(
+            method,
+            BASE_URL + endpoint,
+            data=payload,
+            headers=HEADERS,
+            params=params,
+            timeout=30,
+        )
+
+        # If a successful status code is returned (200 and 300 range)
+        if response:
+            try:
+                data = response.json()
+            except Exception:
+                data = response.text
+
+        # if the request is successful exceptions will not be raised
+        response.raise_for_status()
+
+    except requests.exceptions.RequestException as err:
+        http_errors(resp=response, resp_code=response.status_code, err_msg=err)
+        data = {"error": f"{response.status_code}", "api resp": f"{err}"}
+
+    return data
+
+
+def program_arguments():
+    """Parse and return command-line arguments."""
+    parser = argparse.ArgumentParser(
+        description="Fetch and report Kandji threat details."
+    )
+
+    parser.add_argument("--classification", help="Filter by threat classification (malware, pup).", type=str)
+    parser.add_argument("--date-range", help="Filter by number of days (e.g., 7, 30, 90).", type=int)
+    parser.add_argument("--device-id", help="Filter by specific device ID.", type=str)
+    parser.add_argument("--status", help="Filter by threat status (quarantined, not_quarantined, released).", type=str)
+
+    parser.version = __version__
+    parser.add_argument("--version", action="version", help="Show script version.")
+
+    return parser.parse_args()
+
+
+def main():
+    """Main function to generate the threat report."""
+    args = program_arguments()
+    params = {
+        "classification": args.classification,
+        "date_range": args.date_range,
+        "device_id": args.device_id,
+        "status": args.status,
+    }
+
+    # Remove None values from params
+    params = {k: v for k, v in params.items() if v is not None}
+
+    print("Fetching threat details...")
+    threats = kandji_api("GET", "/v1/threat-details", params=params)
+    results = threats.get("results", [])
+
+    if not results:
+        print("No threats found with the given parameters.")
+        return
+
+    report_name = f"threats_report_{TODAY}.csv"
+    fieldnames = results[0].keys()
+
+
+    print("Generating device report...")
+
+    with open(report_name, "w", newline="") as csvfile:
+        writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
+        writer.writeheader()
+        for threat in results:
+            writer.writerow(threat)
+
+
+    print(f"Kandji report at: {HERE.resolve()}/{report_name}\n")
+
+if __name__ == "__main__":
+    main()

From 954d12506083dea8c9aecd85e77a1da38efd42e8 Mon Sep 17 00:00:00 2001
From: Bentley Hensel <bentleyhensel@gmail.com>
Date: Fri, 22 Mar 2024 16:43:53 -0400
Subject: [PATCH 2/4] Added threats to README

Signed-off-by: Bentley Hensel <bentleyhensel@gmail.com>
---
 api-tools/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/api-tools/README.md b/api-tools/README.md
index f2904e3..f9c6212 100644
--- a/api-tools/README.md
+++ b/api-tools/README.md
@@ -17,6 +17,7 @@ Name | Description
 `device-parameters` | These scripts leverage the Kandji API to interact with and generate reports from the device parameters endpoint.
 `device-secrets` | List and generate reports from the device secrets API. Filevault PRK, Activation lock bypass code, and unlock PIN.
 `device-status` | Generate device reports from the device status API.
+`threats` | These scripts leverage the Kandji API to generate reports about detected threats.
 `update-device-record` | update-device-record leverages the Kandji API along with a CSV input file to update one or more device inventory records. At present, a device the blueprint, asset tag, and assigned user can be updated using this script.
 
 The full API documentation can be found at [https://api.kandji.io](https://api.kandji.io/).

From 7a4df29e252df4b437f3f0ffc37ebbe2203b2487 Mon Sep 17 00:00:00 2001
From: Bentley Hensel <bentleyhensel@gmail.com>
Date: Fri, 22 Mar 2024 16:46:20 -0400
Subject: [PATCH 3/4] Links

Signed-off-by: Bentley Hensel <bentleyhensel@gmail.com>
---
 api-tools/threats/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api-tools/threats/README.md b/api-tools/threats/README.md
index 5f267d2..711ef36 100644
--- a/api-tools/threats/README.md
+++ b/api-tools/threats/README.md
@@ -112,4 +112,4 @@ A CSV report named `threats_report_<current_date>.csv` will be generated in the
 
 ### Note
 
-This script was written by @TheBoatyMcBoatFace on behalf of @CivicActions in March of 2024. We used portions of the various scripts in the [Kandji Support](https://github.com/kandji-inc/support) repo to accomplish this.
+This script was written by [@TheBoatyMcBoatFace](https://github.com/TheBoatyMcBoatFace) on behalf of [@CivicActions](https://github.com/CivicActions) in March of 2024. We used portions of the various scripts in the [Kandji Support](https://github.com/kandji-inc/support) repo to accomplish this.

From deb318a401b46a41036b1ced1bf2a37240bf662b Mon Sep 17 00:00:00 2001
From: Bentley Hensel <bentleyhensel@gmail.com>
Date: Tue, 8 Apr 2025 13:58:32 -0400
Subject: [PATCH 4/4] Add support for USERNAME

Enabled USERNAME as per: https://www.kandji.io/updates/2025/04/new-username-assignment-rule-and-global-variable/

Signed-off-by: Bentley Hensel <bentleyhensel@gmail.com>
---
 Global Variables/Global Variables.mobileconfig | 6 ++++--
 Global Variables/GlobalVariablesExample.sh     | 3 +++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Global Variables/Global Variables.mobileconfig b/Global Variables/Global Variables.mobileconfig
index 2731356..3604ad3 100644
--- a/Global Variables/Global Variables.mobileconfig	
+++ b/Global Variables/Global Variables.mobileconfig	
@@ -31,6 +31,8 @@
 			<string>$PROFILE_UUID</string>
 			<key>EMAIL</key>
 			<string>$EMAIL</string>
+			<key>USERNAME</key>
+			<string>$USERNAME</string>
 			<key>FULL_NAME</key>
 			<string>$FULL_NAME</string>
 			<key>EMAIL_PREFIX</key>
@@ -54,8 +56,8 @@
 	<key>PayloadType</key>
 	<string>Configuration</string>
 	<key>PayloadUUID</key>
-	<string>265684E2-8DCC-464B-8C6A-606E89C630DA</string>
-	<key>PayloadVersion</key>
+	<string>265684E2-8DC
+			<key>PayloadVersion</key>
 	<integer>1</integer>
 </dict>
 </plist>
diff --git a/Global Variables/GlobalVariablesExample.sh b/Global Variables/GlobalVariablesExample.sh
index df07401..ff40ce2 100755
--- a/Global Variables/GlobalVariablesExample.sh	
+++ b/Global Variables/GlobalVariablesExample.sh	
@@ -39,6 +39,7 @@
 FULL_NAME=$(/usr/libexec/PlistBuddy -c 'print :FULL_NAME' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
 EMAIL=$(/usr/libexec/PlistBuddy -c 'print :EMAIL' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
 EMAIL_PREFIX=$(/usr/libexec/PlistBuddy -c 'print :EMAIL_PREFIX' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
+USERNAME=$(/usr/libexec/PlistBuddy -c 'print :USERNAME' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
 DEPARTMENT=$(/usr/libexec/PlistBuddy -c 'print :DEPARTMENT' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
 DEVICE_NAME=$(/usr/libexec/PlistBuddy -c 'print :DEVICE_NAME' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
 SERIAL_NUMBER=$(/usr/libexec/PlistBuddy -c 'print :SERIAL_NUMBER' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)
@@ -57,6 +58,8 @@ Email: $EMAIL
 
 Email Prefix: $EMAIL_PREFIX
 
+Username: $USERNAME
+
 Department: $DEPARTMENT
 
 Device Name: $DEVICE_NAME