From 044c0a59a0a664ff5ddc35330c2dcbf6661f84d5 Mon Sep 17 00:00:00 2001
From: funnywolf <yu5890681@gmail.com>
Date: Wed, 24 Sep 2025 20:42:09 +0800
Subject: [PATCH] add more mock alert and add mock rules for test and debug

---
 Docker/nocoly/AI SOAR.mdy               |  Bin 0 -> 29904 bytes
 Docker/nocoly/AI SOAR_20250923_1406.mdy |  Bin 24048 -> 0 bytes
 Docker/nocoly/AISOAR_20250923_1656.mdy  |  Bin 31808 -> 0 bytes
 External/nocolyapi.py                   |   29 +-
 Lib/ruledefinition.py                   |   17 +-
 Mock/alert.py                           | 6406 +++++++++++++----------
 Mock/rule.py                            |  239 +
 7 files changed, 3892 insertions(+), 2799 deletions(-)
 create mode 100644 Docker/nocoly/AI SOAR.mdy
 delete mode 100644 Docker/nocoly/AI SOAR_20250923_1406.mdy
 delete mode 100644 Docker/nocoly/AISOAR_20250923_1656.mdy
 create mode 100644 Mock/rule.py

diff --git a/Docker/nocoly/AI SOAR.mdy b/Docker/nocoly/AI SOAR.mdy
new file mode 100644
index 0000000000000000000000000000000000000000..94cb59af46397303743755512e16e1eb7a4a9978
GIT binary patch
literal 29904
zcmV(#K;*wMFfcGMF$Dks03ZMW06+i$015yA0IUE20PF++07XMGLN`W1F*QU+I5jds
zGB!mtH#0RvG&46hGcq|aGcRa#dQVzPdR1+0SXpE-QbKn)a6wXRLoYK%d23WKX=7Am
zNJvgfVqs}VZDC79O>;G2GeSv5VPY~<Zgp}&Z!tGDI5#jfFg7+<NnvYMF+@*Badl@x
zIb$_tMQ&JSOfXVTM^;mLNJT?qXfJ0gO>bjGHCT3KVMl0TZ!mdqXf!!ZSWjY2ICyw<
zLs~OIOG-6Da!_n#STsXLY;SmMS2klbMrcHFGFU5bGhtR)Hc>Z3Vt8>uNpdk*OK)y;
zT4YCOS~)RDGEG8NH+6D3RdiTER%t;wG%#0AS87;QZcbxCQ7>pPPI5MSbwM&Qa%x6s
zWotcmXIe{ALS$!hQY%tXWOhMRP)lcMY%eclcydTKcsW6EZBSuuct$m1I8S<7YB?}+
zZEjU{dTvuUZ%j^6cr!0!H*jQdLTGe&Y(!U0MRR6xWKVH%P*FuhFk@FiOjs~+PDn9y
zL~}KIa&Tu@c~?tFY%oSQV>m-IRcSYNcSAXAM=NPmP-tRdb~8b3YGi6dL~}@LNiZ}-
zST{~Vcv&?^W>Yt9SW0P2S7C8ULRLd`S7J;tYc^qNS8!@=F-uD|cs5jQdNpB7Ye;H0
zN>VjtRCq&SYA;n~Ra0qXV@GIcQ!8Y8T54=$Vr^ArYimVlMKMH0V{1)EPGmK2R7!SA
zY;9yYR8&EBVMcgPF?UN+V{dbFS5H()HdHh;O-D0XcQ;LBb5cP#ZCYY@ZcI^baArm~
zYDQ;wO>}2#T5oDbGd4<gbW%f5Yhy)tcurAKcQjOUZ%|M{MsqYxO;|5COG7I!G%+zj
zFJUuFcW*;gFKBKzIX7ceb2&(CbagXWc}{LoXm>byMo(HxT0>Z3X)tSVL@+WzNk>sP
zc}P+?X*Wr4OgL;&bWmw*WNvtRSz1p~P;^FbModd+cWG``O*3$1XH-;BV@q>HaZ*M`
zcv)mdQ%^;DT4^t2Qd(qlRcT93T2@PHN-$bxaA8kqN@YT5PBT(4HF`EnZ%#!@YFaRH
zR!?GgSZi*1L2xl<ICN!XH*#2WX){VRRcl3VGDJ~udT&j4WqEjWWJYLrD`!npbT>In
zc{6HLLu4y?P<TdmP)<rhN@iy^MKNhZW?5@lSu06*GgwP8LN9YuR#IYGX=q_sWN%tk
zS!7OUYB@1jT2f0?O>JUvMMpMKO-_1MLu+JtGDcZ;Oky~7R%A&`I7Dw|VOeH%MOj5Q
zHA!kOd1E<eGHyjsZ+ApBMm9xhF-T)%OK@T_bYd@LGGb+QO?PlLc1?CuS9VHgc64k)
zT5Lo@Yj1E+L^4xDd3kGCOIJl`H(_}zO=)vMa!x`)H)d&cP*8YsbZ<{@MS3q`Gel)C
zZE|`;M@>vJS5Iwpb4)~XZDmVhGFV4#V_{T!R!mk^D`{&tQ#oj2Phxs{FJpFdWn^ql
zS9wb>N^>hTZb)))T3B>OIBsNgYB5w~Xj(BrXhbt_R$??xL3vp?H%CiaHCR_cPE<KF
zb4y2fHF<G(dO}ezO-WH_HgIxERB(7^M@M%!QZ;%xc2{+HHcL-cIeA!bP)uqvPgquE
zGjdUMb#YNqNK!Fka&%BvcvNgjMrv7XL}7VEd3a@ONl7tCGgonJcV;haL~=wcD{6T$
zQE@Lua&>qzW;JFsWI;)GWpP0;aZhJdH!(?bWHee%O*cn1T5U5&Oj37IR8Dm_S7J4F
zWj8Wwa#~q>D{?nsRab2|QZY(1H7|NvOG`;XWHwH0NmMX3OHgK4F)%|(G<I$=GA~g!
zVQX|{Zf!YZW;0naWHv-YdS`EBG-zlvNp@~IaZ5Q!MR+zhOmA~Tbu>6*SV?JPN;GJ0
zS~6H=MM5=eV{}J(Zh13eV`EWGWLR!SWO!j>RaHtjHc)yiLR4;WFLQ5gF=|CQcS?F@
zOm$6qGfG5tLu6HAWKuG0cv4R>ML}hBWl(W=Pcc$PIXGlEGB83<P)0;#MKv&GY;`k3
zGb?Q`YD#uuWO*=JGIu>TmEQr9FQD2MSlruL2*RrO+rP;8Tcv8$ym6H!!!}wd2YW?_
zk)eUdOMXaaNeowiE$tw_Qcdw^#R(g23nBy%Vov#bgvtA3TVmKt;wPYfT*PT~Xrp0)
z+0_h%6z>nTQY%NH3rFQTp0#o)u<T%EgS$+zfSW`vO)9r^MK`#H_$sJ2ojT-jW#X#u
zUb}u@nBw$rs=%D)5h7c#3q0WP+OO4altTEvBx9bQ{%4F~NjXN!vetV6dQL`CK4G1_
zVER{nH7vamyaC<KK1MQ<oe%Q9D|`QKw)pd#SEbI4fEVMkWk80TPQnhm{N;uauV=sD
zN?G|Os?s5>K>16uKS=&tGfS$6#?xv{V%3r^ikbd1`5H&mM%F^keLY`eXn&apLMPc-
zWiwZhD)#9fPEOngkP>9+xKuc8wmObSN90S9IgiIwu0&$P5$7A(|KBfZ!m!SBMy|)K
zdu+RAKpUIpjjI2!GaDW(ztPy3LCOjp3mVxqIzE7ML*faW<GAhKW?|tGZX|+|ySuOS
zgG3SlvyZF0yjI<27?I>Xs`Q8Fg=MKjqQ|^UUb`cj88s&LQ}__LyO$jSnifc|;(*gW
zNt0kOwT~3$A}^Vx@0)d8{q*_qz&wq5d&&>lc#(rHj$6bo7%f8OH{0S$T;3bc{EJ_k
zL`P&&<o3<|!`wsn@|B`icYGjnl7qIft+(GL#v!o+aCPda-r8~evO{o&fNh1mCZ%Bu
zqlBRH9<D1Cwv4?*QuV|QY|O^G?xKm}K%;SzBIXKz{peW4Q0TFf`x$IuMvObZWwuh@
z3J8d_DQ-Z3zfLT^8Z6^$M(Vmz%cduJV5o;&0ZKV&Y&RX;to77R{lAwefYUvl&zy-P
zBA2IMh;ThoRA__?_M1v2H91%u_EYEBiGq|zPojkQ|LR6Nk$d_hT@KklKjg8XIM?yK
zn{g*5&aA5Mp-b(?6USN{h5xS>5P$HN=4Z6!2hEAjWEybc1=dwHK2HE~tRK;Ltrz|-
zS^RYkLD+PwTwx#DP8i#yLa!thv44@Pt8rCr0)j8oI31x2HCE~+UstXZuqz!WYIX(I
zMo0^~;GMmF9OMk^F+{+Olort6lIAW@fCh-NRODg{2EW9<ZmBDlv1(|^Xux4-QOP)&
zF7$y4>$%i>L}nbw0@sY<v`%}?vb;c~#MqBWG28awdCttTUYt-=-A>bVgAMGKP5lOP
z7$d*upRC25kl!ZNI4|CgfhvLH3*BJu;A)@zn#aXq5H;RqfzlEa_V~j8t55xOf(I_~
zHP9_o5OdDH-A__qyGwMm!uMh66BI_y4Br4TUw{yc+f?Op0mRBV>Kw+~W^kK@H4G$l
zviu(kB!HOD)GU;W!_5x*Gyvm}z|OlUR<GZLpfLty@l^T1!IO(c*<%FW>pbiJ3ofoE
zXMmFj$1$b#F^<;$GL6qhD)u3Spd(!U<Z8~@vhN_yB6L<zw#|9!&Uv5u>#6fK`421V
z_d+TRqjs*AE<(Q_vj$TY@OQ?hs>{OMg2A*<&rdB@W}#2H%003I??GEe<>_<7;|C*G
zIkJv7<b%?uoL4(WQNX6hUPJoGjcv+&YJ0Fkja4>}+_Bg1F$|wE#*I}sJfw{waB%Cn
zy^aWqJX_&u*;WZuUg9pgt}bsGAsnOIo)NkkJwSP2zdvJ0rDzw7IOp?jj+xwue`vkx
z&+#P2UM3!Kvptf)4az_+-=xGi#S64>67hjVY#6=AV+)!C3g0|yHZmin(_sbzq@+^j
zMmb=e!HNrg2<zVr1O_|#V|xprx+M>Nc8^;ho~Um3xaFicJ%YyJbg4QVXaj=!*Mx?C
z3~8HhZ74%wmRZ}iXj84MY8nVRR9QVPM+Vt_Zs(_@jUKl3ptAToPB#4VL{<t7Z{&EI
z<U>&lHZp()o$X;YyKQZ*(3$@q6F{Wdq%TNKvWxr1mFaJ$Nru!qB#b(2P#@NI3N7po
zzLuj7_kb7ZxBSUpTn^TmF_p(>(p5~hO-p0SsW&kYBWGWCv1u~K9-Rg&QXRBnI>|(F
z#XV!}eYHbV_?E$REp*}P2s`bI=0SC61OH_;@V<7uVm`oZbf71<#9t3I4_LAeUZ*}t
z$!D#A=W9D?=^JAsNwXTzs`@@Pmx{V9<vO^S)HwnYz$RpaW&q=9qC%>UTYKktjuX49
zkm#mtmE;@>Hxy1d9$A%mMxrJu{7N1ZYK)Qwc*29Sp2wh$qT%&OFE#*VwShy}PmZwF
zTa>Z_o@L+yyi;>_7~(908V(a`M=g!_206MOmvB=>e~)^)xpZ&y!@cU3lYViny909+
z)mF|ex_UQBSZgUEnPJzql%$Z{95F+zX<_UrQpWOGl6R`0S}2;@1BFP?2b{}>8mXGc
zUKeN?thd^&mwtFC)feAn^$yeL=R_<_<Aa4y3`1aUs7kp$)3E{slrj|kLf?AJ6$urj
zgO8STD?%NNk|U+~x|Vj&!1yR5R^-x8)8ib#>@#oVssfU3*b?ozc@(z;7>QTuwSqO7
z<66FopfmCvzwfZJscMzwn)xpZD;O@@A$ze@^cbxvv?ea(cTMb^B-K5hb(v&peEeI&
z<bW<BLxKU%>q^o`UguE^q#{@K1~|_=_wT6Jf)tT#lqMqt0snS{Tp1b30CO3k4*&5>
zwYS#PyZ`Pc&71LMeN!#p;HnnjGIn-7;>5JGJ1XEZI>Y@F6IOneAzx#^=oVZWTClBl
zRDbRG_&GKL3!qZhc_zEB$wy}KYhWHTXdnHk=_s?1w~9^k#9G8YK$xb$;#0`B`sUYi
z^dvwK-1`K*gxVEQw&#Z{5Ww4FUzqJpbWm8ODh9M#+;KtwS@`H<d4PTijRBWWq3Fa{
zdk7C{o+98@tdh&c*kbmGEQ&XT3OHY%e?T*;hH079Gt6`L(e&hUUIr0w@+P05?_?E(
zGl?jaRTc`pV^ALhtE@L2r|9kuEwaP4cB77t9Oi?t9Q;qm7U$NmuHxI2wW@w){#=@U
z5UN82>PVyPa8UR5X9ZJ*gt1SH!0Xxj(US%gSa6n%V7*tcLcqjAQ=YoT_Xz}ZO#j7Z
zO>Gc7HdXOV&JP6S0d>ipzZ7v&iu3waiJT*w!Fzv1CqCwr5-~f`!Bpu>19@W%OM6zr
z3LiN+u0E5Usd+T*pl|8H3aW=vMIkYN_Uk^*s<Swz1&7y`_<+F(grCN`?A~B7_kNIj
zvU2!$(cQwL82G;y$I4Glr{KmGc>N6|a-O$Ez|%O`wPF!`vH9LpPiT7C{hDZ+wor^+
zOMoYTY^uCwlX!67;?8;nv{~!50LaPPk`Z<$TRk8m&o<e=w|Vi-jGo1IhbVTqU@o;M
zp@$zE71Ce#)~c=7MrShtrLO0L9}{Q_L9#{W?ff_#BkcIdzl7so+3^wvP}d`qA6NnL
zs|e-w;LpZ(;VR|fsa~-<fL+ur@6%O((gy6yjmQGxAZFId-v4rbpWNF4*U`PrF{?{n
z<>Tx*Kbv)-62T=k1Gj@9tudmKXOCVBRvJpe&vZv?#g7@)o5BV}ln#eDg@XPRO;6ut
zn7K?0zJb)?^|Yu?@4j&r)bw5#^DAhqC*!WkyZVa(Y&a33fW_yFqYO>=i9MoBx6Ro0
zJ3pHht|t~0&?`}v*~b8bBNb?MSVRv+?LlFpH4$>WrxrrzcRuHQNKOoVgrj?~@h)ea
zx@Gt^%iY)aE3bW(W)le+A-XQ3`eYoWvaA^T!}yxu2IuPZG%qaRZ5_z!D0s(#{)fK6
zwn}mBwLXkWRzpX}*3J4A;Rv8uztP9oVS%#-wEQV?`4jYG>Biv~hZyO>q<O!KNXI%-
z_Tc(*KT!Lc8jvNc;mLrP#4g#G4u8q6{@rdCFAw8$Im8M8$e;y`0op>&>qENwKn{j0
zI+~owT-0C0qNWxJxX{+(0s+V}bCU&1Ci>A`d~_z*r6=0cHg82EUc6HK>73F?t3xQ#
zT@7{5kCBHmG9>$u{B|2SFc|;73Q?$ZW1htIJIXLob2_k<5Uz|biPJd)@Nhka<L!E~
z<C1zmhB;4v&tGxBl@K6m7Ni9K_d4Qw3pbiwVF>2tBu0H{2;~c$H3>>NGzf^KU8c9i
zG+9cDja%yLu-ks%DyuIW<QfN8D(Q#}U4~|72U4w$E;n4HJsXe!6$HhXs<=mncVvVB
z>HlU>aFp-hO9F8Kvt@V@`hquFD*LUIr<OSsC^oEAoxSynFWitYUcV}MtlLfa!Xi&`
zgtxjy0%Tste21J4h`L8jO^v#zAmMI;AgQaLSr4*vV#xwVv6x)19g5J&81OJiFaMJP
zV**Bg=!=M|aGujdd%5w5FjvZLMdYH6^We+Tub=xMO`eoKt~31c%;+g9!Ui>ak^ben
zhO?U_{Ogu!?iYb1i@@r2iSFGVb;iwdhPx@~phb^fGo+#e<)Jt(9$27CBnkyuhMt#8
zo8g0`4Tn6t=uToodWTMxHhQ%CjLl?w$>jH|%o!Hl)c>>nsMp{OOS{W~xb;BbHM2>s
z6lGJf$trWd`H+ubm%dsA6o@F14*W^bbc>Vm;AV{&E>vxbnzCkZJPl1lWF3Sj;)xbk
zpmIrYV$XK4IZ{|hP>z2EzaKWAT3f&nuu3PeG9UhAW!Yf%P3?6ILbkI9Iy1!~ayjLT
zaVrN0&pNKFO`9cofON0TR`oYBl?oi&-Z1J^hxU>1VFNgZ6W@9{zM~(%?ZenBwCZ*-
ziLI--npr*5b(frIy1Njf_%7>yya!v!jXr^1;D@z6l2;IKCDO;O6>?ydDMo&#MU(qw
zK?m>_uyoN9<b*>5cX7}W?5RZBA?T0nzMOku(x0=2iCHZNmDMj!x3(;c8RL=RzZKT+
zNrA*z3}^9q^VGTj+BIV{ST2M;q_6v&Q&$_RqnIQ{I`^zVP{JJb<BWxoFM|j&37kR_
z-bQM7j0Y<PEmePkeJHVPzFLSPO36V}2~n$S_Np#AL6`!6O$LAe=b;1w!dLD1E)Ix_
z(OQkL%SdXPE927EjKOXQh<ua}!0o}05RcOm)f6vmJQEKTuaU!gQA4pA60^`PM`yoR
zuL=m;bSJ#BZMxUW#1=9x(w)?P+)Jb7sB~t@Bh{VnrRKHES^PG+xV4Swf7ZKcf{$v5
zAGEQ)oadtE+PXU{q2PZ7qW~=U?78v=Z6=-dXnDE0eo>)4;k_DlgJbej!E>s<bX@=c
zzOQJ@#%=?)FS&CV;STVzdh=o?(Ev2pQ{V3A?sCJe1^fxMv5R%RAyi)GwHvzp29ijn
z#C-BFap-1RqE4S(VO3(6;0Cq3lzV8~#7Uz;Ao=U?1r<NKs=n5CQeAafEd4cg0HYqT
z_l#0dl3-7dWxjDNUdZBPqJ&>zh|+z&BUOXJhGS3aJ$Z14Z!ti}8pnj?yf3FJqYUB-
z+im=@MTi|`I_OO)4$}yyH|*9WuOUjL+;i6+EP4-3^6+kC#NIH#b=XaH*jJNGq$U=G
z$_XTKa6ATPN8TGBxihl(>@1!Fs2pK>h&amm#G3)LC+l)j7{j_i1^pJtGTl$W=HE*u
z%HRCAY9l}A9(OA7iq38h$xhd|gN-Unj($7gPStyBlYLB+&571~*oydxRvIwOEiSww
z<(xLlP8$q?75($@&1qO3`#@o-!dr`LZfGeE_)@Xx0=OzVWgg*eErsFFV=#L?fAOAb
zaK#@QXTmU1QP>+!lWO6x%*?!~_n2BMO9vE>a)H0dc;nw+^qWcQAZs5#NIQ&dWx&}d
z-eWz)5n`@Uk_-<Ko_9s3qE;%l5gOu_ch0$D*(3C@n#bVe!~CFDWpo2oqO9Q*`Q-9V
zi<K&zK-rqYZq#LfLI)0G6_Q$4?$u)Ba4!L^)KPTQ0b@5_pJvRFkwy`<IC2|g4#2a!
zO}p0l>7vMSin3Yf1Ks>~np6TMG_g9$l53x11>gt)Lc7Jn+!4-_OnzW{$95p%4pt3p
zXKO;N{eE+e#z`ps`ni`50g^lBo!1xh!o@R>UQNfscnir7v)&C8{v9Dvk~Y+Rjg?sb
zJVS5+{sS?VL3l`wjTnt0jq4Z-&Vx7J;H{;;1!n9w%h%FfD-^u?aSd3a*zAQwQ>bhk
z#r`BmkrgNF1@(@Jf?rH9DXr&{WVaEUlpqMFgk3^QwK`Lm3<#g94aPFy@7&)^6;{B*
zFXKzj1go)$C;~ppg!X*`!Pn9o>**O#2ndV;I|tZ;sN`eZ<MC@rENO&?uM|H*DDRos
z{1+hgjrdn_7V3G`((jVxQ&0zi(@3yNdXtc68>Em*6>pki#}O@c%G);AAx?pdL|A-f
zu*EM}Yk>uj-7s)&X7M4CCQZxaPAS<D4>>l9`wT~e<eerSz9U*B`nVshwrXTf1i6Qi
z&=6-f;sc{1BkGe#^H(IMwXm!d_t=={GPz@&$l}i!&rrGEAl5{2(?)5XGKphIBfMQj
zt(j>k+(@EfS9&?*%eJ9+Cf<_FL!?7I7`_UAhr@^K3s7a^<(O1-rvk386*V{d4cC#~
z53}Cr0U}HzrG3c9Lywc$Cbb4rIE^m`${RMk3kp=23OC&I$$M1X6F)=XwOc!x;Vf7f
z_);d5?csC??ac=c-g)IsVoQSr-y>K}Tp*ESd5^J5!$WDbT8#@AsO`5g%q^L-pB=Y!
ziA#?5vLUPle~8c%|7=I4Ww)fT^g$kvS%i$lqElDd@<==vi944QI_*FygeFhsXHkt;
zlEYqPA3uKe_2$|*yk`dWegdyR>^dzN@_mm1(3jZrIey3>PVWla)oZ|7#>mC0R2txl
z)Rdy<wq#m5hG@C6cLfMsW@AtWQG3|CL~@mFd;tW(@ok25+|>Hd$Yfb@?&Kvzi=hqq
z0TXe7-nArf1GwG=FFW~=?m0XJlLXJ`!O_}qUC0GCAG+`d!#+h&UOyTF07ks`<oc|{
zyYZo~Rk?z3ERO<j7W;Mg&43;!$%o+vDyE2QZs3e%1Af$%MXvR^kWBj(c?P>hFrFZ&
zJ66o}pXGGwjp+w#d4Q5;{pA5mRPmzm|5kew-KXcoB36#piQPBGp?omYdvQxssqMY<
zY@&zGp152fKbWyv*=>70^bP$&Y__eOBiG*jgH1|NY}J)?V{R>-TFnJt?B@1FWs^|D
z62=IDI+xt&XNvG^3P7=cPOD3z|3cqu7$x9sX|*TACu83Rm2S9l+8fnl$qsFIozDsi
z2Ab;VOue^2b0jza>k`1Eth5vh|0=&(=n5%yd}cM%==Ni3C#h&e5DGpukZmWCtT^*Y
zQ!|x563z#BVKbk<W<oGJ^lVkXvGJb=)-o|e{<exGd#kRu#o0C|w2zbDjMMgCI%`La
zwcA%1iaBi_u0oYcDn532&v1KR1)cy4%F2q}n==ye>%~?*QD??RTD!5AeS==Pdby@1
zk~8@#A19eTBwoqXaSr*#8n4IAdxbZ}|MA{~5`&IgLa?pyXh)0H-QQFMdd<JErh<8I
zo&bRE0SaH$hfex3PG`siT!i@G`)1!Cg!7z!lj-wK=8I5{P#e}Mdz%?yTT!l9g;ime
zrk5(#SR-%;G&^NlH2qcqcD7XWQR4PX_E#i?Md``=dyBzd%Q9^Jq-}6c>NL1?3o;<m
zek=uk=i3^=(nr+vKDTZa=cd;4>rCi#ULK9q`owt}@$&o`F|Mc00vX)=%(G9$r^V<g
zKe1r|d}f?D>S6nUs`JJ)`u8r*WQ!yRD>%lXlGUHsoYH4jg6ohEXaeggpghWHF^R??
zV@h`_?qovYv`I)cJEH)3axcL3HN8KNC2E_pg2>eDq6<>+eQ5a5wU6%}PAe(NgZzih
z=an;i%OHxickUgN=mbf~e=G5c-__pHC{+yLkQ%yP34srxVPI^@#|)L1IL0ncq;bD7
zHf(ofMI#h4g)#~nkeAOENcx6ZR$Jkdf%+91e^TENI6Khnn>jm!E<m;QX2`V)B?2s$
zXf412C3BM?dQt<7P6&2}y1bqSXOh2lJ|y&a<x);Svmeh(5=RAv{Jf)8TxU|lAww@7
zG)uHscBM^1JKE1jA}SkHO2Ko2j$wI_1;)3LBUPfWEQ1^^c(dXWc9UeZxI)lrA?CR^
zhpYj7An(@*%?GxVc21ibyjgMaCUWIp-L55<!m=r_&GTau^NQK<gMsPZJ5%d&Yzn5V
z?{8{EB)GvsVAB&C1`hxAlZ?xbKm6YmE#@PbHVu!=xR-%Oour1tEDN=<Jq_mDegu;x
z5&UYF)#eH(5w=}`Ug)8f=H{qOO(aqyYN&L(h81%Gv-uDyhyaA|&&yZ}EvQOb55DB;
z62IMIK+@iC+-`8Hj^k58s6B#Wh+7A8)EmDXElZiU@d95m^>v?>VarY%O?8`86ZCrz
zTC98V^H8_u9|NoA(qBE?1M#;l@-n0vT%Q^JZd<g?R2|)w+}eH2C7rW|f6;)Ch(q!t
z>O~Iz@3XtUhh?Yhol{3iai`xf*gpkno{h74mpQirK!*~&lT28?=V`6cD^wXJ@y&mT
zGE?CdE?14d2;T%^B&(Q+_8lw7%D@N8+%$<m_NhaJg$&kGHuEld0Ph=V2bCFMVQWaR
zx$s^?<-h_(nAI%<O7-)cTD`8Pb~xt3v1`y96ZV~G?nHkAx;m!IQ3yFf*HsUZ#TSQC
z-7nH{@(9i?5yD}VISBz3FI{xe6yo`}X5`<Tj#~3Vx9SZh_+rcb0hGinuF`-H5`(61
zQ_{&HyIe#-oE)L2c(m{{fyQn0B{+Z`sP&34dT%98`p`XDD+TQ7r!ZBOqmWmkkNcj+
z$GG`f$d{&Gc%@3fb3$5&(NGotp(sPc2Zgs41%42s*R@B3h?3!#H^%jG9844Mlr6u+
zGBJ9Y+UF|RBcHevWWo1|A_(?5S&VOw#rAJRb>gJ7l&O>Eg_2;}%nJ=_>x=9{`hu_p
zMHOjvoF61SR{M;1?p*}Sd4v+X+$g?Fd7~J1lN|^w4M-wselF_O>9xm(4YL4<JtDfH
zt_#{`krtl#u{YX3fI*ZxKMt3#V2VKBlQQ;W38PZt8ZQ~+4!x1L9zhR>+SgRrp>#3M
zcKY>@saf6j%HJ$aIN3`I*-ih3gQO|tjqbPyYG>)Y-T*{~WfZB`pNyuzT)xC9CJZO{
z*6bl-F<$$M&SWGJVn?88SB}B)EJw%d;MBdwnjte{1nbpt%eeO*?g+pOLA9h9Bn}Sk
znawTcvJVot?Scr|o<GCzLO1Vpy20l{!Bmj*&7_dj3x}F{>9dQ-qmp_Q$bklI!iWo}
z4e=%eIYk7%!%(WmORltuvI8@2K~?8=g(|P=TTb@YMY{yQw$qhxcOw#uQBbm@A)EOD
zTca#NE1iLF=2*Hd9w@0M$&-_UJ&yY`t)pMrMJ5i@fagR#iyD(RSK1|~FL30(nzI1A
zzy`<q*Hf1pXeUNwAL5K`BLJ=u$*M-3otAA$`&{9X#Z?Tlb0b!`MX<1TNzy-zhnS7t
z-v0!c$#1bti;2X)ZMOArhH+9JZ6+i3r9!*FvetDr`riyt?G~3s&o*XV!NKr1(eU4D
z+aDm^v*Q&9sKs88!}e<+ayxSmmMSbQMh!>rbyYcuN>!s%B93>*tf;{OUwLAPfopOx
zWm#S^A>74xj&gK>^EVL8)Av$(=1*%13-~FjLHw$k=zIb-<^*@+J@)l^7SqawE{dqa
z(xjXV(HwIQ-dG-lx}C3`^0aamCO$3nHIt_v?p5kd^Dh~IBZJ|Y`cbj9vWkEp>;+WH
zV{3pt9dE@QE2w<KOa;@U^+j@(>!-qdlnAfxZLGdf2JU(HwIgnW_No+q&74qi-d}ED
zouMH<U`wl33DQXITDJRbMNWIMDvZ`Um5AM{XG<@Bz}Og-=Fn5%8dMWFXS>grNU}#>
zwvlzL46=aF36yTv1tCiYj$D3+h?KN5M`enNIwlYpTjLrGBUbLE%@QtuRMOaTSxLbC
zi`bcbQLNvO<lOaMm@@^4&Xg`1iD{IzyUMs`Ly+eLCbEH=@wYSrHYK`&uX9j|f(Ch3
zaC0n*5jOOjGqxa%j&AFK!Nv&aZ@Bt9#NGHqKF7qUf?JlTYZte8E@ELcQvf-_9;_p`
zh;wVKAE%!KuRL~RJ&Bd@7#RxA>k}MEL+>$h1fKC-HOSELAocTbBP<+lc4y#BP)Ovw
zM<Ut}WRtrGR`X_zj~7S#va7P5Ip6fOxl+xdCE^_Zj-<&9wiIW@t-E@V9>RlIz#)iX
z!rm$6s27I9y)*E~7HoXnc-kcgw`1``5Uk7`ci1o(mot<j4VY1FF#tudx2!?d+k+Nr
z%<$*Q>b-?&cENTY^lLTo8z^qWTyc6!F)9^iFxmm5LF|K^%NadgmAX7L)OGt!HQucz
z&))YrU?6TvWY*UX-cysf^}yA+aeU7~Wt_XwkQ)x0DOEpXQLn+ry_CAsW|dgruc1QK
zxwfrYTz#wgSdZ5gbXpds;D=l-ij;Gu?21SPs>9NVstbBJ#fe;ef2I3g^ykT3=vr$D
zpe1`WI;WIK6M%q>5=!u*WvQjm(~t>@#VU7cDc-<q{axnpHkAbT$2(=Zunf%4djfg6
zw3&doV}iL@sRj0&WuP_x{!2a!(LE`&Stae{^SS-Xu~HHtxl24C#cgGqqBXmF*86h#
zY81o$8g@s)UbDKGL{wOI!pZz%?TM}qW>><pE|Uj!5SelXY`#MHaweNQ>y}ut9x!O6
zXi3xPIOzMJQ%||Gp3+V4UIL3lJe;Pw08J+8a+2@z)KYHKd58&X1E%5Q*7v&js!AuZ
zv-Qh3`Igu-3VN79m|eMquq6WU0jsX;*nrq<JANBIQSr=1BemT%m#DT}hLN}1htdo*
zZqth2Q|0{mMHVlx>xiMynovoM_FapI?k0Egjv>OO_ctr?fWvXEx%IW2Wge8lip}#K
z-xlC{G{-o4s7G~wTOBo=y}HS~lgZp?=4U9!_;4n@gy3)xyM(vf+Occ{$-{+4JkE5r
z5_}TSI0#q5*O@0fCpZN&@K+Sni?a%nonz&5y$>&H1d)`{lj2gD6z0C*Fc5G}kE`M_
z*@7>|oXVnxgv`=wsJJTZDGn68AuIX6jpsw(Ev^-TUo1(4h-*9315a>9Lo^nv?lhTh
zq(%uNBQ0-tOta;aOUS9mS4x~n&(w)gCq4WCnD)MI?lv~R-n|(}t9&?%uG&zx^J-gS
z3YsFG%ZvIT$`_L0H$LdPcjSCQ^cdk|^{|cD2AyTs&j~GavJVAtx!A^D(yggfeOj{!
z<tU^8(IvHI0f_romu<%7zf%6oy(_HPQj8nyq6=H*#qW~r+1mn5n)Mp~jTP8v0GLq1
zdUdt`nr+Blu`LNN%#_pl+Ce+**S~ft=MIDnpFA**hIQ>(o0_G06?8x**%CxhRy9uW
ze5uJu4zdsLwO>1KJ0_Ry<``)qL<%iUM??X2L2+HrJ1ynMWn3vM-uc%7<|VnA*p5?D
zpZ|&{n^~A0bS!7=ubZ+UZ!F$cTkhkXvf(f{DJrs%?xA<C79bKa43{+R3L)h<BC!iu
z7J97LZhQbzppeuPQSG_XsTcX#91g2T$^Cz;Di-YRAs%SXfzdE4j-Bd=_a~j--E3JO
zf7~1?GBBmU_WR@tWSRjkBG#iCqBrU^n*w`|>9O3S>i94x%N+@AJF&#IBhVVWfZcM(
za>Uv*nOnTte})NZFtm)|so&*-s54QmjRyOt+%Ds_M}OgyA0SLZo+&P2JfYOQ6S_Nd
zfBNey{Jc&Pm#sHf0)mU!thCK)1e~5rI+%U`3*yk!%~B8jf6#-x+$}H(<ROl@JsMLV
z=Z?dn3UZ(OjUXp{pwMzn9NKbfaEh2rPh7AgwXa5T`9%OmLVz3=xOoC{m|U=glkhVg
zS3MwkLsJ>)>=Hr@Fz_<hs=*jo3gJ1~Q5T{g&BBam(oW-c-#yMSK9{pJm!RfH(MZ0_
zp_R}}raote4QzOml&%nxw>?AsqGL<pirWhqad>|h<rA4@IewVvtbp$buI0Y!n^g6+
zxpMlgZJ7rU^<~QSq*RJIhrN9n+2#wPQ(f+wlOy>xaZC~DCk)^O&_Jn9;D8pv!O&P%
zp*Hcd2>B{#y|cI~4UDWWpwi?52ms*_uQ;+MC#+1Fc4R<GuhZe{>?QFzLZ~E>)5KyS
zH{kx=?~xw|Qk_`iweyxA1JXG<SWS_kPH_&K&DGjXJdt=c9ow{+`!*`oaZO$l2=pf4
zC#m8^%I_u`Q?k`==UV4y(iB4&Emq1Cqb?+bZT71qby}~m?DOd~6d79t3Lsk1ypqP_
z6~k{m@qBG4we$Jhtd-M)9bAEV&YoSsn-`P=$E?c2Qzn^^)}nF$PJ19Z7sBffozXPP
zbMwz_Y{y3rC|{mMCk|RzC5EPX9(tkFg&vW8l1VX3Zjt~Hn~I|F8_@w!Odk?=QTXkt
zo@F4kR^6h6!Bo^PvW0Qxey4BZnGC0BYWk~dd8Nytqe^E1Es|tkCibsUWwVBMnB5dP
zEwKoeO{SuXmD1Fc!XY*s*yP#IGIe^EHALdis7XggREq=&ff~&E+BQJw{CRHI`s2B*
z?i!Bifxbe(QYV`UR7dp~Hb_xRbzv=fbwpy2p$7NfBz|-4ha7fP901FxLoYCaOM_uc
zP0@}6K##iI_<DiYE%SZi3PL>MmXa_1(gS!@>y*?-x4#Ylz5HlIE8*B(9iEnEQF}$?
zj(_zD`*RZ};K?I0l81BrhsqNP@Un4MbyKpBOb=boC&+%j-$yP*NT!B`5M>A$EvmN)
z{$9o%34}Q~zUEfy0GeJ+HlB*zV5!IbFY=z0>0c&vn{5d<gVA8~lBJ^;ODukHey4s5
zv}sBUU3<b|D%~D{&tn-@<_gWI9T^y$h1tz%J^c$<V#%VBjEu^l!JX7Z=s|bPlShFv
zH$J@bhL#~Z)sOz41P;1D+vrh(yLfX_q&3G>3J&o0N<^5GmUG_)beot<MaG`)u}2vy
zYRk%;3c^Ej<|;yfwR9kW&+cYTvuKABrD6!^Q27F$6&_qs{7r#WCN~yJLwlv}&OIkn
zh@`BCAf+s5lK9r11b+}#wz<H~Rs5c!6Z1qn@)6H%q(sI!J!T6u`-WH~kRT~WS2Yv@
z!}%m+S2-mi9nV5;-8XL;y3Ub^6gDlcc$OU-B~5s{GvgotOyIBNr_YWR@d&6>4+Y|t
z^s?<`C#rfH+2pxzN<@u*`>m9e_dv`gmCfW8SR2rSYj2&=BNxCGtID}gnSV~@FdAGU
zW6r9Bwwf0c+I$%2mf1v;f=>ylS?|7vy-{!V<7WZd<SB?$H>IOI!cQ8bKa4cup8PFf
zN)iVT3$QFb<oMGs#2oPi8%hnLzSO)8X-fSVK$mUsc}`yL4ezHR;C4rLVb|ML<&l4*
z>ZM%C8legDfN;pzd;WTj{8M*-snMmUv6$w$m~)&D!!p;UNo_I5OxY1)x_*VF!(p!(
zFP_gnTHt=Ym5hFZlyAe}IM}(8n<^jkpuv${ISvnhkqu^mINVFj9KlHXk~Q<X76%In
z4T;ta;`7Dgssf!Cig6t$@iMXkE2usBETQD~=2c#pG16$M*)R;?2ZQi|lVo>eCiWE#
zz#-#Fu5mE`6~pZ9QL^+$1EQ?{k&L7u{}v7v5kk|5vd1HnQU80xw*Q|L^23mXpoPZ7
zt-yQiNGl>G&rKVhY<l4bJHd2og6yz~jpX_VO;V<fuI;dSu=lJTbMP%c`CS-|1`j|0
z&`gLYI<m=9Us1WINmQ%99PQ^B_^I}*A05Kvq3(e*02sUXQ>2b1F2xgi31c=KWAnpI
zHVUU`Z2gVKamcjCzbR2~^KCxi0_B5L?N@B_@%9by2?PL%%tzv?RBl9^13ejs6}n#^
z=hJtxe(&WWdXR(>59;cD7R~&9t+A9qBq=*B>oOL_st25W7VjX}T`15F^Ci|TW1Rdr
zQj{ONJ46dpgd6)eOlKf2&=!nkq1ia%^enN);re(jwmYdRj>|J(K4g79V}CFD^7_+~
z;&klOJT`x`>$jG%h}Pd~m_r6#ZPa3}s<$cb$=NEibicv=I)Nm@I!S`?M|mBW3u{7*
zuE{%4Ll1K&$DuO!{o4srIB;n@HqA7KG!R7ZnFWllU=)*|*6K!-HK+FqazgQ)7JB9$
zx|4SZwd!l@8+~G^IJcZnw-8YKL|eZo5_;8YB4+;0UcB7fF$Pj1%M@rqa7ssc3I@Nl
zqNBoy*`KH!%EHJLM{X?@<DvlddopDWynY6NAvwg@+C>@y`)SJH+03h1f6-7(-*tUW
z%D47sbvt*2bRHa%eb@bHgqNb8-HtU_bsQR>!tY73!mV}iI;wsVh!}N4Rn3Wi6VQZE
zLl@_t2`i>+`bbQf(eQpLF~{OWjbr&j$3SCyS3~IJ4ktROb^1bs@u@M1slW{RM3fT=
z9QqiGnbim0uTrWd4V>dM6Eh{bmdL5iLoW(<Io+L_H1ns#P#VIn*xu3#JjQfz86sys
z;w7TYKY1tHrA$5QYt!y`68^(~V$1AZgn)YYfm%^n-X1j1Y^^cW7liMR)ZCiRn@<cv
zV`E)ve8J<Cg9V@UKa?F@2w32e+)Y2Nux&YQmn%KaPQ!+s5g~Ia(w@#VG&XjtA&N+2
zJw{;y*6QiLwE*agj2g!_S-S|4Vc-mM%s0hJV0Z=`Vp)xUEpF5vp4JdevS;7&%DmG9
zr#beATk}udgi&!SBf{94G%wCkp!hWZQxOp`;JrF{Z))h)yPJ^3Q3UM+NOj#6lK;NY
z#@8WS*5>-U)8cX+7L$E3jw8t%<<;INP*OZ7wn9_P6=NX*_Y=O+3ZLT!&;qwvff{uh
z<C&yOwOjVaRIT*;6QsFrT6(z!os9!f2YnZs?J~YpK1vmqU+Y|rtBWlykK9%ViUL7!
zl{6Sp)|+B_i*LgKLI8*-o3@UDIDh*Z$9Wu3O*v~~43hglU+aW#B{seHIf+JRpCQAe
z@%6x)YJGhd-ko-sSP1%K?cbizaz_5r4bz>!86xO$6kr^a-B~G#oBPpSU{t}FwTmW&
zYq+X=_KcsW2u>^$Nnn8wKpps>`dkE#`B>%Z<+9lNY*^wsTSeBFxb4xxopI+4-5fV`
z(v-uvJq~P0MHtyK#bkg9!y{(*R2RnTmh4+Hsn|52Tk-J<TjrGfETWNX1M6MISKB3-
z7*CXt*~y0~zTMK^Ed{J8Qhpc`4QI_Kk<~5b)_!a5w}Mfl-}>r$hpUtrGj&X_Ju0mc
z%|0mGAj7XyC*6cePr$_6SsfsJu@W@H`_UbQj0aZ^t`oh!+Nn;xfjJ6$KLSYr9L$CC
zI6q92v=xstKE$ULp^Xpr3S?(#n`w#-ca5yii34C2fd$%f>n_by%QLM+8ipa;SN!q)
zm?f}IX2;~!rur6p*GM(^Qrj4$F4(NUIkKkXJ~9mMKP~|iHdNdO0vcA>YRWo5R2c(t
zj(e`lqfm*zR#>PN$1gDyZ((ner<G9Ka-ALmpV1ur2p8Mw)V9VhPyqzI#eWU|LG}|^
zRoP;h>c>h^y{a8emurNaiMH8HCxWlMPpKgZwFp}c>$aUicrd%NCloOTPlMlp)%`q_
z;CmE^%P&@MGS2j5Gj`|DU{?}<cEXMd4vaZZ1cFbuGd+pR&n8I%(lT5OapSd*Z&gy{
zwO$(n?y1M)4sKHEh<+gzYu7JfzUnWiCHZB&7qfzcoWTd7e&)J*58hxqT()~SvdzEX
zyC1tWvjy&!`cEy+$ei7gy7rNz40t6LGJXdnqJ?4&0^S%-DY8u<lp$Bt@`Ky{ht;76
zP5?p%952>VZcMZ;V&`_ifP#TWZ#e<WzK?N@SK;qMhB>r~)M05o)ygRTbmpM6^RQmm
zzT}~vN->dq&fc}vZcH2tuHTn}6mNd{tX?U0by7yb7uBdh1qbnWgu~_!JK{)ctTp!e
z35bWW=)SH>!-DD^GegtOc{pM<Y6wD8ecaiu=pJhEY(b;fjW)@^^lX|r(~a@@=V{^%
z|2ZbEjU@jLA|+wf-Jgn8;>Q`&Rh3A^4+A-!#ll2*v3N81x?b?5(TwKf$o|%_i6ylW
zj7_|MWQ7L8Nx)RGS~}}wBqFj1f<vLSz!I}L6k19g^*xa&k$)f}#Vc<nP?Yqy&F<)C
z#}9x!oIhw!;N*6P2=&95QDPP$^nPkFvqNAY*QB9|Z_k7TYr9Be5B-G4*Z1KZr%fn!
z$9pORqLy{{EZi-M$!z4YjSMVf4^i%*kDdwfjBV5=?4#CrZPF3NCR3wS8qo$PVb4~=
zdWvvRVPQqgKHg@O{`v?aKMjo&!)~56)hExqQxon~+1y-vnO1_LJJ<E=q{Q#aNm^sJ
z5KaeM07|HL4E3HALh<3lZ^Zq8+N`-msiJ0?;Rv8@`xI%e`{*HW`jHQ9|8!edBIB<%
zpA$AiN;~E1%Kk*uH7#FP0X)bO?ur!?GDwXsB;)pi%s<GyerM7dYv0R#A#wy7!l>Zd
z<QO7LL^tR|FHfl(7xO(1$h`@ig@Q(ty`rZyiJozY^<4B`BswZ?UsU$^8vNin5>zT_
zMl!%u+v1l5_|~)+E6`_ucZq~@H^+b0Ye3e-ivhza2tn+ifLA&`r%wM)>x+mv_c%iF
zh(?rF_{5$3$zTUN--7&gn{d0O>8stix!XsulhUcRBuzl?P*8w+?CL?yS5AfA8o6i>
zHIfis@AWPK=%VcrIY5JP?fN9EWkjL_6#35Yc^=Ezk~w!!`gJG|V$S8+g4;iGy(*RZ
z^IUM&E4r=b=WWx@#DF~8qTU&FPl??O7RE+W^_Yu~Y%+lBu<}!DmTmxTyvWzUk1Xh-
z@^d_mD&D%BH<r6iSDza_qo;AIl%72W_$$ic0Fwir;&PP3Mp=%u8a|xWJe1X-24o~`
zefB%fL{oK^&KiYKf|_dAY3;ySS8R}Y1%j5D0r>mkO57|xGklaBHIVGX|H;n5#hTIe
zDbn@jlfH_fV~0f>60jQHq`S1A`PQ!)1c!3{<kQsvm;u|Oc_~W&n*hHA`ilV2@1CME
zlWX-MvbU#Ji(gNn=%cXEdOv+p)RP_atwL@8Fuj0y@S@4dDfjh&+l=OBWb#Mzp%sG!
z;QKfgO<=>lI-z>k{6n^1?ee5CUC%tXPI5IbufKWvjYy11$P>DD%pRFbQ;HL~iOh1p
zbv3{^E!XDHz7Ufd_gn-3?nxPlMb$+LDHTJR#i;qA_wEnTfTJIS=6*Qj|7IK%hZse|
zJxr^&Ki0@GbL9o7^pwDdGQfYqU*U6c2YFYj?PfxTUn?qFOMGP7SMI1$P9Z}p#h?!D
z?1{y?RpEn={4>qbJ);x3UMXV>R7(r^f)``Ir*zm63k&>wuV^VEXAtxy!OoUb{E9%j
z#u5d0$QIpXt2C@;?H_>6QhqE_($r`jrkE{u`2>kNMpfDV|B5T%&FSk)A7IL<g}c=8
zEZEOcPFw`NXO(syw0;`b<_sb_r>tIn_e2>^w4(&$Lsr`O<og~Mc>ABt_37r_bjg6e
ziiyma1V7ksYxy%wcTXFmMY1fDYCgsNaOG+$>^R`K-qs6B4=<R)z$1Wz%#Vq-1G)Wp
z)2QbQaI;)_Z5~Ow|N9>R=i0(<qyD~ccXB#(?_ZOIl2<}VSbqvG)JQ8Nz8`_yXg<Vv
z;OIMpKfmP~X5>*rf;&`wuZv~^`NJwR!7G>X5V4?P=$QfRPLsxMKal}@W`o&P$y5S|
zSi5x<n@+$_FToPj-!2saRs>|*0jty|#;k}2JbhGglvp6hY|fFf>U{4<a351ks0xMp
zZ>5-OwkfW4CA{XcpT+&*>p+M>G-I@=lbXtRR3Djx45pEwuwCudi{XM@^F2eI=YHqz
zvHwmkUJBqpd7f*X(lpa-W8{KUR9&Es`Avh|{}Tvm6SJ+4;CD55Yn(D!@FR%n87qQ#
zD#kJ6<v7QIvP~4L9IzevWb8_Gl0{)S9}agfELdoL#Uty9kH_Jr;Sh!-Q2+oegHf{&
z(7M|4z*e^g1l@hVb^xQ}0upkbzXj_0R9r<bHz0O<f4hIieGT7XE2Djvt3N&e;=W=Q
z46l#o>US)e=CunU&93+p6?!58MB%gyDwLM_n1)yyf+--ZQF2bljd`02@gkRs=PNW=
z56n*uVAjHffqrAdr?~PH;wp+%a7E{=pB47Cb~l*Ov-k|Bi#uyf9Z)}%>9_x5JdYWk
zzc9nJ^)f%AgFVC4d}H<<uUuumfeT-ROFN!{dAkArvQdYgyf2#AgjL3}CFtZPn=FHh
zM!?RXGQ~OYV!1hDppitUk?IPEK?7}Mll@VC#NVh^oo5#5&%)A)I#`H6MYaT{Rsgxk
zRwuO*w*@f39w&qKijfL;CBeEV`?1*uT#Q9IMzK_ZG}|WYcgWU}JWy6}(AZDYc2O}R
z9FeXvj?hTB#ee-t%Pp2Ci0Rg`lbGuKWmLLRBsnMT?n*b-WC=Pgm}8fLdyYI;tj0=y
z{LXh8pAG?VDfj;GQ7EwQ%hRk|)F5Wr@w1^P&06<XZWlq{o^TV>_U-G)R%}vma9C|V
z1`(Xbbp$j5VHSi=(g=E&DtakcW+M}6V&wbfS&LVkRRZl%QQ=smx~$Je9?dAhh#g_V
z4E5$ujdlPg9gad0AM1%~%T9|XnBR+TL3;`JI|I)G|4eksF{0h0f`s6TMk9VL{+Z*z
zvTAh?VgGB?(N4U7mY<OG58UA@HD?~o=Uz4ObU%Ruty(jPA7}%_#eDG&EjC=V`<d%<
zj+^ETHQK_~$w9J2U!US$KcR3E#iYT-sP?Z3NWhR@6uAdBKV2}%650bZ^vN4i^+On3
zi^xamIgJW%NcC%v;jE&dU2hq2Su|t2sfCrQU@(h?YC^iaJXVp02;AMdpXcs5?*&;M
z$-KJd^WPn%ToD<>+6s?Hqn?8_88(v%*pxPo9KXeH!3GNDO<Lc1mD;b#4=z^2y<P#}
ztPsh7qd^tKG<jidS)ro_R^;XquhDE(KY{8>tu;eFBm0Da>89S;q&umY82G>4i>)e0
z9Mh~&bU@FfGSmBjx-%xX`1=Vpg))Sw#}N{|wv`(OiSjWp0vfnZUP$>mcB?&WItQ9w
zzIR%OTLYmkooh{D@QiT0237QGxp$gHw5baK8#*1!nY`8$lz_z{F;2c!Ay6IVy$9PU
z64=4FCU=9)KF$YHA;-npNZ9FB4E$sPTB&?gR&PXREM0PC)xueEnz^pt11GPKMxa5y
zZu>(;=%yg$>abtr-2~$2lgPg>S5x|_&CQvDyBqMUl)oh2m{z?zZRBStM44*GO{TL)
zz)0q#i3q4hls=ZJ!bMjJkr4EM_uthZee#jYGCDJpKmNotC6}7x&~pH;G~)@O(Zk63
zAoe>k!y)?FAx5`$aYqDDAGvGQRaeKootQBtx(FoCXcn`4rohstE_ysZ|JW#tK6G6+
z+G#g9wauRKR8hHv>@Jet65P!MREB!@Kp5W1<(h~Y(oqj^rfxm@V52e$7{wlz4oQb{
z8ytU*VyF=D{!T77RyN97UAHWp2A24taPW%d5Rm!xFOY+<DskPZRg@Ww$8&?k$`f5Q
zcr~7nrao5VaUTu$#D-$l{>#CvFFFFc@Q2B+k1AHGzgLANXlMboG)l{gh#}R)V4;Os
z8a&v&$<f`shA@Y_#5ku{LX#u#XCN3XbRyQ-g3FVl3Cm9bH%1hcMioIMsuOL8v7}6X
z`{}5@ZxLR<LeI~Yrqzf!{jD<b=d!NtR6#?j$80pHrp4aTD($*@dFMTK1c_v`bmW9q
zLxPk%BApi|teAm!IQXe&INQ>9(U7zE)-72WPFn{`sI)z>{efUnmcrDPVx+A{ij7)K
z-b&h`BjG!cSI|#zLt^^rjpGcaG5}6?yzqOwHOpjg)k{bRA4Dx>(fIo>oCeUA%r_4S
zGLQI36YLMf-)U_G>=IEH@MhuUG+<_Rj@Fj2tR^Bnc+#{}>$K{$hEe0S*c5m{L_xE_
z=;NDWK(l&2>n;XD8|i#vgQq#As>j7u|KpKBjOdhfMp(jAF3GSk0Qff*%X=<MY%V=N
zyRE~hD(R&{-Ty3@42FR7#bSB;@&<Y30bf%-c|Ezt?zJ#k`)eO`ZLL|cq;8L~70Il&
zLz)+#tYTNo<O0%iQ4&FtH^lP`VMq?{#DeJ}c7MUS%*-IEQ#_uq=wsN1?BfHUYgtAQ
z(ufBUnR60fhtWo7CsNoL+nRcJG6E7_CUBf}h>RX+z#&WK4}F{v*84K)u?#ZzYpH^^
zeWB3YgcS9ScL^q0EMKWxA`+QZ0bW<D#YQD<oq|oO%%-AV&q@iQ=GTc~Bfxmvz;rQj
zOST=C6x~GWCT~rOf#~+#Cmz{r4oAs59B4~6F!z}Ar#SL=djYS}@Xoy^qBqJ*lG5N(
zp~7qbgeN@uc&kBN3@$tJ4=*N`FqEm`^=>ezy@J+#o#9K)YXvuQ6Szw%6<lbXkk!Dt
zCRHS`gJE})SWd2oB;EX}sy1HFxAe8ec&M>x5EPwaAyy!fJ&qO*?B@(tmz|YmpHPJS
zRDIs*>C@$SkFmG!(|B2kLU*bHv2Is;2s+}RytHcY2>S*$!%#FPT)E$0!+MQIw=&cw
z7*)#?9UXqj@d@Hs=?~`PGAc!$gj|S1pzym7Q?^G?J11j|V$$H_>ncT#TJ<-DexKA9
z({fJNYDSoi9a~N4!Z#FbAm#CD%(w|SxqG6N{$&o4vw%=p3@Lj}I%!6_O8Uys%tN_$
z5^rme+_B_lP#lDz#w#<RwL$ha2=>MwjFHnbH9vV#*k}l(u}q-pl?4zPs4<ieguF9H
zQd*@D-+$bbGj9`WA8(HS$~=^kJI5DeNuauZ>|Xd9g#_>OUIe%G_1><AtTd;X6&V{}
z$bW@YMOT8)mB4f>|M~J}04Al=oV~NhvCu6_oa(A5a2B6LhKkh@kVKYcjW+3YcV?2(
z)gR|6JtA!4Qln=Vl}&{f(jqVU8K6x$WKnK6L;-*!)AN|*)gJHolJ;;DKrM5kJfIrO
zRWjdO)MhAdGuidBr}c}P&(~MAm<OQ}hmuwviUTU1z#L=B$cxbJW{n}%j31HoK$l8x
z{U8@}d1~wx1fCbYSyKL-iPiJVk^R0TY7ml@F?_>(dy`w!DkM`Zhn1*X$dSXp<Hr*7
zPrm@itvl9Tx83lVD(463NN#kxFkBvz956D`b}uW!h#{gLTDw;qP}q)mFGy=V#T+0&
z=YdOr75qMzaw^PUvx9hwp^|AkJ%7be8^Ue0f^_Uz=Dc;qFYdC9Lb4;nN<2G*rRV5G
zdn&W0%);ty;wWLr!&<)?Wqz)Z>pC7@tHb1oQR%bslkio4X?s|9hwxRLiat5TfKI_K
zgGs7K+cTDUdF#Pn$C@D8@ihqIS>J`6%MA%1AkWyEk&>JgtyZhr&9g2C74~T0)^@7{
zI1C4cT~h%Xzk!Q9ux`O|YlAuzh*F-V93p@GyHja%Cg*^I2C9;__@LPqmh{){b&fCL
z#mcHR%jZ^?SH(giYG5_7x`{lBh#Y5>nB6cTB5DN~K=Pgt_o|u^VYES^YPj*U!$=09
zsibzeP4=0O8zR{=yNxBT2t(BsI_t6&lvVY+=>$8KXf0qS8|(^jp!|hzYAkx@7Na>Z
zrJQrrJWSz$<EfTQt&ucF-%&wjCaEf)wCu!ydV+m9;TNQiE~h3jTBt*F*W20%^8P^h
zw1oTqT$I6~u?UfXfE!RWaXL}?t%bTtLV!~%reTKoO^Rp<s&SrjfN_n9e+Q8U@$D6+
zA6j6k7nMIruspqGqXJ(S>X*I|xaQ1n?#r?;bpXfaMX<kn_8@lgshmD(0QrJcAJG`_
zh*M~na%a8OFvd-cHRq>hDOW)b?NL;uOQi^R;2}xNvM2N{nhmTodzMciwXx2+^ny$z
zg8HH*&%u{rfsQ%T*FvLri&e)h21DT3&(weC1%<L-UNFmIno3@a0+aj9VFA7T>51*H
zZ*{fw-gBHGd3+0?_T?vzC8N2cX_H)?z*$1k_G2DU;1NiPKHbE`DZUgE4lH}=)Ji$)
zna#8yxWPgokZM;?c8~%pcTngx$ncZvm(PI}l*Z4NmGn=!H@r!jML8sk5&s~(I~(Vm
zyHWVqpgJa9TI**A9%2b)2aJRW*)=U4wXuU*kNSW0!{y3_O2Fxp6Etk?xKW-(&hGa>
zv5^)Z0&@+GyopS@eB@tPZnBXtn?JR&`>d?f5*CJyv+Q8(OQQJ*(8JM|R`kg&+PJ6%
zLJLHzRnoPM4fdtZ&{}r6h2d(vK9EO2e;MZ<guHu3yXvN3&f-qx{^qC^<uap5oC-qL
zG?IPjn64vRM{xGH5X+Lts@Nw8)^6`=Z-f2&?gY81U1Y9=5aIp+%aQJKMrqa1cSqsJ
z+3X~*+&d4}*(y7-Ftk)+Eno6$J%nF8ma{_Gj+#DJbn&G<>_$+O{TW<+Vi!$&!UfM+
zNy;vuJK<|c5~AgID*+UA=N9LfD!*SC`j@7%@?v+%00ae<f0v}e2we#i-n4rAwLb!1
zt|^@{1bt?3_cZ`|-^ds4?0?jXx$}_THE)3q<f<eS2Cywpz~i0=xhlA{=kph4W!)Xb
zUDOkk&SzQ=6ZsG3$++fQh|~`aGJGs0L31YMb>6FBJKF{*6>@cF20N-nBj8m(5$-5z
z8TODO_hCFM`oC1_+U8vn^SZhAg|%lPNf^N3$=m5XmoVdHX6CeH$2&tQz3HA!#v^I$
z?Y>mId@r6NkJ+jr*wBvw;Z(Ya_JUu~UKKH+t7HW&YjjzU&$>O0bj_7fRTI7JJEzEX
zTkZi~&L6)MqD%Kt-hHIjw(5$gwFZ<!lV{Tg=;78P54HT@nu0O?dI4pW03vvBWvsh&
zmoIy~rE}!{Vh?#&MC54F&*pLNR|Sn;sEtP38QfxjnyQJz8z&)UEmfWdvZS2C#z{?^
zdgp~<hbOHb`5of=3E|RpNFoud7*^PaA`<|sekuoz;I(X%$4HJn6u*`xX-wssn44%C
zD@#101uFuKh>*;HY#0P9Z(;qvQ!agU5syqyD3A|T<_*G}!qiYy?OS_I|J}rA$#3z;
zkMgZs@@-O0=|>M0H8`q0+XgE7MuV*{va|>m8#q_5XYgtU$1T!aHyJg=#PX!sv1&`<
zCowD1DTP{!*(P2!ck}$$@g`06$mZ6LWOZ@Z;5g@Cwq3H&Fz9)@8X3AiyC>6D>0<}5
zAtkJTABn4@o%H9ISN|;2>yPA+ijkU#$%4VC^=yxI`vUSr<^hUG3Sa7IV&S;isAlJZ
z7zTM)upQxzo?asKB~BEjEbJ~MUipt}JtI9c?_2O*S&?-qXwoyMzXF3a3NFWN1v?}k
zgiSOAt2jhIu<U=p6(i%1J?|_hvaL^Ydr}s4Uq62x_E{rBCEExKJWYJ<l?S4j;j8!`
zH;*yM?0IcBq-wv|@pVHaWWdxV*`W}GFRuYLcw#VlP}hpblVZg)?QEsZp+>s3SeK9Z
zDp1|lc$Y{cm+Eo7<)0yd#d`>dBQYn~ehypBwpyd0L%xdhSP8d_(_EtCDl@tklKeJ$
zqBk&r@>6J&OlVZN9L5ZyGWld^7r4PKDD`O=@{wREzUhtqo-7kV*oBxoEm>tl;cXGz
z$@Bn`O4&wfeT3%c5)X#HXZQB_)w~SKw_aC<!(>$gDZ?(c%aY{C!s1?>Rt$5m`fHZ7
zw-J-Il+9V;$yXQ$veOzZ`tCs+OV3Mj<)CYyH1@0r50-DE6~~RxCtaVC!Z8Hp)*Ztl
z7py2$!4H9FZKvEOs`6TI$_nVb_n^l4lh8}=TtZR4pM<+;BJ{gyuB~-CHm&~wtMdqD
zBG4}SFL+#Jh9bJ#zx(_G4~y1uC^6bGZ`$GMXax=o%HC$Lia%3i8>^R&!rA3ABk=)T
zRNd>Gb#B^yJ(e*}b9Xqm{b(=(PIYVp$}s*_d|Z%Jzu-dqjCAK(>{MR1@swE|s8FO}
z1+;NUAFJ&}ya*M#w#72Cdz|Q@%1USv9G<9gUg*U5#hj~_ZVcI%jH!N~g@q;>1xPG5
zMV~*xwp}Bus_lVbh$UB}b^kB}=V{w6d^4P*&25E`9@3FJy;;eY3^xbY1JWVfx)q$=
z^_mwGj}_I%R64giYbn2@)1bXrQ2^@nxTGv!SZIU#Sr%?+sI6WjHUIqN4ISY!AuRr-
zXy}mzDDsJpz8Q2ostFpdGk{vALfu@FG`&Y;7pVNN8N|ggZ`XaDQ_J29(1n&PHWnQw
z<&SizNsSmd0<dH(rBN7^nPo;kQz}Rg8!)p1uj_z+wo2mW$OR1sFvvp4t*5PL6XxzH
z)Dwa$z0zzbOor)h8?t&u_!q$h>677~Z*()0_1{-~&6GOFySg8?YX~xhxU~s>%)phN
zfn!6-WNu%=flfO~FNfx#+NaI>sgDW`zSU`E1;Y*bB9A9Fp`4EK+;10u^uwxqf}v6v
zC^#Zhn^y_m((H6OY^l;cloD$+3$;JnYtG?nZvvb$QBH*X+UF$y6!KvY73yH!%(A2U
zy-h(;KMMS4*c&C&AOg}c1S+NS@Is=O0d>3xNG3Dulx6LR`vDbw`crliZAC$00#V3c
zJkTlGV?LZsg=OjjZ`o_~S9jxD$$HIA?4YP@s-Wwyo4Y773<iwV1>9;`iQ(19zW~HV
zMCmy4>y(LiMA@Nq7TVS;uy{NKh6!J;sHSPJg8&TAScT2OX5u$cFF60lbjuiZHLiIw
zrE_EeI(9)Ho+8?*O8^qs$(c=j7f-bsPI>o`l_3C$O~1YHw}ZYmu~g@RW*Lm9bVFYJ
zl?w<RP<g1dD>EZ%EwnnU;NvSh(x$~zB{|2&T>&2SSNv1M;&)B5+UJ##{qMu^LS~u}
z{4<TF^Zi0jxwD4Cb)?&Kp$&A_6XGt6oxS`CGVh8^>VBef+oF4wUhHoaEGT0dXs-?R
z+N8vH%&@!SBBaynyateTW`UAMO!>wzkB$m&^bJaPXySPz-*!YuZZJnZLqoE_AkGUL
z801bSG;;cDn-S5V<%6Xp2b;5Q2_9wMzgMF*k=5p0Cs;KTBAJb?Nt3sGNSpla!kL@Y
zI1)v=U%c*?2zjXf!R=9~W@*?<T9W8UI-c}ItMH`vnbDTL2jV);)VgErZEs0rY=tb1
z?G%djJBqP2sPNOBN@M+-o;mZQzV`01vhfs*Pz5}WA$p~<o;=TY4LZtiFS!&c6ge~;
z1VsiVJMm$O7~3e{%ySJ(b6R8+@7(wmEt?E0&z1((M!*_^fw^1j04~wl@0p7+bI2cq
zAD=wmc4o6psj(Yj=ip<xC*>L%9V7@)kk<|=2hU2NDHs;5Rx%~Yt)bSPUJ`KM&<e<y
zlK+1aA&5l?ie%W-5e;IDaFW?`s9YB%g+L<N`Y3?re0XxMN*W354pqePFzu7v`^+%1
zHqBFz=Ozy+b+Zq^oUr)=vSrSSjqYPWU}4W{f<|X)^e7$|uUw$1vs^L3=f3+8oPcYb
zJO3N$6f%L~t-~@(+dbb(lIBMW0R@}#NHjE!6=BDNk=<=|Q3_gObC03>p%T^5edY%(
zk~$O0#Vh4tM3SiPs9l6rT+_H^TxG?XntP5<-vG<S_{fM+r)<VERy0Wa-@zFK)Ec4<
z)3$@oQ4J#x+@6QB$`b`~N<}3s*mjay5-n8-`-#7Be**JFj)1_?ed{V|pTnCY=&uWf
zk1Wv+e?ro|G;;aGxio|PTVsa%ubaZ3S_G=TKx*4&#%EA#&H~NSkv1sZ=?LcOPj?h)
z>KbcpZvns6<_0qu+%`92O5(T%6-Zqn-X||adIVMPX(m!v1MN<f+*Q#M{NO2rfG^HL
zUPeBDn1_77j1suKqFFbN%jt*V$E2$T3;=^KhbW<)Zd6xD%VGU28e8ZI6&|He@rtY)
z;!R)GnaHD*V1e?D3O0Gg3X<SQD+>F^$+aR}+}yhI*}OOP4m}8;LqGfZiFeG%r&9Gq
zHYiU{$O;*lMDc*s-u~WqIyzjj{v9k5BMEIn===0R@gHTu|5dyjxA#?0IUtB;%)o=W
zlOwuAzayuP&ULf$AXSIIn`88W=|-_=l6NC4D|Y`%Q;El_ccWwIuUA%G8+;r+Si#6C
z;3n5kuC9d5rcW2xzkq%0ycAgOCv1MbQV>c0)hVRt)^`=(xtovw+;sXFlx_x&A24T4
z__4TNCfM0Xd&rcjaZ3|zOjw6+N4t3&dnlRpbpW!>_Phv5XyFXHKjOHTJb5oeLooDG
zvZcx9^r=a%!8#MfA}*aKiEoW>SZPUs6#tq1dKa=5u*$Qz7)WwwjsiJVf-l6Jq{`EA
zrCN?bm(ek|E*A=qFaTb)#PJS)9Ub)ns0E`7@$zFSrfkBls)%+m4rsX1*3YuRH)h!1
zyTMLLKz|((6%rLtnE^|(4lylFE@AMLO+IOfT}0N*3roNz;w`*&Oof8%Un?TBA*eC+
z>>clAHlB;3CEn9Bo9(qd_%R>W6AJGAs$3kDty{i>u=0#XxMh%+{yrXx1SGtKOG*F#
zL`;R{>qZ0Bc7INO&E-?iF~uT{>?YtQ#6$(dFt{lcvnc^vqM3>%BdNkquG?2Ffwgzb
zhVm952TAR?#(29*Iw7$Mv&JEuCxOskZd!03oV1^VzlcPK3<qurx!-uE&N)T{V<r|8
ze25MG4N(!KId3Cfzn!!;jp@|<WsPjCRLs$wo6O3^hI0pf$;3Dii=s%_YJ3})t|A}X
z{{jEHn+}d!!o5&SLAib{yzC(Zuy!*oLcR}2D}Yaq<w_o>1RzOfjdU3VU&z!S&TbWZ
ztK{DB(1i0yG1vrNo@Eav+*esjW!Omsj++W{9a6}K{uQY=S{7~bS7j{hC-uM5X%f~Q
zu@|ttWmWqXxiQb}!82bs?{L>m{BhJ9u&V75<z&%U$9b2DZ`U(FVUeIFy1!jYb_hJl
ztJ)v{RhY{3TmdYaV|i27AC^(^c&NRC)=HpQOKw7Pr7rpNA+BTH55*@0UaN`_Qrz%V
zx+&%Bu{m{es=Eh<YJuBQFP@*q`8-e`!U4#>hk56K%Zj!`t&K~@5AI`&4)hAgO=il(
zFukCiw35_wBaU&VUQoF<O14M&3K%0i8}{his_x}KF59CxPOOBGqY<Tu(xxP5=G<8(
z#-5K>-1J;cWaZ{U+`KH365O^@KX;SUf$|H}EJI1_#~08~64y*AV;DUTtnP~$cEp5k
z&Hnlc49VR)j(tnPqI{{;)syFTPN>ftD@HI~dTNHRqLT57uCWeIo{o;i+*}o1;!{9y
z4~1uqz!2BeFA7J{5YBreo`{^-YNU=$SEPDeZ|gnFH1bW0Zf{gUpcXeNdkOxC_tG0x
z`;jWoolbrNdm8sg(KI09);f`cT?g;4F<8EYru75>Ax-hvJ=;2#ZXO@c{&rtoH=b%B
z2f;K;`b0o4k}@G4K%>HwW%0YwHxMkfe-Qp_yaJb@y)Uz!x%ra$9B5&rmG18ZgO8c3
z+iEAE)$7rx+m6_k`fz%=qr4x+qlu}I_NI<VfT=VAE^>vVa3ZEWW1{nJ41|JH?FdAQ
zyWNl{ho!w;&WhtIMtmJyjlH=`dd0R<*Mq9}GXv8qr|qh7&v#NrOksWhgr~^7maOu+
z(_;a(05N~W`KC@J!}h~3-`Vs~PRhaB=S7PVbs2q4pI8~{12o^lbrq=-fQQD)wE73b
zzz2z%?<jiz0X1s5cOuf0DO;bYb~!P8AF9G8Go*AMv*q(Pq%PrT{-7}>bP3|LuAYdt
z0=Wx{^tsN@9-P#R?Gw!-b7t&hnCiC`;xghT_h<MK*~d0i_@2Nn3uQiey|AZIA&a<C
z+6}GZP-wX+7bnj{nJVtYh#l+HbjY7Xq<Xkf9n<*}SS6O8lKb_>7`eG|C2&YcyPDwl
zv)1>RXT+x|)5|`0Wj5-{?4Eq7^c6H6^&m-y`P?|0EP*kyaJs&lm@6Or8Fnd;9UQHX
zV*r9}Hp__@MNKl?g&XZ5vwRtpWS1Et(bKZ|nf#<g(eOdc%XL0ueeFZ2oW2b>Jb{zF
z=K@at3glA`(!kA=nezCc$cMRq3TBDRiGUD6bz^<*9)aoTUE%y<bpI+YZ7W&X9C8tk
zq97&2-?iAVI!|NX8^nbMuzk@W4($K!%S=uf@ZeH=XR>(z+T0Ri)%iTbnDI~*Bu2Ge
zlR!fJ06q^~8*Ipok;CpdgWaB)T>*e?*m)Ux!O1l=7>9ao?KLld&Gx~yh0O1XGHl0k
z3M$JaB2@1JZbXM~_>7#Rz?y|3#4SzHBd^|H*bCzvBjNzdJb-uv0A>b}c-}9R7#=Jp
zdZCJ#IRkpbuvd!j?E%<KOZ#>{OGvK9ezawe*bY1bfBoM9$peLLa(?V_aqF(g(jdu(
ze^h$%JMzP`rNe8@&hhuktknAMavcweVRn>VQSQq)F9K7dQky#k%%BdR&bE!pM=w&x
zNs9M7f$<18y)Ar|CkfH^6?2<~+K-(}z`mYn<&f89SnHWQXblJO%g9LSd^F4Cg?do@
zQS`TC221It_sXmwYL*@k{9mnUV7m;j?w0)>GHJ0h1GU8wY6FKgvjkyei{*>gd(}H~
z2SzHLj}}v%u=`-$pms3JcIaYWV#jc6WPaX^SC%yLa+l3YED9Q@gqE_w9-{%drU~Dp
zFp1S61Xyj43|$h314xbxfA3w4#X1KZ3wWHwFE6-l5nueQvsE-Ify3u4;+sTmH{bn;
zK4;Nv5IwR_`$=e&viC!nR9vF*=l-|Du$nW@gTha|v^ps8A)W~ENo$xZ&=)=X7Ze1i
zV7IA;<q)|7mqPcFKHcL4RhMV92eBZB{v`oS^lf$dPuGRD{kXU)3_^1mfFUKKF$FXK
zCMCrXk2B)n4}Zf!CHpy4Gd&4j7Pq=DH@KBI742hwR*RoG*t4x?W=(XzI{eauqVxF`
z@w3IXx^i{#6EXPYlv2}iA}B%{C_5B!w#)nnz41*|_|~h}3Ff$kb9sE_^<q>AV`D4A
z^mQ0HfC5SWO&6jtX3Mm40G8x(tQ|Lw{i5`QQUgFfjwDc-gfri26HR{>mM@Ww+^hC3
z(&O@lGmZxK2jnhevT9;Y<<WiX?l?SxG<rU1LFEYJ?bAIn`R*+(Xv9AF;LV-1T=`*E
zzwBTPa8C3>$G|l5p=ys4XJBh><0hf|mP}&_@f@eboow<evX#&UFgX(7$5SdqkP2`e
zf0|3EGMz)u=T8_pp|KwU1hW(~mKtY(sG%44EV;5uU(D1A?K~LJsruQW<yEiT&vu<+
zaUSNG?{CSDf}=%qJOGMUBlnI$(Evo(h;J8881>yu=&i-bA@@?I@P%}I`Q8Q&4Cqjj
zb1TrePhZGbeW{_;c9O{N%P74nkON=k6R^kCGJt^)BD}k8<yWe3`8LEMZ(T6NsCDkm
zb5dC^AXCFQp1e^zDnk;J*4=F)KUaM^gZf0cBuF6}W^IoZbq3UgTl@&3*VbP>1!cev
zk9^#LP4XRwHGj{X%!897G6VtZZvKGSMa~DlzZihnaFz>)mg7!S5T+Vf%UL}n$RyQV
zo}oD{k%iw7$NK|<kq-YAPixZ8tXF(drAU%|A)0=z*TbY_>&lAs(&mkzeOqGzIQeKf
zl9}H}V@PjlKOG3%8NPhD<5Z)=wh|>-@6EZ1iiD9Fe`drEE`AfpvnMWY<>W{MdHk?L
z8J0;Db`rj!F042||EfNpDF1^eRSYp)H<hWyHtRYhUo_g(b8cG7#m0#~^k-+!`xiXe
zzkTrff8cE9|IOedgEqecw}EntATiufLTFE8Jn$70QXrP^6Tp?>O3%p&AMaR|3@IUA
zG)iAgkg$b{ppaw#_i$#8+to<xHuQiIvVfC4=r%Tn*-(K8kR|UF2s=JxQm^DP?ua%y
zLGVS5cqp|Kpd6sz%^#(<wT`;OAv)~_%5=m2d-M9|o#E`Iq&=VbZVFJ<!kdr#TD*D|
z0oGa)xEJSN?8cXlbfdsjj!ip-m%I#31fEsyGW;fE#rdUjc{vO}%y^}58z}th)NxjR
zGSmY8ZnfeV805B7SYfKlp=)M}m0d|~5g)>w0L>SSWuaog(b~^P=s^oE4*h%=C&;-x
z<MZj#x^dWilm`nBAMEkJ#O<%!ZE5NYb>NMmu07b>Beqkut$tUB9(9)@^Zn8cY;^5v
zFPxj;&bl&!Ox#OISn7-Pqrd~>d$>dc^i^Qu1OsxT2{Uo2sJfzViS4oD0w>hoor(F-
zCz~=g|I3DTxnTC;Lka!~8OlF&$=c7<k4qAc7M~|0IL?)2lf|gkKS-5TA1VaGpn-*!
z=H{4NB{2U3z68ckMr{#rI21_U+z{N2e`Tx>&B$>L(T`H5NIqx6nFqxhcS@}+i-lEW
zWPBWN<&SW58kOFZreElG#PKv8t+Y3YCuQq6x~7bFy@aen(qg@l9Q}DjNOy+PBtXrh
zlKFZ|HIdN^nl%PulWvBrxUr|pNE*PqWIT1AtsGU4J36+F-Z*R2v=ZYmERyXL)!o1z
z^8X+X`*1Styv5A^r?T{yF8oXYW}D9n)v;-vRAm<XY-`Av{=mA%4+}`)HAlmmL0MZ-
z`V|6CpS+(h3nQC<Gxe417U+4A+Qjl;FB!5`jDHEn9ndL9mx>ikn`AV*9+MO7^Jvxw
z8?@OCx=-*>*Y-n9x#*1v8BnIn^G*oQ@^AGfxOZ9!8%KH$7AG@Uik(WdmZnL1G1sFF
zcp@>|SDgClVUvP0{WMbrF>@-s=OH?E+P{Hc-+G`EBI;=7V4sCy(P%CP!o?Q)DU$EC
z(0hq#tmW&LtkdJ;U(i})&%j_cztFpFiL&BdrIa@n5Q~xQ)9X6b_c0mWV$g6TaeAE7
z<8`5OtPTXr#ROd8j;ZT!>*ZPU*<S<obud#K5DE~VtPlyO)oK*f{4(G<#4tj>cG=$9
z277=bSf;OW`EfoQ6-7RIX{o(2D+2r?H8}z#SUT79omc!aYe>s3FE5h#(Aatq%8T{C
zVv^ny7E)iEfGMNMcdz{*zc|_}8B_nJaYiWA%;AH(0+Tup&$+r0VotjFC2&d`_(Gb)
z_tL{Iiu`+9ly$@b^_MWG&6K<^(X19B)0U1d&@bx*ie=3e7g)oWx5?4}H2J+sjT@#t
zMn5`i;mo@fBh{HpwpGN^$qHJU*|9b&lTxAP{aq@m!rbfhWuPz6qnmLC-%bLs{tH~#
z9P39i!l6K(!PnA^u>3_{(ZR0`_9Q&Q<mV=&K7w=S^y>B6DwaevyjMYujUDD4=bf)C
zX$U6+l;hX$3gr@PV#0&UtN)~08<#FsFu0=i5^?7(6G|cl29N3)73eBy=fS_Y&7b~H
zx3Wnhs<+0;isDe#my#d`znvoFO^C`2qL(+-XhIXl1wf=4>+tm<vIv~;ygJ)6aZi^@
zA}@jO8o)o6UJ$y%?Z}k0*Hd|;)1T=g*r#KAe9K$j@|x^)QHn{h7*h^@Xj+^+@`28O
zXI#R#3lu@RWrKgZuT&&2`1FW$Nx028y1@Wio)M;!Rqn-KUYhhTgLiyF$|0lilQk-c
zZg~oc#m!ctnyvwSIA{knhucj>-r+W{qGt{OWRqHt^yB@7oN$KfXOojBcc}dVSg_td
z#uUykiCXZG7{bq!+f51%3h7WsO~ORA1$-(RpvdrLSQBYr6}c@7Ntt`HhO$j?Rp<O=
z0D3%EbD4rF@A?>d)$6?5A6yx+a^n~|3vMYgipx5k9-n;&ziDDpOt(3A{_p!$AP3n{
zgbUPGnw-bH2(UQgAZUdLj?_)*d8p+F12EE>5-BiRfLIg0J+d31Fs@gmCH!&;?1Hy`
zX!k(GXE8EU*9SzY5|{(|&WhO4XZ*JpXRWt(`2YM^1SgaY+c3Px^q9}P9-Pn2J2&Yz
zn*H8ZiJaeKTiLn@Icjb~7=2*?&{T11Lubv)c@1<IeA}G^i4$HogA|Tsi-kZ!kEWes
zhhCQ*cidYFG?FA$`$CT}_O5av6Q=nUmzy9)8PHEV#x2}ZiD_wrRweckac9Fy2CzeR
zkHwGoFb0c$5yOd&2uGDN<=_A%5aT8JW2XKU3-Vry76|_(xzS?wx|XH`H&s_B(8KQ0
zx{R5=|F^hynId6CP_<(;*T9^kIW4$^C`Y6PT3u@5d6%E@Hj9MLC?0Qn)ryIz<Z_#A
zkExZQZZD7W`!`VO>5_meRW&57{i=m#z~2jclWHD;T+=w*twVxi#5>+C0IdbV>x;ha
z!Tanpu)_*b+)~f)U&*YL)=EmR&1{(5M?ddZ=4i=|W82|j+#@vmlt6H%IPoAzMtYTp
zy_h_DZC*fb_9Sq(#uAjGDcIU!KuluXEP?d#Lp<|@T*8gd5DDS%xa5S@iSXmheLt0;
zIMl}3cYP!6in~qI6!Zq>!$hlDCg~*EyNx!O*Pcl7Y=aeUiim#pZz5O-K;n*^v`95O
zo|>IC4P{q3ICnkeRoPj4BLl!S5$~@Wn7{M)Gwso975i~{u4k8n6g(3#O$tt2o)dR)
zCa=34oCDz>tM-k0Zo!2ozKc2p!Cpgl7hQFB*}^O>7&!kgf6qx-FPQQT6*T@Rm@LFj
z2$QEP?!Gr{%>arzJEKl?8Sk`A68060xjnNq>0HAjVsfzIe|J`GS1+c~uCLKQOM&A3
z>CL_(Nl_HxNtdEB)u61Wl&rGx+n?`awn@bUQYrPokjoyb>UfW6u=Q0%+=FnQiz@|g
ztq0BwXvtr^I}A+Uv_jYNXHPDNFKQN73#H*<)MLGltm#h;a@|d^MY-Q&A;|cn2pm$a
zA&Lv}l%_^0x#twI7m)^YqLSfBZ!2=}=!8~p71sf4nSOsYO(%yNK@S;TWVlFuK=edB
z-2{qe2HqonT(AI$=jc`_v{%FINh}P#<5gb4N5Vp~I|3s(#U!t7!7~zJ%$#&=(wOZ+
zEXmyCgILWGKYy3c|70;t6{8O~b>0=dX~;CsiwS+G0&Uu5Z@|!Wp>Gyu9gWDFYuS%F
z89h9|Rozs$J@v&>D$8`-6UBdSJVBqHAYj`vP?XOFw9n<bJ$Z}~NZ(~hrb_K)_HxZ}
z#p4O4Ii~cMvAL7^IyZvKgYepRSYNc%L_R54zl$EdvVo}6?0;Q)64v20fzmR8zZfV(
z$al`~qsqzR8?<`+2T&_A%puN9A0u$Rc&MssOIRk{gPV2DLnEG?cOk5=O$r1KQ6Q99
zW<IVNrO<rVPn6aOV-D70=Qbx*hlJQTTbWL+_V8@j7P<`W8&1k+Y~E)#Wm}hQcl|5|
zFqWQH=}V65adwB9*hpLQc<H(IDc@Y>Lb~ty*pDpG8T+*ZiQ`)d`X&o|>Py`-)ST;8
zp-C}F2mj@Rkcjd8?sPrEICzdX2Q9;(tKC2U_9lf#BID53?VBPtYA9-Kv0g_!Zc;PM
z&A2$CAUHy3Jh?fmfB@4LuYUR)?Eb^J8usAiU^ZRFo(D*_Awp|dV?nINjT!Qc*`jB~
zkzV7O&$hNz%z!}+Dul7i8TM=$$|^Y*w)u^+8F|DhENBNMBt?1zbm7D(RHqyiqp|B*
zGe<|RaWGjqlX$HD$jn?@%j)F$WK$J`TV#()*kwC9!x#m_z_~y7P~#T|dI$KgfJ;BJ
zc8<_rXUyZ({UgVrc^d0M$&~e94jgdVQ~D1jV}C3V!`az_if~7Waxjp9UJE^nFot?d
z7bw8Fb0>Vqj0bVQBMgTw<2T!t4qmBydwR$^n?Q}zGhO-R9p<&XG=^HTevKC805~5~
z3<eCbM$T1yQ~Brah2fkdtcPcxB>>5EH}DW0x)E;N+<)i#5?&*Ql%!1tQ9~<AiJ6Vm
z3k8z5rRrg2b<BykEL8eR7v*=wfwDWv4Y4zKRqo;U=Q=nm8-N{@$UOK^Ky16~yEY6b
z-RORz*JoGIIjnrHP4YGF+xH;LG*Phw7p+m{+XgxcaXs<z3IM~748;JMOEO2Z*SO}I
z5f`GcC}XKG()G8AzC(oS)<?H3#Sg7X5sDx7q{YzpB7};I$+lhO1<5AeMC*qdc!97c
zO!Td-TBj&qPk6O7Wk4KbVVT^qvg_$0Rm^s=%$ibVEx$t@L|KNEEoH3Ut9U&cWaDc{
zAPFK`fyho8eP!~NM#1tC#9<@_qu#h;IECCnx0htfHD3;s_FQZ-CHzOAIZ*~_XPw`d
zy}tvT8+%@5h^;{Vd;@8fub5<rUsrjdlsJQrEBgww>S5o7zX5WoM|;$A*}JJ-jCHXn
z(sb<eIBLJ8NE9Om8U@3G@+Mmj`al#gjZ}JLszY;jm+a6`lrb)rG?X%D9A2B4X1h@v
zajauZGvegattIs$@xUaPkdPzYX00+H2J&WK*D#pFs2+o-nm{0x7a?*fB%~zMYFiAr
zmjgi0C91eUy+4sLccURm4&s+YuD8wbQJym&r^wT<1sxhxzOIS~VbuDiVfH)ZZ)up5
zSgrmlhh)<Qo`xjx<_|(lALxEQz&^j}3?~wNOt|wk{B407^MudYa=ZyySKALqh<AFC
z^bYEhZ%^MLccsw_L*;kW=Em&+G(qL}s;gZ)&QGSg_y*|ZZhzsCqAVa5gtr4pq=Ji4
z<aK+@ns2Nv5l@3A6{G6Y=H5oq58RRNEW5VKkhO^p=85r$ySfc6!4Ner$;|}zA@+tJ
zmL@+|Bq_vFqFM>21eA1&yk23#%jff>Oud$pfTY~XjbvA5Cdx0;sGls8Bqvz0!jn{p
zw+AvX>z)5D>3q?KexM(lKZ!Fms#*2uz<B(oZQcf~f4hF*<&(vD!`G0K&S@D8G0f}W
zm1je?+%#4jr_AhW_7iFjpBzBZU01A=C%T8%6yU^$9ULyI7>hREC$1cSp_7C7%u%+s
z&4t$ip;yy=QTzH!rm_sf84&=-`9YDmZj}^5OVecLULE+|$1~qwYIbvWfD^~ipxFCK
z7&FQsqL2x96m+#WiG^1<Rga*)os(P6e3j`2l(~^q43lOg53`%6a>u3V-|Z2h_XQ0Y
z@F<<7rDaA}ZNCwtk8{I#Wj^GzdLwZ4$vwC@Z@8i$$Qex*VA@-exiufMQJHFrdK`_3
ze=9>jaNARJO27#tj=k%@tDu$Y6Yb(Eh4diAI5kOsPmis8U<zMBS>bch1VHKDUOVOI
z@>dzq2QUL9Kgaz75{K?s&-Z(<ZO69Kx>&EL!mT#fmm(K0Z0%&4k1a(=k&f9T{e)4@
zK$kjZu*oPAIx&v=lf~76@Ev>0HwF-ncNvWxry7xSv)%p!{lWBJI#rsTakSU#2v}|e
z-A*APi9Qmm=H{h)@7;<y4~c?e!bxbUfCPAVpO2Re)znk!3AQ46ZH181$QPa%&%fsx
z08!S6u!XLkgY$Km+R6^`4e@H>Q#)RrehhLGmO3@Vq=&ZOLjVM&`7K}Y|L1jNIr3=p
z6ESMSIM+Jch8H3C-zY5J3b^T)YC2f7Rd&x?EF@FBtdXAzQmC%_^=zZeZEAG=2KetY
z;4wE*eOEyos5}MA`!t?Otd&f3Ycj_w{G{HOy8FrSl}TWUOJ6i72RbBuc62Y<3}|oQ
zF)@x!44hJ5>nWq4CYc3T6qHvb-k(`?wRoVkx#uM3R{SO%o`AFjZUft5XU{kJf+lNK
zTffX$dDo&kjNmDeNW-%#fkLGw60jq}*AsS~(0Nw+jOx>hU1rGBpx?iT9I6PgRqdoJ
zcTI}i`zk{!puWPMz2~#e)p&d|nY}%G$ahY);(+d0T8@h>+F~UKQi&M=xfWuK%j$w~
z{59xE;1AJ@6*=De8`5$)i;_8w7i4Y&I;3sTv`q`1$K3(^SYgwU@8)Dn7g-WEk}3{6
zN2aNMur4+%k@Ty^O@vDi_38s0xOFP7L!nrsQ5uRSKBlDPI`+8w`{S%p2B+>aStJI>
z-Ey6`kbDZ~+>*5oXp%_{gf4A6h%_Qs+t*@~bl#+qoB^SIOk`{7m5!>&eH<yQhE&LM
ztk(+7-c{LH40KGEPF^>qx^fwh&FwYED$y#d{kXJxelKs!4}fxDexsBDhqDy4tb8jp
zYIw*xE#7idlWO;gUun-MqR5)@O+yWW$8LArgV7Pzj%Z-sBqynlC^Tw0fo?&QwA;AE
zB+m9K!IL21jhL5T%#MSIZIgx6qwGJ1tn=tbVc@_b1YXPLY#?F|^{qR*0R}f3e%7-_
zEF~qjzO)@4BwdoN(EQziC3fT6M*nA50>+u7uU=Mg6cP-R140xrR*|zc0G$k6aS~K=
zJ8;I@>tNKOVxL+-`tIFUPqO=AzO+?yImL9-?i4jGMf74j=J*a-f>DnrhEToU?waBs
z=_@{z$u^PW&kU@hJwZtEH^FP2ycELXP#BvZf!ifn%v`LZiQ?AX7R`8g#eH%9GuLlh
zB;El@Z%A}{7PT=!)R67?jq{HeVoLrccuD#Nc0W)DJPY89OPIU4hBC-;0VOmvS!MhD
znVxTsb@Ti@TGkP(sTswtAnxlMt&ac!T)w7b_f?Tuiw!k^Be)!zYWVTvye8-#SjtTB
zgq5ozG-1=4E*nIK=q4q4-0ZPR_<QI#cU{|GcE|iP@vSlu0fG@;X#>P&Lk>)6PnV|(
zekJ@o`M^l@SHToisn6?_x^RS+_r^Zkwdz$m@W2E?%!xLU)DvZP8&80ltFW$PQVJzS
zR<Aw63fAWysa3cLVs>mPX(`^oYyDm3@HUkM_s2VBkpywZR3Ju={^S*u0}LGSRj>ad
z#Z(+SaEGR)y*Ll8@`&Uz>U2Kf*Z_Z`B4L^3-;svS8wtvWL#81(3SJU!N^|y2EW}OS
zG<;@nVg~x`_=dUxU$pgiN10Z3DQORBI2gbc29b1tQmCt^p2tjPtqWaQpf|7J$Qb9p
zYS{u8@{W?9q9NEH8^F4gwfKjtHME<Gu03}aghH4RFRa}8Z3JhA#dz^i7qJKRM+yz2
zogMXc5FKg^&i<_PTWPA3nJDW{Zk5OneSN);##5W*%)i|NHy~&OaeON+#Zyf)5+vnU
zG~DdmH!Dmpb7SG2C=z<rY9eO-&0f6R+c5@G)(KrM<zovO{Xcu6qVSq7)BqzT)n65|
zo+UFP0EPEMM^}pJv=y7^&QdR*x~0tT0mvcj64F_5Umb<TTkP9#Q|T9~2jYYa&ry1X
z50Dxv5!@^o-sl-*OEb5o=0vKT$SCfn+kBDO{MFa2+bzc!%2eC|MU^GMsxt^utzs#g
znzD6ta9UDOB=!u%#5V_DM^}pJv=y7^&QdR*x~0tTKPT+l8kC_?kz`JVp(2(BeG4ku
z>&rcHl*#}LtO@@t;Kp)~mv?kH5_=I9zs+a=IH9XXj$T#o=s2&5+S&<il;uQkW5rtr
z4=ln9l6ve#JH2}*f?kDVdy+oaJ!UFh5xcBf>x3HUJC6f?jZMSmp&?LjC4{$&RM9AV
zOT*AmMD603$qdj)iQLysn56#K@R)INSkZy3zT8WNk@RL|=}sc4mdE5uNk~`k1VnpS
T4S@P)^|f?g<DLvhuOgw3e@_M-

literal 0
HcmV?d00001

diff --git a/Docker/nocoly/AI SOAR_20250923_1406.mdy b/Docker/nocoly/AI SOAR_20250923_1406.mdy
deleted file mode 100644
index 94502cab48d4a077a3028c98dcfdbe37e8308635..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 24048
zcmV()K;OSHFfcGMF$Dks03ZMW06+i$015yA0IUE20PF++07XMGLN`W1F*QU+I5jds
zGB!mtH#0RvG&46hGcq|aGcR~KbV6cGOhQ3yYgcV&O)z6sbVfu}HB)0)by;+FXKXca
zMq)HbK~i#gV`ffKLv%7TNi;%LSZ!5NdRa4JLNPZrI5smjG%+`COmR|LOJOrHPgOZt
zb!stmHZwO=aBE3xQDS;*W>$4Mc{gk|K{j?lYHC7lP)<!|L3MLNQZ_OxH*+>mPHH)D
zW>`lvLT+|bMrdX>O+!pqRW?;YWma)aa$!YHLTX`7b7WR>Z%k8HR%dxlO=40}a6)b~
zT1a|HI80hGST{jxT3T#+YIrkJcz8ihVPkc9Ofqd&Q8PtEbZ#+oPF8C$Ml@tpF-A*F
zcV|6#FjXs7OLHqLPj_%PIdo?*ZDU1JMnzL%XJ>PDHCSOeFGDavbTcq%QFUl*T6R`t
zLrGFlcx_r`K}kq7Vp>ObXK8nMI6-Y%N_BWKPHbf}VMZ`YMKE(zSvPqwH#1OnZcj*6
zD@to(MrcV_Rc~u&S5$g(Z%0QkO;J`kcQQC>Z8Aq<PIpi?OEq$BXfrWdXI5h~bxct)
zL~dbnVO23PXi#=qZ(?^rK|)SMOiN)+VK#DSXE9?%PGm$lOLBN+baroeFnV-zHfU>W
zNLo}wQ8rFzRWVCvb~#cvS2IyJMOI-;IdyMQPD4#;LRxxOLUu+oFi}}<OH)HDFEUJN
zLUU$iD^pH-QcFxpL@R1oHdu5|Y+*QVOLI_SF>o?zPc&jQa!o62W;kj=c63B%FEDmb
zS$cAHFHu-yPf>Gtcw<awLQ#5gPkKvvQ({LqOImShZCOH4Y++bxWLj%SFj7KKF=H!p
zZA)Y;Y(-63S7LHfZC7M*No*^2H+fVxIBG9QV^mO6W=nZlX)slGQc_HAW>8HsR5xNP
zOl3=CcS~<MGBjCjVOlh1M@njIHFj!5dQWXDQDJOUd2l&XVNqgmW??ZzI5uKhQDHbV
zN<(%>Wo<<>W^P9@ac)*Cbaq!yFh@`~VnS+EVq$VdMM!IQWoavGOj0psQ)g^wQ+a4F
zX*M`yHdJ9}HCRqWctJ8XXJs-|aY9Kkbyj3cL^D`tZ%t@bb~kD{Y%z0MIZakMIZJk9
zX)!ZudQ4M7OlLAPcSvnQba+Nacq@2tIBPXDXH0QSNnuELN>n#zD=}AhMM5iPG;?ZY
zPj_@QVmEemS~+boK`TXZb7V+IQ%y2WF-}Z+XL3eYOg3zFZg4Y7NK7wCL1K7$Wi>BD
zF=0_rD`;0oOEP0*Mn-UNFmGlwW>G<MZDe6dL{>t0Ry8y?dN*!&L{m>hcT-Gib!0|i
zM{-zZGfYu)P&GnqH)UpNXG}M2H$zTidPYucXlXN4GB#3LcTh@5Q808uRA+K(cylyy
za8+4uS9femZA?T$cWrA?PC;u&M`dSDdU<6;NHRiYLPIt-Z){CPVQ5rYS42Z^QdVzR
zSYj}BVsBYbP*g#5dS^s-RzgB$X=77uN_I^`W^8LUZgOU5c0+DBPC0B?dNNvPMovmI
zY&14GFK$*cK{ZcPd3Q-icQ9!&cycy$YI9UnW^zbMaY=bMMnN%Vac^s5OgD6FNHAe<
zWoKDbQ$$!Rc}!zUOnOpqdQ~}faW;BqZbmSAS$0%mHgaw-YEeT%P)bczLv?XgZCY<K
zGgL?`WHmEccQ$%hW==;>Z#6hiK~Y#pd3h^VVpD8yHFQl=QZr3wN>ONeZA5otbvR3T
zZ8l|NG*L`UZ8lM6Q%6oxHdJsqRcK6eR##zgMN?8@MO12GHfMB1IY?|YQc`7faY}bV
zI8`+;L1{8YFimebQ8Z{vcS$)nF=%!#OGa)-ZBBD`a92}CVMbwANKtG|dS)*)RCF<E
zXm2wyS#NehdP7T1W=}awVJk~kX*N|<NLnvMT4_~UX)|{=F>OmwX=qYTR8M$sO)Gas
zYcz5-XD~u_IX5w4GD2x(M{H?GWk_&nWmG{qdT38+W^OQZHE(BdL`7$7FG*!#a9CnB
zFlIMQYEv^YH%N6<a&JBCb)W&~Q{dmL>+vH=3r;=<P1fGC@gc2A?cL*WZz*mI@DT>8
zLa^EESGt_)mI72j^8&##`G`Xn-xC}^lH{6Vw3rm)-ACRu)qtxXeIfI1Q6DepI-SZ7
zY+mpKr1#TE0;tcJSnNN=q1^FnCKyTIwLIR=M)sDx4QyaCCa?k}f)=8yFx(PSzIF4$
z2;1r;5$2-^;i?D*?eVb{Zf^|ES(DT}izxxMI2mXaE%?5fJ)AhMO{-(NjWa&dCLV5e
zZW33>d0TJ^>KJ?{U#9GK6j)O_-?+@uBl${G6SU~%f2BfMYT>96csM+EARR;#VpF=d
zSpF$}IONt+H*pBTGqwOtr`dD3#v<)=!;%qpI3ik;&(ZLTxc1YxLKKfOhIUWskrn)j
zQfaAlB)SNuczuD$&K55S$ykr)1<j9Mj<rph^hZ!`rmU249uXo~dwYYYX6#TAdv&r(
z!B7C}eZ~JsjdB;zSKT&IQTPN)Kw$aDj_`j6R9EuJy-)n6M0<trf`Y}=!`7tZ2U%4z
zxpiU7Q~d41lwS5Ln(R^^TO<UI>%o-gt(6bN>nswPaUBzOU$Z`b&<eHxg{?&ECPfiX
zCS^#s*Nkuy$#!-DL%O5pH`u}uyt81TtR_dybm(Q#52?iSSU@R0E#f&_5QorrW>xT{
zw5xij2aVc{rhh84M_NfKX7~ch^BATOz0jYIo>f-4M7hw31>C2KqY#28e>}83DQo|b
zzH1qJtrXZ?wv7mh;_R$l?jo<i6uCC1-YEDR+{L@P3@>jrFhmdjDvDW?v%WejRCgfu
zhE21a-0kZJ&ajK4^nko&qKwPpGvK+$n2P<N{z}eZfYSO6zM$y8TNoxF(gt5MCAAQm
zF7rYmGRQkNM^;5BQrq})<N1ic@JXs{^y<-8qtQMyO46cV_*26=!W8Bfg~X4g)H)rb
zs(5#k+JIz?q~*j!sfDqDd|~Z8GekSNV|O$dS-i_xrteW94_Riq{=`vUr(M{L*BXLP
z8fPzbidPuPkc%^wYgzAOBs+~uO+}<122dii#pL-m6FQ_kTqEA5PSL~5+oI(TI#k6(
zS4Rm05+I(FY}<vWiSuUkfH3y8#a8El4cFec4VG~KGT`B796tjZX$9NQdXO##hoy>@
z&qEwf&_Qb%r;BjV7weE4q7&IO-F#QU<$k6LY;f7pq6otj)-^p)lW$&g3?<CM0R34^
z*!vzb9<i556@xE#hE8K1^$$c7s4GQuqs(#~r*};sTaVa3-qJ)2N_UY*CWRfZO;=EE
z+Iu<m=JMhbXX5fJXDayGTCd`Phvut;3NpTt`$wiX(*46te){Uw(c}qCw5Ev50bp4w
zs+o7AB!n@6IW9y6L6asl))}uZyY-Rm5%#MV_B^e1agpbk_%h4C?)Tlq*TU6g@Vlu&
z)6V;z2ay0AwU#R;wcicV`~{l~)hGxSN4NqL*FK+ZEJ;$eMgh-$$M>OL%jK!}WlNxq
zrgTxX&KE0cTS>$y!Q?CrN-g6U&@NZpYV0>H8C&EES88R!Ui6Za&dkvDp1OproAzZw
zusp`|BGyFrGSv{ZT_OL`WXGx4eeFwH$n72ebU8Mk@Uyxywv07DJK9k&c-A_gYWA~z
zwu1Y{aAidOn+#;R=d!C<1f(<G%?44%BZ1r?!aY+OirUPXH65owJ7FZ%v{j*#vn=oL
zoM-VgBx2?Em3m;k^ks)2rOnx*I7@2llD6bN^RkDc4bEu6+RUHT^F-Z5x72HNIv9KX
zOhXhw){$g^DYLE<xVxJjKy<a@w-`a*4=VU@Md4obkj(mC)UcZAiYEbDF)C`;@t=hv
zf5dIx%K@4sFSu~N>w*K24_(ThqWv<IN{)cr`HTn^D?<)4nQ<zmF4TBYid41?u9TzI
zs0cbF<DyW<&#wvCGrYLkgA9&j5+jN|Is^3jt4TVX-}g~<Ns%qcj%&2$0a5H1tHuU9
z|C$@wTHlBs<j3<+eq-==om_$EHF9Fc`Ezw14u^x2r(y9<?`en@&;TGdhOT#8s`wSY
zu>sHbd6(4k(%jFM36jVVn$<EU72*Z|t02!5sYq8C^KBpHwNIOEl7t|=jBO{Y@-|jd
zhO-IaFMnmuf{i;4isNFH**2s4Vi^Wq9k?Q`c4!{{E~20{eTWv@z*s$A0l-LCjrrOj
zgJQ7y09?cJ;qF!wqBD74wCnT8zDcVKFjsMRXY-ow`h?!%Z*=O^jIi}ghDai^)K=kj
zZXkJxLtT7YjCZA%IXrI#PNY9hIo-V#fLrHh=|Po=NA75HmckA3Kknl%Y!JiDd)UG8
zil&~rs9?s_5IZ2rZ1jtC3_jCa#`NRUJsbOO(9IGvVN(t+pcK1aT4Z6(vmu{7S-bOc
z0ut*(nB*N0k1iKcMN?@lm$6x_`{I9?0%@WqVHfD37?(~kFf@VJc9TheO_!j!ooeSr
z?F5blhaOyBckb+pyLl`oyQx3$NEQ~F^O+PZm0X7V8(@bW!=GQ96S~5Q%4}OXS1{iR
zxn>T&%u|7d$LbpoJO_<nJj*+%6>JSz*jy<x`A3_)4|GbP%TggmH4p+O#_-&KzmLDY
zP@NIZGbnTj&<1S4X{ZgZFyJ`H>oX!r^l+qwP6;h2Uwa}}@x>)VeI+RjCK)nGImmr~
z>XPq%C<t!&#H8Ezt<U?xZ^>D?jW?FwYE4@s*(E@UYY)aNDXW*TAOZS&<P@ek45L22
zkitAQ1zjXV?Dzn3@+0svHYYbZ(87?Zkd?BtP2b*qkD*B&fVi^J?hn9xQKlb3n)E~G
zx9JFvpAWT#Sae`6LVV5QtCChG>~&n6XTR9SAGZrx?>7L@@48{#-zA+Rq<Y=n7hO1p
zicMi%cT9vIXk$f#mVqLv8FiV&0*26M0$Pe#WW*{H2+vHEYqQdm-#1klW3O6SqF6XU
zSeH~k5MSbyzl=X{dnrQz-C_<v%B51_-BA<6an9EQPE5$NNyth?LVp`&{1oK<&1acY
zWKP<bGiNOR4dkppScD*n`-;T=)fduB>!z*u2<`T^{UyZxL5uHq(<_>#ChI7k^NG0*
zm-??_TayFV49vPlSV1h{+L=wxth=^94@1E`NqK%({h;`q8d;YQ|KyfF9EeZ+PBNc;
z<^EwuOFX4${J^`{h_BKd^}DB@ow}Vf#_=a3YoB<_m}*Q<C1MIcIaIal)D@*Bm|Zhp
zbiZVb;VTICf@urnlvjg8fkKydBZ|SeZ=CBYi4LlB_gbto0nlsuS7m&0X{)j#+N%jb
ztG|fTX?`7q1DC(=3!d*YA6N2))FyTfeglO^Ufh2EDbxP2lwi3IryAGrZ(fZ5hqD7*
zbu#UPcmd~{N*jK6c(>`0D1u}nk5I&NDfWQMihLVPu)KKNBMb)a-7$`f)wVg@UcpV_
zHNj^$z-A6MAhGS-s-GmO2V&7G6t@+J#)yniruvxrkb-N&^Ho;aVxVfwXVql%L&+<)
zu|mi5*XNA(mdXZ-NfE{ty_QI7T+O9DZVeV`E75?wUU38e*Dxz$N)0mI>3jr&;tELs
z^16hfwHfg@K?VL3-a>ql>~oAlS$~Mk#f~ZCdTh_W%H^c6{~`dgXH~5}JZdEJRdGEw
zZjkf8HOiZ0PRNsUn)OaxO(0)M0S_$}p3xb3G}_W@AZ$#C0pTiZd3WW<86R}ivgfjv
z*64w`E{@gx0NzP!?C2$;Q-jR#`OHQh?Qy(SsU-Yx2n%mM3bjMRG<&OQ>UHFYBj*9t
z=OKl;fADEoNU>+isv*LJ0sYCg?fI~aC9~*K1!&ZjNKlygrV@XSI%ysi<844+pj-Bl
zQzKGcZ(!vME4A*3vCTWNPFe3jhJ1y@Nh$n#n-{6yKDAyd0Sdl9Js~;NJJXOW;>%>z
z-6Ctq9P$k6Z&)=P1V=E{yCUJYWD*6&xxx$pDzhCMN(7yjfq!I#^@2X#Y*8&k*o##K
zO}=tuF}6R%_=1(8oQ0=jPR|JhX29*2>k@TtmZD^#vrw@#w#^$5ARShk5ia7EV$3?R
zAr{$6wM*xnXP-2HRtT?WWbHyj7Zwbk?#6c<zB4LQ;yZ+7GAhb~;M)-v9?`fhW^``i
zc>1dKopZ#^^mi{sBfmkPJRDm^&&TT4JAB_rPVlZjxb6D-bHS3$DK8u>aTTlzLRU9}
zx|=aEpQ~0DPVRa~sP*tNKqd*`>wus;HO#wp4`lImJeMP-U#agd1LTBWrQ0hoS2q~p
zbD53-q$nN~YrOju!{c|ZRQ^Bc=b`%UFfU}bR=g+F7O=}A`e+{O`Ch@iJBxw>Q=uVy
zSz5X6FKPXAapw8C0&{I&Zq+BG5WzP+D3gi-RFx58$&@_9_0VMT;KvTWMMW6b`cjlb
zHL}M3Xh}qJ2^Vy%q7A2cMn3bnMK4zR{>uqf=(t$g>vFj{$zfAqb(KcTUy|N4fTv(|
zDoWv)&X=MAW!#IS0Si6mwn9|;N1|;Fc;I;G3lq_h=w0A=yFxh=Nnr%XcXpx?F{%a(
zBMsSe_1j%a{dCqo6EB{4QJ%FfkK}hq2L6Xt*Rr%WJSzdOQl58&>da~*qXCu4Nq)WQ
zC07}u>s60v3$siRc^moMvJ*Bw`Wh*U^5QO=Pi^DF7+2VERphWDO!2uoqiBrWvX_iA
zZ-j$HUdZCme=scrj#$pyo#RtZ?Qv*6o5U;I#`DCZq+&UhnLPMCuUsAA;Uk7C9SytD
z?I9p;%J6Q+jU1*FRw!*xc(BAxN@QkPYz+*lR=N5~!)nm|13el#(la_+kw=mZ<E!t}
zfp5JAtoZd_7eLengc!*)V-}kLbxiG<dZs|X-htJxH5qNE&!&L|ed}&1OfbY@+2o%)
zrYG1az_^kOg*`~|`zrTch;I%%K1`kT0)8LXOCb*J1mC6>zszUd2g+BImFo6#o#P|k
zO}!)P$6!?ty(mg^QbYK+IAlflDUJZI-|u8@r5&$MOy+I>QT3s}0c%Sg8b*K$U@PY%
zLcGR4&JdO9>cc&|MhF0Rm_3)H!0(-jXo=J{Fm<K3U{5wAx2jcKo~sCuo%T2cp_#?C
z7UDF3>TaF+NR*JCoW{xLh|c>qQV)(4pZIQHO~R*Y0C$}xJ$r5j$;lE3)%hF+zav?X
zh=Yv4_hXI>|BvRG>0@!vEDU@?(9mJo5wWCSMXv&L?J^7{?RR^HF6D{xgN@rRs227N
z4W%7e>It4JDs*MJ)LYXw?_%bWrV7YU(w``QRf7Jj_fbS;4ElwEsvzlk0J!)*K{iYG
zW^l@PUW)Z6zMyd$LTaf5J<-C1yX%z&fzNjJkzp&Ksqy1hnNdtxJOuD;?n;5b@<>Tn
z$JARbe&8T@OKXt?KL?FVqw%QWwBCTwJ|GVQ?NmAHbOGDu7)Aua?{#Ze0JLA6jmHCM
z{De=3K$44%F`B3~F6-`K1|^ppidvw8T2YQ@8w{90MONf({|(0~V0&Iq-o8u@`4~NL
z_Jmo{5=F)CdrPGF=@+a%E-j*6hKBh}&;`qb($lL1-Kf7~5>dn98<<DKeQTpRo<<7v
z;>j3u?@b1)R=jg(?ExT?F8l&hg<f&X7yP?JO*Wgycs~Dlqj>Adk+TQ%!u2*C@HoY&
zg+U+Cl@v`0A_fhg*DMEQGQ(U5N&aO(BpEK_-uUZDI|Qebh6TIT>PglgRlo;Lns@t7
zP<;z<Fi>qwG=yPaImQvB&U4!KctY}OoBp#eO1x-au_rRFJ83Edz30!20{dHJ6`lL&
z&8Pp^v77#sw2qCrXUXAV-$=y#_pBQKs%wBP+YYa6pOqq!|21t5q*GmA$r@|lS(&N9
zl(}b04wUQkeuP=BXDF1q%*50MPo~Gf33#^jU(%}pBs_k=lPq6aL8&a=+&}RZR`j_!
zz1V@LniaNNnLw%HSR+WQb{-kV4vAlHPqJTGocb0gU;|xR->1a(?t?SX6u~f5=lU5q
zFh(Zc=&^m~!7{l6=8Ok`XRuvt3qp5mVPMOw<{04)VwtM9<c!2u5|A>fIM8W-Em4>@
zTofH5rWGt;tSgQ(o)BGF2@&TX{myUvQg;vZf9Mlz5qHpT+Q-f`&hIc>d~q4MOzGU>
z5PX4a@jHeAGzj=t)D1l0Ge`2c)!&_T`X0wu%{t#oD1$I_5HQ*K>87#>Gk|?ag+Z5o
zU<87X{A!XL)3n#$P!IyS^d9g?xc8grL{5xHZC#7ne5#TU_}=~RzjBlLFvmfHn8gg8
zKIQhx5QA<YcxM!fsQmCHOeT!yaqi9wAcdfayRSH;xvMhF<X|u5oO{vnjY>G%h9;Xt
zI~^4+sC1Z>Ml-#z1!WS+EzGY6QXSlt1PSzB!^=&GRDI_l&38l9^<ig3#ex|Xf(U(O
zgv%{aQWFYy)rM_{>C65tak)xUZz3M{@}GNmE>8=1iST`)N0a^M1zGhP()pVdzgKV$
zKUV2mr=>_L)UzY9Yr=Tah=j5?Zl|d}?#gB7g<Z)^U@6Ioq4!$XExsrY>bKc=Qf-6H
z_??nyXA@rM?-A!Yo-_rg#@o7#&t#uoNvmYjb^=Aqg0~KUSmi2z4&FwPq7(FP8I$&I
zdM+I}6+>%*D$(DLUfAikez4w#UUx>XqY*Up!useBB;K{;u@Z6c);AN2@H%lAZOozb
zdyMX-75xye&aGkOni2;4(DdBc-JTKi4_}e}mN)+uLLhKTzh$3A-=)x@&lc4bMvEi+
z=)MdWi<;0(9WcP_bYl-3pW>&Fo`=5oaIm@9KbbN4{5)~~DOE9xH=4kG9uUNx;2lR#
z%i|+QR|zLavEM+f+l_X1^uGd3V=aMCW{vY+VCj$;5zMm9jewPds-9;ng2<c%Io_lx
z`?U-{xaujhvAkv}<0qOo&QGvGQP)i|Z*Nfq=k^>IA^))d&eDm<Rf1Fo_E%Po+zm3!
z%UQHh9TL{JBoSqyc@OURK@99PB6Q<i1qi^LpxOp{%Xy0mS+l-8H0|%SduQPEEhG1K
z$VkF_Wzg-$2f~k0MRz+~u6mCkZEJ^I?<j3QoIeD?Bs&bz(v-xmwFx&~9RDW;tY6-$
zWjrI-+!azOiC`ZE=VjJkE-ZQJ-K@~L%NUl9+}KWOPZ4N))*GW-2$_2(PF5|+Y*^Q$
zf;`r_pN`DQQ6_>vv`3E_x9e`~{1jY1u5>Cpf~CX|7{iY0uI68QO$8>^qdxHWrjOa`
zwGe^2fur463QnW!0uqbT*|5&=r5=6JO{#@xu_#;*6s1=Ewt|V_hxDYzz%%9WWj0bG
zrgjQ;Fxnev5#ee@Nmw*SfQiFO+{_*bpqgU;w(EI#(+0hZuQ7Ls_Q;FyNjmza-DJIq
zAYlubl6MM^^1i&T#%&e|YmvT})S?7PL-5-kzFUaKFQG+hG(eKe_(}D~4;~#Zh~Dw#
zK$)mFp68zDp2&d7OBvj|Z-<5F`hNVmJ7=)8s||Q$4lXXk_6k?Pmu5ZIWxz+Pggt~A
ztq%ckV{n&$r4t?y15`Er5NH`y3m9&zihaw-;IhETf?@P>Rn~IrUMaohL*R;`w;l4v
z1>69<lQApaZg3k#Zj~UrkhY#7)Mda{!RQT0e6n^`|4@Aw<)OGAb@+e7(ay8vp*ycl
zH?Y65q^3sA7kO)3&%yXA*`a|bjjD58yGu?^m#0Df#}>somB1f8dqe6(08?x<rRZCi
ze4qn8V{nuIiN5_^M*P`Gr$QB!DC<MC0RG!EEnAxSoX}RXT9*=8XZBQdV!RqDVhtue
zxDk!?FWpUgu`YvGyr*;IP|WRgA#hL{kQ_&FIHj<3e>@OLBPTCO`BJyd`c@Z_v)(YJ
zh{dF8vhsp*CVc7MzXAx?5GBU7W#{nfe4$Cqgxz%G?rzFgl%VriA_IUpWlWmQn*EWu
z(KEC_rQ%tH%co?j;w^H5XZJ&lhjo<14T(Hrv0@kWJHF!;wVBO<Qidj92$Um$sCxda
znQR^x!_-y>&zBsllZoZ}3o&gvT%8(4kOuHNo#SP<_E1{0aVftOrn1QjY__f8&Ln>t
zY<EoOgW1rUT6?^hu`-Wy*Q*jJPn|cd6o_bV)}23A*qLl#jD0`er*YNUdviJ2H!GX5
zr3}U$=vdEfs1tHJ%-qw?Pu9G_&<vk>pX$KZ7eM6Ad9h`75a>&<F}}XM+2V%oAHHkb
zqMIVj>tB9<flC37OpM+97U;BN5_>tSFdk`o0n8ISNC3K|eZ_R11bc)WH*2lpImBC7
zIaL<B5Ba=iDKg=p<r7F5$c)-<H34H0sx{^?9YLzG=jp|a&W%G_hGPyl|7TM%HNK;P
z)mWK9iQjGDLlX!%%0|-%8gYk9L+g}S8A0xOcjyt?k|swB2z{nI4)^rJnmq8?L)s;n
zx;Yo@KPQ6kYOsn1Ixo*?tx9uQ1KrMVwf1>Q`HPLnJzZHc6I>2EbgjN=JE)Q&XJITd
zJ1ri6N5P`yi;?Cx220*Bompsw;Kqx6cwz<kNkZQPpsK-U{jz=d+7c^v?b`1M)gv}X
zVRja>R)GQElO|RWKx6+_%I%6p6Re^|5d0f{8>G~rA3>~xwyx<}va=^XMtBmehX4Yl
z(0=cUT<5k$K?TK?y{u$@pEuin?^El3N!C|=I3~KIkWSaeanf!6`j%$jx6uN6%b^Ml
zIQF!3@b8Rj%<!q#uOqMmmAmq>Ske6*9wa8<y5SI4oHRK`;7(htnyBR=wK!E*22SNM
z^W#YMbJ7A20Tro-G~yUrVP@EOLo?Eh!QWo$BvH1JRGMMz_BeZ*KQN^(#6S#cjqZ)3
z0l)dYTk90vF*x{$NASLS66i{aWQLa>2PR%(bRg~XG_8v|rA5Bau7Hip&=TpPMZ~62
zB+%t71wtNX1DFYY`lslTKr+>7Nzg>ew9{rhl=!8i!FJdh?=Znb$@>nC+^Y2Kg;Fxs
z#c2bKmU7EIAqGDAC?&Vx!7PSLJ59pYu#s}oC2{j?_I9CD`YM3IdadCE*Ynbhml!#*
zipmLP#T%p(DVZw*0aNscm^T34v!M4lhoWkU>!{0pXcm+MSK+b2V8VsMPTnUAmWzi=
zx^GeB(0b*14AdW{64%X+ZIJWjkzscJ4|A-C08H_gdh(HJBZ$bNyq?A}sAN*0{jNn4
zIvkmMshwml0qwZy46nrM<t$$0b^oy&hcYS1Pb{-2vo&glxFIBZ??zBhI&Ds5gaSGl
zVTNA(@yPkX!E9^@tAV%i6EcTXe288SM%ykr1fz0K=C_^cJPLQ=ciE`cYeNIvGRICu
zR(>Oe?FftEkYk`={J5m7UczK_&4)LJRj{%pXY27Q7cpK+dwtJ#InZnyi3qnT%TV0h
zEW-mL*pU(G9`?i)-?|6R3yY^*&lJ58_E~TQf&Jdex>`t@C5?5<(-OG%@$4+Le!YYj
zm%vjQ#t8(XIpIS!TCkI0Yi?wf=I0p>6&L~5U2VG2ZoHz}rZ0^1LoQP`aAcwjXm^3i
zTYkU;rda<)6boGGsFFGs|NWQRl`p@>S;^_tG@{;x%7PClLIfs&wPq*NmFPbd&xl-1
zc!fLLBzj$ouI*`9Pn``#GO?xN#7}$8T5at)kq-DFJjGmgWATei4o}&JI0+umeABn2
z$Pr(eU90z(Tl);Lv+tswS>3A^w5;AI+TxYzX}{cY$WlnCQB&m!Er9**s)(E++a3K0
z8z3@vwpxCYIT0yXn#Y;zKnR%-d(2*pA2ssf+gPizgRgMbMtYxj#YQXqZ}sdo>9sKK
z!XxwBy#s&OoUy+NB&FwONt?d@;SqbEiy_Wblu-levMe%qw~w2VSX~!DsY}**Kdsya
zl?cxm7&7Q%DB~>(-{(`n_~cSDn4^<{Ajf9~PN&38uX~>IPWu*m!F(6LAAcV*2t{QT
zryj7|({fu_3femTZ@Q9!2F+K~w_C{?u<FTcCZpQgSVdA}0I-~V^dt2j4tSDyH7x!k
zH@-_2kUS917H)a@aR#IWk@t;?tG8Y>3eUA^Dc-<q{axnpHkAbT$2(;_o^K_H4$0@X
z%o1Iv7OUh6%L)5vTfVu$4FQ}UH7AZVuFbh4v8O`6lA!Y%%onGHJsCd^Vd2@1fOLIu
z1S>zOB7a;@&1oBZ_wfoLXK54I&#{=Jx9aN?3X{`hIt}_}uGXQ{hb^>!$#76AKd7r_
zLe<j=a#gJqXO6T*r!7KT2^Dw*b;0r;!>)2EiKLl8G%-CD&R?uz5B7dTYWdI?il4^F
z4oUlGs=b)ClCF@pYJlhhh7ezp7DnarwG!c4g55D_=bp3p?tB~YD>!4-&k?Ug!iqn(
zQ6)v*>NOJTLFb*LSHmbqXSJA`4i7lNPx~2zK6!uGQ2*{xjQJ`~iXP>y%=p3wCHy+l
zfEvuDWS1C&nWnYNFTtvXvbGAqE_vKVxO?LG)wVVdPhU%^at~6iJqfGlsAL)DxLnVc
zh;P0C9?=1-s^rx~P=K%%g0UvTIZnYvsQmVjn}JcssB>&7YxNIl>ofyewQK!s2Cu`u
zGcOVrr8-?anj$y|f3=CJYj<pIS<hb%?txrYHA42Z8Aa#nu?F3tC1MR09khwD^rB_B
zUiN>E>V7Q+Sd)85RP^~8V0#?Y?y>tv&DhZpUa^?LaNQu#Y^o*=0sE54#jnMPn7EhS
zF4HchPxt;MA-$cxG9u147?GLRXv_C;@RQf1!7YS)hAhO2Rt!98AraHof9oY#Cve3>
z&_arSXD+x90tk@Y7e2k29lX}dnj5s|T)?juO^~d%RG-$l-!Ap}AXwV8LQq|smg+mR
zn8y@QA@rzYY<m~C*umnl(dv(ckfVGX+@UzRkHVxiTCl;_kE-^z2Gf4@)e@rL30H6D
zV7iDq%}Onr7Z@#%73C;c1st2lxt{#?CgpCgZ6gG(FXy~)h8Hb<9~7BNaVE<0`>>58
zS&=luaN82dh}7A4w*t(qqVQwKJ$>TKDxh|*`!~w$_$|$BR9QRUZ+nlkilVtEfS}6u
zq`uWMk2Z3eI&^=mdm(E^U%dc<Yl@f<#L35GC|>6IeP$2uB2|+d%fIO(*yL2C20+)x
zgkmM-xvi7YHm&=D)KV#qlP`4nRlQNJ9sl)_ftnWWto&bhBz_9_o}EjnY?T<Mr-x(p
zy&bF_j@*~vUH#8MvAar&KDzkS8Zhl?0CqP=BW9$&R{*<x<@i6vWa3z63@X>G=ir6i
zj<e26IgEL|p1_q4Z<~v2szjY=aOu$D{b;QHF;$8C9~bng-1O?mFmvi2j|$^=XVe6P
z&^?TcUq|_Ab&R+l{5Xqdj7~`}$^WEY3j2UnsD_H$FMj1O$wCmeN)wTHkVM+|Hq*$~
z)-$>=eI@Pg&#`)<gI2T0vPnsIsBHW?i?4Lo3_(bN)^lJ)+oO3E3f`I9?{O+c6lel)
zn?2;gL2>S#LB8cR+R2Xy1KKrN<VWKtkGzcTnDM=$7S%A5k6-F`U|;;7JuMM+x{)5P
zgHv)Gb@>RI@mH|cRgKKL=`*AC5tAXylhODi>zUmGM9AhY<iD1Zn;$wlETu~&jt}0R
za#3G_$PFrpa;(F2tdan{Z!fpt<HyptC(a7~V@bn5SG#5c_XqgHy!V>8gZf(ua{puU
z1`2+>foxV}IJ$2m=DNb?SajHWjJW|+((PjB&r`Ud>CN!c0iMS+KsP2aeExVuo-*93
z;^jsI#{tV$yw2MKk9IeM=sRfj9)K{8q-cDAq(+I3V0OhR5~)TX@F4>&WjHgnK}cf2
zxHx!Y_T3SG<seZKvOR$1Ph^Z4YCDhi5*|`E+&1qq0P=^Y@=f~82+q>AC{^0ocD%cW
z{)?iWzM7?OXF-+Dt?(5BSIA?I<vbtfr^@f0XGmjZKKz_Cvb&Nl6G;ocSdYz-;Y*G<
znRfp<poL!QVaXm&Py*V3kGu1_)jMp!xWm?g`+82ygBp5l4`nT24!#EwI;0NXNY5j@
zr!BHje?yzf5F1RkU_g^2D$g(Cm#0NisNRJBm`J+!NWQoy(e~1ZPd&YhqWa2FAu24@
zOy(pVc92fDwzx}qh7Bh;<$6_(pK?@%T^>Oii7(=q-ypc`nbT*qoPWA^1f#r_#E-_v
zcIGbcH8e3D7|%`8#xEL<BjJ7XD<m=P@hLzVh~*HZRMd(B#gU;qdkaB)2@!roRw9fj
zQIthE#UC+f=xXNoE|cE`iktd@dby+yNw-6-${mlf!7#=+3dH!M-~>}J67l~KZ~1ZT
z6i(Wdn9RSdur)3#M#AH=b{^C|7cbAZrH8l=jd3Mo_)t%3?3DO^DKpHDIcYPMkvzkb
z*g2iXI%N|m`Eva;?Cq)z1s0p3XBddzmP__HcbPk(GWg~t0Wx@(<RW%9ruCWi=4I|~
z+1$LI1vRp2m*fXU$g@J(DpJ_aL}##o*Bry9=ER7r^Uz%B2r~8I3guA@fKv8EZZ9IW
zo3+<I9?rMfb|&MprbnLaKyL#$l$|{4AV!kXPsi+w_E66JOG9`;l`mH*I0&x+Z3m}~
z^mPDJ?jtGHO7a>rlehn!iSPk}erx?7)qpyBMI>=Bi_53o1>_4b5Cd}=C^036LimX6
z)zO-%0v-!9q6_3a$^A0K=^{sy{AMzvy7}1?2-gHs9w7n6gi5Kgw0gCUq5wOZoUv}@
zv!RE8=0*(`>@q;+7G;|oTP9R#;BNq(qzgDgvf}A_G75KzkD>;y$iJboc!XiSy;iwL
zcs1#6n^1O#-5k!m^0q@7mh*U{=ZN8AVFN@!PyJ?F@OR;iA^U5-xVWZ2F2i3x6!4%R
zjv~iBg@WvZpi;p>+Q9y<?^INxo7;yWiCwb@crV+iieY{5P{L_GtR#XS3YW9Qr%aYn
zeh~I<Z@gS+uPNvCisu$ez9CZx73YbcBWYJGgs9-hX1sQ<f)>Wc9ps`Df$^Hg0A1xq
zYbt-rM=6bH?froJ5gof1<?Hl#*IpGIst+KD;hW;41?uH@;sD3f&E}s^)=a{V7aH}`
zfBws3j7fbWB5%rk%7?^oemWpo#KaFdtdD{aKqo+yB0wzwd)}R}jJ|a53^7QM7PU1W
z`}##<iL8;_?@-1ur*H>T>fD773J-!w@BDoS2ihqIOu~WJHQRPXmbi2iXkQj@1nN1I
zxjuIS(?rOXX|MR0zG*{uXMK)a4<&BS>L{1DyL5?*pSZCA&`gLYI<m=9Us1WINmQ#h
z6$Mx^k?{aaicmWRD^|^?7XRWhKOz1?Q@gtLyKfh}_!FVmk%-r^**9W16=R~j{@|Fu
zNBZuIM4$xuo}07*)XdNne*g2W*%Ku^E52mH5m{9}f#kSm4Ia!NY#_*5i1Qu9D)%2q
z&;YNS4zXZ<;v<Y>H=YaI^ocHlpKnPT<i$dse}$Dv=reBG51omZxr<c?U*+<UoLjWj
zP>)E(^Itq!pX7=h54F=`&k%;nnlIr1p^iPyv~FAbE4uMtP~>G4M{q9JWFSCUf_T{Q
z{Sbg)F$Vd6dI$Nv5~*NmHy_L{t-k@L%gr<)#3X~43u{7*uE{%4Ll1K&$DuO!{o4sr
zIB;n@HqA7KG!R7ZnFWllU=)*|*6K!-HK+FqazgQ)7JB9$x|4SZwd!l@8+~G^IJcZn
zw-8YKL|eZk;my(OgUL+Wqvc#IUPNXh%M@rqa7ssc3I@NlqNBoJCZ!(fJrGNpxz><(
z)_sASjoPV0riR6(_tGj~YhRs5#;JVTqSHZ*IGhjyG3bFxL|aZkYz-01D|GOT`*w;u
zd&5nxNvH_3)7aK%HUu3(3by^l#YB1qreq{yOp<mS&r|j)l*?>LM#oyjPg6T(L;9u`
ztWnb!`J?i1VSzYp)rNz55Pi{`k1t-ZOCUaHvQ0@11}EW8)s)+OwKuI5`~%I2)C^7q
zM?7FIvpj*sX(l^?lwf;c?`plXpOCZ$i={vQueExK)#lu0FPB!CEK}^rIZh>iAx1JD
zc6gGKj00ZX;m%0Jo4^q36S{H4o63lyH-jbDq@FsG=v%C2uNpA3qf8`qPno{oPEkh1
zraq#9BU7c?aU8lGPrI_=t3M`~85KGu<$ZMRXUr*Iexm`iVC>s|;^V*<63H#f&OGM^
z^(myvZIs2%QQ7LJZ6nuO(@#VOoGw>#tFoO%<v%k<Z~A4EooS`F&H4BElpC#g9Mh9>
z?nPSw)Cv%AtPzN?eQ8R%HOr7LJE$7U(io9(Mz*R95&15^$gUT?44YdrE5besm?Wv)
zBpUCq;--upyf)=|#^l$=VJ0)IS6(V7YxZ>3xIU$V+@MOdkhN!X3P54JCRC~YQBQ94
zdTTnU-xzgomNgtV0DV9xmv|}0f_l9&u>`GQnK$@B(@K}}UiAfIYqph9qOB56065@*
zRc*;0<X2p!qGh{DJBYf|pC%#|6r-0hEmfM4ueoHuWq;n}f@f$4ZRG{FW;~d^p7Sbs
zkw37(00c`PPxcivRTiiL_3j59z?29{djW_*waJk<D#Z55bNuW7B_WdYvboME4R}^9
zlX!^DN7mtgivv7s#gy4DHsY0_>xyRPFlj_ckuU8-uw#>4^0oF9nTOTw*-H;gDa*@D
z>m80S<<d`~FDBaEcs6AUZ#exJICkltLrc>fVchPEfU^e1$t6m78#0N5H1MTUtb=nQ
znE7#UqL6(I<44V!nd35v03=7LP6@RTS)D|}ZAp&ok7Kcn#5?pcb!dK<8(v*OYtqTB
zGoh<r1iK~RBG7g}(eR(iq+t5I|Cl9@+b>|WHpnwscl=P4?`J1RPM+)Yw`=7ukP308
z^^f_M1*V`HJ_vb@k2;bS<~OYSXd?QSYbU}8`lRyM_av&b622;HcXgDK=GboEOmP5-
zzYU;}i%D&ufqcX6v}VOmyEYEwSAIU$1ae{mek!cG?fGqC#kuLwQlzr6P{r|j(A3zR
zrE0<iu6H86g4~=u1+_sVqVG8H<bUQken81~)#Qa%3D1^DcDJ;eWLg?8Zop(p9m=*g
zCH1#dh+~h;m(!umZG*bBqoBR93Ca9<K77N=Ev9VTN?%jN7No>j6|jx=aEThR<LM2@
zu075VHDsh~;8gQDGmv~dUR87ReF*G4E#V;{Rq0OwJPEXkk{jfjDyhhjuq`90^~TjQ
z=3$4ug4m8+&t*a&ln@A_bU8vZfLLeo*5WUi|LCmtO+3Yh|1E7F)o@F`<k`oFxR{o{
z<H3kx9!iUNyV)Z<h5E$Ea_fi2%xV-mZmkqbhuT2NR*rzsecHnhY;SNPbq;k?2#(Ok
z0?=EE{3RNjroqd?K>591#m!cuZf!3XJ?D8hc%!N)S5a>2FvOBYPZAl61G?E2Le{5#
zly(svHE@h1*rqYNIZ6Dn>LhVn&sJHCFBqcO0qCN_V;D<dP22cvT@5)@`mL4In6Yw;
z`Or3$(u!W3kL}x}UpdW9CD#FE=%1r!f$M2Ce7;7+sV}mLy|p+Ld#hWtcmLWQXYI)e
z!B@DX>Ek4gxx8Z_jGcUpKx+7dRJqE_sdW^}QMNi=4N=uM=W%YR(H_!~{><PIY$nZl
z3rR2h>7hirQ{`REc&8O*)s)im3c04KQ?+oxbyC)hU=Me_jhN{qICLi66cWjMX(L=F
zO7$NoK&#V|ofDdhT;7D-Yc|N-2{z`Q;zLVbIl(zeoVguq<|<$`xoo7+H`M0f*xp^Q
zy{YH_6YVpni3rbny+l=_dm9vXbSjB6l_JzL$pzh%Dy5d54|p>HOf$Yp>l`<?P<;T_
zxO&a&Y}^IC8dGAEl_BtptBlLwnzh*uO(asJfKr)Fo+7(IG+{?JC0S<A2G;#X2(+@V
zhr~xN5-#QLWK$6x_X*1MR#_bisldRuiT#jj!9p$a=SvO`9kWvG9kEM+gkH#$Tg{C?
z2qUvbfl)g7EGL3`*%_4RwWph84;-o4kSE^VU6--)zrd?Yd*he!gA?c4VqAWo=(9Fr
z-)lj0>~OUM#ttpDvK>2CZ25_J`48Rx)33jWcCelq5-VMpe^Sh)2i;tzFj$zbYEwff
z*Sptif;IAYz&VvcR?c=x=oiD#$(HrO)qTlKD_cZqG^EKN_g-D|R4_IcILBRYzC;g`
zF+fW7?pJwFpaLt4QAY4j&!8$+l<m82Ia-jA3a`Kc+hbE;1?z|%1-$W93)ckiz5knY
zXXH%T-@{BVJXK)PQUK&7MR0OW!4;!#@bms@nFwaHMFc1^jxSZvrs~h@CxBdSD|`?b
z$F3XD@yp6Yo6{|Ai|UwZPhJ6*>?Dw>_UnxzR`||d68IMi@B7??Zmt;Nz-GJQ(6)l?
zuf6FX=Z+X;H6{k*IF+7L{m37)hq@epJ)nBz=+{U&YEX;4JTH9VwHZ4IHftcyK+%K8
zZ+h~zHIUFIbQsVjb6dB5tVfob$exH)P`7Jya$18<FWw1uu^uUhDYegx2>i<eYSJ~8
zn|{rZFZV-y2^QUyg`YGMT}K~;`8MW9ak^(sbT=`><+q(^qL1!6a=1Rh?01*H@QrdD
zZ%Ib7BI<}Qx7Oq5HN!#NTY7IgHr9%~;VCemcPgcRStQ^bc!BqZzsUcB;mlB`q{n)x
z>C*b9I5V6-10Whw)l2VSgugmcltQOs8^{<Mnsob~(U8$ww=dX||K>o|RS$){JcIZ6
zeywdIM$kYPM!t|3`eW=J)cK4fE>~$I=A+aL`PD`}eNLe9E+;|VqYpNjIK3(C+WG}*
zT=JZ}IB$_9fx)^w-&FY5eq~AYHhpgBj~wEC{pBAZPE5OB_nUluku1=-bFI1|=jDSB
zvwyKxqFVW@gP2zepLbDir3Pm%OG}?VxZJ*B+kAGZyswC;cku&5>h@Rq{g|JXYE;%b
z5Z+~Y1r6X}fhzB-X8>r?jGKL|10%f+N8Uhj!e!{|-zSu8)x)zOVdmuC?wP*Z6&@N{
zITtt~ARPgFP+e@+jO3+(_wZ4(9%V@~ULkrAeiMs{GWmY7$Ab8=8^;?;aM4SpABbWN
zD+CsUe^O3szz9^gL!Kd!v$&hw`b}N3Uz&XEdp@B`^uR_b-f5FD*T3cO|7FlRBhga&
zloe004hTS(+y7jp)5YmiMgjmciNxX{ni?+7R+0WgE=fxNT7w)QKlk-N7UQkbH?ZXd
zoF@M_xkoJ(ooPbHl&NBuTbBHaxsMmiO0UEDg;>xx)x`H=HR2w)(R&93Gxm_axQ1A{
znX0u<kn9;`*$U4~Qp#Q2QGy<p_8giOHgjJ9bjFVy66-LQsM|<JRIcTtB-rly12PXY
zFwDVp=w&J<=to2!jun6?eOrk=#Dh)6@pagooSwJ=o~19pHi2@`1es_G8r`!ma+9fK
zMyLkILCdHD$8~}7EV_sQBhb~9HD*_dm7+~9TAJ^M#g>IH;2LLN@nSS|R4bZ5jR_QB
zh~LnnxZpq@O*lGS!GxDq=%>1CK^sq?@raI|DOzT|P_H~V(+B*8ok$!Wl-1v5r6X7O
zvK7^M(cSEeZnmm<uTudBIN3uU<f6zLI)wd>k($268B8vfux}p3X2tjCuX+sm4fNM_
zk@Y*w4P1u43%1hFEySaZQF43KPy;LWw0?ok0|Yshv46pi(r%1YtWM2Ln2?>&_+>c4
zQnhvEs<{OfsNZDb;mQM}PN!&ARTC|L2Zlm%K=H{uMz{2U=rh+{MU`N#2qfgT&Tj{j
zaOCc;^v1=uFD>vGzy))D1aUojMDm{4k8$Xk??cD>$$H=|gxPYXB$rMxlB1SxRLkbG
zRnEVN@NIY{j)<XhD+QPu3V5JI`TvIH4N8M99cV*S)=NEgJ*T=72s@NDr>-|{S@yAe
z9<NKm>RF3`&{2q%xX;}B-w0-|(l68u>gzq3o{JNNLpMCMN1B<GZrU@m1#T9R{D<id
zhG+qn-2fKviQy2jIR@WmVb_DV(@^G@5hbQ^rkpu!T#QNDoF}37ZDoO&jlHs3@H`zw
z`bi>9WaySn3F@(w^j12uLmPs-_<6|1b{tMV!VPpi0c0~iJn0=f0n=wK3rUIYMD&U1
z*JT4$fgC237n6d+(8Pi7dvQWOXJI?qCNfS`?y?<;{73Z*Z$uW6ND|@l2~{e3o9u+^
z@=bJGc!m9Lp*Ced>~)iEy57d?#+yMgl9#LYh(JH|T4rG63>xm7<8zRUCFyDOB0<bl
z0!emJ$ejPeR%ve@6ry-8e!?c(1=-V1qp1}sW{Q5uUTdxA?H&Qdg-pvVD1CSGpqoSI
zQ?D&#a8V8L`J`a#i4>=%TqP+jY>M!!@B!GmNV|;si=i)uDMu<(JABBW^52ErjlWrG
zY?j0Gh^E+E{>9~BsP2bEnS&ioq?~l3f?MULyo9ur?W+~+UB?eMu*Sa0h4If_Q<ku#
zL0MUXtSv8A4Jxu7flxLKK#+lCsXXW%=As$noM28hFjaLSYkT80d1VEuIaZVA@b_bo
z2#66BU_(*B7-I`@q8Mzln2)GUhJRHG+PqO9c62UpzVUmBY7w&lV+$w^fe_LL0oIeA
zVS1NkX#p5NS|DqDNY~Sn=<#^y&$BPo(ev{Xi3Km~rf<*-w^#4(*dOPYa#+%!lq5Qz
z{Ho??9rUof^xT33@TQmg^7x;8=94&@t=6D$G_<`B_ZM@>i;bHC5@_nSkzERIDWVK=
zROOM%-Rkh+_(Az*d3RySo`LMsi-&*rP2x7&6eU9)eSH?q`+XS?%IvTez#3HQ8UKOJ
zR8PV0{?R7)@M_w%?yTYc@u0UR@rC#wuq9}w`Zn;9dk<d)KLLYGB?THA8D6t;dT@29
zuf3=&$Xg~;y-Y^<0}t2(3JF_?<JiB%k5F3IpDB#Vs_b53C8=~xU{;80<u@pcyx)Z?
ze0|I#7jW!!q-W#plu!r`b{3B1cAJ+T0oj|5PAL@jP+~fQcr{<w9s+rlP*d?n+G&(7
zZ!Ybrxpco&E*Wy>!s^FFxMdtkk%^Jgg7_;<Fu5e^0AEfUIs|m{z_DH<@A?hZM|ocY
zjq8FZ)|n*eYpG;oq+=7<yLU1aqns0mj-O>q;leV1)UVQ$69m7@%5m5K;RP7KO<@ja
z?sQ1|nO;fr+iz=G$-5-pob0h6l73UrX9~qV#A{HI;>+*3^MLco!mBlyAgAAzBH})k
z0W>`PD}ppJr&oIG^;sueGFZUuKzKv(-@End;`XA7mmupFHJe)XdpQO;A*HMWs~K}7
zZ}24WDwLy#=vVuGCRKCCh%;R4+h0lzoA5e(>dov6x4ui>Bv%jZ5wKJQRcYn*1<fXh
zBUV1L@US21S)74|NOdIW5r5h<D6)9g?pR9H?Os`MUDH$B@cNTLPDc5_b;%W8*h^h}
zc$0_8V7AIy@jUxq$Y*7m(PFb;5&Ig#?PIXsUc+iW?5v25$oo*`Y;sz++=abSF5775
z?|$^6og*gD_Zy%N$P#B&P`yB3EQy?79aD?$8gt9K_%=t4l>$*e+^V&nY~<rxUUm#K
zemb%}{K_9N5i%b{6#Do<xf+B`YPcZ5Y;f!dppJPLD7@)3-WW>kISl<Qh0a2Gt6ydn
zkW2o`;uAy=%Ri{gs486#6HX=|3W)N{^`Cj^GU(qThwxa+5c|ff!wfSfJ_pHCvs+9z
zwrEcaq=24+_k|8t$EgL0RnQn<uVOeo$mTpTow!V!!v4O!_-yU#@`4fp&>b)0;5Y+}
zVPobjJADnk0k;shnE&8g(CdBlv$~@J$ElH%&;7pXX`ifH7ze;sf;UU^Hf~A`@r5!Z
zM5rYGqFl_#A0#^AQtbzLIU{3j?g24ja#Dc%0S@rem5VQp_d=$@P5QMGFdK7;`ztVU
z8F7L{_E7Z1=GHgH>IycxgC~dT0QgO>P7>%myPl72swZcCgss~YTT}^=Q<c)=vpl8@
z>P(;}%-r+DJ|z=-@{re6wf9LN$;oq6ecvY6QW=QMx{xzrUWtS0Ol9U6GSCoXq%smP
z@19s(%=xnIh@Yr*{@ynUx}1@uCH`1_CZvfgg!`J1x$h#^&tY-cHbe@7V+~~>eoaZj
z*zj2^s%<wF+V72iX`Er_2Y~watkf$bZTDyr^I<g{_rX4Id8j==KVqrT^3+}&nB#Y1
z;G)qw1zgCPW~PHknvd1;llv#0Nm?n-bEk0J>sH~M%r}yRJJNfeN#a61uzppq?3r)1
zzumCH6~xv8VdE&*(y4svB{EwJTR2&g=E7i{^$zi{B<YwBq%YwnlEGmmr>rFLtEtT%
zT$$lCvkS-&26Lly(pBMCUpzJu??!3(La?{24wLTGVAZAnWRZCUx6E<^%VSK{h!c<P
zL88?4NkWh!(nD-15hkP1;$9W$xC(_(TEEFC-88^^>VN>y_w7DJTr8rFxo|VU7R;*#
z<Fq5!)i_rK425%<<mR}g2ZbM5^mRvp8?VQQ6<n`!l_8dshTw@>HdK1ly<r2+%BO}S
z3&g_%c#x@3e_wscn();?b<v;5KV%bo3J?z&K>Wjs4$BvYR32wDK<)9a^uwVYt*{HE
z7gm^I)Co;u#cl@4$^Hp+^T$WzQXq}51bSi<I5$Oyuw$*X`W&SI`7d7ejzXiRZJJHe
zB6UpEirO#^RfPyqA0LNy@?0*uv4o<w&;evvG}%xUFXbtmyZ@YItrKnC(_44GL3M$s
zy}qly`n2+tv~zQVm3rS4EXvS~MJIqUy#Rhyn7T~-&$4o@7~p{>BTZA9>(hA&-(q;z
zA{HTd(b2NuJ?bZU%2QU;^27K4gsmH$Csi!DVjFzGz`!QMuh*?RPd}P9woI>_CoTtN
z)4v<ir5JHiu%vYT1%#xtCcA+>XRfXS7Su<KehH8u0oprnhljENQThS~jScnH4NA75
zq$iKKLD?cY`Nad<H9<U5pLx1Wc6Q0DAY1s(V)`oQT%C%@v<Q2~sh_=&@@P(he~N)p
z4I=Jzzq~XX#DRd|*9MMh5qk_1JFBev>xiPupUh5%Ye<Kk^a<?^WlVm`Q<~d)lHRNF
z`<7cj-hrpe1?yoYB&JRZ)F*+iPbFiya&TP<YH7wVb6*jV$ERy>Byr0V)$xzL)nUrU
z6VqFoEiD3jAi^-`m^d+QVe@PR^g-RQr~vWle;s$>D`D4*$S24zx$Lkv=jc)d_VC&*
z*|gKV6dn15&c1s&2)CV;5?Z7SEF*8yS=sdTE<$0pPsk4>f#OLGT2ATxejHRQudMp?
z|0l`y{P>E8BLT>h<E?6q{c8)(8`B)}$U9dwT_1EejUegXDSLMQ>kKGOx8ix=4IKpx
zRs_Lt*cNjrVGpXKr8_bELeY&J*efVB3^C}4styE}u9oLFD?mo<Fo$klMzIEDFmtQ>
z5Rtz0Qi?z3JsZ4wK1!MI$S42jE?KoEj)83LM-`6*UK&&xc1FS;dFm>Ai!KiyZkJga
zWe4eIB6sfWe&jU1(TeS`%C@L9Yu{QQu?9l#_rxhys%PuZyMuv2;aXZ|z2J67e5Vxt
z!9YKJGz7LROy6z(gFl#-$j7By@C;WDmjekf({ys$VI&R*J08=cU8e&A|5~JL^mBFz
zKnXi^+Tm!X6i9H4ZB)0|tA!)b05qRewu}rsmu*PQVES}TPFx#1Vk|+?22h{Q{!bKy
zutk#i#X{reQA?ev2TM@h-{0PS{lK!iotyMt7GCF6ZS~X~D1rofRhKG1=Od|7Db0zu
zd3;-H;+})QvU$@7y&6kNB85Ba-a+c<C>EREbWqWUHE08#-h0E^i6$(Cge<cg5@PZc
zs(5&npb}0$)}fg)|8>1R?0g&*MDg_SdjX(ON^yHosZ@}!Nl;7yJZOaI$(|W`%u<A~
zzd5kkrv%r;Xo2FLnBQFk6Itk)V~q$Y3o2eVH!`YdSSAWr%mg{7DrM7#-c<TO13B5J
z$bWK-=p3nvCuc@S0`y7hbz#Q9Fhw0(4BdL(Lr@?A9(sRLECsodX~0+_UN4LTm#7*C
zkUES|On4^|{<ZW1fG6trS3@vA>1Wf^kTW^fSvPFth`)Yz+m6ZI$oPgnzF&|6!1js-
zC+e4I=)JkZlZz>g>&c<HXwj_+`2xXNgzM)R9>LU-#;IY;wVwg-kkIHtS;*eonOsXk
zs%USduXQo?;tmY9A=u-#Qx`{tZs}iIZ+OvWRPU^vt<DvFrG~FD6+I7FNl_<)C1qP6
z;Y5$*ZkYRf>12$;ZBKW#vFtBEmk#9eXddA{pKUpm9YSFxBo$-noybCiEXDV62c2wZ
zw50e;Nv$f&W-&`AQ;^dQ>Sa;29}TvJ2;G#EPZ{8K0gP45d^_S%f?}}QaCc9UeiYXp
zSQXF~cWpx-c>3OQMtXo{SlpBX$>j_IhKaQcN9{Pal)uqm9nksi4%vbzU1`ziQsnbn
z-e&kL6S{g4UVO+qT8kCiyQv~X{>(%h%Ue*+@J_e)VS<tR$L2=8*swkMl+ZDWnHbFn
z!VhDZg~`IqZ#S1)ud*p>49x=fNBF{GeJA(X<JgtL4|CL3w5?pm1s1ql^pB33%Rc3r
zuPKxsyE&3%+e(>tvSGIrlN=#Hd{|GU%R(Kk7LP;Fj&2_Ka}@=>zu0vy97>)3eKcD+
z?-G>xJ3&rsgr{zQ;-jNUYP4T&o-YetY2&tLIqwlheAr`leNLa+`BzDKoJbj9N#qId
zYLgp`rvY#gxe!ZVKo>X>dcNM>1eG9gI3y8TsQve{VAp$V%7~YZ#vAUjZ+cdB<)rjK
zR)u$QXEe~s!tStSP(3^EyW`d0*m{@N^uC(fsBpvntSF+`O{sBn%Ng3N#`<SO)vKR8
zbIVzt`O}9Ye5f$&G8~^bxFUY=2%3Ku2}0Xv{kSpxW;O*7OFt`*&ovObx^Sx+9A}o(
zGDn@Mg`%TXCbx@OY3h`$*jFO^<Nik6wX!oA5ZK6v$HjKB_g8il@P8`%OHZDO5usS#
zo#SX?lys#v`+h1I2@mSTqnm_uxi&sGg)$Jm?7zDjQr}7Bs8jDfEPmx;RWP0BB%zD~
zFaMEU2Hmgeg#!g$_gG-q*qy^Y(u9PGXrY^ihEa@~by?dMlg=m~7Z67@`Z#dBdsmv+
zD~0p;Nu%V4h!yp>2!vWyL3%@==pqiFQtCg>SepK85;)Wg9?8IMbis46BdD{Sp}FJ+
zBuduC<K~=?70b5tkH-_KJ(K}R3iidR$B^0OC<==58=A`OSg12IJ`2PpFY+j2I7t`~
z9$CVZs87H7e}qQ}M_ZNndMaEDdtULzaN-az9|?f!s4oAH?^h5zx@%0nQq1sNy^qV&
zSRLN4TPYz19K*Lzb~Vs4N9lS{0-hFVDS(mt4tXATq_!Ni3F&SxLf5b>g@)Z-aX*_V
zN(Awx`;ccx%B>MYpIam7^?e2p@cJsRPd*FQjt_IuL4*HLWvyHf9lIBvhxg=rK35HV
znUjGCyK6C2vYZ<C0MgS8b+nfIlen=?xV*SuSUbVK+i0RyYYQfPT`2UG%vY@u5a?77
zwkYzXtb3JB&EE_4fhjgK<3DFE35FM*ufmzGsmy*oryj*hm*r0C9tgNdSu(N!=s6tY
zc}V#PUW6Lh1iZG@&luS5fp`0HATUx7PQ%1rjKfwEEV}z!bEB$x);uQD=gTWTyE1+D
z@5k;}0jK5j7~wco!Dv`G6kA6M4q1#f=l7VD36Hg<e((X}Mf{Zgozk+l07#faSZI=V
z1|b6aRzA$rc@t9{U^2sK6wD#cbYOKNaU_oUr+<?Wgj6-r<4$v<P`IQ^pI#W$0oGeD
z`<=(i+5>lp*YbS6&vseXtY*gwgu<qHs?l*kD?7TxXM!I~q%t}#`Qq+S7W);%!b_12
zQUV~T`iuZ@!>u<RZ!9(!O(FsMvh@qsh@qk&O1bzzCLL|ndq3<>3+>Q5Y8ro$C?{Rf
z7@-Z^=JB@Aj?=pJAh7nd`%C-aRSTJ&>qmC{?cGou<gLjFtGyhiHI(0$OlNXR2v|uA
zG#f$(pwu*1Kq&i=LM?i)S~M>2z9%ONt`LnYR6hjn&Wx0fit=buX~KqUVmQbEO-|nX
zIRhOPrq(sl9q3R}$GEDXUV7<4n%(lY4nw*^0qCweHq{w~e7Zxa-p&5B@3WSoWw!Fm
zFqA}}9WmA+omCkzV{H*8(%-G51eL`QFvwuFd0Q8|feYH~H73(o3C}O?6!^YyEfn;v
zt5bxvcYl2j+p$Y!m7INJ3q|`ulYBvG)@<!HN^PLAew7o(fAlI^6U?fLz{U(^uDY$Q
zA&A)swXJ70c!ECFOdN^@t_Mw4D!$Pjp|ub`|E2S)mU-yppLPN$=)Dm@yMa&Tvkxps
zvlNvPe5?6!OT{`KrDBvHGgBGfn_oIh*W{STNX-7{52shVNV*t)bHuiMZ#3kOx1M>x
zCyBLJ+C`C?bUJEV6O7=|qTkaJi5wWw=tfB*l|G{K6J4vpODKMYxAI=!`$dje2(C^R
z@MF^Bn5{>1Z&+|`qb@hXp_FS&dl?$Yc`6MLj+K()fVBTg)n!P0KDg0FJf0uLG~7HA
zYE?cWUW7xBtm{hdHAk*4C;>HzdBAtnibauUNokaS>g{3lbuE{E?40Z&C7<5ebe~FM
zf>VV=9SAq4f&D>%0@iRV5*Nb_A^R%5I{%NVEe_-Mp#NEo3ib<l3iJc!by_?UY)Fw1
z93-Kf7{Ytr;E+TYJ!@37kJ+coAegCp61j%m87R`+$+BZ`V@qLDmr*xs<P2}FoVH$x
z@2sv}gVI%0pQDngR23N9X6v&oUtn7+3KY_eA=B8-0NV^6FFkY`I_($zar<BPJ0OT#
z8=Objn&3npjhV%dbTS18A6sH0Mn!LGb8y9<_xlFs1229Eoxz0sJ@6j{eHeapmHD~n
z7k~bs8<;d+`E>%s|8te{g}M;*55OUTxnO<Ht_AHE1q<}T79b}*UnbwzlZCcwB*w06
z7%WL|a~$bdZ=xT3zfGi;$Oj;ALzib#GCn2>dAk5@CUdoS_Y^@IGpV&eJVT?N%`{9W
zFaK1tJo}Ht0ZWhus`8A!`e%Nl0{?VfE3_O1jXH}xh=go77?f(}n97UGobWrs_Q#9?
zaMH`Ouzpwu1<4zd8R)F&&2};DJ*Sl#s{rKP%~^g$mYd`Qp}jrg-a8Pj^{>INIW0WY
z(iFm7f>?4g4^}y3pK|#M5g`(1oN;jBZm3zZm^Iw|2Q+YgNFFN!?yJ_6Q-XUujSn*)
zlyDc$z<Xu2KU(fR`kJ3rKKIRKb*Bilr_BpK(VMu(B5ChQ#?`Lz`L`&M%QA7nZ_w6D
zmD!cBr;1|9;LHnwa;NC(3@<MipzuD|@y?o-O!X5JyXX1eCVst%dF_sMDVVnnI6zCT
zTh(N+dCiRYGKm?`FHUTq-6X4QClcV`lZ)4M-am?i=rzcFmp+|=(s`w}E&CJOKpAV%
z;Y*q>-xB>_3Jr~-1#BO=pn;ZW8P!wm-nP}1-Y&&DZQ$G(uuYFvUDW*bSqAXF?ZxU>
zOdDqHlc_x=4@WTobk4$KgTdlxK>7ChF*)F!3I^-vwGW=IE^U7UBdExfLk_Aqx@A9?
z9x*Cf&_B73XID8s#;pXIk9>-|ylgRZv$6|KwAil9o0hs`u>C*by+KtP5DRitc+U?f
zib)t>#a$newPmGw7`(O4o*R;oNqcpx)~%!qCKk!5l;Q35lPw5{KB6e*5sAOs{9)-j
zH>g%C1kyah=TgxlE7b_Q>rztVN(*XNi$7hiIJ7GqSxyR%XQUW@MFlO`Zu%BLh8=kU
zfzfBlg*H5`#|%kuT!|*q8dUMM8q-!#GSEB2&<qa;;2@AC<fW~LglZDnK0~|@OKg!?
z0EzUWg}~yKTyC$#<*qlI&jme(gsU-ivFmU!uu#>vf(&DP`T&|pI!itFqowEp^}2;H
zrt({u-RP8Utd}LDQvfjP(oON|H1q^o^PA`yh#C{!7Wmev{0I%$Hum7Wa&ef9tBP($
zi~|U3^(J}|SOF;_18Krma?>T;lcdw*HEngvhAOnt{-U;XxFzQ?$g9R{hXMm$r>gEY
zxjwrOC*v`+0MLi2GX1S&P>D#2-oM*=noEq~A7U_k+`npnn;O>L0bNXuK1)EG9HEEb
z&?Q2oY;4&girAFPj&A5@%GZBpjDYr3d2}|4k3Toyign(|@%?nnNA`Li*}}30&(hU$
zOSn2d0H2ag(^;JTndZzk#zVM_?)LGfSpdD{A^-f5WQ<J*I?m$3H*)LTi|%6bsEbd!
z6c<`vEEZ?3LI^$?flrm@h}{L3sfRNVB9=B5l(lwL-?Wc&=AC$x=H_0|br-@ED(cu7
zIe#CtJy&3piiKZrl2a87@ek|WJpXe&HUM}_tz1~WK;%i`Idsjx>j;BZ=lTgJ87T+{
zw+RcT;tti(%-B9i>T&YTKG@(S7$bV-d_qE8+25SiwEeh7GOZ!yQuSJqi=6%QQspXu
zn006^7ToHFn^5UkPrsP8UryPBbGg8^h4*#%AEAah4$9;iGhI}GiKl2JIv<l5K4$c)
zaJsbHF=`Of;2BoxQ#YSitmCtf@$GZlGwy1o_>*^}4Nx2W5c=$R4iG!UeU1>OKSrBS
zF;RVU_*a{p+u)s8U#c@}JF<SavkHmCuA>F<;{38;XOWHty#nbx4*Sx`D1gOW5xpOx
zC{j5_-W$Pl_<`jN&V5DhHb}tbC616Cc=MSWzK8S13;1B4&(O1r_*>*P_Szd_6W(rJ
zKz0}_beN)@KvDa3q$u(uAC9r(82ZXcKOfpoWXyn{vYsY{Q{KC7J8yOQ=gB$a%;h@G
z_k2#-`5Z{K9ZctbOx^%4?BmH{z2qHDM#KvVBlzOzZjlzd`?^)tuVMs2nTE7AQ4~dm
zi4i=$R_u&3;wxtJpb*u()Qr>l%Ejid$4zdPqb#=B(A5gwC%)GmLsUj<sLUKE_*^BL
z<a(t{0K<|F82)lDKvVEKYoGd0F3Yi6`j@kmmT3*Fd<j%LMc~h4aLkQw8gd%t*!9`F
z!)JJ4xklezj~>o7)U)IPYuH-e%%O<E+8%)-<CwH#u(tF(t*(rZ@r%vcHV$rD#ii0?
zV+VUpAa}?-iPY8)hO&h6gN@ja%kvC`aT&LMf0!)cRNKcdZLZe+{|kCdZpE>@k|!Sv
z^-T;gf>uBUwvUipqvAH`7=2bkqF>#id7c}zOlf;NO2=N~9VNOg@1S0TU+0yCXs<r{
z+a)MpnHP9^^?AaEb3tyMJ22P#I!GXAfTvWayao_}To6Q!2VItf0E{SMkD*NuXD(~~
zg=kECMvS}lKD^bbV<CGsHpyKNVEq)ZNCCU4PKDqv^u=bK45~oi%VF6KYzIaSx?-s|
zntWb@+=a&8lob&S9`9=yV26>5CeK(=Z{^mv-Gq;lv?Pol_n~(<j+sz1wNkGUv!>#@
zo}+E&&#<(?NxzTRE`k%HDWU{o!Fp8T1}k|>4y>9Y#&4YGz{1JGkO`<d!rYb~pV>95
z{@xhelH3m)A)$REi=m%d%Vtct2~R{raBTjqcZL(S$QTrm<&83ev1V}FGbaGeaGZGA
z%pD<dTA|Dt%1U%}Mm#KXixRU=&F_?G`byg58Y+eKrAR&KAU6O>=h^XLLmI3&$7DaX
zXLai3{{+9t0Qq{y7b~?OM>0t#*B+j=W<XULr3T!!tAZhn-?4d-+FXk^Wd2xCfs?b$
z_iF~c1j{}}P99CEYRAIUBJF;)JT@}qj?^4Wcg<A6QI#<hnl5B+u}iYy1?NX`l=j!C
zE020uQHlwhF?m}VVPFQ#N>jpB=-w(lvz%-zJnE-tHaO5~{I+%JiCxDdsS~mq#2!un
zunUuERY_rsOgP8(Fd#YTV&w;+1(^kk;6Olb!6m0`Zv=oCX&<?~TAO@whKFid!q(M8
zL<g(#WHIzCqz8fvi)i9cG{qa5Jb;VNJ~;%b_<WW>1QoHBIo6hx3e7UujwMfc{mnpD
z_AyHx%!Z2gj3RZS4c+ZK*t1>v@&nUyliq^E>?YXCSLfhJIWpSkdj$?CiQ)3gtfk*P
z=h~SBs^+VlvsIBMhO3hEWC=MEQiqCR?9@R6RgIX_)_sVqxx2Jo>H~yj0^k(51T~R;
z6!}Y($N%<(rPea)0XTrqKR4;Umn}m=d!Vc)&IN~Lt3FbOO}Ocj+JR&R%h&OkELsRZ
zE6ZlNYj!S1a74+OmC**@+!NjxFD+E9N1Mk@f2lc`4YHVM+-7JVZs{7d5%VNd-gBDX
z9RsaLSSafnna#cS>Cs-c2T$FB6~>lppb1`_FPogT@?*nHox{?U$dNHVHjkll{L*R`
zvX;TC6Ue3>z<sT;*&Y~j62$o~+wfI1y*Vx6#><OwkVE$pWg3Y+`qz6xO35HLJGpae
zwz`7d-F8yz1xjKjr?Ga)(gY+5RJLME?0T^M1_B}$=&Gepy=kNU7D-~p=k-W3@$xWr
zU-*_=*<g&1X`>NIH?IJQ=MEkIg3GE6#)nM_&|i4K6{l|C+B{S8hz2&@pS7j?FaoF@
zqRcPIKLsLgd~_epCviKA2^VORW*!0<#WLtEba9kQ^877UW{~GhW8{005&E-Z6Jz>U
zw}FZnA>AS|*Pr{7&k4}Y!YX=KW{)sB@A0;mTx?-b2B*_liWUo#7Pl(h-}XBE!1jiV
z9IwS@`2HW?@E)Mn#Yv?PB*rA`fIBy*dP~CjTvanQQFd24h#>tQmpEpR;{-gLwx}np
zRn%_dtg*3kL;j{wGI`^p(*3RTy1|579#_E`&g4>mtvuM4pB-jt`W1|<mQ+AawZh_2
zr`#3{3lte4sc=eOH#SZ6Hd(tq6P<m?6nM+kb&&T7-U3q|J3(DU*fE*%0Q51x%QDf1
zi*Di(N`^YuH6^$y7^^W)sJGP{Nh?1gt?jO5+S%2J@Qc$0PxYf_7JOCyUiMf6DTzAU
ziae9!dq5V_4RlrTk)O(>^fBx_!MBw_0+6PbN=MdJkhB(EgNxET3?#s(9_g2z?cgF-
zZDU|-5j8Il{!`xEt54Pb>Otq7qgTTyMrXB{nhp;*NmxGEP3w!p9HC%x0=tC~;>s+~
zc~+voo_RnRgv`(wwmpQyD>eDHxd6(&Zo`dU&WCTA=a7F`5rz4?rC%UB5a%riES7!e
zp^D$!2|^os*7%5>4`GV>UkfPUptU(KumIM|$e6xH7~Hwc$$Z`R&GVOq_XSpg===Hh
zRg4$eh7%F+a*DNegHF`*#&rICoi3Fd0TOAQXkAA0CQ<GC3l+CnbbmWhtKdojLVz2T
zhqZ@pckhCEv7YKjBoGWmE-}k`hc0T0{F`sW+JD-zMN?SsYtoPEg)Yw8w_&@V)$;RN
z8ni~@gXHrx9BUJhcYrBWQkCi&17xJJxSgY###N<)5|#u^@>Sp4D^GWmE8&7Ndnr0E
z{1(>+Ew(j>O(vzAGS@M+x@YhXzZc?1MsBs>&#d&EUjvE(6S0?0OnxOG$_0eu8xU^*
z8(g=`^0FUmc^r0_*4<pNNxpIWT_ft{UjfK5&Mr}gC~OqC##N<)5|#u^@>Sp4D^GWm
zMo83pYb3N$WM|3|1e(65I;E{vl4EsrimT)2y#~KWInw!6mj@?p=W^KCg)r}>MV(%*
zx>^p{wGhhdS?+oU&RT75!1W&oUDQt1)vhsDOpa`<PpuR&2UqMJKEn4<`v98@q%>tD
zs?!hRtpc2qH^op2)rsr4EE}t<&8I-*WgEhV1NjiAiQvko?oJW>MQ^Fr{?sjm%s}U?
n;@oQ=V9W)_6V@dv{ElZLl1zFloP5sBEUfO4F$n4+Y@*mZR>Q|t

diff --git a/Docker/nocoly/AISOAR_20250923_1656.mdy b/Docker/nocoly/AISOAR_20250923_1656.mdy
deleted file mode 100644
index 82bb4d413cc792c6d68210b7e8f2cb964ec1f386..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 31808
zcmV(#K;*wMFfcGMF$Dks03ZMW06+i$015yA0IUE20PF++07XMGLN`W1F*QU+I5jds
zGB!mtH#0RvG&46hGcq|aGi^dkVMb+ZL}YMgMsz`1S2AfiRx)KVGFn<jS4?+GHg_v8
zHDgdtF;iGCO>=W)ZCZ45a%nbfYFS!HcQkNPO))n$I5sgiH#RjwW=2IzXGeNZM>1(b
zPAhM9L~b^9bZ9VcIAlU}WN3ABYE*A@Zgp2LQg1hHWHod&GC62&D^+!NFj+59XGAu6
zcWf|mVqtYfXijitI8t|1Wp!>(L}5X1QA1^VLRwKaVK8fUFG)37X*E}II5JOVO=T-@
zb!RU~a(HTWPjgssYf@H1P()f<PGNaWPIfe7Yf?vTF*q|dVP#`iR&7OWV{bHbZ#GV7
zb9X&RN-|V=YIrhtWG^;CWHV+pNK9>HOG0mPa9VXsX=^lBVKX#uaA|IGW;HZIL`*SJ
zZ$Vc_VRI`}azl1WPE=Y%ZfJKiD=S(xQhHT3Gf*^bD@|B6RyjdgD_C!2ay54|Nmo;3
za79L1IA&;5dQ&t(I7(78K{Z5XS!F~?XIfG-Gi@(8LwZUtO=)shWJYpFOH4>^Pcckz
zGIls`Z%b)5b!K)(R#tIuO*Jw}M_E^EbueycHbF*adTwiDdUjZ0LRBz0XEk?qOG;sK
zR#aIwVnsqVRYPY%W^H$HdRBCCc1vV<c0^=Vb#OFiIcjP}Hgj@GR6{vMaBXT&XLd?!
zVpC64bx}uWD{pmFcu{v@ML}0hdT~-uSXxnfMKCaWG;B3iM^Z&{IaNkPLMu-;HFr5|
zQcqG^WMX7AQFM7RHdc2qT1hoaX=-J0SwcoQWKLIdK}|F-YIRvtG-6?MP&ZR&X>>1X
zc~Wa~SY>l7I81anRAppEHgjTmVmWg*VogCqNI6(hV`6VmR%}jBad0$qaaUJnZ%8z4
zb2UtQReEM_Nn&<MOL%5Qa%oF!IC^w#QdMX)GFNL&cWq{DQ87nTV=`=TLrhXxdPG@O
zL}^%NZ%sxoFhX-=M0Y_pXHrXaR#tg+S4U80Wid8pa#=7iI5}fOQeseOOEyPpMn+Rt
zY)UkEa7%1RLu^)gS#x4oZ9;ciQAc$+P;xavWI<O#Sz=0dFK2akHbHA<I5aP8b4O%M
zIY&xOHgRZUQDbE@Pit^fFG55wIeJ%ecv)~_N>(&)M|5RGb5}D@VNzsIYehz7bZBl&
zad%EcFmqW<X-rdMb2K=4cvf~ec`r~^L@Q56O?YihYC&R0IW$x_PdH;oQ%G58XgDi0
zG;?Y>N@XugLvnE|b4WCBNKJJ)F<Ln}Pi<^;ZFF>0O-^=0bwNW$YD6_^Pc&^#D`PKl
zdRIqHHfKm-QgUrUMk{e-F<NGDYI1f{GGTFUYhp1+PIysDSW-`Mb}~;+Z$v^-acyy7
zFiK-)Z!%SOD^*cyc1>(=Lp69eOIK}jNkcYBXiP$MGDTHmMmQ@(WKd^ka8-3sW^HnM
zb7EOnHB)a<Z#6PTGiYv7ZdO(^HbQN8PgOBCF=8_^G+{VGLsw*Eb5vt-Qb}}VX){`9
zM?yAlR7quFR53JBSV%NXb#rcJS6OL#d0J6$F>yslb73`VL2fp1ZFfyFPD)N}bVW3B
zdUkPBX*XCxWJgbIPDy1}HdRhaPDe?4X=HR!N=tA|QEpU1YG_q>T5Lx)a5XbGYA{Mf
zFKaJILos%7Ms{jWT2^m2OieR5c{px4GEPrQdU$J5D`{wDYE*VKc5OpQV{dsmXLWC9
zO;&eeQb~GwNN#j=Lrg+uM`u|^c0wz5S$9uEHhN-4Zg6#JOhs{0F>gmrMm1VCFEnj2
zbb2>cLU%D)WL9Q&H*;}oc2_ktOI2Y(P-R$lSwS#ZZfrw%MP@58bud_XGFL@3NL5-`
zH&a1lQ8GqiG(}M|VoOR`Hf42YMO8v^YdA<$VRA%nQe;AFbWBfgb2fHZPDnL4OLH|^
zZ*_NOcWGfaGh}B`VRUeDGev7jRzxvWQ&LA)b9z`>Q%rYabx>JELriX1c}qocOigTB
zPf}EOQZqPqZfsI|IaNJ)N$0&cR;n*Wkt8E-T~3}2T#S$%&O4#ZKF(XQxYLv$Z;(|l
zmnWKRi=|T^Jh|`MF?FA-2(N}b1u|0ZRMYEF7_i>WO-uGn@R%yz1NE8blu^13@tw%W
zqg8IVS#Fw*B*^?w@#k)<PELViX{3g7AG4pE=2!C<PXu6eaj1{I77e>1g>&S9=b67#
z2x<?KdbdlX=EHh+LmU71m<of?Sb_X`(ssl0V{$qqB75hy4TrKQ_*9w^D#lyNt+&3M
z`H7TixR``gcAKd#|3|lvT*QKmzPjBQiAjZ#_T8|~-I*v%XMT4R;O#$1dl?C~^KdAX
zxuFO7|07ye&$rN~ASmdDPKnlM&wmRpeYiTdoiy53z~?ipWc-I=rs%qmbdB4tVUPx9
z1jXBd>=^&c<wyVI8!N8C$O?^u`Gf&F6Y;Iea<V;U2>p%uZ_xdXTF;1pxDc2hytU#z
z?5Whd(g=KM;s@A~GtV}s2(IZQtZB6TzVd1gQs#muc6={Qt_(++32lt1g7OgknlBo^
zG1NcJk@QapHNX#6%<TVw1X7*d$)%v{6jhJLipp;t@d2179&*QvPi2B*)OAu>Rv!(c
zipu|UwL9!pD6hz@Y3hf{jIdF)pUir)4R916t&mQ!(k`wpHwAkBjQ`e~qx_H%Jw-Fg
z@YMR;0y21deoHc%%r!L2TK?jBLDqJvl>yF+F_Dtm0U@{8((}D`gVPPOeZyy><d{E~
z)p^QPfoL(b-I0gw=^0V&dFIsJRYvW}M4Yw`Ly?2%|3!@`r6C;6#7MWT)zYvt8ads5
zKiKMu)#|i+<x^&q9P`R!hbo8x^$`VHA;#Ul7iFd2>b0A#W_jij!Xi5t<`i3OJ}mL}
z?=F+2U83E%V)|_0Q|uq2F>9pppU+3;gH+(WaaXcA7Szf>5n0#)e7f=3=)j?8G}#!|
zm<MdQMy+YE99ZP<BfXlqk@ndPZ;=W&Q`<s22|sC5*e!Mz&qu(x_n@YU4=p@yoI5B=
zN0zqR8TX(2r>?)LlVj3tCkH1*`nayTnls-I2Gk4W_6F6U?$kiK6+BkRF&+5+07uGx
zgG%9vDmIe%IRG;>=hs?tKI<9qNep`G=FXNC63lbQ5G}<+51qq5lz>CQ)cGG$CtaUJ
z%N;0cFEtS?6(PNs_G(detNrN-ji#|zS0i{2*gzW<hXve7?^XX7BUQqsBmZIUWFRS?
zpeL{3q$J)5<w(PfmAu*Hkh6q)-%(u9l0LF4VqCt6UxSe~<z+IPolRkC`?*k^+!sh1
zfwJ^Z2mQ9Axlri?`b>UH9uxUv?b|rYI^Nj40KfEgDmx!39rqNXWs$EvFiqHawoy!#
zm0ODs0lshDk0y(yFK6|k6DhWrtLWCyutPMofY{bK3%z&b8v&Q*y{8~HZa1)fZcO8S
zH|f6-WumvjX2eU*QziC!00Vx1-pyLjKwo3~GJQ{@e6?T9=EiOGfPw?dhD!RXblk;a
zJ#+T{A!P+h4TPwTjo4k_1wfzVpQB(7E3esO9iS1uq}DE9!2k<<zQtbjDAM=9&5aO|
z-%rRP3C;y<u{IZV7oB;?3khz!#LoWu>BoxdxOn|RwsDKdVQ-dfXfvMs##Fzpnz!i<
zjpApuIz*R*V<}LaF`ZY<G=^|b9V6VWF8f2N<+O@5ibfDXv^OD?_ygICSsS=D?l%qp
z4yDozoUIXO5J?vv0{RQe?<0rHg|$m8Prk$^6<ExOpxATcdNd7)G!nGp!39lP$2tPk
zyC-gl9p&SyJ(clrUqx}h9T?S!8m_=X1}cRQ4%AV%!H~|}?X!v!Vq@;06*$zUt|;P{
z3&u@Oe`Vu*3cd^NZu#_5)s^KH;t9tWGs%@mzvGY>ws@pgO?M`NA4=gd=`cZ+Zz;CH
z1#BcApb#Hr4S{1pfMO)W8<ZsiydwL;GcVw~i`x66Q+{6c17K)b4uh6`Zr4*bRC<#y
zIFHiFs)%6EPSomgb2Z;-k{=6XlBlNkE5q1{k^e~&RNY033W-dVuw}xmX#=Wg#V`C_
zH2QHc?yk91TC2WTV<MFHj9?{7>x_#Q{o^jZg~+$KUBo<jn*mb&@Ye&qVOj3as#iD)
z6;y1vv~1QT5dtseX?s163E;kThr!r}fEX#^Bd-?<fSz3kcpm_&*a@rysZy}Cm0p1z
z(O}VMH8#ZgpX*a@cs`3UV>&j`{N|bn0zxn0Dp#A0q3N#lWn00NF3hFPmuwudS!N#5
zVdKnTV-w6PX2IX#Qfpbp3|Ay#dUt+rYf{DvhRX_6IKV|i-&$z7x?f1|_L<$*AI#_O
z%+pzQ6OXY*zNKRI&Y5MxZ$@3%cH!Modc-2)P9n%jZ4u~k9FpjC2}R<vh*aMUo4FOY
zs)$te0vaDrg)0MH1QCJIuR)Z`Tx(XiGBlKy;5dr-i1we%k?lNsMBzyF4XNN<%eH9?
zj0OU&z07%k6<>PDfN8G+-hu5kv5Cg==~!Cdj!yVIV$?k;Q|Sr;w5EKwLx|zDxs5Ji
z>xAFKLOQ8Zu2<I{1RIectR1$zx_sowUchl@e2^oF8JI!n91zRGn$|a>ZlGWw0?92e
zKwx80{v0+OdE@?#{NVCfJ6#|d<?(>?S|I~X+CftC=DHyZ3SXZZ>NO%{oAV4w_uL4L
zpwAxr{N@cXBueMs(m<C!zZ%Fb|L@KocLrk6gtNy`{_4-yEnay*RErKJQd@<>d`U}_
z!g*+%Mw3E?&%RgsXANHb!n`{Tw%zU(f0A<OaX^Q|lX9)BXkmm1im~7@7D!txRM>+Q
zlaz`~HQ$Y)7oz?jBy+13Z)%Z|&$42+uotC#6fvQ+OwJ;c;q|~6u7Hw1-srs~-^~2)
zsckOR`OI8n{7v9nd8<8qPuPYC?R-BT`w}|4!ctGRF7KMyWXm0?c#01kLA?TV8Nmre
z-ZMIJa#@Ov2-^-L5%tzFd)N$akBlv-2>D7jAhOUCMQtm-D}iGeQ&uaV+r{2N8%j9T
zT5KdNqomtDA6$>2Ro_K{K%IW`r88~gkK-1JYt3b(`rdkKNA6kBN|982hmsx2syaA}
zv~wZqGF~Zsk#ZV+aCWSj{d&tD=%iDPt^8}5!a;`<kc74zUht(5QY*a!7#pThqs4Rc
zBKnsIZN?8<JJQ>6<^R7>@!r9LMI!Kto?+&ip@PBCd1Y;`{EVIU>}e@6T*V#e+T~rH
zCXKg@QModlq;0N!uApC^p>oG=PYh9(*#UnC|A#7m!dIk|9-79TmX3K+AUY34V(Jq#
zv-|??-}H|Aec_5N#RpX2NyDwaGzH>UK{g`b=t~{an=xCYW`V(9@&My?s9hdd$CY_l
zWFK{~(<e(?4(B1U;!Hf7XSsiUiZ%|wZqv`#7BkGygqVN2H6(#68^yu6Ha}P<!23ji
zn+m}BCG?LhhlvtTdvQr{wY2d1!a@H(DTd~wejCY$JoL~j_gM%U>v-_sAJDoiyKJ-0
z_=G;`Nc$Sm)$aGy>W)ffJ_k9<8^TC8jkxEW>N#yY9_v5`9YVu-vDtP#BN-_ywgm~g
z>T|;rnXY$#tvYyj^cU55=tZX1R;xC!>)4Rh?fxLCfTo6?YZbda(5sV?rTc#vEc5BL
z#n>}f3%`xO^S7kqP%Ese3Pi>Vz9Spb)JBq(Xu8U@AHge0NaTJyS?jH)&wf05Yu*DY
z%djrn&^~gJQ7Yb<8(N=$-vg9vnf@7mHXSSrB|9t4j|K<SlYXQzG%`ZH*$X9@b~>Eh
z@y*UlXANiDiw%%|*U9gpYihp7x1re!Yb96EP7PTdC+-GkLEk_C7Gdhorum>D&`Xn+
zoe_$W6JGud%IR~|&-SZB+WSO<pd5l+)Y9fJXKGUlb!`IBDWU7QZke|aKrY4+`WvdA
z?J)~Pu37;%SqXt(3r9w|zX}79X?5*0OA1mmpBBt-K7NeS*)_+?{o0b8RHy;n1eL?s
zwV_gF@-vh^4+HUIvq}!Enkwo&3(;a3#{8sORikn0$*p}Em!8cd#qEarphIfhpelU?
z(dZ>xw{iw9qDRtl3_Yt0(0x$@`e+IW6XkGL<^!bEpB#7sxP9P$9aFqfm0fbnpY_Ro
zvQnZMkS^NQ#3+ro|GP~s35nSAC#-F73Y3&VIbwUuAs&pc>?f^m8h&SGJDX@AQDON4
z0|-WVMDd4-6_5^>n`B;p6Y{-ZIXtISbhk?D=9rJku{2&RM0mij_4<0dpE5X?NAkJS
z2ppHI_7#VW68L<)iEUh$D-`)pN@$STL@do{7Ng^1&%x7a4-t`|)eTY;z2weP6{YSs
zNF%%s^szJy_H6T)j+saNzeu&4ZW!WW_BzK4w>Z4$*g!I42x6XuQ@%ixa>Y0YvEb(U
zZ-EqujRYn&)I6($$~hiMk<9slWC$<VK&JziNDrvH76{~OPYQ&IA35!gM3SI`E6#^B
zJkzE1S}ITZNk3pta&L#b{}&V|OazU;4PBR6$th3z;ky>Ch>DR-kmjQk#-xC;K@C-~
zhiDxODx@RRAf62AV!qrT05W1kXIwZFk)<I063%lS9#^$e_1ea#MO{tBVSS^dXIth_
z`$`S>E7l+?<RT-<GY(>crGON}G)}J6Dz@k4MJoWUi)4jOT&z&|0TKSLruJ#cj06_F
zDARtKMtkrFMA%kEyn7+BoqA6#duz3K+xS+;DzK<&wx;qRs*{LUC0gM5RwO|rGvVBc
zhNT=P{z-;dufIEq^26#KQEDm;m)R}{M#lb0B|%_AUHNJ4z&;&M;t$-J-Si&cD<;4M
zt5saOKIJ21Xi3I$0&)J1vwmQmH<6KDUt3A2lU=(ZL^4~Fq*x+1o|V5YLX<MJx#MFd
z^S{I2FjkiTm}D*)i58tZ*JrHa6X7t*f)kJJ%1ESO?#4ZM?#W4l`KHn+vZ1>A=Qe2N
zus218V4i_l3V6+*Wzs8Gkffn!dqj88v!P&oJ~OFIQMTeGNVzrm+5exr0Yov3+Cdd<
z_TVl^@YZU?qSgrn5jExg9DZLvAt*_Kc=&@KXhx?tjY=iEy$HKjas9zov2d$#df&;B
zm5l9VGxiFRRtf0tQ4No<Xhx~E&5m>--YkI4fsFz9<rHHEgO1IIU+~3K8LGY2$}zq)
ze6U0s)y+|3>jKpkuMwo<;4F558wjXGU_S1n3lB47MrsEiAb+YcKgfJW+GZt786y86
zGBjm!DiXcnBD`CEXavUKsU8Oi`2`l|TsQ`Uzg?ZbcU+uzp`igZmy$hjg;3jaSxoa7
zRyr6iLkkl<W-VH`;bQHpZUU}H4sZkKK-te-A>sB7-WM4fo^}L-q?O0n7Ve`G_#3!8
zjgS_cUrbe^Y?Z7Nbeof?zyt0~@{?N8x^<l3|8rx~TLV=bG1}Bq&4)KtlMaBQy!?S>
zhob1p29d}-!0%gk=svLNZ!GJ#3bIlzA*`jTAsb&t2W@*gWgMRCGD7&(@%6+i-K>x_
zzO6yNFU1dduQH~=wO?GI@U_N<H*Z>+r}Hou1przAxdv&Y@bmY!n0wAxz!K*-d<}L1
zBud+#?1GF-Qt0$i0ue>;%%FuC+;Z#!2sf{+QIY?G2H>@Zx<TuZZ3uCq-3hH<{E=V>
zfdXbbuyEGB%yRDNxzeBPDRLOT0Wiad>Bt(kcNpX^*$V#rv@Ib@(+}e{bVAl0lRZOY
z&hwbmMX8MDL!d)u*U3a3Bm?HP8gciPHW*VyZp1>1(8?KOHlRm30~vzd>%A9G_H2Wu
z=61x9L3+_&qW96M5K4Iu8zwU(Ot)|ugj2lRn=-=;{ys7H1^s0#5&wCzoR(#Bn4}VE
zE1}$FULR?{VW2)7aoIu9l+LJ{A55o|7OA5g*YOTrQtC^&VcyW}U6AOy!dwztAl%Qz
z|2)6hqs}@lD2U5RKqZMF`Q8gMSDCJ2$?9dQw7Bvu!d0QKoZ}PT)W_AN4_seI1GnBT
zQHDL&PSoTy=^-1k2s2;oj+LlYf?`R*Yq_%t2vPkCvCyGZ0!*IJ#urUZ)tDAoJR1TO
zwkoCw-MyDl!2<be5rA%}kY=jBy0hq|9%^;cV_bGl&Ds-a5woP2eX{2=^eMo3*iFz2
zvh0!GQKNDp$^8#P9TQ^T7k78BDNw?svy^LTs9{-xdB-rr0x`B#hQ$Cu8bp9&06`ip
zxSd$TQ@3p;3gktMKvROPT&h|sC?5l%_ksj9AQK28h$#q5k2!zQ%*THC%60I-n~2A$
z_BGY=DRRo(QPo`st@7)>B$Sqa{zl?9iBDQU4sX|j)fBxZx_yaN6ae!#ffuIXy4Nfe
zCs(iD9DT+V#NC>?cKU0TlkFoM8IX(Ic%d`klINEs^%NOJ*XYXS=Tm`Lav{&p^yNH4
zwB<}D{t?SXkaOmxB<?~qb41|N=w{W9Ap-ZW=Y<Uv8S&T0tD~3(jpK~1TfNO+K8O+s
zGaiTyfH*bn7}se{D=QF$#Stdpmx@n5_@vNaE+%<ymlMotmLRX#1lQ0^tPA||UWSzY
zuXL9MxaVcTK-kNfKAi&r4I`}S{!ZLS7;gHS3lYgRu_Adrbn6B~1j=MUzuL*5zbGF=
zq28~6VtbdaVcuNJn@fV5ZBvJ2={8#V4U5ocL;=7?he(bwS8Y&MfmEcbU+;d{=P_A(
z`|mA?XLAK=N_$@mX56wbx|W3Sn0auUY{7i-!Kgv*?hjGDAk>|k%0FR;m&0seU1Aqi
z^QtW;#^;Bt&U2lOj(T<&5d~>Kq1Hs#Q`&<Z>Qpj_HR(&xK*Q^c<jVy1OmFVYkIp{*
zX>W}{4f9ihuf+mAZHtDgAG-8g2S6=n5iwpXI9$=%k*A3y?&U!B|D-f!pq~<Mbl<F#
zt$8rs*3cK9Uit2S!(?s*M{FJojsKSV9HoXUz!6z;$?@I14BT`wx)TTI*kd)H^7udx
z)4}NKhq*z5IfiXN`?CxoS-y_6t&APiK5#3zTQVAF&;L|2tlggjJB@Ps788&>Q>gat
z08r?5*<MjfbjjSO%3@8m*u)!wcV`vwxk-<C*!W+Xd10;z@`FO2eCbZKx%V?o-CC|D
zt|&=9bo+eT)!WR%zw9R572~E)$PRq#7Clq;ra*t?0Sq-<lSiSNEp4WAArm#yocQie
z#`Ck68nf@K1e7oP&~fw2w!-NTy%DCbkpigwYyE5KzgqkKGw6>XZHOkTf#mK57Vg<5
zjSqojBntQ!3WgBt<YCD|zueD;J9-x8j0seNm2glas?QbJPZ2(OQa>57wR4YmI~OWc
zy~2gIL>PC5yUL<*8rg-1JA&5{r3NWSK&rQS3j_$N@FA7Ys|hK9*u0I*j4@zW>A>8i
z(|oN5_dFAkBPhl5(X6i%9oM^6(lDq|ujWGpgo58b=<J#<0=QZ2FiPP_xNVRJjyyq9
zCTt}usFG{fK4^H(sS`dDj_QC5S#hWkfc(^BenXu*qOa8{it~>au5AosjB0KCXQLQ#
zX)K&SJtlnBMHfF8L>o44{K#~*4*2JA)jlZ0LBnt75MHL%-mpuWzZr88w516%zT}$3
zYwDr5*Z{O~l+g=s^ZXWA*^qPjlj(xlL@#y=J&<Hc&Kj#4bpe!hLjqK4>?OVGFU}s(
z6m!m0o&4N{C`D=TZC-dv+9=pnS;02tC~)V@{^?r7fATHOzfmAsX01-&+COa_rW)2;
zFDk>|vSRkzLpVS1V{blXs2k3+a&QeCulc26R;vF5_ghXdEqIgEEFtFGa`Lx2W*Bk~
z{ep9n+MqO~_%WbLTc3nd3HtCKWs+!?eYfoI&882{4@TG>pzVsm#hflW$qcS)C&W_&
z<c#)0{jpO0MP36_VJ&u5j(NkR)VeHAMCKt9@Sv78gKR6EdkIw=tQjVX_37z)zJSVO
zq)89v-GtXlD}|R09vLeY@zNi|Kzv_-EY}w*A5bR(pqGY}HO#hY9zb_{gD)`U-TEXc
z+J}Uh+r2|3A0_{S5h@OUx-(&+s0v1ZVwoRuS?!)s1p=CG%+GRPS6QI&d0?n7!cSqA
zs=E34){MnEVNxiF+f(Or9w$QL>|3PNn&p&Ez%`@){O)-j)aFOr_KmdRypal2*H(Kh
zwl<MYT!CDYX#@jCIrYO&A{s7M%s&9xY~q|O!UD^C5xU8}RhtC#9@x7X%k^*d0xwm+
zc9DmhUpLC3xl$dGg(I#L7i8WflPjuBFC+DBGRVR|o=1+QN1b`~ZRpFYslKn$(yPU;
zDM71oIBDw)k0^ftGbelP;lb2e=NkD-;?BfosuI`OZzb26U)l&hb9J`;%)^Sp0`+n&
zKtI}%peqORrDfn)j65hq2!^?|s0vE=XLVhDHUE6dzFMe*1MRNLsxSP=U?+Xo0DxN_
z(#EdO{EQN3Rcd_ciLJ5N;!?wEXUOfLV@O>n?1Yaze$rSKu1q8TC_r;q6kODGF*!`R
zJ!6W0&a^mnUzo9OU8CusGg}f~NOt;37&z6Ag7)Q}xzGMybKL1?!b8pTq2x%`k367>
zgYC$n!{%O66RC8D@)<87&nzlS>3rPZ>VY^IA9ik2mH6NmvhE*POcgXREL5YH-Fn&4
z{|ZWMm;7q&frL|hK)8^6o1LgrWNid3=Mkojm0iIQDqsUYV2bwSqfa4RYK=!tC4hG8
z{(fo#;*Bwuxr>o64kNo)G1@n@YQLazYBhVK99&-d*E?HXSP$Idhmkgx>h4a9U#L?n
zM{!E2f-kb__2PH|RGbA7b8o{_1USi_>9WDad0hp?!<%78BHkU_CbV%YWIK}}DA%5|
zcP!2w`Z`%;05ShbY~o8rW|CbEmsqvLN75VH+(;c01fL}dGHIw7L9)C-a+dmX;90e6
z`x3+PQeDzGYseDH3XgYmW43Bq$eySEZT=HRgGtqEh{1r@_tA3XRI!-F*G^WSu_A%<
z+hmI?3dxa6KvjT2U3Z;4`l-HM3GLGBPym+uvYVWQ=`v_x>*fXCof_9<j=S2N>a3|y
z%P8Yhx3fb1B}M9ATm6cnGi}*^h@Hwi`~vUFveD6Y^R>eG?{}hdIBHyKgEY%zoN{Pg
z8dyFMBazAHq<2b8uCb^7NIZ+Wfl(fOg&^zEM)M+;WMA}Wok8kYmE1PYmqB69@w`dA
z8RqiFANB^2M=>ex8oK^ul*F#_D~u*-9DQQQTm~fK6gx#phs}{j;X&WbKVa$}`;^hH
z+Crr8HTJ_d0D)$`uaQ+g2AMVKFF_*N#o!s*@lY3RQc1*4w7~<4H@Z3KEDHT?!m~BE
z*_&CS7BMBCjtoyrHJ=h5Zl5&wAJUa#LaFkg!wLq}T_*8rk?g3W#Q(Y=2mgx1UMg?K
zF}0GMnk#pzt1&?$SV><zd5tw10X}@jeVo#InYCA2L%Og{_zROjc6XPJ*}j{sz=Jni
zK##iomu+*XHI#heu!qYiBpBx0hG_3#JyS+qaaTc1z<wEQDkDy_>0o@26e;2#U&E=O
zuu^32Nj@MlLLvdD4-t%Wn8McztH2JqOyhAg$9@|c@i?y5I}r(>sA;an@vD-P{9(~?
zynxk+GG2oZn_zi{jBWfGjZ|p^+9+qiOnmqUK^f>L8fMF`ImA?vg^PR=5%c7Z6bh24
z`Lb0u!I`1efWtsCi!O7q-Wr*^xX-Ojxk;(&K>Bo=tN5ZaQ$ABw9X|!zT1}nK><!gS
zV0o<kY5PWk4FIeAL$#JK%^0uqoiR-jRMRtl&%2VoO--+-dhvFChA^ey8QI94cm`Tf
z<7i@T-Mg%~Hv?h>q?c~1E$KP!8?_MJe#A#z3Bhwg`J(A)8EeTgw<1DH{#`^O*sWy?
zoX*<J0k1jvHAWU&8U@=~!TuZ>q!m0H1ZeXdd>iiv^twKyIRMwU`fLXgs0#Ch2}-lU
zv)&_rgrG`XXLV20d{P{6)`T8*xp@fKErFR;lvGVWx}~FzJou4i%_9g8VT#;_hc;yU
zIBM?e!)XJ|1p>;9@#q@dF*Vy15*<IWv!{_l^a#1!#K1is1#pu;g%1<v*gEeih59D{
z@k)M}5?94cVClU;#X#AgTv`<~Is!Iw<d8FCicMsa(4fCgqBFcDM;-*lS<jNAgA6Ub
zS-qf4?=^H!B-B0Fv820`j?Q>b%%C3%uxuzfPG5h{-C(Wwb;)ioEY>%y>E90N?MKR(
zGwbaP+L%j_@$81!b8vWZtd+{cb<wd)mSb-OPs6jCKf0Lxn#f1(gZ9YY`LoJ}t&vnH
zK{M$tbvnCqw#qA6!OZ@y_DG+csC5gCc-kh90lFn^3&Y<0oN?ii>nY}POdRrLyM#<c
zXSmGD9uXove9YGUF^=K=J4%G!SBi%@qT&X2!rm@(3eYwd2BBh?FxB}lK7P(TI)DVv
zPNE`@nISmVe;uuD=yd75@V8v|`3cts%g|}>aR@CWYJ<3wch4C-+eot7leS}H@DLI@
ztyV2I0YSWABLl&{?q25lgS^x4zb_6vULEV{A6l`cUc7-;pi-fLggv4HZH8SOihFsZ
z#90vttsVmIi;v{VJk~N0B=tm*QTGr$kjCk{0eznuGAgj%cyBCr`$fvz#Wms<=edS=
z8RRp#cMLT(8F%~ELvt}>ogszld`6>;-H`Tc4l~#fMFVZnt*5<o{g%$U^~%qh2Qa_$
zKXs-Rya&Avw95W0$mqcJ#jy&vB$CS@u%7i97N5!{;zY-@r@US7`Y?}MjG;_W1tn|G
zNDI;6B=U&>`-O6JRjk5;#ZMvzAa5@5S!BR>Oqb20LkijyX5{AM)64>N17M%D?RV1*
zk3-DN^3t+UgzC3;TA&h_PW#RoP-nr^S7bisKN8^OfSP<_rPxMa|GzSov|kJG@mYyZ
zw9=AUkC4q~qZr|5D`pYquVU}YRfUI*zv#i7(LA1OZC-pFRBzZ#=`4Q2r(Lr0pSK|~
zxS5%;r1+gzmV%ZY;tAQN?TWNPYJKNrO45;ke-uoL{7O%W0?Q>B+32j+-E91pXUj00
zwh>boJmJaF;Whn3b}Ip0sjn~&Dsdaes<IS1`2DL&5dMF-p@1>rYey{5n$GyxNRQy}
z<+-LYqt6(k_L>*?S*dwnxm(GwMl(1LAecM1x!px<3|)82HgeG(;yAzUw%N@CvL-Q4
zxCibEd8#Kmxq$KE9|+4e4Jp(N2;9``C~GbjFc8MD#f`h=&k~B4<8L}00AFe9bAM04
z`Rk+mqHVnjsKOS^6Q8StQ%S{K4ZUbrvqOYO>=;TvXB7Gf$tUAoPCyX1<Ef%kLaB_6
z4a2qgk+jGq`DbB0&a7TVjW4r*@$mYyVO&Cd^3?~-ME8{CH<3y1>=tZ*8(9V7<)?!M
zol{+|nEtwig-BA*n*?V3&!}v4^U@!we5-Mnh+dZ+g_>XJqelkA?n7=?+U1{=^<WYv
zW#jPBqe5Uq#CShv#LVZglAAX>nPxU$+HOnXXFt5QV*R*vlJj(t3siclJqVXy+Hv`v
zD$pR8SYkc5Kq(Wh$R^4HVh#-j)@!N;B!<8QeSZ}cB>H~HZ||gh8nCX!WoNP$^H$Ib
z6v)$2Hu&;ugf0;T4ezdCiCR_W9|Qqyo<uvZegME>X=?H~@O*9v&e}y20_Qh7V$1M*
zv?x(^<fO@8a5Ffc@;lw4<@4EGxP*lLd2@p3sS9Z&)>wT~^kQM+%tvdGFn3G<7jDeD
z7cbp6xdD@$+gi<^`OMLVBQHCw8;qWdOYPlVRB{ztJb`E*L9_&?p9p~Ydo|d%CndNx
zguL^DOzLs^Z%o=I7>Xfji4Wy7=3dizVcDqeV{LL8xjiZnO`<O(S<k+lpEFVmayvX3
zQBDnMsx9LTt7|w*%PFn6$NW8x0jxF$>}4|aua)QXzplvM_`c;R@JocbVG9VAmYBV2
z0o?#I6nx<6akb(2Q-~GJ=7`16C1*}jT%DfqO@6I4IZC7%<uvR!ly$?#6Uvu-Np(1O
zjnvPPD^^u`niA^WNwHYK58lV?I-Da}=1ftDZ{x4&y`9!xIl3s@l^JzgK*kQkQ|4=J
zl~&ov6aRNm3>^S_3Gt6cjbn9i72Z2Xz!tpO51mD_g3aoi22Y<@Z55f(c>iS2G(!!k
z>>SZ<W_m?;YviHNu5l~|z!7=U){OKlYFr)}GC8D^Guw>+{nXXT1+f>|v-5j-vLRkP
z13V+dD`B2?q{2EPM?sPAU1^B2pe*3v<rnrMTYs6!Lh`%Pr#IX2;Z<-RqS?pl_K}Yx
z1(*8eZ2&HVN|yhzg*t{lkwI117d0~Zfw@SgUbxQ+RzA=iL(f1NNJ|4?&}Z9JF&7Yb
zK?L*n0kumC|AXO|JZl4ZXUQL{!<;N&cvuC%4dAXpkj_9s{$VfGzr$Hizov{UD3fQe
zi{wE-i`jS5n1KhWU{6D%`E@F%6)a6=f^@W)No-HuDq;<>W_`de)wcwhB(7nYIhI}%
z?c|@^j;b?v0n)UBm;-a5f^Hf=vOGRIm;SxQ!H|2A_HYDt(B8x-6jL-=1_9t)#>(j_
zBr1QUg1QK9fmpvD=)F>cFL}i<{@@%!1ZYVUY$LKZG0uoRYmOE&kFjPNZZq$S6}V+Z
z-WJS^s?@RnYtz_!sPl>q^X`BS(pHB(Wo-_5XaABY7O+do-_CC;p6lp+*rvIjULVjg
zwi`mxhOnVo!t6Z2LT*2Gf?o`S9d;(&nw2^~_}T9wrM?tJ*y72E$>bT=nE!M|;47TU
zUq-^skQOpB6dU8TL39>EO71@P&p^G3CLS#m)OC)d5!H#l4z6;42wIyCoCEvLy9}77
zM+kOHzD)u{jydquPGMODw#qkCAI+kwIw2g?XiwOm0ZjoZL(%hdKcYiaO?@ie0OBsy
zi_&f@a=0?V<z<=wY;cp!3lFavv|bGEHUS2#;+^4lg*Pkb=r-5%bYpI}+K+AG8OxOJ
z>x@*S<G;53D-1luF-n?c2qz0@5UaP$tpco3C92Ao`i?$gL~u$G)i65o+4%_G^{&g^
zL+%WwIw&02#6ncdSs*izRPCnau9KI}@2>|ugU?LB-4d>D+es2$Ycw8)Z;!G{4uB~e
z)yw=z61fjQ<+@+98Z=96rN6h=F&`WFF4~J()kSkaBi%bLg*R)7Nw+=&7-E<q66(~Y
z|Lqn+1fw+&sq<ayBQAO72*zBfF;{)ZMTCA+8Q7CdVV2V=gU5>}iE3T07P{I0ap{Z_
zqqWP`8~T73vwW;)XVq<^oDlQxY;qa_HJy`thkZ{{Jgc1T*G$5#^@*Q5+LC;s4bccB
zvRz|tr1#(<n~%{;zqX<qlPY&xMVws3^`(iUk?H8<X5m0FrLK4KEppG|vIH_O7?kLr
zH}tKxum$17wXd&WEg!6LUMQ<?J@7r53yg-x02dD`!q^3fzO0iz30cacsU)G!x}PPw
zQgH<*e8o0c#zF!)%|71H4rT!UM$>R2LP$j#dwP)$;`ljiJfhaxz{SJjOI}ANRo|*<
zpShZygFokp0Z7OwNG`CCwg~l1-u}5GH>!1x!?X3B4fT;ET<-*^Lxl4QtWH4;tEOCi
z6Lh@oe&d>Zmb!$Y2dV)z<_Mo>S*RPOH<rttue7bE*O23h(=%#cPKK%##q7l=TM94Y
zkXkO)F~p=E4hD@cmuiz;@ezsycq~vig(Kn9deSnNs#RKJa^xfR%~YqnPh<1^nm!Gj
zz_s~=*NgIQ6#P^@SrsRO67aDVOTcvb3U0eLxvJA1!Q02I@!rkr7s^<(GCG$FJDb7T
zxv+lC=>Psb^DvW@8o_3!E+HkI?a(-raY&h}f&n^?Q`;#JXEMC>0V>5g1^3iBh%B_A
z)vU&+U#XYWdtDk3r7>v~-c8@6X3^U!f#i8}am#~h<1=_B*+heLkc{Pv_(xHQ(A6XH
zxuv29dOmizgv&$@*`dj3Z!21C=A4B)&*zO7>hZM$x(mo4h|56L`!C0C`YpA9SsclM
ze3ENxx%15i)<Y;6)(Ab&+=npL&RlVLTj=*Ie~8ncc1WDbvi_g8@(7U|V}7IMNU-Io
znmwi#hT%l7*UmNCGG*(RdONUBE!dizt|-!E1lPQRit^sqfW0lS<P`kdPXGY;oaN;g
zc~Sz#3j>5dHdkM0>qP;P);5LRPe)#3ehK}j03p3>vR+fjWL@W0U%QnA<gE4=5<x{p
z2g3Fsh0tzAbVxWB887u^vf*z4Srw$&K-0q}orj2XO=%bg0g+UzO-rbilE30{y3%S#
z%UdKxVkoY2*AcjOmh5{x$!Af%SZW)3f*nC*TZbmp?}Tb#s=_2KJmMOlEPmmLV!68R
z{H!lrz2rnspQ#|HFCloFphULjd49b{{?t3;<@LHbc3swM7^k%RT2KpnPJwjk_)?F<
zTeMu-Bt^%WRUVSm=VIv<Jgcs5gey37he;yP^mGvf`RjGLiM$3Wr6zE-_Dt|iBya8k
z`p`Ibr~rqoCwbx?l4w&}t(l+d0@3q+FACV6TI%&b+<!hDp1i1x5^Jyilce#hzw7==
z!s_iICs>%Ui2$i{I7wAk1qQ#`1aAmYd7xH5fS{6qQ^e2X7p5PSw=dJ@$v*hFbmOMx
z0m(gmwu4)kSa6tf&;S}<B<eAu13+~v8>mA}iqJan^GQL#@3%dx$!3qRbp*(Groq)a
zdz4r10c)P--Gb7MTbe6SSNaTei30&AC)%x-HQBJdjfMd|Ow!7}Hb`j%-)2>(P-ZN{
z%@4g~3^1jg;#ulaH@M~=RAV{qK^othIsu`PF)Yi&`6-_6rCHww)N*I-t&=b*%~++$
zQ@6lf+<xi0a@LI2;K{wZ#T;F#pQ#vh<OmXfu{2SN3}JeFBwqK7j@3(1=>k5w<X%NN
zkGNd#nF08r)LAN5sNPk27C0HQ7hxn|o+&1i!R{i#%t|fI;jrlnrW{i2%}yA+nNmD3
z#?#$RBfjpDEwuoU;#;{9;mwb3RZxceDHZTYx-aV<2MuwdZl0!xGu<b^H5;aX@stEC
z7b6kJvfE~(XUa`Qi=YMqD{msy9BRycL`iJ*zPYEmcnTp1ZHgIq@Fj93yM-fT0(^B3
z-*-x4ee#=>R#Wn#Uf+Ip2~Sw*fi_ux6<Gj_`_Z`T$UdQqE+jpa0r*;BDOF1^gBWLx
z?T$?w@W&{`j`1o-cc_D*cP_0n2i|Hf>*|j3JZ_~=0{pE(D@#a+JTkc_j&RZcJ8tOC
zGxe_(C*)U)iz*&xbr|`LH^na_L5{AS{9oU8IFYlvHv~BZm^t^+rG8+MPf%(WIzMFC
z{Cxw7kzvO-#JxPRq(isSqwY~qQ!FjM{GYfsYc0;2%^^W^km4kP<9ZaM@C~G_$iae?
z(!)jrTMYBpv~NJe#fdJ(p(4wO1oJCVi$WOt@Gp1Cd&S2_C7jw$@ihe`kX89xj_F2X
zsC={vM}ZK;K3yT*o=rxXhRe5IoI-X{b|FS&+=NMonm2NYQ+BVNohXUNF9K`nui<uM
z>6UJ4b_~g6Ik$F%z7Rq!4s2-|^JIrZatqCd&vKf^JJ&l&{g#H127+A;`Nw(#hOUbo
zq;91z(#$MZ>)4o?G$#J~jalOlN}xYB3x`(c&>=oZ6+Jf`{g^w(=Rd(}onDeE$uo9Q
zCIYYfU$h|z=$SFQ{57H@vD&f#`!Uow1!|@*!P_b<Ay<ln`UzWl@F4YbQGSfZafn_0
z#5QGIr}<lE+R2sd%A=eKAahz^`bSuqW>foMZ{E}Ds8KH>mMm;m)b{v9E-L_4a<vxC
zHhB0u#nnlF$2Lr$T6<WEn)KyN!Sj**lV~Gol!OuI0_n#Kyc_+gsJ2KCOKBB2wn$Nm
z%u$(^vxl$Ulw4<V%tz#lo*I4gp7o=@ZRsL|(ICZVYK1K%q|F`E)Uhj6U)>^Bn3{z%
zSoHCJjOp}G;v|e-Uan04M8T3${kV~>XedNRrtmtTV|+*FjAl4eHyeIS27hjX>K*ak
zVhTUv^7GxVQQ+5z)>56Y@pkm(J8oBIpc0k;mE8Le5qLJ#;c?{x&c`wWdSb*5Md2$4
zk>R>^A?W9y;HnO_<ySkx(>`_YK7)zus50`cKsau<gU0H3CAL1>9AToYQgPxte5c8m
ziWXICxg#}#P9jX)CpfZuDw*F`P|k#8BY@WXEtcp!0F{iNZcAEz@(vJ7+rn<Zd~Oud
zt-B<?R-)(%Efe?+BGgwJ25x|HZ_V2{znBF#@ba{*yFiCtuLJGHFJ(MkoKw8K=}$02
zy*Yfw!)!L+S;*j`1BzRpEePXBUz%D4`7Gy=IaAM9P6Z5M{*P88A}vdX7+VyH<3Jz=
z49szI6C>>6r|d@ZAhgm$_-7kg^uK#Lex(83ccXEXStA$)mh|Udl1PWj6eIC?v^RgZ
zcco~n#>ZO}qeQ<C*=70z+=I}`Z$MwXW4`_p-Ta2~JX&;0KYN^8Ma!&17RT5l=j2hE
z4i83m;(nMa=`Ksqq%@#I`^K2W+gMGO7^k1-!eTU>7cAm-hqsdC;h3741c$9V%+dEQ
zAI6FtP02ez49@jCrnk@8$A|)k#*^T@K+#Fp;^6zOI`g)Du(fa-;TBPF!07698zcx(
zZMIduGZKJZy1f$>X(R*9VwsV{=YAY6e))St(<NivxOIJZjJ1=yd9TRYbm3&eN5cW^
zm$^bU6`kp}salA3d33^u(%G$IOBs3!c=~@sK4h;k5h7KKHRARaS<zYlSiNnS2<2=>
z#(C3o-kizRM1`_$$(=j?0W%>1+-)Yn0tD_^gZGINp679#>o&smq=Mqw+j@@b;0WTm
z0KkWv;Lvn1f!KUk3y$N@yi$^QwHWM&2^ymbf^9MHZ?S%56jj)i%;nHz&BXP@u4>h?
zL!$JW)O@U$r|+h&1pZ<duxeA==m^kLuWqg<VG<Fp7M>o|=^oF)!YKKP?!0GXOX=MO
zSEZzBhQuL+Z068#U!38Q12YwdysxeVt`EWN^3=6tw&Jga;3ALxGyHCOLnXiixIHu`
z?w}_NhvpT8l?5q4I+jarD9UBcaowU|??Hd>doQ2PJ$p?ceGTZBMTy{-KgQ+QY|u;w
z|4~9MEaJ@ek@OJ#??iPC#kN792^CrjE|n=HIDBeK^)jrLz;_D|Bt!S7m49wl6(QtP
zWn4j${LP9m*GnHB(Bfk^k1%7UDK?$Nq6LtGT-3WQ?FI1KF+7>wEqjEzHJne!`y$?A
zZ)p%CL?Wr?6(0$ZeQPgHX>;6s`#N=lfaBFL8-6w*E|%@dQv6}4t(vXJ(B9udx1<UW
z<zAImX^KKn4by)o1TZe@wJCEWxA*f{^g0mdZKappRc_3mDhr*<&i<h(Y_c%GKPzBc
zqe=ZR_LF0vwp-T}f*OrmO{s163Urb|H(rDUl<6NO)>S7mebWmuR5700AY+61*3hl^
zENIaUQe2zKV7?2FQ85L{+GW<_yyWXFOyjq;GxvIbuTnBFgcgZFL)(;i+9V(7=pWeu
z6PsjwX$Q#FWO0DqF;OJmiB1575SKFfvdqsF54j3`7-w@|0fAhrcFUcO@!N)o6Cq;^
z6y%i^wy?u0#|D?2?GD_?`yS8MG>hA#igq?2T>Q+-<D5ld?g^B$mAPkX&v2xdA0;N#
z>?FYnk{tHA`AC3VNj{Ocoibt^S(r5`T&T6@d>3!O{}zXHL4|vTgg`^Q%6R^>lR%Q_
zGGge96K(Ky<uHv-oCh~CJ{UTM5|J<jiV4#V-pbmR`=co@Oi{E?6Y<%E6ua|{0%Ho=
z?;BDUuUg(;LDKxyoNN~hOIMV#0-<I_qk2*#<Je~vA{vY$-)*KfOFvp~o{>_cCyid-
z`$|<AMyJYJSZQ^{-kc=OC6@<cKKvviY1SBFi@yKCpJ5w_>Qf_SNm~a-(pUzN*#s+R
z^GC6^a6ljTcaJ1@ZBh=`O+(PP#XVIpBM;6Xe-Egl0MqoVGI0nqi!?4A_jB2_32ddd
z6DgY_Zqeug_9=jMA@#B{lb4N|B<Ao1x>k~nLb#v%5!LpP?|7Z{Uh#*g*TSi#6VC`)
zv!*pU+>1+V&JX1KSm^|JDl5|$r_r?(Hg-VZpCVIx8s+~eLpdN#tI5oZ(*)(RhIG;%
z4OpX-=YI+M8^_L#UNcsD$ML{}y|WvKlXKh!>;NPiC!>D2(LdnkJ}_KG=W%6;d=ems
zaF78)f0U#T@*5}kN$t(hCXHY{S8$i5UG*tOx22szH=j4E^34F+m?>S!2&9BpkyI++
zIVKVg>zIqX(T$W;n}z`_oxFZR|E|IYBrAytW^}nxmIGB9>Aw*9K7D}EE<8OjKp}$*
z`<u-dbQx3Vgs7vbDJ5bGAiZuLN4<yHml@&W?6VK5L|8XfkT)sr|AKt_Tj=!&(IL_F
ze~D(N*rZ*(6U*{Lv&pM^^)+$6nY~Qy%d>DWWa-hyTT%D(gEKcKMH$*sMw4WR9n)AC
z32JBQ1qSl=t{l!@s!7PD!rk2Fn9?U;CsbgUXFxa;E9Z<3q!ey?*M$@Y2}NiRtiXb9
zlnZANQ&6AjkNf+`4g#oeIhRQ4h#v{$)MIOA!68Lbg43{)_S5PqSo!Tn-cx!J#g^Oj
zo2>z_*3?nn%e5z5&Vb!mM88l-?ySl)zvwweFd;`>-?gyy@TLbGr~Onk>Pzn7WVQI|
zRBl4#y{3TY%>}sEtXzZZGPCnDn7i2s5Ygg8oWc34*2)VH)im*sLT`|=xW*_~2d=Eh
zw@giHd?Mo88HWNh+&syMy*AT2%6EWh<#5XJgsYqKFuVvJtLGy4vG3XO5c@?npclO$
zTfFU24Z3nnBQi<ePEi)l)S>Fd$b%kXk3%I3{5*WVB5G@>`{OB_M(HcgyZ#)ux2VW^
zQEpsDS6o~5Gl{}>lu^RX<|gE-eyZ&h_^UNI__+OT`*l@mU~)NgZz402n2m1zB2Q$Q
zcU$%Be+sHP1vXEIy3{uC8tO(X1_`Dks{ApGP1h!0=ZZ-{?fOy?^#WI(mXglasRn`P
zevq-g26Ha%eXdDRC2sb6Q|EI~2mcwCI25&L+-^bMS6NzOrB9k*%6li5lDBj)^mD!)
zg9QnHkfw`#Bmjn5LAa(l(hz*Z?z6~H>Y8)#c;V33t~aS9tVg7u`80t)GO4nk`g*O^
z9<?tcI)Y526vYahDxqU%(Onb|T<IR+X8T<Z6tDtArnS@^mngTuW<qp=jdcobKaoWZ
zN@IH;pah$<3{l_>It1U!kDeCM9=WBdsWYux1R~ekYP1bvJSH!p_TPS9u{erQUU`%b
zl&TrQVngiQ)_tnh{y#d$9_oc3$SFE@g8P?T|8(;Y0jE>LSYH<+B(%w=?!=?0gOHi9
z5%%>vR*|i&eqFZ%e8Vu*KA+kr5m)umvRNuJutd88`wX+v<L0D&?0SbK<n*s_PpG)J
zHXN3tlEcY$in5%!uFYwlI7kZL>W*#Jg})G!PjsG8y|L9gN>d@ziNgHgz^zyS7#H9~
z!0^d*uCVYaeXAMeU&8F}e{-w=Zw~wh6fk(@6@MYVw8zE}$L07b+m3Y&PxKhxXdP*S
zkq-c88$FOCMz;OT=?^}GKB=5gaj$FFV58SHS*VKl@2RI#6fFukZ|XvN@`y(Ys-F5x
zHCv@VV1NzST!skLM5GD7Sz-=J7g`ZO+f}+CjeV7KCEd;i(wBvu!<H!8vP8?aZQHhO
z+qP}nwr$(CZQHJ0@3e2{eZgvEV?~af5#bpRqgdWB0G^W2Qn7VH3|@ipnR_Rt5Qt_Z
z8?R@DdE09j)n4sRk~7(_yf#!k;`L#RIlqO;QR}727!FDitygDY+W5hDG;)b)9Vt?d
zrVlN}GUVa||D-`go*#(5gXW7H9s=ZcJ`YzI+!+@b{R~4PZ%vq%$k^9Y&P^^yL9fkO
zlU<trcLES73QvbrlCBa4QuS*{`ZoTjaR7&DlWD~OCP)nxr^PoVHqY-To@1*6?$jqX
zY0Y?pZ{>vfVX|S$dG3kIomT<NHso|<?Sb0}T^WyOLyv&*AO>4l^&D$>cE%cupSh~*
zwlT*G2i*@u#UyHNq;63<%Lv6X>2EHA{iFoWw)Py2MD-*6j2cv-7<f5!zyj@F+PM8o
znKt)wTy{yrMi?*=X^8rOk)f@1w2%g-9OgZcGPaM8vHne9-KZg(-%7*UKA9Qq@#K8`
z?PSXKt;t>0qHvNW(}kAEikb%dVhS~3$*2!PIwckM<WG&}#v#scP3Bl$iyj!GtF)bO
zV0f;9LtmkIv-K<WJR>1rBkYMTrD0EG?xm5SazsZ_%6gT^B-v?8pRBR-*A4o`hQw+7
z6`j`Qv`xB0@V*pS%eKcg0B&_j*A*=wu@1=>!le9sZYfxoaQ#^Hex*CJ1F1Y}qyQ+s
z-1t!5YlP3@zG^b|g~S0q%KHn~PF!>Qz{v`!Fx<`9_P(^HYJEvD<E8Nl%E&unGU;n&
z0ksOD^WH|+5pfZASE2~`(Y$REMxN%qztB5|E;kbS0c@V+b2vfi&K9mO6qP`S*_DC$
zfb~7#0PTr56&PjfO~S*qbPQE5tK<L;&LcR@AOWCoVwG#GnJ!>;qAi1WPd0WlMwMS_
z9_<j4BRxk^wgLMUpsXJ0P9pPWdMn1i=I<QjpCWpb5*6+VCaR0J9~eHbFDdO@qlT-4
zlPgeX5TIEo{%EQSO*jbaqt#`N<vFIaObGfZfTJwFxmBAW;SjzLQiv}9u&=rpWD#B0
z$iYCsI1_R0N#-h5igbjFj1C!ON+M!28eNEECF}HXg@@(*pS&E1+mO{aMN)MpuVIDX
zocQMhTabCTv_+RqHxXe3X`)p-7<PJd%uQca_T)Y?^l&a~liaCAwaOF7DrP%M8qElK
zdX~k8KS8~;HgIi(=IzH_xO#brYB#_TgLh<bKN9l6)3y-lAgePivl%~7FQ6~Hz3b0t
zx5+vzltEzDHf%tDp$!x>_}wx|PJNBa{xRREJJW4+pvWRonoQm5+rFT>wD@F0Lz(mR
zd5&wNmEaOgV2QrIT(Hha{Ihh=!nMBVy$nC}B)O{O%y`Y8D=v4cyIvLjP+U)@T1Vcc
z7fTatnLxsT7`2rlb23{2?N7-VCl-Z-*(`^|OD|5VUP8gUoppZ(G?F0b(qOqZp>>#m
z>g~ygfl%L#2L`iDC8<5=)ekI>v2AG(nPt3ph`c%XoJ<Lc>#@o5vqAL&7dc(0OsbCl
zVg)&igtT}8m45l1yCixIS`nAP79^UEGR8ovhY3o7Ez(4*I;)*?D`^h<LX&{)#~7WM
z0Idh~xtPMRCozq&=Bu3uwV`LWv4;nnu<NvFE#9ekFy#DF-Tjo1O)|WXAkOZYDd^^i
zCg>q+BtAn)s8r+>z+)qJpW#NAt@$PDW^PV4&p8^w3W4YI#0S#W>X|{Vww`=cm}E9L
zZ(8-c=KRVibJZQa%z2fqxx;q@?t0sJWe%)vriVXx(nN6)&)CCYayz#7E-l&;v(y0!
z%^OrN!{KX5d5%D^D?Iw6uai5!W*tes559M%jdrb60yX1Mx@)SQyWIiBOW=RPLud2?
zOGl3|<A);2rb-QnbG<BV?Qge^!FB&P!24|(@&`?<zg3tsNg4GZ2xVl$v5by*0Ha#u
zmXUq|mjGK?QiuhUG`@}nu;u-Hw7cBGe)P6S9p`zdB*kq=Ec2ge#Bcw=c*;KGnR2nw
z)Y!O8*5e6S&0q><jgg$JwXGR$F#ap}8++Dz@>vxhsQVQ0$ovT|&x=A-=f?MmZYbpk
zsIi;@p_?frqOO>2XzwIgvX6u_`MCWqo5{&W31u^=n{Kwm!I<nq1FB`Y4c^+tkV*n2
zJKPDB?|<_X6Ptk>fL{ik0B?+R8)hQ|RWsLvk(+;F$3PLE$$kuKdC^-Dg1a(rh83l8
z9Q6v8-%l~KO;f&RLl30A(-+?&ZrHLrvv8m4F9?b;FLSLW-1UrUu3Az|Er#W`m5@`A
zz5&V0hv+j;2p1d^#vUJS$cc)G;c3N%z53acv23_WaeK5@4>5S0tBHiun{%;NH7m*D
znR>G*{#S^{#%N`@x%rcSXY~5-Tp<c05HCOq$P!>k;MB8|8w9pXg^<((-?kpAokPSf
zp1IK5jJX$ZQZh5An+DzkpWfvWo4c9nL(-g3{fNg&_gaoDvgT*o13|E)&cwc=Z&Dy@
z5V<7P0v^$3X~N8U9l4V_-E5?5cA$@KN`nu?Ie70bqR?>|iXvgP=R4NRh+a^#dO!3#
z*VD`^Nb4p?Da}={2HKb{M3OWKHSRqTE!52r-+wWTW+Z&JXtWQQ;)6HVA?7c0BCkfA
z@w8?Yjl|h4cxMDyw`&^O$PHPv#*u()q-^t<ZZ07Yu6M6w?ABx}iO-}5CNa_DdE{!R
zION;b+@oA)4uC{o{tf=v17of_=INrx`-@QKtE0T0nRrP(EYpC^9)t4I4JG0qa?Rv~
zVo!BK9LU5z-6|63TPMO0jjc?DEIc7h*7JKFFK@ALClRg$Yxe4TQ%~$N&I;LBSiFB=
zhCHl*?dGY2SizzpO+vLYvf|s7ioWhtS0ZEj&&UN9Qy$*spTNtOCxGkDkFluxO!D_S
zE=xmt#m{2A$=tsvDMyO5kh`Jim>xs&yMHaE{{o%x5+Umb3-U6!W5`-s@nvriDXQWf
z2Z>PFo2SwB1dO&PE7T*WySNacpyK>f9v{cFFF0oBrhAt#hlU?LWqLs+fxGoX3kQRu
z-KE}(Nyg6@$nnL%x(^!alFz7Pg>aTg7`I7zoeq%nRN>TxWiybnW+LnPfA*C&nqXUA
zi|gJ_kUTMJX4sa{-6<Gr?jF1pBb72O55f1G1sZ!(x#|8<SD5&cAfe9`tMkj`PTUL*
z&k{j*V;c>Ty~CFkgWRsyAb$JpT&&a7j1z9MZVzd_gjlps6^S9%s-fmombm0F&gae7
z&fD2j-Ft+^f1+16I)5%-vSMyYXA+w7-z0@(;s(*kNbWAE3Efkzxa_#?%{+hcKL|20
zs9<gFg)1rkG%?)IcxWo+J&`GIn1BQFLo1XAHIeFv^G`8^xW+>bHIO}1G0}Sv>L!+Z
zw=I6T7iLW)ItPl{rTotC*a2$z*ZQUi?xMkS{OuaiBgeTk0cDyRP0K&IN9^Gzx4%mU
zb9;_+$ZyrtC|U}!j`G7QUXt@HgD#Law$kl0QauY)CCw@fT?xcV^U#8x#BI%F6^oNF
zRr{y{14fLmhUieWN~fE1z8VuX;CB$CRS5!}0#^5NzHOtUY_XudpJ6hD*;hb;qm|fl
z4>n>qP#T5gcK6`2&wcXE)d|(8yMyXa7)aglpM(rq4W(ap%GRc<ndj8>@i5##&$ewJ
zXkYOkv<#CthKKB{Sd9BPTBx19njW?xv)Mngpxk;?CsK+UENjmts+NYGaapeA(d7KB
zAs0`c<B-v$>+9v0QY_PJ>C;(p^?1&-nz<P9oNi<gsLlP9+K^+z$0g&vO=!``4Du_7
zs1yn*$)~;*fEj}*=&!t_(qej^|HTM)5|CMj8%y0tU4VCvSqoO{S8|5-;Q^+%BOw`r
zRWlre)02E0b!ZN6f8l)>>zTaoqW4U{!8o!Wjd?zd#=tnyE7nm`7FNgrG02d#7e12P
zfR_}~af7($<1}fVtsB-~$S}G%lAl=i^1x&JYbY1X!&s%syMEbQjKIjsMSR?xU%*Tg
z8jVhQP5(rbrZf7n{eVYHXvm;7EKEfxXRf3Klutzb<{Q0l+vV{PE)O*qIlASl@(3_k
ze#Ss+=vB#z^NxGGl41e{QX(zXI7TqC$&j5v$kuy!Vnzz4ZXE7}ctj<Ct0*EC2Uv8u
zCzwk4(O2GeWe2{)*8NVFaz8yo1<G+6&|pw@6+OS}w8%t$9=bzMb!&Z4uD#I#eOkU|
zo!68jDKDoKLs*8=Tt)jkqlDXXR4pn=NnJInE`@l;-1C1LduJ7x4<V{jhCz|dZtUJM
zn@a5+=sTiRPDNE&-VnC~BJ`HjdTOs|2B)Tmo>(6Io5kh|C_)p`lzqSe5pLHzl7Rf=
z(hx`*`|Q4JN=wdgqc*WJY?|%;OAxzjwLTCD(t|0z1ZDZEQ-`5WDz|CW@8ssFgz=h|
z#%a0dH`x7os0FVLGo?!ybNL$3UCjHkI?8EMtY`H3tYT~Le?Cn*1u%)b6e>8>&Q^v<
zQk_>ppP*r>SC4~NwzPhj?vgHAJ4Zr1-pXjb?vp-{C%()qkw%)>)kCbdQG(LB7%LLd
z(&qwjOW;hlYv1?_J8XvtE@Q(ip4xFBk};R9bSPKGC<s>WvB4|xJ3nx|dE^I52ii*}
z!bC??lg)2~Erm!?_T|Zy1@TdfSmv!i?i#h4lZ(j~OwJ<Edj&s+^4grdd=RU!VoM>P
zfAby^hwfmS+MDvxq6V+$NeS=K_UB!tj-RM(rVY|pkB!B9Ya9H4psKoA#QwgYE1`Q?
z#+FccPI1`yFAl3mzgR%*(e4oqPN4)BAvi3%ww+wK$izIM&2Aisiwxc5NOYq4Ic+sQ
zJKBoR3j;^-i}gVhT^Gcsr9A_Mo>&bNv539MCniYSxDQpNn-^OZlNDLlD$G+S%dya>
z$_In+)X0bIr^hfl;F(Rw40*3oYu{sUo6}M)uM>#$5ZVZO-^?tYe*3)UbIde?3nru=
zJf0EPf0|&206ap4$dC^V2Jl&6kfKD-uep+1&uy?GjRV|f$IGKJPVOo%>EDC|5X+%p
z&A<_NsZiuRj(Jp4?wq?ANl8Lm(k+e#jk+GSy3;2n?+>>H^f&-d7fx8j+&d{SX{*3@
zGqw(7p|Zu>aQdFd6jn5yR)U1&!iy^S=CIrp0a7kEy%yD(R{C(fnssk7*&wM6!6UkR
zk7r>6Y|wlf)AXBQY~I1K0Je8})>8AMDL-|NnF0<8@D&J7k{T7e{5Epu9q$I^J>$m<
zrxcOY_h8<LJJ~oZ>=gqMBsRl8z6Z&`dR0B42RI+dz=jCy4z~j7IH)w~_`9xXkE={x
z+;O^LoHF@_$TIfOOgxvE70U3Lg`E82-J6g3$xIY4oVQOUcA%I^%q9o-$dcg6;MZR?
zr-s~o$o*Z9kG7Q)IE8AV`Bn2F5xv=;eH<$X!BcSOPvf73+6OGGt)KgL9PV<QV$*t#
z>l#pLL&M2Bq$PqHbQw$p388t4fwD5VfeYVY$rw?ZS||^yMN_2|J-w#nv%{xeY=*_%
z_F@>7G%>z2d`4hrYX~7Um3sL|o_K{L`if%&XICap9KeGLX0HWjoAGdxf07IuAJ&_!
zr+^>El~sLQ508Ka-g7RW*MeYEUjjBwtBlR3tibaY9@e=F%)<POlKzjMLTw?EBJn>o
z2r!!tG=HUwV`j>Kr(&*ShDN)D|6O@DwF`sb6ZkMih7IW;rQ$$z`zBuVM_ZsVw|vyP
zQz&40BMlIezAh0E&ZB9~+T#IEeJ)II{SYb_%?R^JX8#LV$U6v2xL#pC^0$ZzqAP~m
zPyPW+enjX1fJo?#b}{je4N)%RXaVfRZ)XZ9WlL^*Qfg_KxT;1D0w{<Of-1<AV(Bk5
z7CEp|sir<l*SFLI=Z}>u4Xm$Pj&l_s-U8tSN66N;3DnuvZMmJ2PDYrAhQY0Cm4#A&
ze*?NY`rMS;m{aiFIuD>~o(vins#I1zLMkH4%Rubq_BweiPh%4X*&@G{i5KlVE72gZ
z`<@n-5;%6X;mG|!6gEQ-)`n=qAoNvikOv2cH-&JU$z`&1I*!BCw3g%@BsOu@(N|Kh
zs_=c>KE%Imxt8pdO2_pjjuWwtx%*@n@zT|I_HuZMU&-Li;Y3Hd#M4fEQHJHpLh#NV
zYerRlR(0R8Qba&p1lC^$cWyX2O>bmrV;)N~cbFA;MOl=Mxcs9WTgY^nn~>XN%<`xc
z#<h^E2s91irx@;O|IsJCcL%LZgNc)NhAR1@IZLhXtAFaB-cp&ALos*I(g_pDE7LQ2
z+K3zU#_hm9xN~p{cx0m=P&=xng`rUdcxjo_@i<R+GHe<A6QbQ89*G0X-I~I=6afD*
zcl7LI!BS7%WrYbX^r|21&d46~`)m2uC`D#-25H)Y?sj(l0O*Zke*O~Hd-(0<m&rRC
z&o8p}i}UZ>Co8sX85XN0{B{t6BzAybIb8O?S=tW<gWZRCNdY78lF8*etTeQ2qtOz@
z{HY*hw4`C0MUom(^Tw@znz>?{#%+;02s#v3n{1BM#_~jRhD%xK5rFQAt!!H3Q0sd~
z!dnQ1{ayRCfMf-xV@i^=l@U7sC_!1^eN6Mjz4LuR!nel|lOP;Jd8E6=5ure^^Qvfa
zwk(h$h_XjizEd~9F?eN1&tlRJ>n7a7`zU74<Tqo@i<Bisxg8+S*~jdhuv^C8j1leY
z8ZCK#V_)Xgi#rc^j#9!-r43MC;fX6OPsD_>ClvS&a!<NQ?SAZ;HXDHsD~r-<D2b-a
zG71i<;t{wNqN4(UilD+9Xqax=hMu2(S8M!2UI{742IL^JLjE^^)d;_v{~vU20{)nk
z*T4(09fo95C2_DQ1~xY%Xu_X`Fs`S{D~W`4y@Nn;(3tr<A1H6E;cMtYk9-4(pLt<_
zI>|Kd1l?s}JO4FHY0pSIwQeOxe;Xhidjt;Q{Q3n6S@dc9SWTM3!=0oQy41W(VdLv4
z$ck9=6Fpz`%EQyvSifo!u@6@Yv1jj9CR9>D?{!M_<~MMnphN_Ygj<6htEg0%{}kw(
zrwYmG_HNpZ_+Q$iVM{V;T_R1ko?96O``Mi~dUYTsTwowj5SMw-y8K;)er2ani}cB5
z$dxsaKHM&`h!Tqy|JuIJ7IZ|e_nhP2q`<U9rGfCi(xq5a;iHBbot8@n!tM1bAT=OS
zV1`IMRUA->o|XU8r^Kty1S%hTZ4yDIetqh-|A5Wk0f*$CYuz$cunVIBMOxprB4cDA
zX|43&j2^YZ0jTWk>EqM^Gw(PN+-!kO22yz4ZS|Y-U3Go5CjH0&cO)%2{|!_GGY!X3
z8co;s_QZsfO968@oy@I#Wd2Gn_94HrW=0R47RRraMM|Z?!%KRpfbC=_13PvZ7NV$s
zl*l2}=hy*?Sl9<FM^sb13;j_mAbQP)6o_duWBMlF2`~cv7im;T9_83@>*Sz^sA3Sz
z4FwG2{90cb4*JBp7u}qPD9W`{9@c?2E}_^&UOvEvF)p)1PuUo}C8p&*!ZuFoF^c}M
zaBxWh+G)UXMjbF!(i@|#aQ;-!+rV<-Zq{r2kGa~T!R5n$_<402%yihOHl;W4fTe4-
zf4_ohc-z8eP=4D6VN=;m-mENe^hQe}Qh(NvEyd7K7v*$AF5Ioy!|m)Lmh`##w5;O_
zbkU@NLXXeLPmL$m(c`Qh-Y1usqHQjWZmC3n;NaPs0DWK&wmX0OT~fBS`j^(7mi3=Q
zP0+$@@~+A)nve9&w1<pZ?nzC@3P~T3=Jg(4{gSu~QG9PVgYAG-C7W8}66_p+WSwM3
zXP(Fv(44_rb#uQkQu`dDRnOqKUb57JEFff0TtJHh{sy2H{hQQ*eg82dHsxm!)-QeS
zPyZE+7}kB+g$Gb)Mf{g}e9+uc2L8Tr@S;Ai3^wRgQOT&>yMvge5?8y>0MDOt7-8#+
zVz3qxSSd~!%J$fucch1y>Muw&*x+@Ls%F@DfUCu!uccx!2+pX$rEaIeFZJ(61fY2y
z@+{P(@GNVR@!dkr%OSj*Sil;{>|yU&mLl)nyLH7<5?-@Y>k{WSswiS^oh!YnppL(G
z;3jfnQ1$!@UC;8Y&>03M^!cX{D~WBMzKs`_cN-9WXj!zVeeEb2{x-i_78QwST32xG
z1EzybL&NL3wIKn+$IZl#N+kF3_#zbj8H%~xc^^@D?<XRN%%xMJ5$b`2I$D1FjS59I
zfTiR{^Kfh$e8fi9UzmkR><s(N3eJ>RjmC5B@Ty-~njTn`^)SNrK#U=ta;N2{6Z!Y(
zvYK@`xSUCQ$ldxfA9)Wk%>ag~n*uc)eVD5}0_q0ZtYzCRSxqUE&4eZlJ=cg!<uuZS
z*oa#r!zvS*O0kS3B7Q+LG$A^ns&~$E5q@69mc0YTK_+%?5v)N!nWdaNaSSv;$%U4M
z3<STkmNx-2^d*6kB)&SAmVwzD=mbDcJU%d}7Dah#rr6Mw*(|1FY%5E5wKI>*$leVd
zdZME1Q{7s6OB>*9XT|`=awHQ3n`LtJIx|G~ELwiD;zd~(YF`X|RpWbhotS{S>Q12~
zAUm4{CG9PwTT$P{r`fV#O|%vS02$#^)=S`AlTCj7$9LV6)FAasjS1$A#NRcBY6rYL
zl+c)Z5dekAt(-yAgZq2i3E>~GU{+BnnkX^J5sw}Fn(XsGvn%`Rn$j4G{-7k<Cb?TZ
zhJpkP$2dQyLt+@WVjs9B*ZpSH`om~sZtP*k8k;|F<$~9!0yYjbki+JMJ1@3dgDI}$
z3hS{cul8?~(!z5vJTZ#6zXTOGUp^{5F^JC%Yjg>v<p{7$?}FUTyWvBEppX2#1nja<
zV3LY;qcsh+QU`p!0ssHpz<emENvpd3c~oDQ<ugA;`)A`bs@#uCoY$zLx}Vjo5teAX
z>UP<S*|c=79vz_6N`A?*59aW@Nkv=H?VzZ1bQ|jnYPv2qjR|693L9&+$|2bpuK>Mi
zj&T{fad-D}q&t8syIn(7HwwCh>t|V>GDJt0B@csTPw7fqg(&x4153D!SsPKWU|a5*
zW?=T^H!`#StScCxUl&U_>I`nVbO$~vG+B&A=?z%VV%BwO@IfU5l(FW~a)jdIrh|gj
zEMrt{j5rP$j}`xr@kcNtaAonC0H_t|rOnA##1h^`UDb#%5%Nw!!rI(OHY?<L1$?Lf
zSeE)bLS$4&AfXSot2%M5L~?T830kf<JvtcFYMTW}ui*b>k#wEIy10<|v7#;lL!Wsu
zbhihCHR)8~X{hoOh4*x&$?b7GuxU82wbo#pRUXieNvoFta&J>BO`k8=Jz(qi4e6d8
z4t_hW(1yKvwvNIUiQDudwsMzthEEn~@43-IFY#8BQ)du*H18e{&yst<csMYT6cu^m
zZXU=Xa3<HV@M`#VK4*&)wMNyBs+p0|`;T5(=0;kj1k?+8Mlp6ZP#X3bIq57Y$XM)W
zAizLRUxvr22DhiX?S-?N`y<2ci9^3O@1)e5NPg27t6?a_F9WER#(v*XvpfJ{YaLNB
z5PuU->Yj_JH6{F6rXjGS`P?I3c8jD&uWEOoq!@<>aZ+C0>L(aLf?JM=*+mo&`|=vV
z45M1qsD41Ip$d!&=A)D6azJ|I5Z`Ev68rnS`aFX?Dw#J;jcQ&Z*><{+D~AHe_rzih
z^GrG9iy_m}5~15VqZ}&HzF|Q&FIwHGoB~DbIKP)AyBtN2P<^M&^E%r_f{gI&Gc<<n
zUNd&+%`Zx-GpDIgW2NA6nK~XWte9w2po*teg?i`EDA=jni3OhiB}t7Zyuk07qH?uM
z%e0Fm?Rb33@#X&$oU847y9T#4P#>ljtowEv0Dx(?1z*J$Y>Xp=zvXfKN9b>7TDi^0
z;k+D7(SzKj%-?ReHFS>sEKXQ{6><XrTyEo({Uo}RgXI|5fF#Ya2_l~&g@Iw{vo4*<
zxvNgtsjSms!c`ffV~n4K^?8CEw?~8aatcn?;$;WnM4)OcaGoT@2fWmreKXGDctq2<
z^X{Gdt&;ZAQz0U9$pWlaFT=eS{x{#zX~D>354#l!>QS?s5|(g$|1-vpBA!+M{K(++
zEvO;muWLzkJWdslhbZB$ayGsS4dz#RN!AV6@%Eyuj#m!e27*V<dL(*&isRLOann$>
z6~h`9!LjRX=P-^>AMP%=YT5RitIstL)fdE8Wt_&9-Op4ESeFOd)9C(Zt!$Mwy}h4J
zP*D;OIrH!$GNDHY_^(88IF>zEzxChxwj=}md<kU3FJ!rf*3l^jZB5_i8BOCtnmnFW
zcFGi}eMP7iDJxiUIMY`#JQSp<nc|(&zl4SZ>#F&mB!LWWqt<ot&fsol4o42!pKvvd
zt03+m3?;k4i2)b-bn1T}H|}hx@(_ilDP24;WiOk;#Le+JqoiRC*~}_f#MFsS+wWUq
zAU3_dxX;wsu4cn4`-O83V37(jYqM`$2^DSu;~6mLa^DBci>#JgT__+qIS14nFNU;P
zEU`V4RvW!yU)+jLG{4T%FX{{)W?p=n2(zl^RBw+>aUeKB1tNtG%bdF%=C#ft++~xo
z5)JfU(LicH#=p`3fao}n(`F9djIjO1sduLfS!VsFt1KFOfAkdQBB6ihi3$_PK<WWk
zNWWQ@Tqe)$xm~wv;8x0uoL3;H^Ps1kN})GI#oY)sw>i5QN8+1Npey^Wo^qc>tx;YT
zNpTE6+jGDaBTY#suyn;?hj<xS44G>d<78Jhct7rqP+B|lSv?~NFf$%u2~^;TSBO`k
zdpoI&R)%)4C8rF>>b9I4EoiwEA#f#0QYGIbka7@lgtQH5WeU<i>e~F0A}e@8bX7=Q
zRNLL0Qfgj5H=Q;3=*m`CCkQ9kSsCqw>k`oAQ=<ZfQal-jdjNDKNeuei>5GblKh$q!
z-(Bk3BCuG~>g=<;>?a`RFrSkv;P=WaX^ek8>iQCPD<YPT$nH|2PhP;s6&_x#0XlqG
zBah`Xq~JIME6c}rM6t)8X;*vP_!w$o)5LefHScJgKFs7>TEW$cNRkGu3Q-@)jX-oc
zVhFEo_`yN-c1!I91oZmSU_~h-YyJ5uV88Jbre^W6S=UR9m^AejNC5elk+pp!-3)JD
zgG6*X6FFDNm=z|c`(L&ZdCww=cGZV~FXI6_Zj~Z315v~QT}coA^!rR#-6v=N+ST(Z
z^42M7qEq8{u{Ern)4m0l%=@f4Li}>=;Zb*!aAXWo?lv2hj*w@3;uitBr%7KcP-d@9
zQwW3O)JUbHU~EqKC-PFbP?gH(@=s*VVkdu>D9;RStu$U=$p+BuYS6|izZ$cdYaCRS
zC_-2lecocDJGb)ZE{T{P(x6b!Wc1)`BJ!&eL1R|7JM}*o5(INM?L#O%gI6R5aw{MI
zjt4^`#vz+e=k=gzV@*jAQxLKA&tvsnXGM2aJ{KBn&_t1>;Mn<Wc1$J9_oc?v8)0l*
zuUblF6i*l~D;eu{#~k2rYrCYWjijS+><f6XBcE+kS?6f$q5!$;L@NP5@aC~p?ibx0
zW~*!AnRNA^!-UTXm}cAyf^Rrs6FiZk2Bz(^kGpFh);Dyunu>I~>7>Ia+b#$|*(Av^
z^cgtU+Ck+8`?LTn{tM`xGqtcy4Ek(Idc1EMbD{haPdpVfz)e5hhywXZu85^^dM4tG
zG#m1#JLHD#V2aTGcbiKQUg6{4f_w_>+puaFoPi^=rGjLoB)UfrW6?buxeLwDqx`e;
zjPK4T{K>jaz#v!(c{}T%8LXy}Y*Lwi{)1823eiBa6L?AP6&GIu2j?UFc{Vz6@&!l?
zsmyHZZ<H_{SUg4AUSk6f)uuL<7WNv#tF3go&8)P$lj7B`4jbcOZ6COg%CQx(mmrLP
zv%m3}Hf5ANkwmR&g;xPbd^?dE<|n*tMpxTub}%6iH0Ie3Wl9~+m&_)*{n#ACKz-|J
zvKF(v@v88ngc}kg%r_%MemT(W+`ogAltHh;x%r292*T`Nm!7wo_FY*lu5%BA&aytG
za+VXbnQ52DC3r`lsW-Q4W7$ZH+l-|)i^{fT>jw>kkLS+p^s?*^ZD5jVhRTnxK8okj
zK|_9}T^zt0@g2@DO(1WBx_f|Cx27huxh(ZXJOQ?}ptVCsRZxA*co=Z(e=mR$@>279
zwR1FgEe)w&yd<utY{V=dq8mxuPp>VD;aPedKGAPQwjD~tp|dZQt#2_v?f0KcHQmrC
z5EdWOZmWzh8fw5!r-WkBD)_d2jT`kvMm+)uU~iZbATPy;D7g_Ix7iAMCwyLAd=a_L
zGifDE8oJ=#V;}!29>(Q0fAMcL&`*-o7<Mlc3~Zb(B}X99q%VHs&N^ubQ|W!?y?|A>
zy?LXZxWb~wOMJn%=dqpN(iMTu?|lmWcV1!%9J_b-wSTcx9-bieKL90=lAUKypXs*5
z5$J@39$wpUs+d1V2bZDL{I1&}^*PUtRR9n#O-&XQb?^{|j#u(C;5Wq44uY8xv+$?F
zV0BZikRcEy<(-2&@YOcld=gNczwEdnC|Jx0xt1#roacaPye26Mi+U~o7$Vq(>yI;8
ziCD!!t9&<8<$FUVEhG;F5eO}1>}}?Py@+E-QC=0+!eyWxNCh}`s6qnWpUCr{+Js&j
znZKD@1d8~4Es{$uOc>A(yKhKI7iDJ|$3m^Ftf^d`6>l8BB`O=3qSYYmbT3+jiB<u8
zoU+6U-mAe9>;?do0_aOv2YFOBKv)GVJYeyQI`g+>AP=eg5PrCiL8qY|Hp3O!)2p^g
zDkThuRSN2{5=?S98=UfOb%W8jHw{$gL!5u1{;meSqj9gov};-F(6i9J-m;X|C=71{
zG<*83eA5a!B|To0sfEtV%*LYc!tE>&K^eH>zd3!@==>nK8sO$Tko}f#FXRe*dbB6N
zEF`-Z%w&46)goUyVZ5SPEyPga%$;>1x(3S*o!3mMEEJwV&<X2qvcN`>?-KG(N)CQ`
zvDPw_ZfoOV|2se&%214*wEc(UNRSM|KQ|v>M2n=q0u{HOO`_1socpK=m&8+6fDfom
zZ=}8BB&$Y_cjA$14T$~5c%k@rH~q2z$#?9M1y$h@G&2Abe{0lgF-?WDy|yQvkH)Wd
zzjKv4MZW_eBi%%!t)$2h=60@gOq(mVy9JC%6k0v}lM_=QM+!akwhTT0>Gw@)kiy<J
z=+uB1qycmi32^ePbt0+-xcQ$rOkgNKuEo+nhc+58O}DBUv?vcRNW~1m!mFy73oi1j
z$EjYWEX)gKFCuVah}0S^<B9cs!T%aCUVj0ihsX2P+K=HO*b#~Nh3oj=tLGcyJlXi`
z50XPo8&d7TcetvEz+prWGYcZM&CA<)vV1nTJJ|d;VIdOGD)C|Pty(iW;m!<y<Fk_|
zd<OrxTYQpDs%FA)w5}it>?zqa+LB$*XC(0NOkG_f2DP-i@3n<Xof6W}SZgB2nk}gw
zu<+yN4AlyQ*s-g1qN?8xTLgz`qW#DhKRIKG2j-21n>CpE?>j+--h(-!g*Ni?T#G=F
zf85B9WB859%?3hD4=_jLP`P+!<Vc*ku8Yj>5o3~S=S^*pXP#@dp1cAVdOM*qYp<?S
z108W#R<iWcM!4%zV$&V=^QZVO*{u-%P;!N`Kej}B#=n#c+~MnL9Z1is6O2oO6_e1k
z-F4Ll!i1=uL!^$x0~47I=x_qRsx@jWqTFNtbbxj&=Y<r$rnoFNBKi&NRAkn!Yh&m^
zLArm1@yW1y%yyFTlP+X$U5067u*V98wPyLnw5u3!C7#4{4JaF}(`jz$gd{-%SAE8)
z(rROJzs`mOFP-<WjWhMF7nXJreZ~drWk^DeCfJIQkf98R+PV413Q9jy;WB~87e~@x
zMn81at4E-@u6U&Mvn=uPflL^$-Og-t1Viand>RG2(~DsO{9F>vEkct+Q?`W-4U&=0
zN&777gq8+MIX~QsF$wQG1ovUz9JEf;m(AYiPuv*il@lgQMN4|W2A;2TWu<v{<$^w;
zHGeh97bkY*(oa@_!}_9pq+L3REb<FF6T$Y4fp{A2<Jfg=Eh=}I1H?NT{CV?T{4>%?
zucpI^!R4DaX%1YZJ&mrM2&NZQDbCun)p3w>3S+wc54_?nmea6#+rcapRgnfj5_d)J
zJv1OfpEi~U8wwhI?i6W$%ISkae)_|sqm>X>s=q?$YJ9?PA~(3CrQyW}J75do>CgB%
z@<O?m!MvFT=k>0w`0EXh@h{Y43}E7?4W3>^QN9&vg-y?oV{7uu2Zepr#5t7diXD5E
zOE3@c%`zhcFFzv~w?x5PFexQ1BRI@H-n5wjP$Z7UnD@lXbx6ph>ZiIyWWcC#Qb;vn
z(5QRl&{CyvbBGj+AU)G%wa4u?H)?!^V@37RH?((@14fA2G;dfPJ-(1jhN*Owg5tIg
zuC2}*(bo`&d7YYS#@^9ZmHkN-3+D_aH}!gJ?k*h2Slm?}{((h>ie1a+t}vqo@INT8
zh6LVIwSsu0sYQWLSGE1ZMy=cz<?!9szOnzR;#E=?k17au84-;IvvRd*`6uC8acS*q
z9b`{M9ZBuP$P><%({Ux410Jd#)wu!V*o5UIjdMV_Xj<LCG(kWDuonDUu8Y{Zo0QQo
zJlefZxY7?9gOJnHh}29zROAk1{2fv@Fa*|kcK2J<gAgT;=AUnQ20Y)KFqa@&uYDUh
z^MHK`@}v%7G$5*2nMpzhyTA@{?llM=oT~>e47#~~l6lBxqF+k_(0|Gzr?LRt)j0WU
z;kI02#&`kvn`e2<qzL_*!-F|G{{TWBv2mFxq|wj#IWJ3*w&WL;{c%f+J)wg>W`U4k
ziL^bDW@b(~>wKYEyS|?o4>UGdM=+jCBf!tjd9O7NDN?aOV6kCp)GpP)ctHB$#T}5z
zKzV~Nozdn-V`l{PhVIf1zTv(`MwRG8w<Vn&KTJsWi^5V4{bL>zIPQSgk7B4dKDe@O
zm?01rsYi!UkH7MnPm5Q6)7IOgnd?ct5n?;6ql?e-L!%dMUN{}x(~Y<{?z2bM{TI2q
z$KSf;bq(O%#XWCpL;I#$cCIEfQelBU$%%UUK5>2TjnINKszr|r%soC0CpAg<?nUvU
z|2=#}Jcx!%@h#BKoO1)%kE}?gXy&OTGb|!GI03#eXSq#hOKJj99q(H~8P?V1#+)nN
zf{Xe$xJJh(0J!kqGQ9hgZ$P1DDO+v3{n!1f+INVj1V!SnXrImOoqB;1|KFaz3|B%t
zr(*|BEMU4aIt=^)GP}|{Es3CzmKjlPphnx?d<9KAE<3*gCu@~9Fh{6#hE?{&7QRZD
z!HgwKZg`1{b&5wj*1%ADh@OvrrB6JfZK#gmM|<K1NKGfRV8HOhnK<ajYPk%k0O2kM
zB@X<7GoZUl*QcfAo`L7;7O8c+HY8PL;KA+Z!7wwDa)`eB7pO3QqNdv&zleq~f4;M;
z`@nPs7Vk*pSTL1y6pgM6SN;)x^f=g+(+}Q39M|?xJhC{G2!FInueeCJ^-n`}YfiE_
zzeLM8tys#r+Yvf);jnYq)5b&CR3uLSxw_s1q_3arpvHmkCfWWk7yG_-l9*|7bysdU
z5b@Py5siK{GlPRWF55BZygkXSfZX#_z>zX;amyKhbOl`YWH<kQY_7PDE=gC^T9MWy
zDWIOE;u)p+f*F+zXeh(lOm9|&Ckd|%d@r5qM}8yA-jypG(nipEsj3a@6!B&KNkp}J
zCq|?vM1o~k?B#Nfz(F|shKvlnWxp=karJN%u`Xhyp$953Q`p6x?LP30L(c1UU(L1v
zj(jLc?Auvi(mk_*D=<3h0)!`8Ow`W)#*W;NxT6B@Slv~okd+K{!;r(RG{k~mDz`J3
zi@93!_kOYoM$1F8atf_tQ@q?uHW9m@YfsM>H;bqN+?#dw6J;b#gL&M$#>we2#IaMF
z`M<)TE?^F4Hc#g^tJw<#5&Z|9OQi*M!PsQ*^e&kU{}&2+-=|KOw7eAH&uSAV`g9L@
zkBj&A_@NK0d~gfoq^Ejlo)(JNfX-%61Fh)SBPEi&TW<F9odRs~+?w$Xmym036LPOY
ziPtk)<pNBMn0SJoApe7vr4vwJC5g$?tuNRhzn;Jesu(dGX)JWG#dqy!i!Cx$HOqkU
zUzFNprEA-QdYO4=H6HVrt)7hQL*lc{`Hlaw(`}@pJdS$Ci1nW^d%(Ib2>4tEN*=L)
zyj{bJC$V1-ZZJvKOFrBi2ILSH^X~!sskTfJB&NUUfI@7#D7l3my0h;9%&+96ZnE%-
zwe7r|OK*QUf>J~(i&RTdA&5F@bO3huef@c)?xLNs<$ZQFcLu1nYiq)nfO@Y<hYuUM
z0!*X4L^E**330?{5^r|6UYdCx)X&s!e8qrO(R+L$4juDa79G)?_9H1^aeK95TKP!T
z1$iebjW4CsBPw5x<_!%NBD5uwD+_e85>q*W_z`%iEl4tvZ?O?8%${}o=SH%_1h`ma
z_9Ym^1|nt2qkJHIxHM4hrXo9-3fVsC-RIhwZ=%l!Mdw@_9Z|g<e^-1~vN;f_T`-7`
zVsuspmWURUtCp4<Eu)q!O3mKL1;vq#6Zy@N^$t6<d9d?oxXdHw!&RdVKS1ht^ZZgX
zXhPGqlzI>Rjou@s+|0qkpzvK9;u4~}@tm7jsol)p*4YbC)T)b|lSU6iN5!5s&Yl~W
z{5jF#x_JI0UXF4S!=G#-dCJa=m{6yZO2y%F8?dbuxrcD8xjOou$USn*SK9kiBRAC0
zoc08PJULw8^D5Y)wcdG1a-&*sU2;1Sv9l{Y8-z<!lg4n+6usQ%SB*V;n*}%~x|J_$
zgD5zutWlOk3p|6dxD2fBTMYrIr`6)~)H8J8evXMPh9`BwdzcZ=F5TCb@&P@;3Z>o5
zJJhuoEBxj<NgaJ+6C#Ci^%q*91Y=T}9zRa846bEbN)0YSa2~|&e~zcv0cByi0~++z
zlrtza3d+)z92?Y>AIT&ZMXU%W8l!ju<Ge%us}Muy#cIoNLuOpl=5^e+$~%^8vK<$e
zEk$i#W|DY=e7%pkf&-=M<H+D6Xd_tS{8*WMZ$OsPLVA^nn#fBS6eKv9T^Jh|VTx2Q
z5f>X*Wy_JSGDhCB`1F-5j9mSIO>&jBiGh~bqe+O%Fy3H13)7;I@iHygm9ON#`g>Po
z_#l8!nhCIQHXo2eLocrMFQ$vCUMR;HsTMy$;Q?z;G|oVU+|um&K}NT^9sG{`d_geM
zhM3Fde3JpT5z8XHJjyI`O;ik#O$NTe3X9eQR7@9fHlvnH=V)L2PKqOqc7#Bq)*T{4
z<39bT=q)&mTymHAx+gsIBnl#dq#<On;Pa~<J1b$9Y%O5{sADtd8}hkyx%bBhJ}s57
zmGUlxyk_r)FYheD^E%xK0b<R8c4mV)3XZERh0^2+x&Iy20wmlb+dGzI+_T&a+7^%^
zy&o5oO=gX*EB9ye#a8OM_MX$VK<4r}Y`Jbg@(N8!4pjHDB!7j?7Tcj{wI<6le(~#s
z*#@n-h9jA(MPs!0U!b++dWAxDD!PT7{2F+88mEf&FFKH8lzMfWO!o&j1h~^>w2iA;
z`V0DK&s`!X*mFB^nrRuZ`Dy$kBXbC8J=^#T9FG-+f8YHe^>jzIrz2&Fnm3H{!9l!n
zx)Zcnx)CWs1t#m@ym)Vq5VQUm;cpG8BhYh!^IL(t<4!LBl9^g4m1^GjGqQ9aD=EB1
zv1A_8sewhF2WRQsUHcX4C=u3??lwb9Mk8>PS;w?<dnCcvi~pFvK_^t7+rDjW=|O>&
z8pM8g(UcKDKCF^vS74TP(W}|}&zCu6U8~LyDTH}uz&z^Idpu$HZY$jrTWBr!Yz-jj
zt>U*te9k5{q9+wOF%e{SU^@xCn=!Cb1;*H4Xrra#UuHaY2NmWw4g{*f1^7x?VHme!
zJ8)ZDWPjgI@Oe~bI)E!RB7&94?E{H|Enpe{WyEqG^4W_Q+XF1nL1&=uwE=l-SH@Wp
z9nUz*?se(PX(mK+d#h^*z4nB^;~?o)0?p4eNbr&GnL}!yj1r8;`n8CuVl0+9v-F~a
z<0c{_+?ir2l&5_n;D)H7?sLoLSf~Y-F2SzQN<B@ILHtzxpH=)OBnTj{$lRBCu{Z+1
zDA8h|hEEqVq`93<X@?O#DFk*p8t(CBuh6N|KwRrr<t7qvOeCncl-E1*Th={t0B>MM
zC%V3yL87W*2RsB^x#ggxQm6HwEqU^<jvOx%pZ*jR#d?xpfS#-koLots)`8B@G@WSM
zi@OwnV8`9wx+m~H?&@#j-jewwqtX1aVwo=bhl5ZLSLhh2acWmOzTO3OvOn`Tu)r$U
zeq7BrWyVv9N1ekRY@)@jWVNA>UAY?9{V0ji;C~2sRC)v|y_+3-#(enos4&p&LZp^Z
z;XP+DgeM#p4gF@0N({7KvBQxmfc5cC4#SRs&@LB5zeZ6+P+}yzrK*pYy$$SyyFRJx
z$TnpLj&W9Oa$tt~)YJktkhYCl>7T|BGmun>O{ASS=#5~{D<l_~OcOcTPMakX&jv|M
zO+;O*eR6%0OmAUe)N?)X#v@pP*DYxzYXY=WTc#rmV|i29VR;{BmSq`qN33JBBzAy@
zM{t|mhI~z3EV+vJXmGq?)LTh5&*AmunbPuW_w1QHwyts^NG*6*xX@EM6zKzUZSsc7
zr5Gxs$A%3A1?0T(_dnn`WNRwnD0Guh%l;_Y)&}qiif_Uq5L%=>&WtjW#|A@OF=NN8
zw$Jj8KFke^%5|Md)?AZY-qT!&A}(q>nbfs~d0ThEXdyJyI@0uv)foO1OeOfok+;B>
z!RNqFmd9U-CZDCsS7tBgCBC73A-IEVKK4^-BLP~Y8m>X;XPOIgb{<T6!5(ZwDdS-o
z0pDc!H_p*2KZ`i<>~mka97S}!A47H`DF4^MI?#cXJSNLG*f?4e`h989hbggsr-0F5
zhNrozb{|hYpayFBJW~(i{hmzBpBdkju}RL0;L0}YYf6+2xX5%Be@tRswZYvU$s$!S
z;q5|5e2FT@()f)=zcULae#Ta@P3Sk=VYrIGg4owemDx`9iAdu{6DAWex{V;#y>-e>
z*f8`U()O4_iMonvyGSe1D9|4!Lw%H{pEjIz8~S`=*{Em9^C(l~1CNGNy62i(*zVw0
zT7=&@H*mB6%$p4y`nf+<L<ijN;1ap+E|SZhujqcIi_+8%X28;bG#H^1-qzznCJx=q
zpo7(ere)oZl;hmAUi_BHZ$TUuZd&G33boL>ng#6j2NM|Q{Z^Ym=nH0j^0Ad}MEKBz
zh)%MrBTr^7RDoecAewd9X!6MM%ENwXKNekM^sN{K1k4xmxEXvf>u#FAVHTs&^S<N-
zQssU!z{a(knj)5enr4+OQo+jZr*l?@QenbJ)<k{R9@<q!v-Z?!n0C(1$QiT@{r~GP
zL196t(i!`Y-I{)J0aVvU@mwqK@*KpRbA!*OGU~K$|KIsOKS)FrRomqlVVoNZ!Kt=}
zmpR#0tx2Xsdjhk#kz#;$r1eb@Iz^td#xAeg=op>+0@zYd3pHA-95jbmHO{6|SzAJ~
zD9@s^Xu1r!P`C60#lZ65&*ODJ)71^Q_VzY=Wc4#G<JGc|pS1D`ZSlZ4w06vii5#r^
z&Km*e^cOgSZisF`OB3ze_nbAk43lZapLw0OPO}?7<Z^gEjW1oi3!Fi$;xJLwXO*4q
ztArvaz`4SX`LsrSO@_itCDuUF%mV`1<!F(b$Fr_*xnbG=?|c8N|5`&xbv!z=%mipV
z{Sy4(?HW=Q;@~sF2h>Gbhr+{SC;xYzhnFX{2WPk=9T1{StnjR_5HI@B=aL<tk1!hu
zg5>PBBy(?6gUJL3u^H+5GjYKYtK#n;%&XhFJf^bfif$gMC|eFk2ZRhQOGJ!oHGdFS
z!6EOt1$8}aPy5%-QyXPM|F3@fw;)ddeNdX4Aw*^f@I+Nkv%~swcD8bC6ti`F905n}
zN^{+@X-`njFr$_nUAW@2<+-QRnBZD-wKs8)ns0t@l5LXKp1f=5S*p-%DPC3B0NGm7
zn}xzC+4uQQxov1ledwNAS`*@ii*U}dq)IX8a1wq=U%=$n`7T&2p96!kDOfNj2E2O7
z@|cM9yb`E2{6J8AI#&RABto!aica#s|Czm3HIM@_kN35v<s#<&d(Z_SrP%zSO@103
zjG#EU9f&k3q7c`=VwEV+Pqy_FBna|i-f*-&la;Z72MW36e{&vJ@e=o)lc53e9DBr7
n^)SCaHi;^5R+qZl7m4s=_G|0**dW$;NkdZ7VZsPSxljKGv=gCr

diff --git a/External/nocolyapi.py b/External/nocolyapi.py
index b18c13d..769d5bb 100644
--- a/External/nocolyapi.py
+++ b/External/nocolyapi.py
@@ -93,11 +93,12 @@ class WorksheetRow(object):
             raise
 
     @staticmethod
-    def list(worksheet_id: str, filter: dict):
+    def list(worksheet_id: str, filter: dict, fields: list = None):
         headers = {"HAP-Appkey": AISOAR_APPKEY,
                    "HAP-Sign": AISOAR_SIGN}
         url = f"{NOCOLY_URL}/api/v3/app/worksheets/{worksheet_id}/rows/list"
         data = {
+            "fields": fields,
             "filter": filter,
             "sorts": [
                 {
@@ -108,6 +109,7 @@ class WorksheetRow(object):
             "includeTotalCount": True,
             "includeSystemFields": True,
             "useFieldIdAsKey": False,
+            "pageSize": 1000,
         }
         try:
             response = requests.post(url,
@@ -173,6 +175,31 @@ class WorksheetRow(object):
         except Exception as e:
             raise
 
+    @staticmethod
+    def delete(worksheet_id: str, row_ids: list):
+        headers = {"HAP-Appkey": AISOAR_APPKEY,
+                   "HAP-Sign": AISOAR_SIGN}
+        url = f"{NOCOLY_URL}/api/v3/app/worksheets/{worksheet_id}/rows/batch"
+
+        data = {
+            "rowIds": row_ids,
+            "triggerWorkflow": True,
+        }
+
+        try:
+            response = requests.delete(url,
+                                       headers=headers,
+                                       json=data)
+            response.raise_for_status()
+
+            response_data = response.json()
+            if response_data.get("success"):
+                return response_data.get("data")
+            else:
+                raise Exception(f"error_code: {response_data.get('error_code')} error_msg: {response_data.get('error_msg')}")
+        except Exception as e:
+            raise
+
 
 class OptionSet(object):
     def __init__(self):
diff --git a/Lib/ruledefinition.py b/Lib/ruledefinition.py
index 6cc9c5f..3d2738d 100644
--- a/Lib/ruledefinition.py
+++ b/Lib/ruledefinition.py
@@ -12,9 +12,9 @@ class RuleDefinition:
                  rule_id: str,
                  rule_name: str,
                  deduplication_fields: List[str],
-                 case_title_template: str,
-                 deduplication_window: str,
-                 source: str,
+                 case_title_template: str = None,
+                 deduplication_window: str = "24h",
+                 source: str = "Default",
                  ):
 
         self.rule_id = rule_id
@@ -68,8 +68,15 @@ class RuleDefinition:
 
         return "-".join(key_parts)
 
-    def generate_case_title(self, artifacts: List[Dict[str, Any]]) -> str:
+    def generate_case_title(self, artifacts: List[Dict[str, Any]] = None) -> str:
         template_values = {"rule_name": self.rule_name}
         for art in artifacts:
             template_values[art['type']] = art['value']
-        return self.case_title_template.format_map(template_values)
+        if self.case_title_template is None:
+            title = ""
+            for art in artifacts:
+                if art.get('type') in self.deduplication_fields:
+                    title += f" {art['type']}:{art['value']}"
+            return f"{self.rule_name}{title.strip()}"
+        else:
+            return self.case_title_template.format_map(template_values)
diff --git a/Mock/alert.py b/Mock/alert.py
index d11d33e..fa19641 100644
--- a/Mock/alert.py
+++ b/Mock/alert.py
@@ -326,2769 +326,7 @@ edr_alerts = [
             "user_details": {"username": "a.smith", "domain": "MYCORP"},
             "device_details": {"hostname": "MKT-WKS-ASMITH-01", "ip_address": "192.168.2.54"}
         }
-    }
-]
-
-ndr_alert = [
-    {
-        "source": "NDR",
-        "rule_id": "NDR-Rule-05-Suspect-C2-Communication",
-        "rule_name": "可疑的命令与控制（C2）通信",
-        "alert_date": "2025-09-18T13:35:10Z",
-        "tags": ["c2", "cobaltstrike", "network"],
-        "severity": "Critical",
-        "reference": "主机FIN-WKS-JDOE-05与已知C2服务器通信",
-        "description": "检测到主机 FIN-WKS-JDOE-05 发起出站连接到被标记为恶意 C2 服务器的 IP 地址 198.51.100.50。流量特征与 Cobalt Strike Beacon 模式高度匹配。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_ip", "value": "198.51.100.50"},
-            {"type": "destination_domain", "value": "known-bad.c2.server"},
-            {"type": "destination_port", "value": "443"},
-            {"type": "protocol", "value": "HTTPS"}
-        ],
-        "raw_log": {
-            "sensor_id": "ndr-sensor-finance",
-            "timestamp": "2025-09-18T13:35:09.800Z",
-            "event_type": "Flow",
-            "flow_details": {
-                "source_ip": "192.168.1.101",
-                "source_port": 51234,
-                "destination_ip": "198.51.100.50",
-                "destination_port": 443,
-                "protocol": "TCP",
-                "bytes_in": 1024,
-                "bytes_out": 512,
-                "duration_seconds": 5
-            },
-            "network_context": {
-                "destination_domain": "known-bad.c2.server",
-                "threat_intel": {"source": "threat-feed-X", "match": "Cobalt Strike C2 server"}
-            },
-            "device_details": {"hostname": "FIN-WKS-JDOE-05"}
-        }
-    },
-    {
-        "source": "NDR",
-        "rule_id": "NDR-Rule-12-Lateral-Movement-Attempt",
-        "rule_name": "主机到主机的横向移动尝试",
-        "alert_date": "2025-09-18T14:12:00Z",
-        "tags": ["lateral-movement", "internal-scan"],
-        "severity": "High",
-        "reference": "主机FIN-WKS-JDOE-05对域控SRV-DC-01发起异常连接",
-        "description": "检测到 FIN-WKS-JDOE-05（工作站）发起大量到域控制器 SRV-DC-01 的 SMB 和 LDAP 连接，这与常规用户行为不符，表明可能存在横向移动或侦察行为。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_ip", "value": "10.10.1.5"},
-            {"type": "destination_hostname", "value": "SRV-DC-01"},
-            {"type": "protocol", "value": "SMB", "port": 445},
-            {"type": "protocol", "value": "LDAP", "port": 389}
-        ],
-        "raw_log": {
-            "sensor_id": "ndr-sensor-finance",
-            "timestamp": "2025-09-18T14:11:59.550Z",
-            "event_type": "AnomalousFlow",
-            "flow_details": {
-                "source_ip": "192.168.1.101",
-                "destination_ip": "10.10.1.5",
-                "destination_port": [445, 389],
-                "protocol": ["SMB", "LDAP"],
-                "flow_count": 25,
-                "flow_rate_per_sec": 5
-            },
-            "network_context": {
-                "source_device_type": "workstation",
-                "destination_device_type": "domain-controller",
-                "behavior_anomaly": "Unusual high-volume SMB/LDAP traffic from a workstation to a DC"
-            },
-            "device_details": {"hostname": "FIN-WKS-JDOE-05"}
-        }
-    },
-    {
-        "source": "NDR",
-        "rule_id": "NDR-Rule-15-Unauthorized-Data-Exfiltration",
-        "rule_name": "异常数据外泄",
-        "alert_date": "2025-09-18T14:18:30Z",
-        "tags": ["exfiltration", "data-transfer", "unusual-port"],
-        "severity": "High",
-        "reference": "主机SRV-DC-01向外部IP传输异常数据量",
-        "description": "域控制器 SRV-DC-01 正在通过非标准端口（44443）向外部 IP 地址 203.0.113.78 发送大量加密数据。此模式通常与数据外泄有关。",
-        "artifacts": [
-            {"type": "hostname", "value": "SRV-DC-01"},
-            {"type": "source_ip", "value": "10.10.1.5"},
-            {"type": "destination_ip", "value": "203.0.113.78"},
-            {"type": "destination_port", "value": "44443"},
-            {"type": "data_volume", "value": "1.2 GB"}
-        ],
-        "raw_log": {
-            "sensor_id": "ndr-sensor-dc",
-            "timestamp": "2025-09-18T14:18:29.112Z",
-            "event_type": "Flow",
-            "flow_details": {
-                "source_ip": "10.10.1.5",
-                "destination_ip": "203.0.113.78",
-                "destination_port": 44443,
-                "protocol": "TCP",
-                "bytes_out": 1200000000,
-                "duration_seconds": 180
-            },
-            "network_context": {
-                "flow_direction": "outbound",
-                "behavior_anomaly": "Large volume of data transfer on an unusual port to an external host"
-            },
-            "device_details": {"hostname": "SRV-DC-01"}
-        }
-    },
-    {
-        "source": "NDR",
-        "rule_id": "NDR-Rule-12-Lateral-Movement-Attempt",
-        "rule_name": "主机到主机的横向移动尝试",
-        "alert_date": "2025-09-18T14:20:05Z",
-        "tags": ["lateral-movement", "internal-scan"],
-        "severity": "High",
-        "reference": "主机SRV-DC-01对文件服务器SRV-FILE-02发起异常连接",
-        "description": "检测到 SRV-DC-01（域控）正在扫描并尝试连接到 SRV-FILE-02（文件服务器）。该行为模式与攻击者在内网中进行横向移动以寻找新目标相符。",
-        "artifacts": [
-            {"type": "hostname", "value": "SRV-DC-01"},
-            {"type": "source_ip", "value": "10.10.1.5"},
-            {"type": "destination_ip", "value": "10.10.2.18"},
-            {"type": "destination_hostname", "value": "SRV-FILE-02"},
-            {"type": "protocol", "value": "SMB", "port": 445}
-        ],
-        "raw_log": {
-            "sensor_id": "ndr-sensor-dc",
-            "timestamp": "2025-09-18T14:20:04.990Z",
-            "event_type": "AnomalousFlow",
-            "flow_details": {
-                "source_ip": "10.10.1.5",
-                "destination_ip": "10.10.2.18",
-                "destination_port": 445,
-                "protocol": "SMB",
-                "flow_count": 50,
-                "flow_rate_per_sec": 10
-            },
-            "network_context": {
-                "source_device_type": "domain-controller",
-                "destination_device_type": "file-server",
-                "behavior_anomaly": "Port scan/enumeration activity from a DC to a file server"
-            },
-            "device_details": {"hostname": "SRV-DC-01"}
-        }
-    },
-    {
-        "source": "NDR",
-        "rule_id": "NDR-Rule-05-Suspect-C2-Communication",
-        "rule_name": "可疑的命令与控制（C2）通信",
-        "alert_date": "2025-09-18T14:40:15Z",
-        "tags": ["c2", "cobaltstrike", "network"],
-        "severity": "Critical",
-        "reference": "主机FIN-WKS-JDOE-05与已知C2服务器持续通信",
-        "description": "FIN-WKS-JDOE-05 与已知 C2 服务器 known-bad.c2.server (198.51.100.50) 之间持续存在低流量、周期性出站连接。这种通信模式是持续性命令与控制活动的典型特征。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_ip", "value": "198.51.100.50"},
-            {"type": "destination_domain", "value": "known-bad.c2.server"},
-            {"type": "destination_port", "value": "443"},
-            {"type": "protocol", "value": "HTTPS"}
-        ],
-        "raw_log": {
-            "sensor_id": "ndr-sensor-finance",
-            "timestamp": "2025-09-18T14:40:14.654Z",
-            "event_type": "Flow",
-            "flow_details": {
-                "source_ip": "192.168.1.101",
-                "destination_ip": "198.51.100.50",
-                "destination_port": 443,
-                "protocol": "HTTPS",
-                "bytes_in": 256,
-                "bytes_out": 128,
-                "duration_seconds": 2
-            },
-            "network_context": {
-                "flow_direction": "outbound",
-                "threat_intel": {"source": "threat-feed-X", "match": "Cobalt Strike C2 server"}
-            },
-            "behavior_pattern": "Periodic, low-volume communication typical of a beaconing C2"
-        },
-        "related_events": ["EDR-Rule-21-CobaltStrike-Beacon-Detected"]
-    }
-]
-
-dlp_alert = [
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-08-Financial-Record-Transfer-to-USB",
-        "rule_name": "财务记录传输到可移动设备",
-        "alert_date": "2025-09-18T15:25:55Z",
-        "tags": ["finance", "exfiltration", "usb"],
-        "severity": "High",
-        "reference": "用户j.doe将公司财务报表复制到U盘",
-        "description": "检测到用户 j.doe 将包含公司季度财务数据的 Excel 文件复制到连接到 FIN-WKS-JDOE-05 主机的可移动存储设备。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "action", "value": "file-copy-to-usb"},
-            {"type": "data_classification", "value": "Financial"},
-            {"type": "file_name", "value": "Q3_Financial_Report.xlsx"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-finance05",
-            "timestamp": "2025-09-18T15:25:54.660Z",
-            "event_type": "DataTransfer",
-            "data_source": "Local File System",
-            "data_destination": "Removable Media",
-            "file_details": {
-                "file_path": "C:\\Users\\j.doe\\Documents\\Reports\\Q3_Financial_Report.xlsx",
-                "file_hash_sha256": "c3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4",
-                "classification_tags": ["Financial", "Confidential"]
-            },
-            "transfer_details": {
-                "device_type": "USB-Drive",
-                "device_serial": "A1B2C3D4E5F6"
-            },
-            "user_details": {"username": "j.doe", "domain": "MYCORP"},
-            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-09-Source-Code-Upload-to-Pastebin",
-        "rule_name": "源代码上传到公共网站",
-        "alert_date": "2025-09-18T15:30:15Z",
-        "tags": ["source-code", "exfiltration", "web"],
-        "severity": "Critical",
-        "reference": "研发部员工在公共网站发布源代码",
-        "description": "检测到研发部用户试图将包含公司专有源代码的文本片段上传到 pastebin.com。这属于严重的数据外泄行为。",
-        "artifacts": [
-            {"type": "username", "value": "d.chen"},
-            {"type": "hostname", "value": "DEV-WKS-DCHEN-12"},
-            {"type": "ip", "value": "10.10.3.25"},
-            {"type": "action", "value": "web-upload"},
-            {"type": "data_classification", "value": "Proprietary Source Code"},
-            {"type": "destination_domain", "value": "pastebin.com"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-dev12",
-            "timestamp": "2025-09-18T15:30:14.981Z",
-            "event_type": "DataTransfer",
-            "data_source": "Clipboard",
-            "data_destination": "Web",
-            "data_details": {
-                "extracted_content_hash": "e1f2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2",
-                "classification_tags": ["Proprietary Code", "Project-Nova"]
-            },
-            "transfer_details": {
-                "application": "chrome.exe",
-                "url": "https://pastebin.com/post"
-            },
-            "user_details": {"username": "d.chen", "domain": "MYCORP"},
-            "device_details": {"hostname": "DEV-WKS-DCHEN-12", "ip_address": "10.10.3.25"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-10-Health-Information-Transfer",
-        "rule_name": "受保护健康信息（PHI）传输",
-        "alert_date": "2025-09-18T15:35:40Z",
-        "tags": ["phi", "healthcare", "exfiltration"],
-        "severity": "High",
-        "reference": "HR部门员工外发员工健康数据",
-        "description": "人力资源部用户 h.lin 试图通过电子邮件将包含员工受保护健康信息（PHI）的文件发送给外部收件人。",
-        "artifacts": [
-            {"type": "username", "value": "h.lin"},
-            {"type": "hostname", "value": "HR-WKS-HLIN-03"},
-            {"type": "ip", "value": "192.168.4.15"},
-            {"type": "action", "value": "email-send"},
-            {"type": "data_classification", "value": "PHI"},
-            {"type": "file_name", "value": "Employee_Health_Data.csv"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-hr03",
-            "timestamp": "2025-09-18T15:35:39.145Z",
-            "event_type": "DataTransfer",
-            "data_source": "Outlook",
-            "data_destination": "External Email",
-            "file_details": {
-                "file_path": "C:\\Users\\h.lin\\Documents\\Employee_Health_Data.csv",
-                "file_hash_sha256": "f3d4c5b6a7e8d9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1e2d3f4",
-                "classification_tags": ["PHI", "HIPAA-Compliance"]
-            },
-            "transfer_details": {
-                "protocol": "SMTP",
-                "recipient": "external.clinic@example.com",
-                "subject": "Staff Health Records"
-            },
-            "user_details": {"username": "h.lin", "domain": "MYCORP"},
-            "device_details": {"hostname": "HR-WKS-HLIN-03", "ip_address": "192.168.4.15"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-11-Leaked-API-Key-in-Code",
-        "rule_name": "API密钥泄露",
-        "alert_date": "2025-09-18T15:40:00Z",
-        "tags": ["api-key", "secrets", "source-code"],
-        "severity": "High",
-        "reference": "Git推送中包含硬编码API密钥",
-        "description": "检测到用户 m.li 在代码提交中包含硬编码的敏感 API 密钥。此行为可能导致未授权访问公司的服务。",
-        "artifacts": [
-            {"type": "username", "value": "m.li"},
-            {"type": "hostname", "value": "DEV-WKS-MLI-08"},
-            {"type": "ip", "value": "10.10.3.18"},
-            {"type": "action", "value": "code-commit"},
-            {"type": "data_classification", "value": "Secrets"},
-            {"type": "repository", "value": "git.mycorp.com/backend-service"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-dev08",
-            "timestamp": "2025-09-18T15:39:59.810Z",
-            "event_type": "CodeCommit",
-            "application": "git.exe",
-            "data_details": {
-                "extracted_content": "API_KEY = \"sk_live_abcdefg123456789\"",
-                "classification_tags": ["API-Key", "Hardcoded-Secrets"]
-            },
-            "commit_details": {
-                "repo_url": "git.mycorp.com/backend-service",
-                "commit_hash": "9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c"
-            },
-            "user_details": {"username": "m.li", "domain": "MYCORP"},
-            "device_details": {"hostname": "DEV-WKS-MLI-08", "ip_address": "10.10.3.18"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-12-Internal-SSN-Transfer",
-        "rule_name": "内部社会安全号码（SSN）传输",
-        "alert_date": "2025-09-18T15:45:20Z",
-        "tags": ["pii", "ssn", "internal-communication"],
-        "severity": "Medium",
-        "reference": "用户j.doe通过内部邮件发送SSN",
-        "description": "用户 j.doe 在内部电子邮件中发送了包含多个员工社会安全号码的列表，此行为违反了数据保护政策。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "action", "value": "internal-email"},
-            {"type": "data_classification", "value": "PII-SSN"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-finance05",
-            "timestamp": "2025-09-18T15:45:19.456Z",
-            "event_type": "DataTransfer",
-            "data_source": "Outlook",
-            "data_destination": "Internal Email",
-            "data_details": {
-                "extracted_content_hash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
-                "classification_tags": ["PII", "SSN"]
-            },
-            "transfer_details": {
-                "protocol": "MAPI",
-                "recipient": "k.smith@mycorp.com",
-                "subject": "Payroll Details"
-            },
-            "user_details": {"username": "j.doe", "domain": "MYCORP"},
-            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-13-Schema-Definition-Download",
-        "rule_name": "敏感数据库架构下载",
-        "alert_date": "2025-09-18T15:50:35Z",
-        "tags": ["database-schema", "exfiltration"],
-        "severity": "High",
-        "reference": "用户c.jones从数据库下载敏感架构",
-        "description": "用户 c.jones 从生产数据库中下载了包含敏感表结构和字段定义的数据库架构文件，这可能被用于未来的攻击或数据窃取。",
-        "artifacts": [
-            {"type": "username", "value": "c.jones"},
-            {"type": "hostname", "value": "DBA-WKS-CJONES-07"},
-            {"type": "ip", "value": "10.10.4.8"},
-            {"type": "action", "value": "file-download"},
-            {"type": "data_classification", "value": "Database Schema"},
-            {"type": "file_name", "value": "prod_db_schema.sql"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-dba07",
-            "timestamp": "2025-09-18T15:50:34.777Z",
-            "event_type": "DataTransfer",
-            "data_source": "MSSQL-Server",
-            "data_destination": "Local File System",
-            "file_details": {
-                "file_path": "C:\\Users\\c.jones\\Downloads\\prod_db_schema.sql",
-                "file_hash_sha256": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0d1e2f3c4b5a6f7e8d9c0b1a2",
-                "classification_tags": ["Database-Schema", "Internal-Only"]
-            },
-            "transfer_details": {
-                "application": "sqlclient.exe",
-                "server_ip": "10.10.5.10"
-            },
-            "user_details": {"username": "c.jones", "domain": "MYCORP"},
-            "device_details": {"hostname": "DBA-WKS-CJONES-07", "ip_address": "10.10.4.8"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-14-Encrypted-File-Upload",
-        "rule_name": "加密文件异常上传",
-        "alert_date": "2025-09-18T15:55:12Z",
-        "tags": ["encrypted-data", "exfiltration", "cloud-storage"],
-        "severity": "High",
-        "reference": "用户a.smith上传加密压缩包到云服务",
-        "description": "检测到用户 a.smith 将一个加密的压缩文件（ZIP）上传到非授权的云服务。由于无法检查其内容，该行为被视为可疑，可能用于规避DLP检查。",
-        "artifacts": [
-            {"type": "username", "value": "a.smith"},
-            {"type": "hostname", "value": "MKT-WKS-ASMITH-01"},
-            {"type": "action", "value": "file-upload"},
-            {"type": "file_name", "value": "project_data.zip.enc"},
-            {"type": "destination_service", "value": "Google Drive"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-marketing01",
-            "timestamp": "2025-09-18T15:55:11.901Z",
-            "event_type": "DataTransfer",
-            "data_source": "Local File System",
-            "data_destination": "Cloud Storage",
-            "file_details": {
-                "file_path": "C:\\Users\\a.smith\\Desktop\\project_data.zip.enc",
-                "file_hash_sha256": "c3e4d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
-                "classification_tags": ["Encrypted", "Uncategorized"]
-            },
-            "transfer_details": {
-                "application": "GoogleDriveFS.exe",
-                "file_size_mb": 150
-            },
-            "user_details": {"username": "a.smith", "domain": "MYCORP"},
-            "device_details": {"hostname": "MKT-WKS-ASMITH-01", "ip_address": "192.168.2.54"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-15-Credit-Card-Number-Clipboard",
-        "rule_name": "信用卡号复制到剪贴板",
-        "alert_date": "2025-09-18T16:00:25Z",
-        "tags": ["pci", "credit-card", "clipboard"],
-        "severity": "Low",
-        "reference": "用户j.doe从浏览器复制信用卡信息",
-        "description": "检测到用户 j.doe 从浏览器中复制了信用卡号码到剪贴板。虽然没有立即外发，但该行为存在潜在风险。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "action", "value": "clipboard-copy"},
-            {"type": "data_classification", "value": "PCI"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-finance05",
-            "timestamp": "2025-09-18T16:00:24.555Z",
-            "event_type": "DataTransfer",
-            "data_source": "Chrome Browser",
-            "data_destination": "Clipboard",
-            "data_details": {
-                "extracted_content_hash": "d1e2f3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2",
-                "classification_tags": ["Credit Card", "PCI"]
-            },
-            "transfer_details": {
-                "application": "chrome.exe",
-                "source_url": "https://internal.payment.portal.com"
-            },
-            "user_details": {"username": "j.doe", "domain": "MYCORP"},
-            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-16-CAD-Drawing-Print",
-        "rule_name": "技术图纸打印",
-        "alert_date": "2025-09-18T16:05:00Z",
-        "tags": ["intellectual-property", "cad", "print"],
-        "severity": "High",
-        "reference": "研发部员工d.chen打印工程图纸",
-        "description": "检测到用户 d.chen 将包含公司知识产权的技术图纸（CAD）打印到非指定的打印机。",
-        "artifacts": [
-            {"type": "username", "value": "d.chen"},
-            {"type": "hostname", "value": "DEV-WKS-DCHEN-12"},
-            {"type": "action", "value": "print"},
-            {"type": "data_classification", "value": "Intellectual Property"},
-            {"type": "file_name", "value": "New_Product_Design_V2.dwg"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-dev12",
-            "timestamp": "2025-09-18T16:04:59.666Z",
-            "event_type": "DataTransfer",
-            "data_source": "Local File System",
-            "data_destination": "Printer",
-            "file_details": {
-                "file_path": "C:\\Users\\d.chen\\Documents\\CAD\\New_Product_Design_V2.dwg",
-                "file_hash_sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
-                "classification_tags": ["CAD", "Design", "Proprietary"]
-            },
-            "transfer_details": {
-                "printer_name": "\\\\CORP-PRN-05\\HR-Printer"
-            },
-            "user_details": {"username": "d.chen", "domain": "MYCORP"},
-            "device_details": {"hostname": "DEV-WKS-DCHEN-12", "ip_address": "10.10.3.25"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-17-Sensitive-Data-in-Email-Subject",
-        "rule_name": "邮件主题中包含敏感信息",
-        "alert_date": "2025-09-18T16:10:15Z",
-        "tags": ["pii", "email"],
-        "severity": "Low",
-        "reference": "用户j.doe在邮件主题中包含SSN",
-        "description": "用户 j.doe 发送的内部电子邮件主题中包含了敏感的社会安全号码（SSN）。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "action", "value": "internal-email"},
-            {"type": "data_classification", "value": "PII-SSN"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-finance05",
-            "timestamp": "2025-09-18T16:10:14.333Z",
-            "event_type": "DataTransfer",
-            "data_source": "Outlook",
-            "data_destination": "Internal Email",
-            "transfer_details": {
-                "protocol": "MAPI",
-                "subject": "工资核算 - 员工 SSN: 123-45-6789",
-                "recipient": "k.smith@mycorp.com"
-            },
-            "data_match": {
-                "pattern": "Social Security Number",
-                "field": "subject"
-            },
-            "user_details": {"username": "j.doe", "domain": "MYCORP"},
-            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-18-Unauthorized-Database-Query-Result",
-        "rule_name": "未经授权的数据库查询结果",
-        "alert_date": "2025-09-18T16:15:30Z",
-        "tags": ["database-query", "pii", "exfiltration"],
-        "severity": "High",
-        "reference": "用户c.jones执行大规模客户数据查询",
-        "description": "用户 c.jones 执行了返回大量客户数据的数据库查询，并将结果导出。该查询涉及敏感字段，超出了其正常工作权限。",
-        "artifacts": [
-            {"type": "username", "value": "c.jones"},
-            {"type": "hostname", "value": "DBA-WKS-CJONES-07"},
-            {"type": "action", "value": "database-query-export"},
-            {"type": "data_classification", "value": "PII-Customer"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-dba07",
-            "timestamp": "2025-09-18T16:15:29.876Z",
-            "event_type": "DataTransfer",
-            "data_source": "MSSQL-Server",
-            "data_destination": "Local File System",
-            "transfer_details": {
-                "application": "sqlclient.exe",
-                "query": "SELECT * FROM Customers.PersonalDetails",
-                "rows_exported": 50000
-            },
-            "data_match": {
-                "pattern": "PII-Customer",
-                "match_count": 50000
-            },
-            "user_details": {"username": "c.jones", "domain": "MYCORP"},
-            "device_details": {"hostname": "DBA-WKS-CJONES-07", "ip_address": "10.10.4.8"}
-        }
     }, {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-03-Confidential-Document-Exfiltration",
-        "rule_name": "机密文件外泄",
-        "alert_date": "2025-09-18T15:05:30Z",
-        "tags": ["confidential-data", "exfiltration", "email"],
-        "severity": "High",
-        "reference": "用户j.doe通过个人邮箱外发项目计划书",
-        "description": "检测到用户 j.doe 试图通过其个人邮箱（johndoe.private@gmail.com）发送包含“2025年战略项目计划书”的文件。该文件被DLP系统标记为机密。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "ip", "value": "192.168.1.101"},
-            {"type": "action", "value": "email-send"},
-            {"type": "data_classification", "value": "Confidential"},
-            {"type": "file_name", "value": "2025_Strategic_Plan.docx"},
-            {"type": "destination_email", "value": "johndoe.private@gmail.com"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-finance05",
-            "timestamp": "2025-09-18T15:05:29.876Z",
-            "event_type": "DataTransfer",
-            "data_source": "Outlook",
-            "data_destination": "External Email",
-            "file_details": {
-                "file_path": "C:\\Users\\j.doe\\Documents\\Projects\\2025_Strategic_Plan.docx",
-                "file_hash_sha256": "f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4",
-                "classification_tags": ["Confidential", "Project-Chimera"]
-            },
-            "transfer_details": {
-                "protocol": "SMTP",
-                "recipient": "johndoe.private@gmail.com",
-                "subject": "FYI - 2025 Plan"
-            },
-            "user_details": {"username": "j.doe", "domain": "MYCORP"},
-            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-05-PII-Upload-to-Cloud",
-        "rule_name": "敏感个人信息上传到非授权云服务",
-        "alert_date": "2025-09-18T15:15:10Z",
-        "tags": ["pii", "cloud-storage", "exfiltration"],
-        "severity": "Medium",
-        "reference": "市场部员工a.smith向Dropbox上传客户列表",
-        "description": "用户 a.smith 将一个包含大量客户个人身份信息（PII）的电子表格上传到非授权的云存储服务 Dropbox。该行为违反了公司的数据处理政策。",
-        "artifacts": [
-            {"type": "username", "value": "a.smith"},
-            {"type": "hostname", "value": "MKT-WKS-ASMITH-01"},
-            {"type": "ip", "value": "192.168.2.54"},
-            {"type": "action", "value": "file-upload"},
-            {"type": "data_classification", "value": "PII"},
-            {"type": "file_name", "value": "Q3_Customer_Leads.xlsx"},
-            {"type": "destination_service", "value": "Dropbox"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-marketing01",
-            "timestamp": "2025-09-18T15:15:09.521Z",
-            "event_type": "DataTransfer",
-            "data_source": "Local File System",
-            "data_destination": "Cloud Storage",
-            "file_details": {
-                "file_path": "C:\\Users\\a.smith\\Documents\\Q3_Customer_Leads.xlsx",
-                "file_hash_sha256": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
-                "classification_tags": ["PII", "Customers"]
-            },
-            "transfer_details": {
-                "application": "Dropbox.exe",
-                "url": "https://api.dropbox.com/content/upload"
-            },
-            "user_details": {"username": "a.smith", "domain": "MYCORP"},
-            "device_details": {"hostname": "MKT-WKS-ASMITH-01", "ip_address": "192.168.2.54"}
-        }
-    },
-    {
-        "source": "DLP",
-        "rule_id": "DLP-Rule-07-Internal-Credit-Card-Number-Transfer",
-        "rule_name": "内部信用卡号码传输",
-        "alert_date": "2025-09-18T15:20:45Z",
-        "tags": ["pci", "credit-card", "chat-application"],
-        "severity": "Low",
-        "reference": "用户j.doe在内部聊天中发送敏感信息",
-        "description": "用户 j.doe 在内部即时通讯工具中发送了疑似信用卡号码的字符串。尽管是内部通信，但该行为仍违反了 PCI DSS（支付卡行业数据安全标准）规定。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "action", "value": "chat-message"},
-            {"type": "data_classification", "value": "PCI"}
-        ],
-        "raw_log": {
-            "agent_id": "agent-guid-finance05",
-            "timestamp": "2025-09-18T15:20:44.912Z",
-            "event_type": "DataTransfer",
-            "data_source": "Chat Application",
-            "data_destination": "Internal Chat",
-            "transfer_details": {
-                "application": "Teams.exe",
-                "message_text": "订单号 456789，付款失败，用这张卡试试 4123-4567-8901-2345"
-            },
-            "data_match": {
-                "pattern": "Credit Card Number",
-                "value_redacted": "4123-XXXX-XXXX-2345"
-            },
-            "user_details": {"username": "j.doe", "domain": "MYCORP"},
-            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
-        }
-    }
-]
-mail_alert = [
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-01-Phishing-URL-Detected",
-        "rule_name": "邮件中检测到钓鱼URL",
-        "alert_date": "2025-09-18T16:20:10Z",
-        "tags": ["phishing", "url-threat"],
-        "severity": "High",
-        "reference": "用户j.doe收到含有恶意URL的钓鱼邮件",
-        "description": "用户 j.doe 收到一封伪装成银行通知的邮件，其中包含一个指向已知钓鱼网站的恶意链接。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "j.doe@mycorp.com"},
-            {"type": "sender_email", "value": "noreply@mybank-secure.net"},
-            {"type": "subject", "value": "您的账户已被暂停，请立即验证"},
-            {"type": "url", "value": "http://mybank-login-secure.com/verify?id=1a2b3c4d"},
-            {"type": "threat_type", "value": "Phishing"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-01",
-            "timestamp": "2025-09-18T16:20:09.543Z",
-            "event_type": "URLScan",
-            "detection_details": {
-                "url": "http://mybank-login-secure.com/verify?id=1a2b3c4d",
-                "verdict": "Malicious",
-                "reason": "Threat intelligence match",
-                "threat_name": "Fake Bank Login Page"
-            },
-            "email_details": {
-                "sender": "noreply@mybank-secure.net",
-                "recipient": "j.doe@mycorp.com",
-                "subject": "您的账户已被暂停，请立即验证"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-02-Malicious-Attachment-Detected",
-        "rule_name": "邮件中检测到恶意附件",
-        "alert_date": "2025-09-18T16:25:35Z",
-        "tags": ["malware", "attachment", "ransomware"],
-        "severity": "Critical",
-        "reference": "用户a.smith收到含有恶意宏文档的邮件",
-        "description": "一封发给用户 a.smith 的邮件附件中包含一个被沙箱分析为恶意软件（Ransomware）的 Word 文档。该文档试图执行恶意宏。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "a.smith@mycorp.com"},
-            {"type": "sender_email", "value": "invoice@supplier-online.co.kr"},
-            {"type": "subject", "value": "重要：发票#20250918"},
-            {"type": "file_name", "value": "Invoice-20250918.docm"},
-            {"type": "file_hash_sha256", "value": "a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1"},
-            {"type": "threat_type", "value": "Ransomware"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-02",
-            "timestamp": "2025-09-18T16:25:34.888Z",
-            "event_type": "AttachmentScan",
-            "detection_details": {
-                "file_name": "Invoice-20250918.docm",
-                "file_hash_sha256": "a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1",
-                "verdict": "Malicious",
-                "reason": "Sandbox analysis (macro execution)",
-                "threat_name": "Qbot"
-            },
-            "email_details": {
-                "sender": "invoice@supplier-online.co.kr",
-                "recipient": "a.smith@mycorp.com",
-                "subject": "重要：发票#20250918"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-03-BEC-Spoofing-CEO",
-        "rule_name": "商业邮件欺诈（BEC）- 冒充CEO",
-        "alert_date": "2025-09-18T16:30:40Z",
-        "tags": ["bec", "spoofing", "financial-fraud"],
-        "severity": "High",
-        "reference": "假冒CEO的邮件要求紧急转账",
-        "description": "一封伪装成公司CEO（j.smith@mycorp.com）的邮件，要求财务部员工 j.doe 紧急执行一笔电汇。发件人显示名称与CEO一致，但发件人邮箱地址为外部域名。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "j.doe@mycorp.com"},
-            {"type": "sender_display_name", "value": "John Smith"},
-            {"type": "sender_email", "value": "john.smith.ceo@outlook.com"},
-            {"type": "subject", "value": "紧急电汇请求"},
-            {"type": "threat_type", "value": "BEC"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-03",
-            "timestamp": "2025-09-18T16:30:39.901Z",
-            "event_type": "BECDetection",
-            "detection_details": {
-                "spoofed_user": "j.smith@mycorp.com",
-                "sender_email": "john.smith.ceo@outlook.com",
-                "reason": "Sender domain mismatch, display name impersonation, urgency keywords detected."
-            },
-            "email_details": {
-                "sender": "john.smith.ceo@outlook.com",
-                "recipient": "j.doe@mycorp.com",
-                "subject": "紧急电汇请求"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-04-Credential-Phishing-Page",
-        "rule_name": "凭据钓鱼页面链接",
-        "alert_date": "2025-09-18T16:35:15Z",
-        "tags": ["phishing", "credential-harvesting", "url-threat"],
-        "severity": "High",
-        "reference": "用户d.chen收到钓鱼邮件，链接到假冒的Office登录页面",
-        "description": "用户 d.chen 收到一封声称“您的Office 365密码即将过期”的邮件，邮件中的链接指向一个模仿公司登录页面的钓鱼网站。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "d.chen@mycorp.com"},
-            {"type": "sender_email", "value": "admin@microsoft.co.us"},
-            {"type": "subject", "value": "立即更新您的密码以避免账户锁定"},
-            {"type": "url", "value": "https://office365-mycorp-login.net/signin"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-01",
-            "timestamp": "2025-09-18T16:35:14.678Z",
-            "event_type": "URLScan",
-            "detection_details": {
-                "url": "https://office365-mycorp-login.net/signin",
-                "verdict": "Malicious",
-                "reason": "URL impersonation pattern, known phishing site"
-            },
-            "email_details": {
-                "sender": "admin@microsoft.co.us",
-                "recipient": "d.chen@mycorp.com",
-                "subject": "立即更新您的密码以避免账户锁定"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-05-Fileless-Malware-Detected",
-        "rule_name": "邮件中检测到无文件恶意软件",
-        "alert_date": "2025-09-18T16:40:50Z",
-        "tags": ["malware", "fileless", "powershell"],
-        "severity": "High",
-        "reference": "用户h.lin收到含有可疑PowerShell命令的邮件",
-        "description": "用户 h.lin 收到一封邮件，邮件正文或附件中包含经过混淆的 PowerShell 命令，旨在下载并执行恶意载荷，不依赖于传统文件附件。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "h.lin@mycorp.com"},
-            {"type": "sender_email", "value": "updates@newsletters.xyz"},
-            {"type": "subject", "value": "最新公司新闻"},
-            {"type": "command_line_snippet", "value": "powershell.exe -enc VwByAGkAdABlAC0ASABv..."},
-            {"type": "threat_type", "value": "Fileless Malware"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-02",
-            "timestamp": "2025-09-18T16:40:49.123Z",
-            "event_type": "ContentScan",
-            "detection_details": {
-                "detection_method": "Signature/Behavioral",
-                "reason": "Detected obfuscated PowerShell command in email body"
-            },
-            "email_details": {
-                "sender": "updates@newsletters.xyz",
-                "recipient": "h.lin@mycorp.com",
-                "subject": "最新公司新闻"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-06-Suspicious-Login-Attempt-Notification",
-        "rule_name": "可疑登录尝试钓鱼邮件",
-        "alert_date": "2025-09-18T16:45:22Z",
-        "tags": ["phishing", "social-engineering"],
-        "severity": "Medium",
-        "reference": "用户m.li收到可疑登录通知邮件",
-        "description": "一封发给用户 m.li 的邮件声称有“来自未知设备的登录尝试”，并要求用户点击链接“立即保护您的账户”。该邮件来自非官方来源。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "m.li@mycorp.com"},
-            {"type": "sender_email", "value": "security-alert@service.online-secure.ru"},
-            {"type": "subject", "value": "警告：来自新设备的登录！"},
-            {"type": "threat_type", "value": "Phishing"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-03",
-            "timestamp": "2025-09-18T16:45:21.567Z",
-            "event_type": "PhishingAttempt",
-            "detection_details": {
-                "reason": "Social engineering keywords, non-corporate sender, urgency in subject"
-            },
-            "email_details": {
-                "sender": "security-alert@service.online-secure.ru",
-                "recipient": "m.li@mycorp.com",
-                "subject": "警告：来自新设备的登录！"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-07-Domain-Spoofing-HR-Team",
-        "rule_name": "邮件域名仿冒 - HR团队",
-        "alert_date": "2025-09-18T16:50:05Z",
-        "tags": ["spoofing", "credential-harvesting"],
-        "severity": "Medium",
-        "reference": "假冒HR团队的邮件发送给全体员工",
-        "description": "一封伪装成 HR 团队（hr@mycorp.com）的邮件，其发件人地址使用了高度相似的域名（hr@mycorps.com），邮件要求员工更新个人信息。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "all@mycorp.com"},
-            {"type": "sender_email", "value": "hr@mycorps.com"},
-            {"type": "subject", "value": "请更新您的员工信息以获取最新福利"},
-            {"type": "spoofed_domain", "value": "mycorp.com"},
-            {"type": "threat_type", "value": "Domain Spoofing"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-01",
-            "timestamp": "2025-09-18T16:50:04.990Z",
-            "event_type": "SpoofingDetection",
-            "detection_details": {
-                "reason": "DMARC/SPF/DKIM failed, domain similarity detected",
-                "spoofed_domain": "mycorp.com",
-                "sender_domain": "mycorps.com"
-            },
-            "email_details": {
-                "sender": "hr@mycorps.com",
-                "recipient": "all@mycorp.com",
-                "subject": "请更新您的员工信息以获取最新福利"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-08-Suspicious-Archive-Attachment",
-        "rule_name": "可疑的压缩附件",
-        "alert_date": "2025-09-18T16:55:18Z",
-        "tags": ["malware", "attachment", "archive"],
-        "severity": "Medium",
-        "reference": "用户c.jones收到密码保护的压缩附件",
-        "description": "一封发给用户 c.jones 的邮件附件中包含一个密码保护的 ZIP 文件，邮件正文提供了密码。这种技术常用于规避安全扫描。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "c.jones@mycorp.com"},
-            {"type": "sender_email", "value": "support@data-service.ru"},
-            {"type": "subject", "value": "数据请求回复"},
-            {"type": "file_name", "value": "report.zip"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-02",
-            "timestamp": "2025-09-18T16:55:17.345Z",
-            "event_type": "AttachmentScan",
-            "detection_details": {
-                "file_name": "report.zip",
-                "verdict": "Suspicious",
-                "reason": "Password-protected archive, password provided in body"
-            },
-            "email_details": {
-                "sender": "support@data-service.ru",
-                "recipient": "c.jones@mycorp.com",
-                "subject": "数据请求回复"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-09-Internal-Account-Compromise",
-        "rule_name": "内部账户被盗用发送垃圾邮件",
-        "alert_date": "2025-09-18T17:00:00Z",
-        "tags": ["compromised-account", "spam"],
-        "severity": "High",
-        "reference": "被盗用的内部账户j.doe发送大量垃圾邮件",
-        "description": "内部账户 j.doe@mycorp.com 发送了大量包含垃圾内容的邮件。该账户可能已被攻击者接管，用于传播恶意信息。",
-        "artifacts": [
-            {"type": "sender_email", "value": "j.doe@mycorp.com"},
-            {"type": "source_ip", "value": "8.8.8.8"},
-            {"type": "subject", "value": "赚取丰厚利润的秘诀"},
-            {"type": "threat_type", "value": "Spam/Account Compromise"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-03",
-            "timestamp": "2025-09-18T16:59:59.000Z",
-            "event_type": "SpamDetection",
-            "detection_details": {
-                "reason": "High volume of spam messages, source IP mismatch with corporate network"
-            },
-            "email_details": {
-                "sender": "j.doe@mycorp.com",
-                "recipient": "various-external-recipients",
-                "subject": "赚取丰厚利润的秘诀"
-            }
-        }
-    },
-    {
-        "source": "Email Security",
-        "rule_id": "ES-Rule-10-Payload-Delivery-through-Image",
-        "rule_name": "邮件图片中隐藏恶意载荷",
-        "alert_date": "2025-09-18T17:05:30Z",
-        "tags": ["steganography", "malware"],
-        "severity": "High",
-        "reference": "用户a.smith收到含有隐写恶意代码的图片",
-        "description": "一封发给用户 a.smith 的邮件附件中包含一张图片（JPG），但经深度内容分析，发现其中使用了隐写术隐藏了恶意代码。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "a.smith@mycorp.com"},
-            {"type": "sender_email", "value": "photo-share@online-gallery.biz"},
-            {"type": "subject", "value": "您有一张新照片需要查看"},
-            {"type": "file_name", "value": "photo.jpg"},
-            {"type": "threat_type", "value": "Steganography"}
-        ],
-        "raw_log": {
-            "gateway_id": "email-gw-01",
-            "timestamp": "2025-09-18T17:05:29.876Z",
-            "event_type": "AttachmentScan",
-            "detection_details": {
-                "file_name": "photo.jpg",
-                "verdict": "Malicious",
-                "reason": "Steganography detection, hidden code payload found"
-            },
-            "email_details": {
-                "sender": "photo-share@online-gallery.biz",
-                "recipient": "a.smith@mycorp.com",
-                "subject": "您有一张新照片需要查看"
-            }
-        }
-    }
-]
-
-ot_alert = [
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-01-PLC-Configuration-Change",
-        "rule_name": "PLC配置未经授权修改",
-        "alert_date": "2025-09-18T17:10:00Z",
-        "tags": ["plc", "unauthorized-change", "firmware"],
-        "severity": "Critical",
-        "reference": "生产线PLC01上发生未授权的配置修改",
-        "description": "检测到生产线 PLC-PROD-01 的固件或配置发生未经授权的修改。此行为可能导致生产过程中断或安全风险。",
-        "artifacts": [
-            {"type": "device_id", "value": "PLC-PROD-01"},
-            {"type": "ip", "value": "10.1.1.10"},
-            {"type": "protocol", "value": "S7Comm"},
-            {"type": "change_type", "value": "PLC-Firmware-Update"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line01",
-            "timestamp": "2025-09-18T17:09:59.321Z",
-            "event_type": "DeviceConfigurationChange",
-            "device_details": {"device_id": "PLC-PROD-01", "ip_address": "10.1.1.10", "vendor": "Siemens"},
-            "change_details": {"type": "firmware-update", "status": "succeeded", "source_ip": "10.1.2.55", "user": "system"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-02-Unusual-Protocol-Activity",
-        "rule_name": "SCADA网络中可疑协议活动",
-        "alert_date": "2025-09-18T17:15:30Z",
-        "tags": ["protocol", "network-anomaly", "scada"],
-        "severity": "Medium",
-        "reference": "SCADA网络中出现异常的RDP连接",
-        "description": "SCADA 网络段中，主机 SCADA-HMI-05 发起了到未知主机的 RDP 连接。该协议通常不用于生产网络中的 SCADA 通信。",
-        "artifacts": [
-            {"type": "source_device", "value": "SCADA-HMI-05"},
-            {"type": "source_ip", "value": "10.1.1.20"},
-            {"type": "destination_ip", "value": "10.1.50.123"},
-            {"type": "protocol", "value": "RDP", "port": 3389}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line02",
-            "timestamp": "2025-09-18T17:15:29.876Z",
-            "event_type": "NetworkFlow",
-            "flow_details": {
-                "source_ip": "10.1.1.20",
-                "destination_ip": "10.1.50.123",
-                "destination_port": 3389,
-                "protocol": "TCP"
-            },
-            "network_context": {"segment": "SCADA-Network-Zone", "reason": "Unusual protocol for this segment"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-03-Controller-Stop-Command",
-        "rule_name": "控制器收到停止命令",
-        "alert_date": "2025-09-18T17:20:10Z",
-        "tags": ["controller", "process-interruption", "stop-command"],
-        "severity": "Critical",
-        "reference": "控制器ROB-ARM-03收到停止命令",
-        "description": "生产机器人控制器 ROB-ARM-03 收到一个停止命令。该命令未在正常操作时间范围内或来自非授权源。",
-        "artifacts": [
-            {"type": "device_id", "value": "ROB-ARM-03"},
-            {"type": "ip", "value": "10.1.1.30"},
-            {"type": "command", "value": "stop"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line01",
-            "timestamp": "2025-09-18T17:20:09.555Z",
-            "event_type": "ControlCommand",
-            "device_details": {"device_id": "ROB-ARM-03", "ip_address": "10.1.1.30"},
-            "command_details": {"action": "stop-command", "source_ip": "10.1.1.20"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-04-Unauthorized-External-Access",
-        "rule_name": "生产网络未经授权的外部访问",
-        "alert_date": "2025-09-18T17:25:45Z",
-        "tags": ["external-access", "remote-access", "vpn"],
-        "severity": "Critical",
-        "reference": "来自外部IP的未经授权访问",
-        "description": "检测到来自公司外部 IP 地址 203.0.113.10 的远程访问尝试，目标是生产网络中的主机，此访问未通过常规的 VPN 渠道。",
-        "artifacts": [
-            {"type": "source_ip", "value": "203.0.113.10"},
-            {"type": "destination_ip", "value": "10.1.1.50"},
-            {"type": "protocol", "value": "TCP", "port": 22},
-            {"type": "service", "value": "SSH"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-firewall-01",
-            "timestamp": "2025-09-18T17:25:44.912Z",
-            "event_type": "TrafficBlock",
-            "traffic_details": {
-                "source_ip": "203.0.113.10",
-                "destination_ip": "10.1.1.50",
-                "destination_port": 22,
-                "protocol": "TCP"
-            },
-            "security_context": {"reason": "Unauthorized external IP access to OT segment"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-05-High-Frequency-HMI-Commands",
-        "rule_name": "HMI高频操作命令",
-        "alert_date": "2025-09-18T17:30:20Z",
-        "tags": ["hmi", "command-spam", "anomaly"],
-        "severity": "Medium",
-        "reference": "HMI-CTRL-02发出异常高频的命令",
-        "description": "人机界面 HMI-CTRL-02 在短时间内向多个控制器发出异常高频的操作命令。这可能是恶意脚本或自动化攻击的迹象。",
-        "artifacts": [
-            {"type": "device_id", "value": "HMI-CTRL-02"},
-            {"type": "ip", "value": "10.1.1.45"},
-            {"type": "command_rate", "value": "20 commands/sec"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line03",
-            "timestamp": "2025-09-18T17:30:19.444Z",
-            "event_type": "ControlCommandRateAnomaly",
-            "device_details": {"device_id": "HMI-CTRL-02", "ip_address": "10.1.1.45"},
-            "anomaly_details": {"command_count": 120, "time_window_sec": 6, "reason": "High frequency of write commands"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-06-Controller-Password-Reset-Attempt",
-        "rule_name": "控制器密码重置尝试",
-        "alert_date": "2025-09-18T17:35:50Z",
-        "tags": ["authentication", "password-reset", "brute-force"],
-        "severity": "High",
-        "reference": "控制器PLC-PROD-02上发生多次密码重置失败",
-        "description": "检测到对 PLC-PROD-02 控制器进行多次失败的密码重置尝试。这表明可能存在暴力破解或未经授权的访问尝试。",
-        "artifacts": [
-            {"type": "device_id", "value": "PLC-PROD-02"},
-            {"type": "ip", "value": "10.1.1.11"},
-            {"type": "attempt_count", "value": 5}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line01",
-            "timestamp": "2025-09-18T17:35:49.111Z",
-            "event_type": "AuthenticationFailure",
-            "device_details": {"device_id": "PLC-PROD-02", "ip_address": "10.1.1.11"},
-            "auth_details": {"attempt_count": 5, "protocol": "Modbus", "source_ip": "10.1.1.99"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-07-Unauthorized-Access-to-Engineering-Workstation",
-        "rule_name": "工程工作站未经授权访问",
-        "alert_date": "2025-09-18T17:40:25Z",
-        "tags": ["access-control", "workstation", "lateral-movement"],
-        "severity": "High",
-        "reference": "WKS-ENG-12上发生未授权访问",
-        "description": "检测到工程工作站 WKS-ENG-12 上发生未经授权的登录尝试。此工作站包含敏感的工程项目文件，是攻击者的主要目标。",
-        "artifacts": [
-            {"type": "device_id", "value": "WKS-ENG-12"},
-            {"type": "ip", "value": "10.1.2.55"},
-            {"type": "source_ip", "value": "10.1.1.10"},
-            {"type": "username", "value": "guest"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-engineering",
-            "timestamp": "2025-09-18T17:40:24.789Z",
-            "event_type": "LoginAttempt",
-            "device_details": {"device_id": "WKS-ENG-12", "ip_address": "10.1.2.55"},
-            "auth_details": {"username": "guest", "status": "failed", "source_ip": "10.1.1.10"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-08-New-Device-on-SCADA-Network",
-        "rule_name": "SCADA网络中新增设备",
-        "alert_date": "2025-09-18T17:45:10Z",
-        "tags": ["inventory", "network-scan", "new-device"],
-        "severity": "Medium",
-        "reference": "SCADA网络中出现未知的PLC",
-        "description": "检测到 SCADA 网络中出现一个未在资产清单中注册的新 PLC。这可能是未经授权的连接或侦察行为。",
-        "artifacts": [
-            {"type": "device_type", "value": "PLC"},
-            {"type": "ip", "value": "10.1.1.15"},
-            {"type": "mac", "value": "00:1A:2B:3C:4D:5E"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line01",
-            "timestamp": "2025-09-18T17:45:09.600Z",
-            "event_type": "NewDeviceDiscovery",
-            "device_details": {"ip_address": "10.1.1.15", "mac_address": "00:1A:2B:3C:4D:5E", "device_type": "PLC"},
-            "security_context": {"reason": "Device not in asset inventory"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-09-Process-Parameter-Out-of-Range",
-        "rule_name": "生产过程参数超出安全范围",
-        "alert_date": "2025-09-18T17:50:40Z",
-        "tags": ["process-anomaly", "physical-impact", "safety"],
-        "severity": "High",
-        "reference": "CHEM-PUMP-04的压力超出正常范围",
-        "description": "化学泵 CHEM-PUMP-04 的压力读数异常升高，已超出预设的安全操作范围。这可能由恶意命令或设备故障引起。",
-        "artifacts": [
-            {"type": "device_id", "value": "CHEM-PUMP-04"},
-            {"type": "ip", "value": "10.2.1.22"},
-            {"type": "parameter", "value": "Pressure"},
-            {"type": "value", "value": "150 PSI"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line04",
-            "timestamp": "2025-09-18T17:50:39.123Z",
-            "event_type": "ProcessValueAnomaly",
-            "device_details": {"device_id": "CHEM-PUMP-04", "ip_address": "10.2.1.22"},
-            "value_details": {"parameter": "Pressure", "value": 150, "unit": "PSI", "normal_range": "20-80"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-10-Lateral-Movement-Attempt-Protocol-Hop",
-        "rule_name": "协议跳跃式横向移动尝试",
-        "alert_date": "2025-09-18T17:55:05Z",
-        "tags": ["lateral-movement", "protocol-hop"],
-        "severity": "High",
-        "reference": "IT网络主机通过SCADA网络访问PLC",
-        "description": "IT 网络中的一台工作站（10.100.1.5）尝试通过 SCADA 网关（10.1.1.1）直接访问 PLC 设备。此行为违反了分段原则。",
-        "artifacts": [
-            {"type": "source_ip", "value": "10.100.1.5"},
-            {"type": "destination_ip", "value": "10.1.1.10"},
-            {"type": "protocol", "value": "Modbus/TCP"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-gateway-01",
-            "timestamp": "2025-09-18T17:55:04.990Z",
-            "event_type": "NetworkFlow",
-            "flow_details": {
-                "source_ip": "10.100.1.5",
-                "destination_ip": "10.1.1.10",
-                "destination_port": 502,
-                "protocol": "TCP"
-            },
-            "network_context": {"reason": "IT-to-OT unauthorized protocol flow"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-11-Network-Scan-Activity",
-        "rule_name": "生产网络扫描活动",
-        "alert_date": "2025-09-18T18:00:15Z",
-        "tags": ["reconnaissance", "network-scan"],
-        "severity": "High",
-        "reference": "主机10.1.2.80扫描生产网络",
-        "description": "检测到来自主机 10.1.2.80 的大规模端口扫描活动，目标是生产网络中的多个 OT 设备。这通常是攻击者在进行侦察。",
-        "artifacts": [
-            {"type": "source_ip", "value": "10.1.2.80"},
-            {"type": "scan_target_count", "value": 50},
-            {"type": "ports_scanned", "value": ["502", "102", "44818"]}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line02",
-            "timestamp": "2025-09-18T18:00:14.543Z",
-            "event_type": "NetworkScanDetection",
-            "scan_details": {
-                "source_ip": "10.1.2.80",
-                "target_ips": ["10.1.1.10", "10.1.1.11", "..."],
-                "scanned_ports": [502, 102, 44818]
-            },
-            "security_context": {"reason": "Systematic port scanning of OT devices"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-12-Failed-Logic-Transfer-Attempt",
-        "rule_name": "PLC逻辑传输失败尝试",
-        "alert_date": "2025-09-18T18:05:30Z",
-        "tags": ["plc", "logic-change", "failure"],
-        "severity": "Medium",
-        "reference": "PLC-PROD-03的逻辑程序上传失败",
-        "description": "检测到向 PLC-PROD-03 上传新逻辑程序的失败尝试。这可能表明存在未经授权的固件修改或恶意的逻辑注入。",
-        "artifacts": [
-            {"type": "device_id", "value": "PLC-PROD-03"},
-            {"type": "ip", "value": "10.1.1.12"},
-            {"type": "action", "value": "PLC-Logic-Write"},
-            {"type": "status", "value": "Failed"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line01",
-            "timestamp": "2025-09-18T18:05:29.987Z",
-            "event_type": "DeviceControlActivity",
-            "device_details": {"device_id": "PLC-PROD-03", "ip_address": "10.1.1.12", "vendor": "Rockwell"},
-            "activity_details": {"action": "logic-write", "status": "failed", "source_ip": "10.1.2.55", "reason": "Checksum mismatch"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-13-Suspicious-File-Transfer-SCADA",
-        "rule_name": "SCADA服务器可疑文件传输",
-        "alert_date": "2025-09-18T18:10:45Z",
-        "tags": ["file-transfer", "data-exfiltration", "scada"],
-        "severity": "High",
-        "reference": "SCADA-Server-01向外部传输文件",
-        "description": "SCADA 服务器 SCADA-Server-01 向生产网络外部的服务器（10.1.50.200）发起了一个大文件的传输。这可能与数据外泄有关。",
-        "artifacts": [
-            {"type": "source_device", "value": "SCADA-Server-01"},
-            {"type": "source_ip", "value": "10.1.2.10"},
-            {"type": "destination_ip", "value": "10.1.50.200"},
-            {"type": "protocol", "value": "FTP"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-scada",
-            "timestamp": "2025-09-18T18:10:44.666Z",
-            "event_type": "NetworkFlow",
-            "flow_details": {
-                "source_ip": "10.1.2.10",
-                "destination_ip": "10.1.50.200",
-                "destination_port": 21,
-                "protocol": "TCP",
-                "bytes_out": 250000000
-            },
-            "network_context": {"reason": "Large outbound file transfer from SCADA server"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-14-Firmware-Tampering-Attempt",
-        "rule_name": "固件篡改尝试",
-        "alert_date": "2025-09-18T18:15:20Z",
-        "tags": ["firmware", "tampering", "integrity"],
-        "severity": "Critical",
-        "reference": "传感器SENSOR-TEMP-07固件哈希值异常",
-        "description": "温度传感器 SENSOR-TEMP-07 的固件哈希值与已知良好哈希值不匹配。这表明其固件可能已被篡改。",
-        "artifacts": [
-            {"type": "device_id", "value": "SENSOR-TEMP-07"},
-            {"type": "ip", "value": "10.2.2.35"},
-            {"type": "file_hash_sha256", "value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line04",
-            "timestamp": "2025-09-18T18:15:19.444Z",
-            "event_type": "FirmwareIntegrityCheck",
-            "device_details": {"device_id": "SENSOR-TEMP-07", "ip_address": "10.2.2.35"},
-            "integrity_details": {"firmware_hash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
-                                  "known_good_hash": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "reason": "Hash mismatch"}
-        }
-    },
-    {
-        "source": "OT",
-        "rule_id": "OT-Rule-15-Unauthorized-Serial-Communication",
-        "rule_name": "未经授权的串行通信",
-        "alert_date": "2025-09-18T18:20:00Z",
-        "tags": ["serial-communication", "legacy-protocol", "physical-access"],
-        "severity": "High",
-        "reference": "HMI-CTRL-01与PLC-PROD-01的串行通信异常",
-        "description": "人机界面 HMI-CTRL-01 与 PLC-PROD-01 之间建立了未经授权的串行通信。此通信绕过了网络安全控制，可能被用于发送恶意命令。",
-        "artifacts": [
-            {"type": "source_device", "value": "HMI-CTRL-01"},
-            {"type": "destination_device", "value": "PLC-PROD-01"},
-            {"type": "protocol", "value": "Modbus-RTU"}
-        ],
-        "raw_log": {
-            "sensor_id": "ot-sensor-line01",
-            "timestamp": "2025-09-18T18:19:59.876Z",
-            "event_type": "SerialCommunication",
-            "communication_details": {
-                "source_device": "HMI-CTRL-01",
-                "destination_device": "PLC-PROD-01",
-                "port": "COM1",
-                "protocol": "Modbus-RTU"
-            },
-            "security_context": {"reason": "Unauthorized physical or serial communication link"}
-        }
-    }
-]
-
-proxy_alert = [
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-01-Malware-Download-Blocked",
-        "rule_name": "阻止恶意软件下载",
-        "alert_date": "2025-09-18T19:00:15Z",
-        "tags": ["malware", "download", "blocked"],
-        "severity": "Critical",
-        "reference": "用户a.smith尝试从恶意站点下载可执行文件",
-        "description": "代理服务器阻止了用户 a.smith 从已知恶意域名下载一个可执行文件。该文件被安全引擎标记为恶意软件。",
-        "artifacts": [
-            {"type": "username", "value": "a.smith"},
-            {"type": "source_ip", "value": "192.168.2.54"},
-            {"type": "destination_url", "value": "http://malware-distro.com/update.exe"},
-            {"type": "threat_name", "value": "Trojan.Agent"},
-            {"type": "action", "value": "Blocked"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-01",
-            "timestamp": "2025-09-18T19:00:14.998Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "a.smith", "ip_address": "192.168.2.54"},
-            "access_details": {
-                "url": "http://malware-distro.com/update.exe",
-                "method": "GET",
-                "status": "403 Forbidden",
-                "policy": "Blocklist-ThreatIntel"
-            },
-            "threat_details": {
-                "verdict": "Malicious",
-                "reason": "Threat intelligence match",
-                "engine": "Antivirus Scan"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-02-C2-Communication-Blocked",
-        "rule_name": "阻止C2通信",
-        "alert_date": "2025-09-18T19:05:30Z",
-        "tags": ["c2", "cobaltstrike", "blocked"],
-        "severity": "Critical",
-        "reference": "主机FIN-WKS-JDOE-05尝试连接C2服务器",
-        "description": "代理服务器检测并阻止了来自主机 FIN-WKS-JDOE-05 对已知命令与控制 (C2) 服务器的连接请求。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_domain", "value": "known-bad.c2.server"},
-            {"type": "threat_type", "value": "C2 Traffic"},
-            {"type": "action", "value": "Blocked"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-02",
-            "timestamp": "2025-09-18T19:05:29.876Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
-            "access_details": {
-                "url": "https://known-bad.c2.server/api/v1/data",
-                "method": "POST",
-                "status": "403 Forbidden",
-                "policy": "ThreatIntel-C2"
-            },
-            "threat_details": {
-                "verdict": "Malicious",
-                "reason": "Known C2 domain/IP"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-03-Phishing-URL-Detected",
-        "rule_name": "访问钓鱼网站被阻止",
-        "alert_date": "2025-09-18T19:10:45Z",
-        "tags": ["phishing", "url-threat", "blocked"],
-        "severity": "High",
-        "reference": "用户c.jones尝试访问钓鱼网站",
-        "description": "代理服务器阻止了用户 c.jones 访问一个伪装成公司登录门户的钓鱼网站。",
-        "artifacts": [
-            {"type": "username", "value": "c.jones"},
-            {"type": "source_ip", "value": "192.168.3.88"},
-            {"type": "destination_url", "value": "http://mycorp-ssologin.net/portal"},
-            {"type": "threat_type", "value": "Phishing"},
-            {"type": "action", "value": "Blocked"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-01",
-            "timestamp": "2025-09-18T19:10:44.666Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "c.jones", "ip_address": "192.168.3.88"},
-            "access_details": {
-                "url": "http://mycorp-ssologin.net/portal",
-                "status": "403 Forbidden",
-                "policy": "Phishing-Blocklist"
-            },
-            "threat_details": {
-                "verdict": "Malicious",
-                "reason": "URL impersonation pattern"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-04-Unauthorized-Cloud-Storage",
-        "rule_name": "未经授权的云存储访问",
-        "alert_date": "2025-09-18T19:15:20Z",
-        "tags": ["data-exfiltration", "cloud-storage"],
-        "severity": "Medium",
-        "reference": "用户d.chen访问个人Dropbox账户",
-        "description": "用户 d.chen 访问了未经公司授权的个人云存储服务（Dropbox）。这可能用于数据外泄。",
-        "artifacts": [
-            {"type": "username", "value": "d.chen"},
-            {"type": "source_ip", "value": "192.168.4.12"},
-            {"type": "destination_domain", "value": "dropbox.com"},
-            {"type": "threat_type", "value": "Policy Violation"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-03",
-            "timestamp": "2025-09-18T19:15:19.444Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "d.chen", "ip_address": "192.168.4.12"},
-            "access_details": {
-                "url": "https://www.dropbox.com/home",
-                "status": "200 OK",
-                "policy": "Block-Unauthorized-Cloud-Storage"
-            },
-            "security_context": {
-                "action": "Alert Only",
-                "reason": "Policy violation: Access to unauthorized cloud storage"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-05-High-Risk-Category-Access",
-        "rule_name": "访问高风险内容类别",
-        "alert_date": "2025-09-18T19:20:05Z",
-        "tags": ["policy-violation", "high-risk"],
-        "severity": "Low",
-        "reference": "用户m.li访问赌博网站",
-        "description": "用户 m.li 访问了被归类为“赌博”的高风险网站。该行为违反了公司的网络使用策略。",
-        "artifacts": [
-            {"type": "username", "value": "m.li"},
-            {"type": "source_ip", "value": "192.168.5.31"},
-            {"type": "destination_domain", "value": "online-casino.com"},
-            {"type": "category", "value": "Gambling"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-01",
-            "timestamp": "2025-09-18T19:20:04.555Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "m.li", "ip_address": "192.168.5.31"},
-            "access_details": {
-                "url": "http://www.online-casino.com/play",
-                "status": "200 OK",
-                "policy": "Permit-Alert"
-            },
-            "security_context": {
-                "category": "Gambling",
-                "action": "Alert Only"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-06-Suspicious-User-Agent",
-        "rule_name": "可疑用户代理访问",
-        "alert_date": "2025-09-18T19:25:50Z",
-        "tags": ["anomaly", "botnet", "reconnaissance"],
-        "severity": "Medium",
-        "reference": "FIN-WKS-JDOE-05使用异常用户代理访问网络",
-        "description": "主机 FIN-WKS-JDOE-05 发起的网络请求使用了异常的用户代理（User-Agent），这可能与僵尸网络或自动化脚本活动有关。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "user_agent", "value": "Mozilla/5.0 (Windows NT 6.1; WOW64) Gecko/20100101 Firefox/56.0"},
-            {"type": "threat_type", "value": "Botnet/C2"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-02",
-            "timestamp": "2025-09-18T19:25:49.111Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
-            "access_details": {
-                "url": "http://api.external-service.org/check",
-                "user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64) Gecko/20100101 Firefox/56.0",
-                "status": "200 OK"
-            },
-            "security_context": {
-                "reason": "User-Agent mismatch with known browser patterns"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-07-SSL-Inspection-Bypass",
-        "rule_name": "SSL检查规避尝试",
-        "alert_date": "2025-09-18T19:30:25Z",
-        "tags": ["evasion", "ssl-tls", "policy-violation"],
-        "severity": "High",
-        "reference": "用户j.doe尝试绕过SSL检查",
-        "description": "用户 j.doe 尝试访问一个通过无效证书来规避 SSL 检查的网站。该行为可能用于隐藏恶意流量或访问不当内容。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_domain", "value": "bad-cert-site.com"},
-            {"type": "threat_type", "value": "Evasion"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-02",
-            "timestamp": "2025-09-18T19:30:24.789Z",
-            "event_type": "SSLConnection",
-            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
-            "ssl_details": {
-                "url": "https://bad-cert-site.com",
-                "verdict": "Blocked",
-                "reason": "Invalid or untrusted SSL certificate"
-            },
-            "security_context": {
-                "action": "Blocked",
-                "reason": "SSL inspection bypass attempt"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-08-File-Upload-to-Suspicious-Domain",
-        "rule_name": "文件上传到可疑域名",
-        "alert_date": "2025-09-18T19:35:10Z",
-        "tags": ["data-exfiltration", "file-upload"],
-        "severity": "Medium",
-        "reference": "用户a.smith向可疑域名上传文件",
-        "description": "用户 a.smith 上传了一个文件到已知信誉低下的域名。这可能表明数据外泄正在进行。",
-        "artifacts": [
-            {"type": "username", "value": "a.smith"},
-            {"type": "source_ip", "value": "192.168.2.54"},
-            {"type": "destination_domain", "value": "data-receiver.ru"},
-            {"type": "action", "value": "file-upload"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-03",
-            "timestamp": "2025-09-18T19:35:09.600Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "a.smith", "ip_address": "192.168.2.54"},
-            "access_details": {
-                "url": "http://data-receiver.ru/upload.php",
-                "method": "POST",
-                "file_size_bytes": 1200000,
-                "status": "200 OK"
-            },
-            "security_context": {
-                "reason": "File upload to a low-reputation domain"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-09-High-Volume-DNS-Queries",
-        "rule_name": "高频DNS查询",
-        "alert_date": "2025-09-18T19:40:40Z",
-        "tags": ["dns", "reconnaissance", "data-tunneling"],
-        "severity": "High",
-        "reference": "主机FIN-WKS-JDOE-05发起大量异常DNS查询",
-        "description": "主机 FIN-WKS-JDOE-05 在短时间内发起大量异常 DNS 查询。该行为可能与 DNS 隧道通信或侦察活动有关。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "query_count", "value": 500}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-dns-gw-01",
-            "timestamp": "2025-09-18T19:40:39.123Z",
-            "event_type": "DNSQuery",
-            "user_details": {"ip_address": "192.168.1.101"},
-            "query_details": {
-                "domain_list": ["a.exfil.dns.com", "b.exfil.dns.com", "..."],
-                "query_rate": "100 queries/sec"
-            },
-            "security_context": {
-                "reason": "High-volume, rapid-fire DNS queries"
-            }
-        }
-    },
-    {
-        "source": "Proxy",
-        "rule_id": "PROXY-Rule-10-Policy-Violation-Circumvention",
-        "rule_name": "试图规避策略",
-        "alert_date": "2025-09-18T19:45:25Z",
-        "tags": ["evasion", "circumvention", "vpn"],
-        "severity": "High",
-        "reference": "用户j.doe尝试访问VPN服务",
-        "description": "用户 j.doe 试图访问并连接到 VPN 服务，以规避公司的网络代理和内容过滤策略。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_domain", "value": "nordvpn.com"},
-            {"type": "threat_type", "value": "Circumvention"}
-        ],
-        "raw_log": {
-            "proxy_server": "proxy-gw-02",
-            "timestamp": "2025-09-18T19:45:24.777Z",
-            "event_type": "WebAccess",
-            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
-            "access_details": {
-                "url": "https://nordvpn.com/login",
-                "status": "403 Forbidden",
-                "policy": "Block-VPN-Anonymizers"
-            },
-            "security_context": {
-                "action": "Blocked",
-                "reason": "Attempt to access a VPN service to bypass security controls"
-            }
-        }
-    }
-]
-ueba_alert = [
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-01-Lateral-Movement-Spike",
-        "rule_name": "夜间异常横向移动",
-        "alert_date": "2025-09-23T22:35:00Z",
-        "tags": ["lateral-movement", "anomaly", "after-hours", "compromised-account"],
-        "severity": "High",
-        "reference": "用户j.doe账户在非工作时间异常登录多台服务器",
-        "description": "用户 j.doe 的账户在夜间（非其通常工作时间）异常登录了多台不属于其日常工作范围的服务器。这与该账户的历史行为基线存在显著偏差，可能表明账户已被盗用。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "time_of_day", "value": "After-hours"},
-            {"type": "login_count", "value": 7},
-            {"type": "login_targets", "value": ["SRV-FINANCE-02", "SRV-HR-05", "DB-PROD-01"]}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T22:34:59.789Z",
-            "event_type": "LoginAnomaly",
-            "user_details": {"username": "j.doe", "department": "Finance"},
-            "behavioral_details": {
-                "login_time": "22:30-22:35",
-                "normal_login_time": "09:00-18:00",
-                "login_target_change_score": 9.5,
-                "login_rate_score": 8.8
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-02-Unusual-Data-Volume-Download",
-        "rule_name": "非正常数据外发量",
-        "alert_date": "2025-09-23T11:15:20Z",
-        "tags": ["data-exfiltration", "anomaly", "insider-threat"],
-        "severity": "High",
-        "reference": "用户h.lin下载大量文件到个人云存储",
-        "description": "用户 h.lin 在短时间内从公司的 SharePoint 下载了异常大批量的文件，并将其同步到个人 Google Drive。这与该用户的历史数据传输习惯严重不符。",
-        "artifacts": [
-            {"type": "username", "value": "h.lin"},
-            {"type": "data_source", "value": "SharePoint"},
-            {"type": "data_destination", "value": "Google Drive"},
-            {"type": "data_volume_gb", "value": 2.5},
-            {"type": "file_count", "value": 150}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T11:15:19.444Z",
-            "event_type": "DataTransferAnomaly",
-            "user_details": {"username": "h.lin", "department": "HR"},
-            "behavioral_details": {
-                "normal_data_volume_gb_24h": 0.05,
-                "current_data_volume_gb_24h": 2.5,
-                "volume_deviation_score": 9.8,
-                "destination_deviation_score": 9.0
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-03-Account-Brute-Force-Multiple-Sources",
-        "rule_name": "多源账户暴力破解",
-        "alert_date": "2025-09-23T05:40:55Z",
-        "tags": ["authentication", "brute-force", "distributed-attack"],
-        "severity": "High",
-        "reference": "来自多个IP地址对单个账户的暴力破解",
-        "description": "检测到针对账户 s.brown 的大量失败登录尝试，这些尝试来自多个不同的外部 IP 地址。这表明可能存在分布式暴力破解攻击。",
-        "artifacts": [
-            {"type": "target_username", "value": "s.brown"},
-            {"type": "failed_logins", "value": 58},
-            {"type": "source_ip_count", "value": 12},
-            {"type": "time_window_minutes", "value": 10}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T05:40:54.666Z",
-            "event_type": "AuthenticationAnomaly",
-            "user_details": {"username": "s.brown", "department": "Sales"},
-            "behavioral_details": {
-                "failed_login_rate": 5.8,
-                "failed_login_rate_score": 9.2,
-                "ip_source_entropy": 7.1
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-04-Service-Account-Unusual-Access",
-        "rule_name": "服务账户异常访问",
-        "alert_date": "2025-09-23T14:50:30Z",
-        "tags": ["service-account", "anomaly", "privilege-escalation"],
-        "severity": "High",
-        "reference": "服务账户SVC-APP-01访问敏感数据库",
-        "description": "服务账户 SVC-APP-01 通常仅用于应用程序通信，但现在却尝试访问一个包含客户 PII 的数据库，这与该账户的正常行为模式严重不符。",
-        "artifacts": [
-            {"type": "account_name", "value": "SVC-APP-01"},
-            {"type": "source_ip", "value": "10.10.1.5"},
-            {"type": "action", "value": "Database Query"},
-            {"type": "target_resource", "value": "DB-CUSTOMER-PII"}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T14:50:29.999Z",
-            "event_type": "ServiceAccountAnomaly",
-            "entity_details": {"entity_name": "SVC-APP-01", "entity_type": "Service Account"},
-            "behavioral_details": {
-                "normal_access_patterns": ["App-DB-01", "App-API-Gateway"],
-                "current_access_target_deviation": 9.9
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-05-Insider-Trading-Recon",
-        "rule_name": "可疑的内部侦察活动",
-        "alert_date": "2025-09-23T10:25:40Z",
-        "tags": ["insider-threat", "reconnaissance", "data-exfiltration"],
-        "severity": "Medium",
-        "reference": "用户l.wang搜索机密项目文件",
-        "description": "用户 l.wang（非相关部门）在文件服务器上多次搜索并访问与“Project Chimera”相关的机密文件。该项目与该用户的日常职责无关。",
-        "artifacts": [
-            {"type": "username", "value": "l.wang"},
-            {"type": "source_ip", "value": "192.168.1.55"},
-            {"type": "search_keywords", "value": ["Project Chimera", "acquisition", "financial model"]},
-            {"type": "file_access_count", "value": 20}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T10:25:39.111Z",
-            "event_type": "FileAccessAnomaly",
-            "user_details": {"username": "l.wang", "department": "Marketing"},
-            "behavioral_details": {
-                "normal_file_access_path": ["/marketing/", "/campaigns/"],
-                "abnormal_file_access_path": ["/finance/projects/"]
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-06-Geographic-Login-Impossible-Travel",
-        "rule_name": "异地登录（不可能行程）",
-        "alert_date": "2025-09-23T08:10:15Z",
-        "tags": ["impossible-travel", "geolocation", "compromised-account"],
-        "severity": "High",
-        "reference": "用户m.li在两地同时或短时间登录",
-        "description": "用户 m.li 的账户在 10 分钟内分别从中国和美国登录。这在物理上是不可能的，强烈表明账户已被盗用。",
-        "artifacts": [
-            {"type": "username", "value": "m.li"},
-            {"type": "login_1_ip", "value": "203.0.113.1"},
-            {"type": "login_1_country", "value": "China"},
-            {"type": "login_2_ip", "value": "198.51.100.25"},
-            {"type": "login_2_country", "value": "United States"}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T08:10:14.543Z",
-            "event_type": "ImpossibleTravel",
-            "user_details": {"username": "m.li", "department": "R&D"},
-            "behavioral_details": {
-                "time_between_logins_min": 10,
-                "distance_km": 11000,
-                "speed_kph": 66000
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-07-Workstation-Communication-Anomaly",
-        "rule_name": "工作站异常通信",
-        "alert_date": "2025-09-23T13:45:00Z",
-        "tags": ["network-anomaly", "workstation", "c2"],
-        "severity": "Medium",
-        "reference": "WKS-ENG-12与不寻常主机通信",
-        "description": "工程工作站 WKS-ENG-12 突然开始与一个不属于公司网络的内部主机进行高频通信，这偏离了其日常通信模式，可能表明感染或侦察行为。",
-        "artifacts": [
-            {"type": "hostname", "value": "WKS-ENG-12"},
-            {"type": "source_ip", "value": "192.168.4.12"},
-            {"type": "destination_ip", "value": "192.168.5.88"},
-            {"type": "protocol", "value": "TCP", "port": 4444}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T13:44:59.123Z",
-            "event_type": "NetworkFlowAnomaly",
-            "entity_details": {"entity_name": "WKS-ENG-12", "entity_type": "Workstation"},
-            "behavioral_details": {
-                "normal_destination_ips": ["192.168.4.1", "10.10.1.10"],
-                "flow_deviation_score": 8.5
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-08-Excessive-Privilege-Use",
-        "rule_name": "特权账户异常使用",
-        "alert_date": "2025-09-23T16:10:30Z",
-        "tags": ["privileged-account", "escalation", "misuse"],
-        "severity": "High",
-        "reference": "特权账户k.smith异常查询员工工资信息",
-        "description": "特权账户 k.smith 异常地访问了包含员工工资数据的敏感数据库。尽管该账户有此权限，但此行为与该用户的日常职责无关。",
-        "artifacts": [
-            {"type": "username", "value": "k.smith"},
-            {"type": "source_ip", "value": "192.168.1.200"},
-            {"type": "resource", "value": "HR-Salary-DB"},
-            {"type": "action", "value": "read"}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T16:10:29.876Z",
-            "event_type": "PrivilegedAccessAnomaly",
-            "user_details": {"username": "k.smith", "department": "IT Operations"},
-            "behavioral_details": {
-                "normal_access_targets": ["IT-Asset-DB", "Network-Logs-DB"],
-                "deviation_reason": "Access to out-of-scope database"
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-09-Mass-File-Renaming",
-        "rule_name": "批量文件重命名/加密",
-        "alert_date": "2025-09-23T18:05:55Z",
-        "tags": ["ransomware", "data-destruction", "file-anomaly"],
-        "severity": "High",
-        "reference": "主机WKS-HR-03上发生大规模文件重命名",
-        "description": "主机 WKS-HR-03 在短时间内执行了异常大量的批量文件重命名操作，将文件扩展名改为 '.encrypted'。这与勒索软件活动的行为模式高度一致。",
-        "artifacts": [
-            {"type": "hostname", "value": "WKS-HR-03"},
-            {"type": "source_ip", "value": "192.168.2.150"},
-            {"type": "file_change_count", "value": 250},
-            {"type": "new_extension", "value": ".encrypted"}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T18:05:54.666Z",
-            "event_type": "HostFileAnomaly",
-            "entity_details": {"entity_name": "WKS-HR-03", "entity_type": "Workstation"},
-            "behavioral_details": {
-                "file_change_rate": 50,
-                "file_change_rate_score": 9.9,
-                "reason": "Mass file renaming/encryption pattern"
-            }
-        }
-    },
-    {
-        "source": "UEBA",
-        "rule_id": "UEBA-Rule-10-Account-Creation-Anomaly",
-        "rule_name": "异常账户创建",
-        "alert_date": "2025-09-23T20:45:10Z",
-        "tags": ["account-management", "anomaly", "privilege-escalation"],
-        "severity": "Medium",
-        "reference": "非IT管理员账户创建新用户",
-        "description": "非 IT 部门的管理员账户 n.jones 在非工作时间创建了一个新的高权限用户账户。此行为严重偏离了该账户的正常职责。",
-        "artifacts": [
-            {"type": "actor_username", "value": "n.jones"},
-            {"type": "source_ip", "value": "192.168.1.120"},
-            {"type": "action", "value": "user_creation"},
-            {"type": "new_username", "value": "temp_admin_user"}
-        ],
-        "raw_log": {
-            "ueba_engine": "ueba-core-engine",
-            "timestamp": "2025-09-23T20:45:09.111Z",
-            "event_type": "AccountManagementAnomaly",
-            "user_details": {"username": "n.jones", "department": "Facilities"},
-            "behavioral_details": {
-                "normal_activities": ["door-access-control", "HVAC-management"],
-                "deviation_reason": "Out-of-scope user management activity"
-            }
-        }
-    }
-]
-ti_alert = [
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-01-Malicious-IP-Inbound",
-        "rule_name": "来自恶意IP的入站连接",
-        "alert_date": "2025-09-23T20:50:00Z",
-        "tags": ["malicious-ip", "reconnaissance", "botnet"],
-        "severity": "High",
-        "reference": "来自俄罗斯僵尸网络IP的扫描尝试",
-        "description": "防火墙日志显示，来自一个已知僵尸网络基础设施的恶意 IP 地址 185.22.67.123 尝试连接到内部网络。",
-        "artifacts": [
-            {"type": "source_ip", "value": "185.22.67.123"},
-            {"type": "destination_ip", "value": "10.10.10.50"},
-            {"type": "country", "value": "Russia"},
-            {"type": "threat_list", "value": "Botnet C2 IPs"}
-        ],
-        "raw_log": {
-            "source_type": "Firewall",
-            "timestamp": "2025-09-23T20:49:59.876Z",
-            "action": "DENY",
-            "protocol": "TCP",
-            "src_ip": "185.22.67.123",
-            "dst_ip": "10.10.10.50",
-            "dst_port": 22,
-            "rule_name": "deny_all_malicious_ips"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-02-C2-Domain-Outbound",
-        "rule_name": "内部主机尝试连接C2域名",
-        "alert_date": "2025-09-23T20:55:30Z",
-        "tags": ["c2", "malware", "outbound"],
-        "severity": "Critical",
-        "reference": "主机WKS-HR-03连接到恶意C2域名",
-        "description": "内部主机 WKS-HR-03 (192.168.2.150) 尝试通过代理服务器连接到一个被威胁情报标记为命令与控制 (C2) 服务器的域名。",
-        "artifacts": [
-            {"type": "source_ip", "value": "192.168.2.150"},
-            {"type": "destination_domain", "value": "evil.c2-server.net"},
-            {"type": "threat_list", "value": "APT C2 Domains"}
-        ],
-        "raw_log": {
-            "source_type": "Proxy",
-            "timestamp": "2025-09-23T20:55:29.987Z",
-            "action": "BLOCK",
-            "user": "j.smith",
-            "src_ip": "192.168.2.150",
-            "url": "http://evil.c2-server.net/beacon"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-03-Malicious-File-Hash-Match",
-        "rule_name": "内部文件哈希匹配恶意情报",
-        "alert_date": "2025-09-23T21:00:15Z",
-        "tags": ["malware", "file-hash", "endpoint"],
-        "severity": "High",
-        "reference": "主机FIN-WKS-JDOE-05上发现恶意文件",
-        "description": "终端日志显示，主机 FIN-WKS-JDOE-05 上存在一个文件的 SHA256 哈希值与一个已知的恶意软件（勒索软件）哈希值匹配。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "file_path", "value": "C:\\Users\\j.doe\\Downloads\\invoice.exe"},
-            {"type": "file_hash_sha256", "value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"},
-            {"type": "threat_list", "value": "Ransomware Hashes"}
-        ],
-        "raw_log": {
-            "source_type": "EDR",
-            "timestamp": "2025-09-23T21:00:14.654Z",
-            "event_name": "File_Creation_Detected",
-            "file_hash_sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
-            "file_path": "C:\\Users\\j.doe\\Downloads\\invoice.exe"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-04-Phishing-URL-Access",
-        "rule_name": "访问钓鱼URL",
-        "alert_date": "2025-09-23T21:05:40Z",
-        "tags": ["phishing", "url-threat"],
-        "severity": "Medium",
-        "reference": "用户d.chen访问钓鱼URL",
-        "description": "用户 d.chen 访问了一个被威胁情报标记为钓鱼网站的 URL。虽然访问被允许，但该行为需要进一步调查。",
-        "artifacts": [
-            {"type": "username", "value": "d.chen"},
-            {"type": "source_ip", "value": "192.168.4.12"},
-            {"type": "url", "value": "http://my-corp-sso-secure.cc/login"},
-            {"type": "threat_list", "value": "Phishing URLs"}
-        ],
-        "raw_log": {
-            "source_type": "Proxy",
-            "timestamp": "2025-09-23T21:05:39.111Z",
-            "action": "ALLOW",
-            "user": "d.chen",
-            "src_ip": "192.168.4.12",
-            "url": "http://my-corp-sso-secure.cc/login"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-05-Known-Vulnerability-Scan",
-        "rule_name": "已知漏洞扫描活动",
-        "alert_date": "2025-09-23T21:10:20Z",
-        "tags": ["vulnerability", "scan", "reconnaissance"],
-        "severity": "High",
-        "reference": "来自IP 104.22.56.78的Log4j漏洞扫描",
-        "description": "来自 IP 地址 104.22.56.78 的流量模式与 Log4j (CVE-2021-44228) 漏洞的扫描特征相匹配。该 IP 被列在恶意扫描者列表中。",
-        "artifacts": [
-            {"type": "source_ip", "value": "104.22.56.78"},
-            {"type": "destination_ip", "value": "10.10.10.200"},
-            {"type": "vulnerability", "value": "Log4j (CVE-2021-44228)"}
-        ],
-        "raw_log": {
-            "source_type": "IPS/IDS",
-            "timestamp": "2025-09-23T21:10:19.456Z",
-            "action": "DROP",
-            "src_ip": "104.22.56.78",
-            "dst_ip": "10.10.10.200",
-            "signature_id": "IDS_Log4j_Scan_Pattern"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-06-Data-Exfiltration-Endpoint-Match",
-        "rule_name": "数据外泄端点连接",
-        "alert_date": "2025-09-23T21:15:50Z",
-        "tags": ["exfiltration", "data-theft"],
-        "severity": "Medium",
-        "reference": "主机WKS-ENG-12连接到数据外泄端点",
-        "description": "主机 WKS-ENG-12 (192.168.4.12) 尝试连接到一个被标记为数据外泄端点的 IP 地址 45.33.20.10。",
-        "artifacts": [
-            {"type": "hostname", "value": "WKS-ENG-12"},
-            {"type": "source_ip", "value": "192.168.4.12"},
-            {"type": "destination_ip", "value": "45.33.20.10"},
-            {"type": "threat_list", "value": "Data Exfiltration Endpoints"}
-        ],
-        "raw_log": {
-            "source_type": "Firewall",
-            "timestamp": "2025-09-23T21:15:49.123Z",
-            "action": "BLOCK",
-            "src_ip": "192.168.4.12",
-            "dst_ip": "45.33.20.10",
-            "dst_port": 80
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-07-Malicious-Domain-DNS-Query",
-        "rule_name": "DNS查询恶意域名",
-        "alert_date": "2025-09-23T21:20:10Z",
-        "tags": ["dns", "malware"],
-        "severity": "Medium",
-        "reference": "主机IT-ADMIN-01查询恶意域名",
-        "description": "IT-ADMIN-01 (192.168.10.5) 主机向内部 DNS 服务器查询了一个被列为恶意软件分发站点的域名。",
-        "artifacts": [
-            {"type": "source_ip", "value": "192.168.10.5"},
-            {"type": "query_domain", "value": "malware-repo.xyz"},
-            {"type": "threat_list", "value": "Malware Drop Zones"}
-        ],
-        "raw_log": {
-            "source_type": "DNS",
-            "timestamp": "2025-09-23T21:20:09.543Z",
-            "src_ip": "192.168.10.5",
-            "query_domain": "malware-repo.xyz",
-            "response": "blocked"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-08-Suspicious-Country-Access",
-        "rule_name": "来自受限制国家的连接",
-        "alert_date": "2025-09-23T21:25:00Z",
-        "tags": ["geofencing", "risk-country"],
-        "severity": "Low",
-        "reference": "来自受限制国家朝鲜的连接尝试",
-        "description": "来自 IP 地址 175.45.176.1 的连接尝试，该 IP 归属于一个被公司安全策略列为高风险或受限制的国家/地区（朝鲜）。",
-        "artifacts": [
-            {"type": "source_ip", "value": "175.45.176.1"},
-            {"type": "country", "value": "North Korea"}
-        ],
-        "raw_log": {
-            "source_type": "Firewall",
-            "timestamp": "2025-09-23T21:24:59.000Z",
-            "action": "DENY",
-            "src_ip": "175.45.176.1",
-            "dst_ip": "52.8.10.20",
-            "dst_port": 443,
-            "rule_name": "geo_block_north_korea"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-09-Compromised-Account-Credential",
-        "rule_name": "内部账户凭据出现在暗网",
-        "alert_date": "2025-09-23T21:30:35Z",
-        "tags": ["compromised-credentials", "darkweb", "insider-threat"],
-        "severity": "High",
-        "reference": "账户l.wang的凭据出现在暗网数据库",
-        "description": "威胁情报源报告，用户 l.wang (l.wang@mycorp.com) 的凭据（用户名和密码）在一个已泄露的暗网数据库中被发现。",
-        "artifacts": [
-            {"type": "username", "value": "l.wang"},
-            {"type": "email", "value": "l.wang@mycorp.com"},
-            {"type": "leak_source", "value": "Dark Web Credential Dump"}
-        ],
-        "raw_log": {
-            "source_type": "Threat Intelligence Feed",
-            "timestamp": "2025-09-23T21:30:34.888Z",
-            "alert_source": "credential-monitoring-service",
-            "details": "Credential 'l.wang@mycorp.com:password123' found in pastebin dump."
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-10-Honeypot-Interaction",
-        "rule_name": "与公司蜜罐交互",
-        "alert_date": "2025-09-23T21:35:10Z",
-        "tags": ["honeypot", "attacker-activity", "reconnaissance"],
-        "severity": "Medium",
-        "reference": "IP 1.1.1.1与蜜罐服务进行交互",
-        "description": "IP 地址 1.1.1.1 (可能为攻击者) 与公司内部的蜜罐服务建立了连接。该行为表示有针对性的侦察或攻击尝试。",
-        "artifacts": [
-            {"type": "source_ip", "value": "1.1.1.1"},
-            {"type": "destination_ip", "value": "10.10.10.250"},
-            {"type": "device_type", "value": "Honeypot"}
-        ],
-        "raw_log": {
-            "source_type": "Honeypot",
-            "timestamp": "2025-09-23T21:35:09.999Z",
-            "action": "ATTEMPTED_ACCESS",
-            "src_ip": "1.1.1.1",
-            "dst_ip": "10.10.10.250",
-            "dst_port": 21,
-            "service": "ftp"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-11-Malicious-IP-Outbound",
-        "rule_name": "内部主机连接到恶意IP",
-        "alert_date": "2025-09-23T21:40:05Z",
-        "tags": ["malicious-ip", "outbound", "botnet"],
-        "severity": "High",
-        "reference": "主机WKS-HR-03尝试连接到恶意IP",
-        "description": "主机 WKS-HR-03 (192.168.2.150) 尝试连接到一个被列为恶意基础设施的 IP 地址 5.6.7.8。",
-        "artifacts": [
-            {"type": "source_ip", "value": "192.168.2.150"},
-            {"type": "destination_ip", "value": "5.6.7.8"},
-            {"type": "threat_list", "value": "Malicious IPs"}
-        ],
-        "raw_log": {
-            "source_type": "Firewall",
-            "timestamp": "2025-09-23T21:40:04.999Z",
-            "action": "DENY",
-            "src_ip": "192.168.2.150",
-            "dst_ip": "5.6.7.8",
-            "dst_port": 443
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-12-Suspicious-URL-Inbound",
-        "rule_name": "入站邮件中的可疑URL",
-        "alert_date": "2025-09-23T21:45:30Z",
-        "tags": ["phishing", "email"],
-        "severity": "Medium",
-        "reference": "邮件中检测到可疑URL",
-        "description": "邮件安全网关检测到一封入站邮件中包含一个被威胁情报标记为可疑或钓鱼的 URL。",
-        "artifacts": [
-            {"type": "sender_email", "value": "noreply@sso-update.com"},
-            {"type": "url", "value": "https://sso-update.mycorp.io"},
-            {"type": "threat_list", "value": "Suspicious URLs"}
-        ],
-        "raw_log": {
-            "source_type": "Email Gateway",
-            "timestamp": "2025-09-23T21:45:29.876Z",
-            "action": "QUARANTINE",
-            "sender": "noreply@sso-update.com",
-            "recipient": "j.doe@mycorp.com",
-            "subject": "Important Security Notice",
-            "body_snippet": "Please update your password via this link: https://sso-update.mycorp.io"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-13-Known-Attacker-IP",
-        "rule_name": "与已知攻击者IP的交互",
-        "alert_date": "2025-09-23T21:50:00Z",
-        "tags": ["apt", "attacker", "reconnaissance"],
-        "severity": "Critical",
-        "reference": "来自APT组织IP的扫描",
-        "description": "来自一个被确定为APT（高级持续威胁）组织使用的 IP 地址 103.203.20.12 的流量被检测到。",
-        "artifacts": [
-            {"type": "source_ip", "value": "103.203.20.12"},
-            {"type": "threat_actor", "value": "Fancy Bear"}
-        ],
-        "raw_log": {
-            "source_type": "IPS/IDS",
-            "timestamp": "2025-09-23T21:49:59.000Z",
-            "action": "ALERT",
-            "src_ip": "103.203.20.12",
-            "dst_ip": "10.10.10.50",
-            "signature_id": "IDS_Known_APT_Scan"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-14-Ransomware-Hash-Downloaded",
-        "rule_name": "勒索软件哈希被下载",
-        "alert_date": "2025-09-23T21:55:45Z",
-        "tags": ["ransomware", "download", "endpoint"],
-        "severity": "Critical",
-        "reference": "主机MKT-WKS-ASMITH-01下载勒索软件文件",
-        "description": "终端日志显示，主机 MKT-WKS-ASMITH-01 上下载的一个文件与一个已知的勒索软件哈希值匹配。",
-        "artifacts": [
-            {"type": "hostname", "value": "MKT-WKS-ASMITH-01"},
-            {"type": "file_hash_sha256", "value": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"},
-            {"type": "file_path", "value": "C:\\Users\\a.smith\\Downloads\\document.zip"}
-        ],
-        "raw_log": {
-            "source_type": "EDR",
-            "timestamp": "2025-09-23T21:55:44.888Z",
-            "event_name": "File_Download_Detected",
-            "file_hash_sha256": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
-            "file_path": "C:\\Users\\a.smith\\Downloads\\document.zip"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-15-Cryptocurrency-Miner-Domain",
-        "rule_name": "加密货币挖矿域名连接",
-        "alert_date": "2025-09-23T22:00:20Z",
-        "tags": ["cryptomining", "malware"],
-        "severity": "Medium",
-        "reference": "主机FIN-WKS-JDOE-05连接到加密货币挖矿池",
-        "description": "主机 FIN-WKS-JDOE-05 尝试连接到一个被威胁情报标记为加密货币挖矿池的域名。",
-        "artifacts": [
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "destination_domain", "value": "mine-xmr.pool.net"}
-        ],
-        "raw_log": {
-            "source_type": "Proxy",
-            "timestamp": "2025-09-23T22:00:19.999Z",
-            "action": "BLOCK",
-            "user": "j.doe",
-            "src_ip": "192.168.1.101",
-            "url": "http://mine-xmr.pool.net/miner"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-16-Dark-Web-Mention",
-        "rule_name": "公司信息出现在暗网",
-        "alert_date": "2025-09-23T22:05:00Z",
-        "tags": ["darkweb", "intel", "breach"],
-        "severity": "High",
-        "reference": "暗网论坛提及公司名称和泄露数据",
-        "description": "在暗网的一个黑客论坛上，公司名称 'MyCorp' 被提及，并附有泄露员工数据的链接。",
-        "artifacts": [
-            {"type": "company_name", "value": "MyCorp"},
-            {"type": "leak_type", "value": "Employee Data"}
-        ],
-        "raw_log": {
-            "source_type": "Dark Web Monitor",
-            "timestamp": "2025-09-23T22:04:59.000Z",
-            "details": "Post on 'Breach Forums' discussing 'MyCorp' and 'staff email list'"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-17-Malicious-IP-Port-Scan",
-        "rule_name": "来自恶意IP的端口扫描",
-        "alert_date": "2025-09-23T22:10:30Z",
-        "tags": ["malicious-ip", "reconnaissance", "port-scan"],
-        "severity": "Medium",
-        "reference": "来自IP 134.119.50.60的大规模端口扫描",
-        "description": "来自一个已知恶意 IP 的 134.119.50.60 对内部资产进行大规模端口扫描，试图发现开放的服务。",
-        "artifacts": [
-            {"type": "source_ip", "value": "134.119.50.60"},
-            {"type": "destination_ip", "value": "10.10.10.0/24"},
-            {"type": "threat_list", "value": "Malicious Scanners"}
-        ],
-        "raw_log": {
-            "source_type": "IPS/IDS",
-            "timestamp": "2025-09-23T22:10:29.876Z",
-            "action": "ALERT",
-            "src_ip": "134.119.50.60",
-            "dst_ip": "10.10.10.10, 10.10.10.20, ...",
-            "signature_id": "Port_Scan_TCP_Syn"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-18-Spear-Phishing-Email-Detected",
-        "rule_name": "鱼叉式网络钓鱼邮件检测",
-        "alert_date": "2025-09-23T22:15:15Z",
-        "tags": ["spear-phishing", "email"],
-        "severity": "High",
-        "reference": "针对CEO的鱼叉式钓鱼邮件",
-        "description": "一封针对 CEO (j.smith@mycorp.com) 的鱼叉式钓鱼邮件，该邮件模仿了客户公司的通信，并包含一个恶意附件。",
-        "artifacts": [
-            {"type": "recipient_email", "value": "j.smith@mycorp.com"},
-            {"type": "sender_email", "value": "info@customer-relations-co.org"},
-            {"type": "subject", "value": "Regarding Q3 contract renewal"}
-        ],
-        "raw_log": {
-            "source_type": "Email Gateway",
-            "timestamp": "2025-09-23T22:15:14.666Z",
-            "action": "BLOCK",
-            "sender": "info@customer-relations-co.org",
-            "recipient": "j.smith@mycorp.com",
-            "subject": "Regarding Q3 contract renewal",
-            "threat_details": "Targeted phishing, known malicious sender, attachment scan"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-19-Vulnerability-Exploit-Attempt",
-        "rule_name": "已知漏洞利用尝试",
-        "alert_date": "2025-09-23T22:20:00Z",
-        "tags": ["vulnerability", "exploit", "attack"],
-        "severity": "Critical",
-        "reference": "针对Web服务器的SQL注入尝试",
-        "description": "Web 应用防火墙 (WAF) 检测到针对 Web 服务器 (10.10.10.100) 的一个 SQL 注入尝试，该模式与已知的攻击工具和方法相符。",
-        "artifacts": [
-            {"type": "source_ip", "value": "172.67.100.200"},
-            {"type": "destination_ip", "value": "10.10.10.100"},
-            {"type": "attack_type", "value": "SQL Injection"}
-        ],
-        "raw_log": {
-            "source_type": "WAF",
-            "timestamp": "2025-09-23T22:19:59.123Z",
-            "action": "BLOCK",
-            "src_ip": "172.67.100.200",
-            "dst_ip": "10.10.10.100",
-            "request_uri": "/api/users?id=' OR 1=1 --",
-            "rule_id": "WAF_SQLI_Rule_01"
-        }
-    },
-    {
-        "source": "Threat Intelligence",
-        "rule_id": "TI-Rule-20-Social-Media-Threat-Mention",
-        "rule_name": "公司在社交媒体被提及为攻击目标",
-        "alert_date": "2025-09-23T22:25:00Z",
-        "tags": ["social-media", "intel", "targeting"],
-        "severity": "Medium",
-        "reference": "Twitter上提及公司为即将攻击目标",
-        "description": "在公共社交媒体平台（Twitter）上，一个可疑账户发布了关于将 'MyCorp' 作为即将攻击目标的帖子。",
-        "artifacts": [
-            {"type": "platform", "value": "Twitter"},
-            {"type": "mention_text", "value": "MyCorp is next. #breach"},
-            {"type": "threat_actor_alias", "value": "CyberViking"}
-        ],
-        "raw_log": {
-            "source_type": "Social Media Monitor",
-            "timestamp": "2025-09-23T22:24:59.000Z",
-            "details": "Tweet by user @CyberViking: 'MyCorp is next. #breach #hack'"
-        }
-    }
-]
-
-iam_alert = [
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-01-Excessive-Permission-Grant",
-        "rule_name": "账户权限异常提升",
-        "alert_date": "2025-09-23T23:05:00Z",
-        "tags": ["privilege-escalation", "iam", "access-anomaly"],
-        "severity": "High",
-        "reference": "用户j.doe账户被授予敏感管理员权限",
-        "description": "用户 j.doe 的账户被授予 'Global Administrator' 权限。此权限提升发生在非IT管理员的操作下，且不符合其日常工作职责，可能表明特权提升攻击。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "actor_account", "value": "l.smith"},
-            {"type": "permission_granted", "value": "Global Administrator"},
-            {"type": "platform", "value": "Azure AD"}
-        ],
-        "raw_log": {
-            "service": "Azure AD",
-            "timestamp": "2025-09-23T23:04:59.888Z",
-            "event_type": "RoleAssignment",
-            "actor": {"user_id": "l.smith"},
-            "target": {"user_id": "j.doe"},
-            "details": {"role": "Global Administrator", "reason": "Unjustified elevation"}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-02-Impossible-Travel-Login",
-        "rule_name": "异地登录（不可能行程）",
-        "alert_date": "2025-09-23T23:10:30Z",
-        "tags": ["impossible-travel", "geolocation", "compromised-account"],
-        "severity": "High",
-        "reference": "用户c.jones账户在两地同时登录",
-        "description": "用户 c.jones 的账户在 10 分钟内分别从美国和日本登录。这在物理上是不可能的，强烈表明账户已被盗用。",
-        "artifacts": [
-            {"type": "username", "value": "c.jones"},
-            {"type": "login_1_ip", "value": "198.51.100.25"},
-            {"type": "login_1_location", "value": "New York, USA"},
-            {"type": "login_2_ip", "value": "203.0.113.50"},
-            {"type": "login_2_location", "value": "Tokyo, Japan"}
-        ],
-        "raw_log": {
-            "service": "Okta",
-            "timestamp": "2025-09-23T23:10:29.987Z",
-            "event_type": "AuthenticationSuccess",
-            "user": {"username": "c.jones"},
-            "geolocations": [{"country": "USA", "ip": "198.51.100.25"}, {"country": "Japan", "ip": "203.0.113.50"}],
-            "details": {"time_between_logins_min": 10}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-03-Brute-Force-Attack-Password-Spraying",
-        "rule_name": "多账户密码喷洒攻击",
-        "alert_date": "2025-09-23T23:15:20Z",
-        "tags": ["brute-force", "password-spraying", "authentication"],
-        "severity": "High",
-        "reference": "来自IP 104.22.56.78的密码喷洒攻击",
-        "description": "来自单个 IP 地址 104.22.56.78 对多个用户账户进行了大量的失败登录尝试。该攻击模式与密码喷洒攻击一致。",
-        "artifacts": [
-            {"type": "source_ip", "value": "104.22.56.78"},
-            {"type": "failed_logins", "value": 50},
-            {"type": "target_user_count", "value": 10}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-23T23:15:19.444Z",
-            "event_type": "AuthenticationFailure",
-            "src_ip": "104.22.56.78",
-            "details": {"target_users": ["j.doe", "a.smith", "c.jones", "..."], "password_attempted": "Spring2025!"}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-04-New-Privileged-Account-Created",
-        "rule_name": "非授权创建特权账户",
-        "alert_date": "2025-09-23T23:20:55Z",
-        "tags": ["account-creation", "privileged-account", "insider-threat"],
-        "severity": "Medium",
-        "reference": "非IT管理员账户创建新管理员用户",
-        "description": "非 IT 部门的管理员账户 s.brown 在非工作时间创建了一个新的高权限用户账户，名为 'temp_admin_user'。",
-        "artifacts": [
-            {"type": "actor_username", "value": "s.brown"},
-            {"type": "new_username", "value": "temp_admin_user"},
-            {"type": "source_ip", "value": "192.168.1.55"},
-            {"type": "time_of_day", "value": "After-hours"}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-23T23:20:54.666Z",
-            "event_type": "UserCreation",
-            "actor": {"username": "s.brown", "department": "Facilities"},
-            "target": {"username": "temp_admin_user", "groups": ["Domain Admins"]}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-05-Unusual-API-Call-Cloud",
-        "rule_name": "云服务账户异常API调用",
-        "alert_date": "2025-09-23T23:25:40Z",
-        "tags": ["cloud-security", "iam", "api-call-anomaly"],
-        "severity": "High",
-        "reference": "AWS账户'App-Service'在异常地点调用API",
-        "description": "AWS 服务账户 'App-Service' 通常仅从美国东部地区发起 API 调用，但现在却从欧洲地区发起了异常的 'EC2 StartInstances' API 调用。",
-        "artifacts": [
-            {"type": "account_name", "value": "App-Service"},
-            {"type": "api_call", "value": "EC2:StartInstances"},
-            {"type": "source_region", "value": "eu-west-1"},
-            {"type": "normal_region", "value": "us-east-1"}
-        ],
-        "raw_log": {
-            "service": "AWS CloudTrail",
-            "timestamp": "2025-09-23T23:25:39.111Z",
-            "event_name": "StartInstances",
-            "user_identity": {"type": "AssumedRole", "principal_id": "App-Service"},
-            "source_ip_address": "85.234.11.22",
-            "aws_region": "eu-west-1"
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-06-Multiple-Failed-MFA-Attempts",
-        "rule_name": "多因素认证失败尝试",
-        "alert_date": "2025-09-23T23:30:10Z",
-        "tags": ["mfa", "authentication", "brute-force"],
-        "severity": "Medium",
-        "reference": "用户h.lin多次尝试失败的MFA验证",
-        "description": "用户 h.lin 在短时间内多次尝试失败的多因素认证（MFA）。这可能表明攻击者已经窃取了其密码，并正在尝试绕过 MFA。",
-        "artifacts": [
-            {"type": "username", "value": "h.lin"},
-            {"type": "failed_attempts", "value": 5},
-            {"type": "source_ip", "value": "203.0.113.100"},
-            {"type": "mfa_method", "value": "TOTP"}
-        ],
-        "raw_log": {
-            "service": "Okta",
-            "timestamp": "2025-09-23T23:30:09.543Z",
-            "event_type": "AuthenticationFailure",
-            "user": {"username": "h.lin"},
-            "details": {"reason": "MFA challenge failed", "mfa_method": "TOTP"}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-07-Admin-Password-Reset-Anomaly",
-        "rule_name": "管理员账户密码重置异常",
-        "alert_date": "2025-09-23T23:35:00Z",
-        "tags": ["privileged-account", "password-reset", "compromised-account"],
-        "severity": "Critical",
-        "reference": "管理员账户k.smith在异常时间被重置密码",
-        "description": "管理员账户 k.smith 的密码在非工作时间被重置，且重置请求来自一个不属于正常管理员工作站的 IP 地址。",
-        "artifacts": [
-            {"type": "username", "value": "k.smith"},
-            {"type": "source_ip", "value": "192.168.10.20"},
-            {"type": "time_of_day", "value": "After-hours"}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-23T23:34:59.000Z",
-            "event_type": "PasswordReset",
-            "user": {"username": "k.smith"},
-            "details": {"action_by_ip": "192.168.10.20", "action_by_user": "SERVICE_ACCOUNT_PRV"}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-08-New-User-Accessing-Sensitive-Data",
-        "rule_name": "新创建用户访问敏感数据",
-        "alert_date": "2025-09-23T23:40:15Z",
-        "tags": ["new-user", "insider-threat", "data-exfiltration"],
-        "severity": "Medium",
-        "reference": "新用户n.jones创建后立即访问敏感数据",
-        "description": "新创建的用户 n.jones 在其账户创建后 1 小时内，尝试访问一个包含客户 PII 的文件服务器。此行为与新员工的正常入职流程不符。",
-        "artifacts": [
-            {"type": "username", "value": "n.jones"},
-            {"type": "source_ip", "value": "192.168.2.150"},
-            {"type": "resource", "value": "FileServer-HR-PII"}
-        ],
-        "raw_log": {
-            "service": "File Server",
-            "timestamp": "2025-09-23T23:40:14.999Z",
-            "event_type": "FileAccess",
-            "user": {"username": "n.jones"},
-            "file_path": "/sensitive/hr/pii/customers.xlsx",
-            "access_result": "Denied"
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-09-Service-Account-Interactive-Login",
-        "rule_name": "服务账户异常交互式登录",
-        "alert_date": "2025-09-23T23:45:30Z",
-        "tags": ["service-account", "anomaly", "lateral-movement"],
-        "severity": "High",
-        "reference": "服务账户SVC-APP-01在工作站进行登录",
-        "description": "服务账户 'SVC-APP-01' 通常仅用于自动化进程，但现在却在工作站上进行了交互式登录。这强烈表明账户已被攻击者盗用。",
-        "artifacts": [
-            {"type": "account_name", "value": "SVC-APP-01"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "login_type", "value": "Interactive"}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-23T23:45:29.876Z",
-            "event_type": "LoginSuccess",
-            "user": {"username": "SVC-APP-01"},
-            "src_ip": "192.168.1.101",
-            "login_type": "Interactive"
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-10-Account-Creation-Followed-by-Compromise",
-        "rule_name": "新账户创建后立即被盗用",
-        "alert_date": "2025-09-23T23:50:00Z",
-        "tags": ["account-compromise", "new-user", "suspicious-activity"],
-        "severity": "High",
-        "reference": "新账户'temp_admin_user'被创建后立即登录异地",
-        "description": "新创建的账户 'temp_admin_user' 在其创建后 10 分钟内，从一个异常的外部 IP 地址 203.0.113.20 进行了首次登录。这表明该账户可能被恶意创建并立即被盗用。",
-        "artifacts": [
-            {"type": "username", "value": "temp_admin_user"},
-            {"type": "login_ip", "value": "203.0.113.20"},
-            {"type": "time_since_creation_min", "value": 10}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-23T23:50:00.000Z",
-            "event_type": "LoginSuccess",
-            "user": {"username": "temp_admin_user"},
-            "src_ip": "203.0.113.20"
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-11-High-Frequency-Access-Denied",
-        "rule_name": "账户高频访问拒绝",
-        "alert_date": "2025-09-23T23:55:10Z",
-        "tags": ["reconnaissance", "lateral-movement", "access-denied"],
-        "severity": "Medium",
-        "reference": "用户a.smith高频访问被拒绝的资源",
-        "description": "用户 a.smith 在短时间内对多个权限不足的资源进行了高频访问尝试。这可能是攻击者在进行侦察，试图发现可利用的权限。",
-        "artifacts": [
-            {"type": "username", "value": "a.smith"},
-            {"type": "source_ip", "value": "192.168.2.54"},
-            {"type": "denied_attempts", "value": 30},
-            {"type": "time_window_sec", "value": 60}
-        ],
-        "raw_log": {
-            "service": "File Server",
-            "timestamp": "2025-09-23T23:55:09.123Z",
-            "event_type": "AccessDenied",
-            "user": {"username": "a.smith"},
-            "resource_list": ["/finance/docs/", "/hr/payroll/", "/ceo/private/"],
-            "access_result": "Denied"
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-12-Shared-Credential-Used-Unusual-Context",
-        "rule_name": "共享凭据异常使用",
-        "alert_date": "2025-09-24T00:00:20Z",
-        "tags": ["shared-account", "anomaly", "lateral-movement"],
-        "severity": "Low",
-        "reference": "共享账户'Guest-User'在异常时间登录",
-        "description": "共享账户 'Guest-User' 通常仅在白天使用，但在凌晨 2:00 进行了登录。这表明该共享账户可能被滥用。",
-        "artifacts": [
-            {"type": "username", "value": "Guest-User"},
-            {"type": "source_ip", "value": "192.168.3.88"},
-            {"type": "time_of_day", "value": "Unusual-hours"}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-24T00:00:19.999Z",
-            "event_type": "LoginSuccess",
-            "user": {"username": "Guest-User"},
-            "src_ip": "192.168.3.88"
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-13-Credential-Theft-Attempt-Local-Admin",
-        "rule_name": "本地管理员账户凭据盗窃尝试",
-        "alert_date": "2025-09-24T00:05:00Z",
-        "tags": ["credential-theft", "lateral-movement", "endpoint"],
-        "severity": "High",
-        "reference": "主机FIN-WKS-JDOE-05上发生本地凭据转储",
-        "description": "主机 FIN-WKS-JDOE-05 上检测到 Mimikatz 等凭据转储工具的活动。攻击者可能试图从本地系统窃取管理员或域账户凭据。",
-        "artifacts": [
-            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
-            {"type": "source_ip", "value": "192.168.1.101"},
-            {"type": "tool_name", "value": "Mimikatz"}
-        ],
-        "raw_log": {
-            "service": "EDR",
-            "timestamp": "2025-09-24T00:04:59.876Z",
-            "event_type": "ProcessActivity",
-            "src_ip": "192.168.1.101",
-            "process_name": "cmd.exe",
-            "command_line": "powershell.exe -e JABNAGkAbQBpAGsAYQB0AHoAIAB... "
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-14-Role-Assignment-Anomaly-Cloud",
-        "rule_name": "云角色分配异常",
-        "alert_date": "2025-09-24T00:10:30Z",
-        "tags": ["cloud-security", "iam", "role-anomaly"],
-        "severity": "High",
-        "reference": "用户c.jones被授予'IAMFullAccess'角色",
-        "description": "用户 c.jones 被授予 AWS 'IAMFullAccess' 角色，该角色允许创建和管理所有 IAM 资源。此权限与该用户的开发人员角色不符。",
-        "artifacts": [
-            {"type": "username", "value": "c.jones"},
-            {"type": "role_granted", "value": "IAMFullAccess"},
-            {"type": "platform", "value": "AWS"}
-        ],
-        "raw_log": {
-            "service": "AWS CloudTrail",
-            "timestamp": "2025-09-24T00:10:29.999Z",
-            "event_name": "AttachUserPolicy",
-            "user_identity": {"type": "AssumedRole", "principal_id": "AdminRole"},
-            "details": {"user_id": "c.jones", "policy_name": "IAMFullAccess"}
-        }
-    },
-    {
-        "source": "IAM",
-        "rule_id": "IAM-Rule-15-Account-Lockout-Threshold-Exceeded",
-        "rule_name": "账户锁定阈值超出",
-        "alert_date": "2025-09-24T00:15:15Z",
-        "tags": ["authentication", "account-lockout", "brute-force"],
-        "severity": "Medium",
-        "reference": "账户j.doe因高频失败登录被锁定",
-        "description": "用户 j.doe 的账户因在 5 分钟内多次失败登录而达到锁定阈值。这可能是针对该账户的直接暴力破解攻击。",
-        "artifacts": [
-            {"type": "username", "value": "j.doe"},
-            {"type": "failed_logins", "value": 6},
-            {"type": "lockout_time", "value": "2025-09-24T00:15:15Z"}
-        ],
-        "raw_log": {
-            "service": "Active Directory",
-            "timestamp": "2025-09-24T00:15:14.543Z",
-            "event_type": "AccountLockout",
-            "user": {"username": "j.doe"},
-            "src_ip": "192.168.1.101",
-            "details": {"lockout_threshold": 5, "current_failures": 6}
-        }
-    }
-]
-edr_alerts_1 = [
-    {
         "source": "EDR",
         "rule_id": "EDR-Rule-01-Suspicious-PowerShell-Execution",
         "rule_name": "可疑的PowerShell命令执行",
@@ -3537,8 +775,191 @@ edr_alerts_1 = [
         }
     }
 ]
-ndr_alert_1 = [
+
+ndr_alert = [
     {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-05-Suspect-C2-Communication",
+        "rule_name": "可疑的命令与控制（C2）通信",
+        "alert_date": "2025-09-18T13:35:10Z",
+        "tags": ["c2", "cobaltstrike", "network"],
+        "severity": "Critical",
+        "reference": "主机FIN-WKS-JDOE-05与已知C2服务器通信",
+        "description": "检测到主机 FIN-WKS-JDOE-05 发起出站连接到被标记为恶意 C2 服务器的 IP 地址 198.51.100.50。流量特征与 Cobalt Strike Beacon 模式高度匹配。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_ip", "value": "198.51.100.50"},
+            {"type": "destination_domain", "value": "known-bad.c2.server"},
+            {"type": "destination_port", "value": "443"},
+            {"type": "protocol", "value": "HTTPS"}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-18T13:35:09.800Z",
+            "event_type": "Flow",
+            "flow_details": {
+                "source_ip": "192.168.1.101",
+                "source_port": 51234,
+                "destination_ip": "198.51.100.50",
+                "destination_port": 443,
+                "protocol": "TCP",
+                "bytes_in": 1024,
+                "bytes_out": 512,
+                "duration_seconds": 5
+            },
+            "network_context": {
+                "destination_domain": "known-bad.c2.server",
+                "threat_intel": {"source": "threat-feed-X", "match": "Cobalt Strike C2 server"}
+            },
+            "device_details": {"hostname": "FIN-WKS-JDOE-05"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-12-Lateral-Movement-Attempt",
+        "rule_name": "主机到主机的横向移动尝试",
+        "alert_date": "2025-09-18T14:12:00Z",
+        "tags": ["lateral-movement", "internal-scan"],
+        "severity": "High",
+        "reference": "主机FIN-WKS-JDOE-05对域控SRV-DC-01发起异常连接",
+        "description": "检测到 FIN-WKS-JDOE-05（工作站）发起大量到域控制器 SRV-DC-01 的 SMB 和 LDAP 连接，这与常规用户行为不符，表明可能存在横向移动或侦察行为。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_ip", "value": "10.10.1.5"},
+            {"type": "destination_hostname", "value": "SRV-DC-01"},
+            {"type": "protocol", "value": "SMB", "port": 445},
+            {"type": "protocol", "value": "LDAP", "port": 389}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-18T14:11:59.550Z",
+            "event_type": "AnomalousFlow",
+            "flow_details": {
+                "source_ip": "192.168.1.101",
+                "destination_ip": "10.10.1.5",
+                "destination_port": [445, 389],
+                "protocol": ["SMB", "LDAP"],
+                "flow_count": 25,
+                "flow_rate_per_sec": 5
+            },
+            "network_context": {
+                "source_device_type": "workstation",
+                "destination_device_type": "domain-controller",
+                "behavior_anomaly": "Unusual high-volume SMB/LDAP traffic from a workstation to a DC"
+            },
+            "device_details": {"hostname": "FIN-WKS-JDOE-05"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-15-Unauthorized-Data-Exfiltration",
+        "rule_name": "异常数据外泄",
+        "alert_date": "2025-09-18T14:18:30Z",
+        "tags": ["exfiltration", "data-transfer", "unusual-port"],
+        "severity": "High",
+        "reference": "主机SRV-DC-01向外部IP传输异常数据量",
+        "description": "域控制器 SRV-DC-01 正在通过非标准端口（44443）向外部 IP 地址 203.0.113.78 发送大量加密数据。此模式通常与数据外泄有关。",
+        "artifacts": [
+            {"type": "hostname", "value": "SRV-DC-01"},
+            {"type": "source_ip", "value": "10.10.1.5"},
+            {"type": "destination_ip", "value": "203.0.113.78"},
+            {"type": "destination_port", "value": "44443"},
+            {"type": "data_volume", "value": "1.2 GB"}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-dc",
+            "timestamp": "2025-09-18T14:18:29.112Z",
+            "event_type": "Flow",
+            "flow_details": {
+                "source_ip": "10.10.1.5",
+                "destination_ip": "203.0.113.78",
+                "destination_port": 44443,
+                "protocol": "TCP",
+                "bytes_out": 1200000000,
+                "duration_seconds": 180
+            },
+            "network_context": {
+                "flow_direction": "outbound",
+                "behavior_anomaly": "Large volume of data transfer on an unusual port to an external host"
+            },
+            "device_details": {"hostname": "SRV-DC-01"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-12-Lateral-Movement-Attempt",
+        "rule_name": "主机到主机的横向移动尝试",
+        "alert_date": "2025-09-18T14:20:05Z",
+        "tags": ["lateral-movement", "internal-scan"],
+        "severity": "High",
+        "reference": "主机SRV-DC-01对文件服务器SRV-FILE-02发起异常连接",
+        "description": "检测到 SRV-DC-01（域控）正在扫描并尝试连接到 SRV-FILE-02（文件服务器）。该行为模式与攻击者在内网中进行横向移动以寻找新目标相符。",
+        "artifacts": [
+            {"type": "hostname", "value": "SRV-DC-01"},
+            {"type": "source_ip", "value": "10.10.1.5"},
+            {"type": "destination_ip", "value": "10.10.2.18"},
+            {"type": "destination_hostname", "value": "SRV-FILE-02"},
+            {"type": "protocol", "value": "SMB", "port": 445}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-dc",
+            "timestamp": "2025-09-18T14:20:04.990Z",
+            "event_type": "AnomalousFlow",
+            "flow_details": {
+                "source_ip": "10.10.1.5",
+                "destination_ip": "10.10.2.18",
+                "destination_port": 445,
+                "protocol": "SMB",
+                "flow_count": 50,
+                "flow_rate_per_sec": 10
+            },
+            "network_context": {
+                "source_device_type": "domain-controller",
+                "destination_device_type": "file-server",
+                "behavior_anomaly": "Port scan/enumeration activity from a DC to a file server"
+            },
+            "device_details": {"hostname": "SRV-DC-01"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-05-Suspect-C2-Communication",
+        "rule_name": "可疑的命令与控制（C2）通信",
+        "alert_date": "2025-09-18T14:40:15Z",
+        "tags": ["c2", "cobaltstrike", "network"],
+        "severity": "Critical",
+        "reference": "主机FIN-WKS-JDOE-05与已知C2服务器持续通信",
+        "description": "FIN-WKS-JDOE-05 与已知 C2 服务器 known-bad.c2.server (198.51.100.50) 之间持续存在低流量、周期性出站连接。这种通信模式是持续性命令与控制活动的典型特征。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_ip", "value": "198.51.100.50"},
+            {"type": "destination_domain", "value": "known-bad.c2.server"},
+            {"type": "destination_port", "value": "443"},
+            {"type": "protocol", "value": "HTTPS"}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-18T14:40:14.654Z",
+            "event_type": "Flow",
+            "flow_details": {
+                "source_ip": "192.168.1.101",
+                "destination_ip": "198.51.100.50",
+                "destination_port": 443,
+                "protocol": "HTTPS",
+                "bytes_in": 256,
+                "bytes_out": 128,
+                "duration_seconds": 2
+            },
+            "network_context": {
+                "flow_direction": "outbound",
+                "threat_intel": {"source": "threat-feed-X", "match": "Cobalt Strike C2 server"}
+            },
+            "behavior_pattern": "Periodic, low-volume communication typical of a beaconing C2"
+        }
+    }, {
         "source": "NDR",
         "rule_id": "NDR-Rule-01-C2-Beaconing",
         "rule_name": "C2 信标（Beaconing）流量",
@@ -4142,9 +1563,3247 @@ ndr_alert_1 = [
         }
     }
 ]
+
+ndr_alert.extend([
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-05-Suspect-C2-Communication",
+        "rule_name": "可疑的命令与控制（C2）通信",
+        "alert_date": "2025-09-18T13:35:10Z",
+        "tags": ["c2", "cobaltstrike", "network"],
+        "severity": "Critical",
+        "reference": "主机FIN-WKS-JDOE-05与已知C2服务器通信",
+        "description": "检测到主机 FIN-WKS-JDOE-05 发起出站连接到被标记为恶意 C2 服务器的 IP 地址 198.51.100.50。流量特征与 Cobalt Strike Beacon 模式高度匹配。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_ip", "value": "198.51.100.50"},
+            {"type": "destination_domain", "value": "known-bad.c2.server"},
+            {"type": "destination_port", "value": "443"},
+            {"type": "protocol", "value": "HTTPS"}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-18T13:35:09.800Z",
+            "event_type": "Flow",
+            "flow_details": {
+                "source_ip": "192.168.1.101",
+                "source_port": 51234,
+                "destination_ip": "198.51.100.50",
+                "destination_port": 443,
+                "protocol": "TCP",
+                "bytes_in": 1024,
+                "bytes_out": 512,
+                "duration_seconds": 5
+            },
+            "network_context": {
+                "destination_domain": "known-bad.c2.server",
+                "threat_intel": {"source": "threat-feed-X", "match": "Cobalt Strike C2 server"}
+            },
+            "device_details": {"hostname": "FIN-WKS-JDOE-05"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-12-Lateral-Movement-Attempt",
+        "rule_name": "主机到主机的横向移动尝试",
+        "alert_date": "2025-09-18T14:12:00Z",
+        "tags": ["lateral-movement", "internal-scan"],
+        "severity": "High",
+        "reference": "主机FIN-WKS-JDOE-05对域控SRV-DC-01发起异常连接",
+        "description": "检测到 FIN-WKS-JDOE-05（工作站）发起大量到域控制器 SRV-DC-01 的 SMB 和 LDAP 连接，这与常规用户行为不符，表明可能存在横向移动或侦察行为。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_ip", "value": "10.10.1.5"},
+            {"type": "destination_hostname", "value": "SRV-DC-01"},
+            {"type": "protocol", "value": "SMB", "port": 445},
+            {"type": "protocol", "value": "LDAP", "port": 389}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-18T14:11:59.550Z",
+            "event_type": "AnomalousFlow",
+            "flow_details": {
+                "source_ip": "192.168.1.101",
+                "destination_ip": "10.10.1.5",
+                "destination_port": [445, 389],
+                "protocol": ["SMB", "LDAP"],
+                "flow_count": 25,
+                "flow_rate_per_sec": 5
+            },
+            "network_context": {
+                "source_device_type": "workstation",
+                "destination_device_type": "domain-controller",
+                "behavior_anomaly": "Unusual high-volume SMB/LDAP traffic from a workstation to a DC"
+            },
+            "device_details": {"hostname": "FIN-WKS-JDOE-05"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-15-Unauthorized-Data-Exfiltration",
+        "rule_name": "异常数据外泄",
+        "alert_date": "2025-09-18T14:18:30Z",
+        "tags": ["exfiltration", "data-transfer", "unusual-port"],
+        "severity": "High",
+        "reference": "主机SRV-DC-01向外部IP传输异常数据量",
+        "description": "域控制器 SRV-DC-01 正在通过非标准端口（44443）向外部 IP 地址 203.0.113.78 发送大量加密数据。此模式通常与数据外泄有关。",
+        "artifacts": [
+            {"type": "hostname", "value": "SRV-DC-01"},
+            {"type": "source_ip", "value": "10.10.1.5"},
+            {"type": "destination_ip", "value": "203.0.113.78"},
+            {"type": "destination_port", "value": "44443"},
+            {"type": "data_volume", "value": "1.2 GB"}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-dc",
+            "timestamp": "2025-09-18T14:18:29.112Z",
+            "event_type": "Flow",
+            "flow_details": {
+                "source_ip": "10.10.1.5",
+                "destination_ip": "203.0.113.78",
+                "destination_port": 44443,
+                "protocol": "TCP",
+                "bytes_out": 1200000000,
+                "duration_seconds": 180
+            },
+            "network_context": {
+                "flow_direction": "outbound",
+                "behavior_anomaly": "Large volume of data transfer on an unusual port to an external host"
+            },
+            "device_details": {"hostname": "SRV-DC-01"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-05-Suspect-C2-Communication",
+        "rule_name": "可疑的命令与控制（C2）通信",
+        "alert_date": "2025-09-19T09:20:15Z",
+        "tags": ["c2", "metasploit", "network"],
+        "severity": "Critical",
+        "reference": "主机FIN-SRV-ACCT-03与已知C2服务器通信",
+        "description": "检测到主机 FIN-SRV-ACCT-03 发起出站连接到被标记为恶意 C2 服务器的 IP 地址 198.51.100.60。流量特征与 Metasploit payload 模式高度匹配。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-SRV-ACCT-03"},
+            {"type": "source_ip", "value": "192.168.2.55"},
+            {"type": "destination_ip", "value": "198.51.100.60"},
+            {"type": "destination_domain", "value": "metasploit.c2.server"},
+            {"type": "destination_port", "value": "8080"},
+            {"type": "protocol", "value": "HTTP"}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-19T09:20:14.500Z",
+            "event_type": "Flow",
+            "flow_details": {
+                "source_ip": "192.168.2.55",
+                "source_port": 61123,
+                "destination_ip": "198.51.100.60",
+                "destination_port": 8080,
+                "protocol": "TCP",
+                "bytes_in": 789,
+                "bytes_out": 456,
+                "duration_seconds": 8
+            },
+            "network_context": {
+                "destination_domain": "metasploit.c2.server",
+                "threat_intel": {"source": "threat-feed-Y", "match": "Metasploit C2 server"}
+            },
+            "device_details": {"hostname": "FIN-SRV-ACCT-03"}
+        }
+    },
+    {
+        "source": "NDR",
+        "rule_id": "NDR-Rule-12-Lateral-Movement-Attempt",
+        "rule_name": "主机到主机的横向移动尝试",
+        "alert_date": "2025-09-19T10:05:45Z",
+        "tags": ["lateral-movement", "reconnaissance"],
+        "severity": "High",
+        "reference": "主机FIN-SRV-ACCT-03对FIN-WKS-JDOE-05发起异常连接",
+        "description": "检测到 FIN-SRV-ACCT-03（财务服务器）发起异常数量的 RDP 连接到 FIN-WKS-JDOE-05，这与常规服务器行为不符，表明可能存在内部侦察或凭证窃取后的横向移动行为。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-SRV-ACCT-03"},
+            {"type": "source_ip", "value": "192.168.2.55"},
+            {"type": "destination_ip", "value": "192.168.1.101"},
+            {"type": "destination_hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "protocol", "value": "RDP", "port": 3389}
+        ],
+        "raw_log": {
+            "sensor_id": "ndr-sensor-finance",
+            "timestamp": "2025-09-19T10:05:44.880Z",
+            "event_type": "AnomalousFlow",
+            "flow_details": {
+                "source_ip": "192.168.2.55",
+                "destination_ip": "192.168.1.101",
+                "destination_port": [3389],
+                "protocol": ["RDP"],
+                "flow_count": 15,
+                "flow_rate_per_sec": 3
+            },
+            "network_context": {
+                "source_device_type": "server",
+                "destination_device_type": "workstation",
+                "behavior_anomaly": "Unusual RDP traffic from a server to a workstation"
+            },
+            "device_details": {"hostname": "FIN-SRV-ACCT-03"}
+        }
+    }
+])
+
+dlp_alert = [
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-08-Financial-Record-Transfer-to-USB",
+        "rule_name": "财务记录传输到可移动设备",
+        "alert_date": "2025-09-18T15:25:55Z",
+        "tags": ["finance", "exfiltration", "usb"],
+        "severity": "High",
+        "reference": "用户j.doe将公司财务报表复制到U盘",
+        "description": "检测到用户 j.doe 将包含公司季度财务数据的 Excel 文件复制到连接到 FIN-WKS-JDOE-05 主机的可移动存储设备。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "action", "value": "file-copy-to-usb"},
+            {"type": "data_classification", "value": "Financial"},
+            {"type": "file_name", "value": "Q3_Financial_Report.xlsx"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T15:25:54.660Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Removable Media",
+            "file_details": {
+                "file_path": "C:\\Users\\j.doe\\Documents\\Reports\\Q3_Financial_Report.xlsx",
+                "file_hash_sha256": "c3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4",
+                "classification_tags": ["Financial", "Confidential"]
+            },
+            "transfer_details": {
+                "device_type": "USB-Drive",
+                "device_serial": "A1B2C3D4E5F6"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-09-Source-Code-Upload-to-Pastebin",
+        "rule_name": "源代码上传到公共网站",
+        "alert_date": "2025-09-18T15:30:15Z",
+        "tags": ["source-code", "exfiltration", "web"],
+        "severity": "Critical",
+        "reference": "研发部员工在公共网站发布源代码",
+        "description": "检测到研发部用户试图将包含公司专有源代码的文本片段上传到 pastebin.com。这属于严重的数据外泄行为。",
+        "artifacts": [
+            {"type": "username", "value": "d.chen"},
+            {"type": "hostname", "value": "DEV-WKS-DCHEN-12"},
+            {"type": "ip", "value": "10.10.3.25"},
+            {"type": "action", "value": "web-upload"},
+            {"type": "data_classification", "value": "Proprietary Source Code"},
+            {"type": "destination_domain", "value": "pastebin.com"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dev12",
+            "timestamp": "2025-09-18T15:30:14.981Z",
+            "event_type": "DataTransfer",
+            "data_source": "Clipboard",
+            "data_destination": "Web",
+            "data_details": {
+                "extracted_content_hash": "e1f2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2",
+                "classification_tags": ["Proprietary Code", "Project-Nova"]
+            },
+            "transfer_details": {
+                "application": "chrome.exe",
+                "url": "https://pastebin.com/post"
+            },
+            "user_details": {"username": "d.chen", "domain": "MYCORP"},
+            "device_details": {"hostname": "DEV-WKS-DCHEN-12", "ip_address": "10.10.3.25"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-10-Health-Information-Transfer",
+        "rule_name": "受保护健康信息（PHI）传输",
+        "alert_date": "2025-09-18T15:35:40Z",
+        "tags": ["phi", "healthcare", "exfiltration"],
+        "severity": "High",
+        "reference": "HR部门员工外发员工健康数据",
+        "description": "人力资源部用户 h.lin 试图通过电子邮件将包含员工受保护健康信息（PHI）的文件发送给外部收件人。",
+        "artifacts": [
+            {"type": "username", "value": "h.lin"},
+            {"type": "hostname", "value": "HR-WKS-HLIN-03"},
+            {"type": "ip", "value": "192.168.4.15"},
+            {"type": "action", "value": "email-send"},
+            {"type": "data_classification", "value": "PHI"},
+            {"type": "file_name", "value": "Employee_Health_Data.csv"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-hr03",
+            "timestamp": "2025-09-18T15:35:39.145Z",
+            "event_type": "DataTransfer",
+            "data_source": "Outlook",
+            "data_destination": "External Email",
+            "file_details": {
+                "file_path": "C:\\Users\\h.lin\\Documents\\Employee_Health_Data.csv",
+                "file_hash_sha256": "f3d4c5b6a7e8d9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1e2d3f4",
+                "classification_tags": ["PHI", "HIPAA-Compliance"]
+            },
+            "transfer_details": {
+                "protocol": "SMTP",
+                "recipient": "external.clinic@example.com",
+                "subject": "Staff Health Records"
+            },
+            "user_details": {"username": "h.lin", "domain": "MYCORP"},
+            "device_details": {"hostname": "HR-WKS-HLIN-03", "ip_address": "192.168.4.15"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-11-Leaked-API-Key-in-Code",
+        "rule_name": "API密钥泄露",
+        "alert_date": "2025-09-18T15:40:00Z",
+        "tags": ["api-key", "secrets", "source-code"],
+        "severity": "High",
+        "reference": "Git推送中包含硬编码API密钥",
+        "description": "检测到用户 m.li 在代码提交中包含硬编码的敏感 API 密钥。此行为可能导致未授权访问公司的服务。",
+        "artifacts": [
+            {"type": "username", "value": "m.li"},
+            {"type": "hostname", "value": "DEV-WKS-MLI-08"},
+            {"type": "ip", "value": "10.10.3.18"},
+            {"type": "action", "value": "code-commit"},
+            {"type": "data_classification", "value": "Secrets"},
+            {"type": "repository", "value": "git.mycorp.com/backend-service"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dev08",
+            "timestamp": "2025-09-18T15:39:59.810Z",
+            "event_type": "CodeCommit",
+            "application": "git.exe",
+            "data_details": {
+                "extracted_content": "API_KEY = \"sk_live_abcdefg123456789\"",
+                "classification_tags": ["API-Key", "Hardcoded-Secrets"]
+            },
+            "commit_details": {
+                "repo_url": "git.mycorp.com/backend-service",
+                "commit_hash": "9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c"
+            },
+            "user_details": {"username": "m.li", "domain": "MYCORP"},
+            "device_details": {"hostname": "DEV-WKS-MLI-08", "ip_address": "10.10.3.18"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-12-Internal-SSN-Transfer",
+        "rule_name": "内部社会安全号码（SSN）传输",
+        "alert_date": "2025-09-18T15:45:20Z",
+        "tags": ["pii", "ssn", "internal-communication"],
+        "severity": "Medium",
+        "reference": "用户j.doe通过内部邮件发送SSN",
+        "description": "用户 j.doe 在内部电子邮件中发送了包含多个员工社会安全号码的列表，此行为违反了数据保护政策。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "action", "value": "internal-email"},
+            {"type": "data_classification", "value": "PII-SSN"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T15:45:19.456Z",
+            "event_type": "DataTransfer",
+            "data_source": "Outlook",
+            "data_destination": "Internal Email",
+            "data_details": {
+                "extracted_content_hash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+                "classification_tags": ["PII", "SSN"]
+            },
+            "transfer_details": {
+                "protocol": "MAPI",
+                "recipient": "k.smith@mycorp.com",
+                "subject": "Payroll Details"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-13-Schema-Definition-Download",
+        "rule_name": "敏感数据库架构下载",
+        "alert_date": "2025-09-18T15:50:35Z",
+        "tags": ["database-schema", "exfiltration"],
+        "severity": "High",
+        "reference": "用户c.jones从数据库下载敏感架构",
+        "description": "用户 c.jones 从生产数据库中下载了包含敏感表结构和字段定义的数据库架构文件，这可能被用于未来的攻击或数据窃取。",
+        "artifacts": [
+            {"type": "username", "value": "c.jones"},
+            {"type": "hostname", "value": "DBA-WKS-CJONES-07"},
+            {"type": "ip", "value": "10.10.4.8"},
+            {"type": "action", "value": "file-download"},
+            {"type": "data_classification", "value": "Database Schema"},
+            {"type": "file_name", "value": "prod_db_schema.sql"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dba07",
+            "timestamp": "2025-09-18T15:50:34.777Z",
+            "event_type": "DataTransfer",
+            "data_source": "MSSQL-Server",
+            "data_destination": "Local File System",
+            "file_details": {
+                "file_path": "C:\\Users\\c.jones\\Downloads\\prod_db_schema.sql",
+                "file_hash_sha256": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0d1e2f3c4b5a6f7e8d9c0b1a2",
+                "classification_tags": ["Database-Schema", "Internal-Only"]
+            },
+            "transfer_details": {
+                "application": "sqlclient.exe",
+                "server_ip": "10.10.5.10"
+            },
+            "user_details": {"username": "c.jones", "domain": "MYCORP"},
+            "device_details": {"hostname": "DBA-WKS-CJONES-07", "ip_address": "10.10.4.8"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-14-Encrypted-File-Upload",
+        "rule_name": "加密文件异常上传",
+        "alert_date": "2025-09-18T15:55:12Z",
+        "tags": ["encrypted-data", "exfiltration", "cloud-storage"],
+        "severity": "High",
+        "reference": "用户a.smith上传加密压缩包到云服务",
+        "description": "检测到用户 a.smith 将一个加密的压缩文件（ZIP）上传到非授权的云服务。由于无法检查其内容，该行为被视为可疑，可能用于规避DLP检查。",
+        "artifacts": [
+            {"type": "username", "value": "a.smith"},
+            {"type": "hostname", "value": "MKT-WKS-ASMITH-01"},
+            {"type": "action", "value": "file-upload"},
+            {"type": "file_name", "value": "project_data.zip.enc"},
+            {"type": "destination_service", "value": "Google Drive"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-marketing01",
+            "timestamp": "2025-09-18T15:55:11.901Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Cloud Storage",
+            "file_details": {
+                "file_path": "C:\\Users\\a.smith\\Desktop\\project_data.zip.enc",
+                "file_hash_sha256": "c3e4d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
+                "classification_tags": ["Encrypted", "Uncategorized"]
+            },
+            "transfer_details": {
+                "application": "GoogleDriveFS.exe",
+                "file_size_mb": 150
+            },
+            "user_details": {"username": "a.smith", "domain": "MYCORP"},
+            "device_details": {"hostname": "MKT-WKS-ASMITH-01", "ip_address": "192.168.2.54"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-15-Credit-Card-Number-Clipboard",
+        "rule_name": "信用卡号复制到剪贴板",
+        "alert_date": "2025-09-18T16:00:25Z",
+        "tags": ["pci", "credit-card", "clipboard"],
+        "severity": "Low",
+        "reference": "用户j.doe从浏览器复制信用卡信息",
+        "description": "检测到用户 j.doe 从浏览器中复制了信用卡号码到剪贴板。虽然没有立即外发，但该行为存在潜在风险。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "action", "value": "clipboard-copy"},
+            {"type": "data_classification", "value": "PCI"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T16:00:24.555Z",
+            "event_type": "DataTransfer",
+            "data_source": "Chrome Browser",
+            "data_destination": "Clipboard",
+            "data_details": {
+                "extracted_content_hash": "d1e2f3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2",
+                "classification_tags": ["Credit Card", "PCI"]
+            },
+            "transfer_details": {
+                "application": "chrome.exe",
+                "source_url": "https://internal.payment.portal.com"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-16-CAD-Drawing-Print",
+        "rule_name": "技术图纸打印",
+        "alert_date": "2025-09-18T16:05:00Z",
+        "tags": ["intellectual-property", "cad", "print"],
+        "severity": "High",
+        "reference": "研发部员工d.chen打印工程图纸",
+        "description": "检测到用户 d.chen 将包含公司知识产权的技术图纸（CAD）打印到非指定的打印机。",
+        "artifacts": [
+            {"type": "username", "value": "d.chen"},
+            {"type": "hostname", "value": "DEV-WKS-DCHEN-12"},
+            {"type": "action", "value": "print"},
+            {"type": "data_classification", "value": "Intellectual Property"},
+            {"type": "file_name", "value": "New_Product_Design_V2.dwg"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dev12",
+            "timestamp": "2025-09-18T16:04:59.666Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Printer",
+            "file_details": {
+                "file_path": "C:\\Users\\d.chen\\Documents\\CAD\\New_Product_Design_V2.dwg",
+                "file_hash_sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+                "classification_tags": ["CAD", "Design", "Proprietary"]
+            },
+            "transfer_details": {
+                "printer_name": "\\\\CORP-PRN-05\\HR-Printer"
+            },
+            "user_details": {"username": "d.chen", "domain": "MYCORP"},
+            "device_details": {"hostname": "DEV-WKS-DCHEN-12", "ip_address": "10.10.3.25"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-17-Sensitive-Data-in-Email-Subject",
+        "rule_name": "邮件主题中包含敏感信息",
+        "alert_date": "2025-09-18T16:10:15Z",
+        "tags": ["pii", "email"],
+        "severity": "Low",
+        "reference": "用户j.doe在邮件主题中包含SSN",
+        "description": "用户 j.doe 发送的内部电子邮件主题中包含了敏感的社会安全号码（SSN）。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "action", "value": "internal-email"},
+            {"type": "data_classification", "value": "PII-SSN"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T16:10:14.333Z",
+            "event_type": "DataTransfer",
+            "data_source": "Outlook",
+            "data_destination": "Internal Email",
+            "transfer_details": {
+                "protocol": "MAPI",
+                "subject": "工资核算 - 员工 SSN: 123-45-6789",
+                "recipient": "k.smith@mycorp.com"
+            },
+            "data_match": {
+                "pattern": "Social Security Number",
+                "field": "subject"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-18-Unauthorized-Database-Query-Result",
+        "rule_name": "未经授权的数据库查询结果",
+        "alert_date": "2025-09-18T16:15:30Z",
+        "tags": ["database-query", "pii", "exfiltration"],
+        "severity": "High",
+        "reference": "用户c.jones执行大规模客户数据查询",
+        "description": "用户 c.jones 执行了返回大量客户数据的数据库查询，并将结果导出。该查询涉及敏感字段，超出了其正常工作权限。",
+        "artifacts": [
+            {"type": "username", "value": "c.jones"},
+            {"type": "hostname", "value": "DBA-WKS-CJONES-07"},
+            {"type": "action", "value": "database-query-export"},
+            {"type": "data_classification", "value": "PII-Customer"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dba07",
+            "timestamp": "2025-09-18T16:15:29.876Z",
+            "event_type": "DataTransfer",
+            "data_source": "MSSQL-Server",
+            "data_destination": "Local File System",
+            "transfer_details": {
+                "application": "sqlclient.exe",
+                "query": "SELECT * FROM Customers.PersonalDetails",
+                "rows_exported": 50000
+            },
+            "data_match": {
+                "pattern": "PII-Customer",
+                "match_count": 50000
+            },
+            "user_details": {"username": "c.jones", "domain": "MYCORP"},
+            "device_details": {"hostname": "DBA-WKS-CJONES-07", "ip_address": "10.10.4.8"}
+        }
+    }, {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-03-Confidential-Document-Exfiltration",
+        "rule_name": "机密文件外泄",
+        "alert_date": "2025-09-18T15:05:30Z",
+        "tags": ["confidential-data", "exfiltration", "email"],
+        "severity": "High",
+        "reference": "用户j.doe通过个人邮箱外发项目计划书",
+        "description": "检测到用户 j.doe 试图通过其个人邮箱（johndoe.private@gmail.com）发送包含“2025年战略项目计划书”的文件。该文件被DLP系统标记为机密。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "ip", "value": "192.168.1.101"},
+            {"type": "action", "value": "email-send"},
+            {"type": "data_classification", "value": "Confidential"},
+            {"type": "file_name", "value": "2025_Strategic_Plan.docx"},
+            {"type": "destination_email", "value": "johndoe.private@gmail.com"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T15:05:29.876Z",
+            "event_type": "DataTransfer",
+            "data_source": "Outlook",
+            "data_destination": "External Email",
+            "file_details": {
+                "file_path": "C:\\Users\\j.doe\\Documents\\Projects\\2025_Strategic_Plan.docx",
+                "file_hash_sha256": "f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4",
+                "classification_tags": ["Confidential", "Project-Chimera"]
+            },
+            "transfer_details": {
+                "protocol": "SMTP",
+                "recipient": "johndoe.private@gmail.com",
+                "subject": "FYI - 2025 Plan"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-05-PII-Upload-to-Cloud",
+        "rule_name": "敏感个人信息上传到非授权云服务",
+        "alert_date": "2025-09-18T15:15:10Z",
+        "tags": ["pii", "cloud-storage", "exfiltration"],
+        "severity": "Medium",
+        "reference": "市场部员工a.smith向Dropbox上传客户列表",
+        "description": "用户 a.smith 将一个包含大量客户个人身份信息（PII）的电子表格上传到非授权的云存储服务 Dropbox。该行为违反了公司的数据处理政策。",
+        "artifacts": [
+            {"type": "username", "value": "a.smith"},
+            {"type": "hostname", "value": "MKT-WKS-ASMITH-01"},
+            {"type": "ip", "value": "192.168.2.54"},
+            {"type": "action", "value": "file-upload"},
+            {"type": "data_classification", "value": "PII"},
+            {"type": "file_name", "value": "Q3_Customer_Leads.xlsx"},
+            {"type": "destination_service", "value": "Dropbox"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-marketing01",
+            "timestamp": "2025-09-18T15:15:09.521Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Cloud Storage",
+            "file_details": {
+                "file_path": "C:\\Users\\a.smith\\Documents\\Q3_Customer_Leads.xlsx",
+                "file_hash_sha256": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
+                "classification_tags": ["PII", "Customers"]
+            },
+            "transfer_details": {
+                "application": "Dropbox.exe",
+                "url": "https://api.dropbox.com/content/upload"
+            },
+            "user_details": {"username": "a.smith", "domain": "MYCORP"},
+            "device_details": {"hostname": "MKT-WKS-ASMITH-01", "ip_address": "192.168.2.54"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-07-Internal-Credit-Card-Number-Transfer",
+        "rule_name": "内部信用卡号码传输",
+        "alert_date": "2025-09-18T15:20:45Z",
+        "tags": ["pci", "credit-card", "chat-application"],
+        "severity": "Low",
+        "reference": "用户j.doe在内部聊天中发送敏感信息",
+        "description": "用户 j.doe 在内部即时通讯工具中发送了疑似信用卡号码的字符串。尽管是内部通信，但该行为仍违反了 PCI DSS（支付卡行业数据安全标准）规定。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "action", "value": "chat-message"},
+            {"type": "data_classification", "value": "PCI"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T15:20:44.912Z",
+            "event_type": "DataTransfer",
+            "data_source": "Chat Application",
+            "data_destination": "Internal Chat",
+            "transfer_details": {
+                "application": "Teams.exe",
+                "message_text": "订单号 456789，付款失败，用这张卡试试 4123-4567-8901-2345"
+            },
+            "data_match": {
+                "pattern": "Credit Card Number",
+                "value_redacted": "4123-XXXX-XXXX-2345"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    }
+]
+dlp_alert.extend([
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-08-Financial-Record-Transfer-to-USB",
+        "rule_name": "财务记录传输到可移动设备",
+        "alert_date": "2025-09-18T15:25:55Z",
+        "tags": ["finance", "exfiltration", "usb"],
+        "severity": "High",
+        "reference": "用户j.doe将公司财务报表复制到U盘",
+        "description": "检测到用户 j.doe 将包含公司季度财务数据的 Excel 文件复制到连接到 FIN-WKS-JDOE-05 主机的可移动存储设备。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "action", "value": "file-copy-to-usb"},
+            {"type": "data_classification", "value": "Financial"},
+            {"type": "file_name", "value": "Q3_Financial_Report.xlsx"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance05",
+            "timestamp": "2025-09-18T15:25:54.660Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Removable Media",
+            "file_details": {
+                "file_path": "C:\\Users\\j.doe\\Documents\\Reports\\Q3_Financial_Report.xlsx",
+                "file_hash_sha256": "c3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4",
+                "classification_tags": ["Financial", "Confidential"]
+            },
+            "transfer_details": {
+                "device_type": "USB-Drive",
+                "device_serial": "A1B2C3D4E5F6"
+            },
+            "user_details": {"username": "j.doe", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-JDOE-05", "ip_address": "192.168.1.101"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-09-Source-Code-Upload-to-Pastebin",
+        "rule_name": "源代码上传到公共网站",
+        "alert_date": "2025-09-18T15:30:15Z",
+        "tags": ["source-code", "exfiltration", "web"],
+        "severity": "Critical",
+        "reference": "研发部员工在公共网站发布源代码",
+        "description": "检测到研发部用户试图将包含公司专有源代码的文本片段上传到 pastebin.com。这属于严重的数据外泄行为。",
+        "artifacts": [
+            {"type": "username", "value": "d.chen"},
+            {"type": "hostname", "value": "DEV-WKS-DCHEN-12"},
+            {"type": "ip", "value": "10.10.3.25"},
+            {"type": "action", "value": "web-upload"},
+            {"type": "data_classification", "value": "Proprietary Source Code"},
+            {"type": "destination_domain", "value": "pastebin.com"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dev12",
+            "timestamp": "2025-09-18T15:30:14.981Z",
+            "event_type": "DataTransfer",
+            "data_source": "Clipboard",
+            "data_destination": "Web",
+            "data_details": {
+                "extracted_content_hash": "e1f2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2",
+                "classification_tags": ["Proprietary Code", "Project-Nova"]
+            },
+            "transfer_details": {
+                "application": "chrome.exe",
+                "url": "https://pastebin.com/post"
+            },
+            "user_details": {"username": "d.chen", "domain": "MYCORP"},
+            "device_details": {"hostname": "DEV-WKS-DCHEN-12", "ip_address": "10.10.3.25"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-08-Financial-Record-Transfer-to-USB",
+        "rule_name": "财务记录传输到可移动设备",
+        "alert_date": "2025-09-19T09:40:20Z",
+        "tags": ["finance", "exfiltration", "usb"],
+        "severity": "High",
+        "reference": "用户p.smith将客户数据库文件复制到U盘",
+        "description": "检测到用户 p.smith 将包含客户数据库的 SQL 文件复制到连接到 FIN-WKS-PSMITH-07 主机的可移动存储设备。",
+        "artifacts": [
+            {"type": "username", "value": "p.smith"},
+            {"type": "hostname", "value": "FIN-WKS-PSMITH-07"},
+            {"type": "action", "value": "file-copy-to-usb"},
+            {"type": "data_classification", "value": "Customer Data"},
+            {"type": "file_name", "value": "customer_database.sql"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance07",
+            "timestamp": "2025-09-19T09:40:19.500Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Removable Media",
+            "file_details": {
+                "file_path": "C:\\Users\\p.smith\\Documents\\customer_database.sql",
+                "file_hash_sha256": "d8e9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9",
+                "classification_tags": ["Customer Data", "PII"]
+            },
+            "transfer_details": {
+                "device_type": "USB-Drive",
+                "device_serial": "X9Y8Z7A6B5C4"
+            },
+            "user_details": {"username": "p.smith", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-PSMITH-07", "ip_address": "192.168.1.115"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-09-Source-Code-Upload-to-Pastebin",
+        "rule_name": "源代码上传到公共网站",
+        "alert_date": "2025-09-19T10:15:30Z",
+        "tags": ["source-code", "exfiltration", "web"],
+        "severity": "Critical",
+        "reference": "研发部员工在公共网站发布源代码",
+        "description": "检测到研发部用户试图将包含公司专有源代码的文本片段上传到 github.com。这属于严重的数据外泄行为。",
+        "artifacts": [
+            {"type": "username", "value": "l.wang"},
+            {"type": "hostname", "value": "DEV-WKS-LWANG-08"},
+            {"type": "ip", "value": "10.10.3.51"},
+            {"type": "action", "value": "web-upload"},
+            {"type": "data_classification", "value": "Proprietary Source Code"},
+            {"type": "destination_domain", "value": "github.com"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-dev08",
+            "timestamp": "2025-09-19T10:15:29.876Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Web",
+            "data_details": {
+                "extracted_content_hash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+                "classification_tags": ["Proprietary Code", "Project-Phoenix"]
+            },
+            "transfer_details": {
+                "application": "git.exe",
+                "url": "https://github.com/mycorp/project-phoenix"
+            },
+            "user_details": {"username": "l.wang", "domain": "MYCORP"},
+            "device_details": {"hostname": "DEV-WKS-LWANG-08", "ip_address": "10.10.3.51"}
+        }
+    },
+    {
+        "source": "DLP",
+        "rule_id": "DLP-Rule-08-Financial-Record-Transfer-to-USB",
+        "rule_name": "财务记录传输到可移动设备",
+        "alert_date": "2025-09-19T11:02:10Z",
+        "tags": ["finance", "exfiltration", "usb"],
+        "severity": "High",
+        "reference": "用户s.jones将薪资表复制到U盘",
+        "description": "检测到用户 s.jones 将包含员工薪资信息的 Excel 文件复制到连接到 FIN-WKS-SJONES-09 主机的可移动存储设备。",
+        "artifacts": [
+            {"type": "username", "value": "s.jones"},
+            {"type": "hostname", "value": "FIN-WKS-SJONES-09"},
+            {"type": "action", "value": "file-copy-to-usb"},
+            {"type": "data_classification", "value": "Payroll"},
+            {"type": "file_name", "value": "employee_salaries.xlsx"}
+        ],
+        "raw_log": {
+            "agent_id": "agent-guid-finance09",
+            "timestamp": "2025-09-19T11:02:09.910Z",
+            "event_type": "DataTransfer",
+            "data_source": "Local File System",
+            "data_destination": "Removable Media",
+            "file_details": {
+                "file_path": "C:\\Users\\s.jones\\Documents\\Payroll\\employee_salaries.xlsx",
+                "file_hash_sha256": "b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+                "classification_tags": ["Payroll", "Confidential"]
+            },
+            "transfer_details": {
+                "device_type": "USB-Drive",
+                "device_serial": "T7U6V5W4X3Y2"
+            },
+            "user_details": {"username": "s.jones", "domain": "MYCORP"},
+            "device_details": {"hostname": "FIN-WKS-SJONES-09", "ip_address": "192.168.1.120"}
+        }
+    }
+])
+
+mail_alert = [
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-01-Phishing-URL-Detected",
+        "rule_name": "邮件中检测到钓鱼URL",
+        "alert_date": "2025-09-18T16:20:10Z",
+        "tags": ["phishing", "url-threat"],
+        "severity": "High",
+        "reference": "用户j.doe收到含有恶意URL的钓鱼邮件",
+        "description": "用户 j.doe 收到一封伪装成银行通知的邮件，其中包含一个指向已知钓鱼网站的恶意链接。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "j.doe@mycorp.com"},
+            {"type": "sender_email", "value": "noreply@mybank-secure.net"},
+            {"type": "subject", "value": "您的账户已被暂停，请立即验证"},
+            {"type": "url", "value": "http://mybank-login-secure.com/verify?id=1a2b3c4d"},
+            {"type": "threat_type", "value": "Phishing"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-18T16:20:09.543Z",
+            "event_type": "URLScan",
+            "detection_details": {
+                "url": "http://mybank-login-secure.com/verify?id=1a2b3c4d",
+                "verdict": "Malicious",
+                "reason": "Threat intelligence match",
+                "threat_name": "Fake Bank Login Page"
+            },
+            "email_details": {
+                "sender": "noreply@mybank-secure.net",
+                "recipient": "j.doe@mycorp.com",
+                "subject": "您的账户已被暂停，请立即验证"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-02-Malicious-Attachment-Detected",
+        "rule_name": "邮件中检测到恶意附件",
+        "alert_date": "2025-09-18T16:25:35Z",
+        "tags": ["malware", "attachment", "ransomware"],
+        "severity": "Critical",
+        "reference": "用户a.smith收到含有恶意宏文档的邮件",
+        "description": "一封发给用户 a.smith 的邮件附件中包含一个被沙箱分析为恶意软件（Ransomware）的 Word 文档。该文档试图执行恶意宏。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "a.smith@mycorp.com"},
+            {"type": "sender_email", "value": "invoice@supplier-online.co.kr"},
+            {"type": "subject", "value": "重要：发票#20250918"},
+            {"type": "file_name", "value": "Invoice-20250918.docm"},
+            {"type": "file_hash_sha256", "value": "a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1"},
+            {"type": "threat_type", "value": "Ransomware"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-02",
+            "timestamp": "2025-09-18T16:25:34.888Z",
+            "event_type": "AttachmentScan",
+            "detection_details": {
+                "file_name": "Invoice-20250918.docm",
+                "file_hash_sha256": "a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1",
+                "verdict": "Malicious",
+                "reason": "Sandbox analysis (macro execution)",
+                "threat_name": "Qbot"
+            },
+            "email_details": {
+                "sender": "invoice@supplier-online.co.kr",
+                "recipient": "a.smith@mycorp.com",
+                "subject": "重要：发票#20250918"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-03-BEC-Spoofing-CEO",
+        "rule_name": "商业邮件欺诈（BEC）- 冒充CEO",
+        "alert_date": "2025-09-18T16:30:40Z",
+        "tags": ["bec", "spoofing", "financial-fraud"],
+        "severity": "High",
+        "reference": "假冒CEO的邮件要求紧急转账",
+        "description": "一封伪装成公司CEO（j.smith@mycorp.com）的邮件，要求财务部员工 j.doe 紧急执行一笔电汇。发件人显示名称与CEO一致，但发件人邮箱地址为外部域名。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "j.doe@mycorp.com"},
+            {"type": "sender_display_name", "value": "John Smith"},
+            {"type": "sender_email", "value": "john.smith.ceo@outlook.com"},
+            {"type": "subject", "value": "紧急电汇请求"},
+            {"type": "threat_type", "value": "BEC"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-03",
+            "timestamp": "2025-09-18T16:30:39.901Z",
+            "event_type": "BECDetection",
+            "detection_details": {
+                "spoofed_user": "j.smith@mycorp.com",
+                "sender_email": "john.smith.ceo@outlook.com",
+                "reason": "Sender domain mismatch, display name impersonation, urgency keywords detected."
+            },
+            "email_details": {
+                "sender": "john.smith.ceo@outlook.com",
+                "recipient": "j.doe@mycorp.com",
+                "subject": "紧急电汇请求"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-04-Credential-Phishing-Page",
+        "rule_name": "凭据钓鱼页面链接",
+        "alert_date": "2025-09-18T16:35:15Z",
+        "tags": ["phishing", "credential-harvesting", "url-threat"],
+        "severity": "High",
+        "reference": "用户d.chen收到钓鱼邮件，链接到假冒的Office登录页面",
+        "description": "用户 d.chen 收到一封声称“您的Office 365密码即将过期”的邮件，邮件中的链接指向一个模仿公司登录页面的钓鱼网站。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "d.chen@mycorp.com"},
+            {"type": "sender_email", "value": "admin@microsoft.co.us"},
+            {"type": "subject", "value": "立即更新您的密码以避免账户锁定"},
+            {"type": "url", "value": "https://office365-mycorp-login.net/signin"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-18T16:35:14.678Z",
+            "event_type": "URLScan",
+            "detection_details": {
+                "url": "https://office365-mycorp-login.net/signin",
+                "verdict": "Malicious",
+                "reason": "URL impersonation pattern, known phishing site"
+            },
+            "email_details": {
+                "sender": "admin@microsoft.co.us",
+                "recipient": "d.chen@mycorp.com",
+                "subject": "立即更新您的密码以避免账户锁定"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-05-Fileless-Malware-Detected",
+        "rule_name": "邮件中检测到无文件恶意软件",
+        "alert_date": "2025-09-18T16:40:50Z",
+        "tags": ["malware", "fileless", "powershell"],
+        "severity": "High",
+        "reference": "用户h.lin收到含有可疑PowerShell命令的邮件",
+        "description": "用户 h.lin 收到一封邮件，邮件正文或附件中包含经过混淆的 PowerShell 命令，旨在下载并执行恶意载荷，不依赖于传统文件附件。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "h.lin@mycorp.com"},
+            {"type": "sender_email", "value": "updates@newsletters.xyz"},
+            {"type": "subject", "value": "最新公司新闻"},
+            {"type": "command_line_snippet", "value": "powershell.exe -enc VwByAGkAdABlAC0ASABv..."},
+            {"type": "threat_type", "value": "Fileless Malware"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-02",
+            "timestamp": "2025-09-18T16:40:49.123Z",
+            "event_type": "ContentScan",
+            "detection_details": {
+                "detection_method": "Signature/Behavioral",
+                "reason": "Detected obfuscated PowerShell command in email body"
+            },
+            "email_details": {
+                "sender": "updates@newsletters.xyz",
+                "recipient": "h.lin@mycorp.com",
+                "subject": "最新公司新闻"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-06-Suspicious-Login-Attempt-Notification",
+        "rule_name": "可疑登录尝试钓鱼邮件",
+        "alert_date": "2025-09-18T16:45:22Z",
+        "tags": ["phishing", "social-engineering"],
+        "severity": "Medium",
+        "reference": "用户m.li收到可疑登录通知邮件",
+        "description": "一封发给用户 m.li 的邮件声称有“来自未知设备的登录尝试”，并要求用户点击链接“立即保护您的账户”。该邮件来自非官方来源。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "m.li@mycorp.com"},
+            {"type": "sender_email", "value": "security-alert@service.online-secure.ru"},
+            {"type": "subject", "value": "警告：来自新设备的登录！"},
+            {"type": "threat_type", "value": "Phishing"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-03",
+            "timestamp": "2025-09-18T16:45:21.567Z",
+            "event_type": "PhishingAttempt",
+            "detection_details": {
+                "reason": "Social engineering keywords, non-corporate sender, urgency in subject"
+            },
+            "email_details": {
+                "sender": "security-alert@service.online-secure.ru",
+                "recipient": "m.li@mycorp.com",
+                "subject": "警告：来自新设备的登录！"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-07-Domain-Spoofing-HR-Team",
+        "rule_name": "邮件域名仿冒 - HR团队",
+        "alert_date": "2025-09-18T16:50:05Z",
+        "tags": ["spoofing", "credential-harvesting"],
+        "severity": "Medium",
+        "reference": "假冒HR团队的邮件发送给全体员工",
+        "description": "一封伪装成 HR 团队（hr@mycorp.com）的邮件，其发件人地址使用了高度相似的域名（hr@mycorps.com），邮件要求员工更新个人信息。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "all@mycorp.com"},
+            {"type": "sender_email", "value": "hr@mycorps.com"},
+            {"type": "subject", "value": "请更新您的员工信息以获取最新福利"},
+            {"type": "spoofed_domain", "value": "mycorp.com"},
+            {"type": "threat_type", "value": "Domain Spoofing"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-18T16:50:04.990Z",
+            "event_type": "SpoofingDetection",
+            "detection_details": {
+                "reason": "DMARC/SPF/DKIM failed, domain similarity detected",
+                "spoofed_domain": "mycorp.com",
+                "sender_domain": "mycorps.com"
+            },
+            "email_details": {
+                "sender": "hr@mycorps.com",
+                "recipient": "all@mycorp.com",
+                "subject": "请更新您的员工信息以获取最新福利"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-08-Suspicious-Archive-Attachment",
+        "rule_name": "可疑的压缩附件",
+        "alert_date": "2025-09-18T16:55:18Z",
+        "tags": ["malware", "attachment", "archive"],
+        "severity": "Medium",
+        "reference": "用户c.jones收到密码保护的压缩附件",
+        "description": "一封发给用户 c.jones 的邮件附件中包含一个密码保护的 ZIP 文件，邮件正文提供了密码。这种技术常用于规避安全扫描。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "c.jones@mycorp.com"},
+            {"type": "sender_email", "value": "support@data-service.ru"},
+            {"type": "subject", "value": "数据请求回复"},
+            {"type": "file_name", "value": "report.zip"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-02",
+            "timestamp": "2025-09-18T16:55:17.345Z",
+            "event_type": "AttachmentScan",
+            "detection_details": {
+                "file_name": "report.zip",
+                "verdict": "Suspicious",
+                "reason": "Password-protected archive, password provided in body"
+            },
+            "email_details": {
+                "sender": "support@data-service.ru",
+                "recipient": "c.jones@mycorp.com",
+                "subject": "数据请求回复"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-09-Internal-Account-Compromise",
+        "rule_name": "内部账户被盗用发送垃圾邮件",
+        "alert_date": "2025-09-18T17:00:00Z",
+        "tags": ["compromised-account", "spam"],
+        "severity": "High",
+        "reference": "被盗用的内部账户j.doe发送大量垃圾邮件",
+        "description": "内部账户 j.doe@mycorp.com 发送了大量包含垃圾内容的邮件。该账户可能已被攻击者接管，用于传播恶意信息。",
+        "artifacts": [
+            {"type": "sender_email", "value": "j.doe@mycorp.com"},
+            {"type": "source_ip", "value": "8.8.8.8"},
+            {"type": "subject", "value": "赚取丰厚利润的秘诀"},
+            {"type": "threat_type", "value": "Spam/Account Compromise"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-03",
+            "timestamp": "2025-09-18T16:59:59.000Z",
+            "event_type": "SpamDetection",
+            "detection_details": {
+                "reason": "High volume of spam messages, source IP mismatch with corporate network"
+            },
+            "email_details": {
+                "sender": "j.doe@mycorp.com",
+                "recipient": "various-external-recipients",
+                "subject": "赚取丰厚利润的秘诀"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-10-Payload-Delivery-through-Image",
+        "rule_name": "邮件图片中隐藏恶意载荷",
+        "alert_date": "2025-09-18T17:05:30Z",
+        "tags": ["steganography", "malware"],
+        "severity": "High",
+        "reference": "用户a.smith收到含有隐写恶意代码的图片",
+        "description": "一封发给用户 a.smith 的邮件附件中包含一张图片（JPG），但经深度内容分析，发现其中使用了隐写术隐藏了恶意代码。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "a.smith@mycorp.com"},
+            {"type": "sender_email", "value": "photo-share@online-gallery.biz"},
+            {"type": "subject", "value": "您有一张新照片需要查看"},
+            {"type": "file_name", "value": "photo.jpg"},
+            {"type": "threat_type", "value": "Steganography"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-18T17:05:29.876Z",
+            "event_type": "AttachmentScan",
+            "detection_details": {
+                "file_name": "photo.jpg",
+                "verdict": "Malicious",
+                "reason": "Steganography detection, hidden code payload found"
+            },
+            "email_details": {
+                "sender": "photo-share@online-gallery.biz",
+                "recipient": "a.smith@mycorp.com",
+                "subject": "您有一张新照片需要查看"
+            }
+        }
+    }
+]
+
+mail_alert.extend([
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-01-Phishing-URL-Detected",
+        "rule_name": "邮件中检测到钓鱼URL",
+        "alert_date": "2025-09-18T16:20:10Z",
+        "tags": ["phishing", "url-threat"],
+        "severity": "High",
+        "reference": "用户j.doe收到含有恶意URL的钓鱼邮件",
+        "description": "用户 j.doe 收到一封伪装成银行通知的邮件，其中包含一个指向已知钓鱼网站的恶意链接。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "j.doe@mycorp.com"},
+            {"type": "sender_email", "value": "noreply@mybank-secure.net"},
+            {"type": "subject", "value": "您的账户已被暂停，请立即验证"},
+            {"type": "url", "value": "http://mybank-login-secure.com/verify?id=1a2b3c4d"},
+            {"type": "threat_type", "value": "Phishing"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-18T16:20:09.543Z",
+            "event_type": "URLScan",
+            "detection_details": {
+                "url": "http://mybank-login-secure.com/verify?id=1a2b3c4d",
+                "verdict": "Malicious",
+                "reason": "Threat intelligence match",
+                "threat_name": "Fake Bank Login Page"
+            },
+            "email_details": {
+                "sender": "noreply@mybank-secure.net",
+                "recipient": "j.doe@mycorp.com",
+                "subject": "您的账户已被暂停，请立即验证"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-02-Malicious-Attachment-Detected",
+        "rule_name": "邮件中检测到恶意附件",
+        "alert_date": "2025-09-18T16:25:35Z",
+        "tags": ["malware", "attachment", "ransomware"],
+        "severity": "Critical",
+        "reference": "用户a.smith收到含有恶意宏文档的邮件",
+        "description": "一封发给用户 a.smith 的邮件附件中包含一个被沙箱分析为恶意软件（Ransomware）的 Word 文档。该文档试图执行恶意宏。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "a.smith@mycorp.com"},
+            {"type": "sender_email", "value": "invoice@supplier-online.co.kr"},
+            {"type": "subject", "value": "重要：发票#20250918"},
+            {"type": "file_name", "value": "Invoice-20250918.docm"},
+            {"type": "file_hash_sha256", "value": "a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1"},
+            {"type": "threat_type", "value": "Ransomware"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-02",
+            "timestamp": "2025-09-18T16:25:34.888Z",
+            "event_type": "AttachmentScan",
+            "detection_details": {
+                "file_name": "Invoice-20250918.docm",
+                "file_hash_sha256": "a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1",
+                "verdict": "Malicious",
+                "reason": "Sandbox analysis (macro execution)",
+                "threat_name": "Qbot"
+            },
+            "email_details": {
+                "sender": "invoice@supplier-online.co.kr",
+                "recipient": "a.smith@mycorp.com",
+                "subject": "重要：发票#20250918"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-01-Phishing-URL-Detected",
+        "rule_name": "邮件中检测到钓鱼URL",
+        "alert_date": "2025-09-19T09:10:00Z",
+        "tags": ["phishing", "url-threat"],
+        "severity": "High",
+        "reference": "用户s.jones收到含有恶意URL的钓鱼邮件",
+        "description": "用户 s.jones 收到一封伪装成薪资系统通知的邮件，其中包含一个指向已知钓鱼网站的恶意链接。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "s.jones@mycorp.com"},
+            {"type": "sender_email", "value": "hr-notifications@mycorp-payroll.com"},
+            {"type": "subject", "value": "薪资变更通知：请立即查看"},
+            {"type": "url", "value": "http://mycorp-payroll-update.net/login"},
+            {"type": "threat_type", "value": "Phishing"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-19T09:09:59.123Z",
+            "event_type": "URLScan",
+            "detection_details": {
+                "url": "http://mycorp-payroll-update.net/login",
+                "verdict": "Malicious",
+                "reason": "Threat intelligence match",
+                "threat_name": "Fake HR Login Page"
+            },
+            "email_details": {
+                "sender": "hr-notifications@mycorp-payroll.com",
+                "recipient": "s.jones@mycorp.com",
+                "subject": "薪资变更通知：请立即查看"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-02-Malicious-Attachment-Detected",
+        "rule_name": "邮件中检测到恶意附件",
+        "alert_date": "2025-09-19T10:30:45Z",
+        "tags": ["malware", "attachment", "trojan"],
+        "severity": "Critical",
+        "reference": "用户l.chen收到含有恶意exe的邮件",
+        "description": "一封发给用户 l.chen 的邮件附件中包含一个被沙箱分析为恶意软件（Trojan）的压缩文件。该文件试图伪装成软件更新。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "l.chen@mycorp.com"},
+            {"type": "sender_email", "value": "support@software-update.ru"},
+            {"type": "subject", "value": "软件更新通知"},
+            {"type": "file_name", "value": "Software_Update_v3.2.zip"},
+            {"type": "file_hash_sha256", "value": "f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1"},
+            {"type": "threat_type", "value": "Trojan"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-02",
+            "timestamp": "2025-09-19T10:30:44.777Z",
+            "event_type": "AttachmentScan",
+            "detection_details": {
+                "file_name": "Software_Update_v3.2.zip",
+                "file_hash_sha256": "f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1",
+                "verdict": "Malicious",
+                "reason": "Sandbox analysis (PE file extraction)",
+                "threat_name": "Trickbot"
+            },
+            "email_details": {
+                "sender": "support@software-update.ru",
+                "recipient": "l.chen@mycorp.com",
+                "subject": "软件更新通知"
+            }
+        }
+    },
+    {
+        "source": "Email",
+        "rule_id": "ES-Rule-01-Phishing-URL-Detected",
+        "rule_name": "邮件中检测到钓鱼URL",
+        "alert_date": "2025-09-19T11:45:22Z",
+        "tags": ["phishing", "url-threat"],
+        "severity": "High",
+        "reference": "用户d.wang收到含有恶意URL的钓鱼邮件",
+        "description": "用户 d.wang 收到一封伪装成发票通知的邮件，其中包含一个指向已知钓鱼网站的恶意链接。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "d.wang@mycorp.com"},
+            {"type": "sender_email", "value": "billing-support@invoices-secure.com"},
+            {"type": "subject", "value": "发票提醒 #INV-87654"},
+            {"type": "url", "value": "http://invoices-update.info/view-invoice/87654"},
+            {"type": "threat_type", "value": "Phishing"}
+        ],
+        "raw_log": {
+            "gateway_id": "email-gw-01",
+            "timestamp": "2025-09-19T11:45:21.999Z",
+            "event_type": "URLScan",
+            "detection_details": {
+                "url": "http://invoices-update.info/view-invoice/87654",
+                "verdict": "Malicious",
+                "reason": "Threat intelligence match",
+                "threat_name": "Fake Invoice Portal"
+            },
+            "email_details": {
+                "sender": "billing-support@invoices-secure.com",
+                "recipient": "d.wang@mycorp.com",
+                "subject": "发票提醒 #INV-87654"
+            }
+        }
+    }
+])
+
+ot_alert = [
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-01-PLC-Configuration-Change",
+        "rule_name": "PLC配置未经授权修改",
+        "alert_date": "2025-09-18T17:10:00Z",
+        "tags": ["plc", "unauthorized-change", "firmware"],
+        "severity": "Critical",
+        "reference": "生产线PLC01上发生未授权的配置修改",
+        "description": "检测到生产线 PLC-PROD-01 的固件或配置发生未经授权的修改。此行为可能导致生产过程中断或安全风险。",
+        "artifacts": [
+            {"type": "device_id", "value": "PLC-PROD-01"},
+            {"type": "ip", "value": "10.1.1.10"},
+            {"type": "protocol", "value": "S7Comm"},
+            {"type": "change_type", "value": "PLC-Firmware-Update"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T17:09:59.321Z",
+            "event_type": "DeviceConfigurationChange",
+            "device_details": {"device_id": "PLC-PROD-01", "ip_address": "10.1.1.10", "vendor": "Siemens"},
+            "change_details": {"type": "firmware-update", "status": "succeeded", "source_ip": "10.1.2.55", "user": "system"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-02-Unusual-Protocol-Activity",
+        "rule_name": "SCADA网络中可疑协议活动",
+        "alert_date": "2025-09-18T17:15:30Z",
+        "tags": ["protocol", "network-anomaly", "scada"],
+        "severity": "Medium",
+        "reference": "SCADA网络中出现异常的RDP连接",
+        "description": "SCADA 网络段中，主机 SCADA-HMI-05 发起了到未知主机的 RDP 连接。该协议通常不用于生产网络中的 SCADA 通信。",
+        "artifacts": [
+            {"type": "source_device", "value": "SCADA-HMI-05"},
+            {"type": "source_ip", "value": "10.1.1.20"},
+            {"type": "destination_ip", "value": "10.1.50.123"},
+            {"type": "protocol", "value": "RDP", "port": 3389}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line02",
+            "timestamp": "2025-09-18T17:15:29.876Z",
+            "event_type": "NetworkFlow",
+            "flow_details": {
+                "source_ip": "10.1.1.20",
+                "destination_ip": "10.1.50.123",
+                "destination_port": 3389,
+                "protocol": "TCP"
+            },
+            "network_context": {"segment": "SCADA-Network-Zone", "reason": "Unusual protocol for this segment"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-03-Controller-Stop-Command",
+        "rule_name": "控制器收到停止命令",
+        "alert_date": "2025-09-18T17:20:10Z",
+        "tags": ["controller", "process-interruption", "stop-command"],
+        "severity": "Critical",
+        "reference": "控制器ROB-ARM-03收到停止命令",
+        "description": "生产机器人控制器 ROB-ARM-03 收到一个停止命令。该命令未在正常操作时间范围内或来自非授权源。",
+        "artifacts": [
+            {"type": "device_id", "value": "ROB-ARM-03"},
+            {"type": "ip", "value": "10.1.1.30"},
+            {"type": "command", "value": "stop"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T17:20:09.555Z",
+            "event_type": "ControlCommand",
+            "device_details": {"device_id": "ROB-ARM-03", "ip_address": "10.1.1.30"},
+            "command_details": {"action": "stop-command", "source_ip": "10.1.1.20"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-04-Unauthorized-External-Access",
+        "rule_name": "生产网络未经授权的外部访问",
+        "alert_date": "2025-09-18T17:25:45Z",
+        "tags": ["external-access", "remote-access", "vpn"],
+        "severity": "Critical",
+        "reference": "来自外部IP的未经授权访问",
+        "description": "检测到来自公司外部 IP 地址 203.0.113.10 的远程访问尝试，目标是生产网络中的主机，此访问未通过常规的 VPN 渠道。",
+        "artifacts": [
+            {"type": "source_ip", "value": "203.0.113.10"},
+            {"type": "destination_ip", "value": "10.1.1.50"},
+            {"type": "protocol", "value": "TCP", "port": 22},
+            {"type": "service", "value": "SSH"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-firewall-01",
+            "timestamp": "2025-09-18T17:25:44.912Z",
+            "event_type": "TrafficBlock",
+            "traffic_details": {
+                "source_ip": "203.0.113.10",
+                "destination_ip": "10.1.1.50",
+                "destination_port": 22,
+                "protocol": "TCP"
+            },
+            "security_context": {"reason": "Unauthorized external IP access to OT segment"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-05-High-Frequency-HMI-Commands",
+        "rule_name": "HMI高频操作命令",
+        "alert_date": "2025-09-18T17:30:20Z",
+        "tags": ["hmi", "command-spam", "anomaly"],
+        "severity": "Medium",
+        "reference": "HMI-CTRL-02发出异常高频的命令",
+        "description": "人机界面 HMI-CTRL-02 在短时间内向多个控制器发出异常高频的操作命令。这可能是恶意脚本或自动化攻击的迹象。",
+        "artifacts": [
+            {"type": "device_id", "value": "HMI-CTRL-02"},
+            {"type": "ip", "value": "10.1.1.45"},
+            {"type": "command_rate", "value": "20 commands/sec"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line03",
+            "timestamp": "2025-09-18T17:30:19.444Z",
+            "event_type": "ControlCommandRateAnomaly",
+            "device_details": {"device_id": "HMI-CTRL-02", "ip_address": "10.1.1.45"},
+            "anomaly_details": {"command_count": 120, "time_window_sec": 6, "reason": "High frequency of write commands"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-06-Controller-Password-Reset-Attempt",
+        "rule_name": "控制器密码重置尝试",
+        "alert_date": "2025-09-18T17:35:50Z",
+        "tags": ["authentication", "password-reset", "brute-force"],
+        "severity": "High",
+        "reference": "控制器PLC-PROD-02上发生多次密码重置失败",
+        "description": "检测到对 PLC-PROD-02 控制器进行多次失败的密码重置尝试。这表明可能存在暴力破解或未经授权的访问尝试。",
+        "artifacts": [
+            {"type": "device_id", "value": "PLC-PROD-02"},
+            {"type": "ip", "value": "10.1.1.11"},
+            {"type": "attempt_count", "value": 5}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T17:35:49.111Z",
+            "event_type": "AuthenticationFailure",
+            "device_details": {"device_id": "PLC-PROD-02", "ip_address": "10.1.1.11"},
+            "auth_details": {"attempt_count": 5, "protocol": "Modbus", "source_ip": "10.1.1.99"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-07-Unauthorized-Access-to-Engineering-Workstation",
+        "rule_name": "工程工作站未经授权访问",
+        "alert_date": "2025-09-18T17:40:25Z",
+        "tags": ["access-control", "workstation", "lateral-movement"],
+        "severity": "High",
+        "reference": "WKS-ENG-12上发生未授权访问",
+        "description": "检测到工程工作站 WKS-ENG-12 上发生未经授权的登录尝试。此工作站包含敏感的工程项目文件，是攻击者的主要目标。",
+        "artifacts": [
+            {"type": "device_id", "value": "WKS-ENG-12"},
+            {"type": "ip", "value": "10.1.2.55"},
+            {"type": "source_ip", "value": "10.1.1.10"},
+            {"type": "username", "value": "guest"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-engineering",
+            "timestamp": "2025-09-18T17:40:24.789Z",
+            "event_type": "LoginAttempt",
+            "device_details": {"device_id": "WKS-ENG-12", "ip_address": "10.1.2.55"},
+            "auth_details": {"username": "guest", "status": "failed", "source_ip": "10.1.1.10"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-08-New-Device-on-SCADA-Network",
+        "rule_name": "SCADA网络中新增设备",
+        "alert_date": "2025-09-18T17:45:10Z",
+        "tags": ["inventory", "network-scan", "new-device"],
+        "severity": "Medium",
+        "reference": "SCADA网络中出现未知的PLC",
+        "description": "检测到 SCADA 网络中出现一个未在资产清单中注册的新 PLC。这可能是未经授权的连接或侦察行为。",
+        "artifacts": [
+            {"type": "device_type", "value": "PLC"},
+            {"type": "ip", "value": "10.1.1.15"},
+            {"type": "mac", "value": "00:1A:2B:3C:4D:5E"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T17:45:09.600Z",
+            "event_type": "NewDeviceDiscovery",
+            "device_details": {"ip_address": "10.1.1.15", "mac_address": "00:1A:2B:3C:4D:5E", "device_type": "PLC"},
+            "security_context": {"reason": "Device not in asset inventory"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-09-Process-Parameter-Out-of-Range",
+        "rule_name": "生产过程参数超出安全范围",
+        "alert_date": "2025-09-18T17:50:40Z",
+        "tags": ["process-anomaly", "physical-impact", "safety"],
+        "severity": "High",
+        "reference": "CHEM-PUMP-04的压力超出正常范围",
+        "description": "化学泵 CHEM-PUMP-04 的压力读数异常升高，已超出预设的安全操作范围。这可能由恶意命令或设备故障引起。",
+        "artifacts": [
+            {"type": "device_id", "value": "CHEM-PUMP-04"},
+            {"type": "ip", "value": "10.2.1.22"},
+            {"type": "parameter", "value": "Pressure"},
+            {"type": "value", "value": "150 PSI"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line04",
+            "timestamp": "2025-09-18T17:50:39.123Z",
+            "event_type": "ProcessValueAnomaly",
+            "device_details": {"device_id": "CHEM-PUMP-04", "ip_address": "10.2.1.22"},
+            "value_details": {"parameter": "Pressure", "value": 150, "unit": "PSI", "normal_range": "20-80"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-10-Lateral-Movement-Attempt-Protocol-Hop",
+        "rule_name": "协议跳跃式横向移动尝试",
+        "alert_date": "2025-09-18T17:55:05Z",
+        "tags": ["lateral-movement", "protocol-hop"],
+        "severity": "High",
+        "reference": "IT网络主机通过SCADA网络访问PLC",
+        "description": "IT 网络中的一台工作站（10.100.1.5）尝试通过 SCADA 网关（10.1.1.1）直接访问 PLC 设备。此行为违反了分段原则。",
+        "artifacts": [
+            {"type": "source_ip", "value": "10.100.1.5"},
+            {"type": "destination_ip", "value": "10.1.1.10"},
+            {"type": "protocol", "value": "Modbus/TCP"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-gateway-01",
+            "timestamp": "2025-09-18T17:55:04.990Z",
+            "event_type": "NetworkFlow",
+            "flow_details": {
+                "source_ip": "10.100.1.5",
+                "destination_ip": "10.1.1.10",
+                "destination_port": 502,
+                "protocol": "TCP"
+            },
+            "network_context": {"reason": "IT-to-OT unauthorized protocol flow"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-11-Network-Scan-Activity",
+        "rule_name": "生产网络扫描活动",
+        "alert_date": "2025-09-18T18:00:15Z",
+        "tags": ["reconnaissance", "network-scan"],
+        "severity": "High",
+        "reference": "主机10.1.2.80扫描生产网络",
+        "description": "检测到来自主机 10.1.2.80 的大规模端口扫描活动，目标是生产网络中的多个 OT 设备。这通常是攻击者在进行侦察。",
+        "artifacts": [
+            {"type": "source_ip", "value": "10.1.2.80"},
+            {"type": "scan_target_count", "value": 50},
+            {"type": "ports_scanned", "value": ["502", "102", "44818"]}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line02",
+            "timestamp": "2025-09-18T18:00:14.543Z",
+            "event_type": "NetworkScanDetection",
+            "scan_details": {
+                "source_ip": "10.1.2.80",
+                "target_ips": ["10.1.1.10", "10.1.1.11", "..."],
+                "scanned_ports": [502, 102, 44818]
+            },
+            "security_context": {"reason": "Systematic port scanning of OT devices"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-12-Failed-Logic-Transfer-Attempt",
+        "rule_name": "PLC逻辑传输失败尝试",
+        "alert_date": "2025-09-18T18:05:30Z",
+        "tags": ["plc", "logic-change", "failure"],
+        "severity": "Medium",
+        "reference": "PLC-PROD-03的逻辑程序上传失败",
+        "description": "检测到向 PLC-PROD-03 上传新逻辑程序的失败尝试。这可能表明存在未经授权的固件修改或恶意的逻辑注入。",
+        "artifacts": [
+            {"type": "device_id", "value": "PLC-PROD-03"},
+            {"type": "ip", "value": "10.1.1.12"},
+            {"type": "action", "value": "PLC-Logic-Write"},
+            {"type": "status", "value": "Failed"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T18:05:29.987Z",
+            "event_type": "DeviceControlActivity",
+            "device_details": {"device_id": "PLC-PROD-03", "ip_address": "10.1.1.12", "vendor": "Rockwell"},
+            "activity_details": {"action": "logic-write", "status": "failed", "source_ip": "10.1.2.55", "reason": "Checksum mismatch"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-13-Suspicious-File-Transfer-SCADA",
+        "rule_name": "SCADA服务器可疑文件传输",
+        "alert_date": "2025-09-18T18:10:45Z",
+        "tags": ["file-transfer", "data-exfiltration", "scada"],
+        "severity": "High",
+        "reference": "SCADA-Server-01向外部传输文件",
+        "description": "SCADA 服务器 SCADA-Server-01 向生产网络外部的服务器（10.1.50.200）发起了一个大文件的传输。这可能与数据外泄有关。",
+        "artifacts": [
+            {"type": "source_device", "value": "SCADA-Server-01"},
+            {"type": "source_ip", "value": "10.1.2.10"},
+            {"type": "destination_ip", "value": "10.1.50.200"},
+            {"type": "protocol", "value": "FTP"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-scada",
+            "timestamp": "2025-09-18T18:10:44.666Z",
+            "event_type": "NetworkFlow",
+            "flow_details": {
+                "source_ip": "10.1.2.10",
+                "destination_ip": "10.1.50.200",
+                "destination_port": 21,
+                "protocol": "TCP",
+                "bytes_out": 250000000
+            },
+            "network_context": {"reason": "Large outbound file transfer from SCADA server"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-14-Firmware-Tampering-Attempt",
+        "rule_name": "固件篡改尝试",
+        "alert_date": "2025-09-18T18:15:20Z",
+        "tags": ["firmware", "tampering", "integrity"],
+        "severity": "Critical",
+        "reference": "传感器SENSOR-TEMP-07固件哈希值异常",
+        "description": "温度传感器 SENSOR-TEMP-07 的固件哈希值与已知良好哈希值不匹配。这表明其固件可能已被篡改。",
+        "artifacts": [
+            {"type": "device_id", "value": "SENSOR-TEMP-07"},
+            {"type": "ip", "value": "10.2.2.35"},
+            {"type": "file_hash_sha256", "value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line04",
+            "timestamp": "2025-09-18T18:15:19.444Z",
+            "event_type": "FirmwareIntegrityCheck",
+            "device_details": {"device_id": "SENSOR-TEMP-07", "ip_address": "10.2.2.35"},
+            "integrity_details": {"firmware_hash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+                                  "known_good_hash": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "reason": "Hash mismatch"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-15-Unauthorized-Serial-Communication",
+        "rule_name": "未经授权的串行通信",
+        "alert_date": "2025-09-18T18:20:00Z",
+        "tags": ["serial-communication", "legacy-protocol", "physical-access"],
+        "severity": "High",
+        "reference": "HMI-CTRL-01与PLC-PROD-01的串行通信异常",
+        "description": "人机界面 HMI-CTRL-01 与 PLC-PROD-01 之间建立了未经授权的串行通信。此通信绕过了网络安全控制，可能被用于发送恶意命令。",
+        "artifacts": [
+            {"type": "source_device", "value": "HMI-CTRL-01"},
+            {"type": "destination_device", "value": "PLC-PROD-01"},
+            {"type": "protocol", "value": "Modbus-RTU"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T18:19:59.876Z",
+            "event_type": "SerialCommunication",
+            "communication_details": {
+                "source_device": "HMI-CTRL-01",
+                "destination_device": "PLC-PROD-01",
+                "port": "COM1",
+                "protocol": "Modbus-RTU"
+            },
+            "security_context": {"reason": "Unauthorized physical or serial communication link"}
+        }
+    }
+]
+
+ot_alert.extend([
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-01-PLC-Configuration-Change",
+        "rule_name": "PLC配置未经授权修改",
+        "alert_date": "2025-09-18T17:10:00Z",
+        "tags": ["plc", "unauthorized-change", "firmware"],
+        "severity": "Critical",
+        "reference": "生产线PLC01上发生未授权的配置修改",
+        "description": "检测到生产线 PLC-PROD-01 的固件或配置发生未经授权的修改。此行为可能导致生产过程中断或安全风险。",
+        "artifacts": [
+            {"type": "device_id", "value": "PLC-PROD-01"},
+            {"type": "ip", "value": "10.1.1.10"},
+            {"type": "protocol", "value": "S7Comm"},
+            {"type": "change_type", "value": "PLC-Firmware-Update"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line01",
+            "timestamp": "2025-09-18T17:09:59.321Z",
+            "event_type": "DeviceConfigurationChange",
+            "device_details": {"device_id": "PLC-PROD-01", "ip_address": "10.1.1.10", "vendor": "Siemens"},
+            "change_details": {"type": "firmware-update", "status": "succeeded", "source_ip": "10.1.2.55", "user": "system"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-02-Unusual-Protocol-Activity",
+        "rule_name": "SCADA网络中可疑协议活动",
+        "alert_date": "2025-09-18T17:15:30Z",
+        "tags": ["protocol", "network-anomaly", "scada"],
+        "severity": "Medium",
+        "reference": "SCADA网络中出现异常的RDP连接",
+        "description": "SCADA 网络段中，主机 SCADA-HMI-05 发起了到未知主机的 RDP 连接。该协议通常不用于生产网络中的 SCADA 通信。",
+        "artifacts": [
+            {"type": "source_device", "value": "SCADA-HMI-05"},
+            {"type": "source_ip", "value": "10.1.1.20"},
+            {"type": "destination_ip", "value": "10.1.50.123"},
+            {"type": "protocol", "value": "RDP", "port": 3389}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line02",
+            "timestamp": "2025-09-18T17:15:29.876Z",
+            "event_type": "NetworkFlow",
+            "flow_details": {
+                "source_ip": "10.1.1.20",
+                "destination_ip": "10.1.50.123",
+                "destination_port": 3389,
+                "protocol": "TCP"
+            },
+            "network_context": {"segment": "SCADA-Network-Zone", "reason": "Unusual protocol for this segment"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-01-PLC-Configuration-Change",
+        "rule_name": "PLC配置未经授权修改",
+        "alert_date": "2025-09-19T08:30:15Z",
+        "tags": ["plc", "unauthorized-change", "firmware"],
+        "severity": "Critical",
+        "reference": "水处理系统PLC03上发生未授权的程序上传",
+        "description": "检测到水处理系统 PLC-WATER-03 的程序发生未经授权的上传。此行为可能导致供水系统操作异常或污染风险。",
+        "artifacts": [
+            {"type": "device_id", "value": "PLC-WATER-03"},
+            {"type": "ip", "value": "10.2.1.30"},
+            {"type": "protocol", "value": "Modbus/TCP"},
+            {"type": "change_type", "value": "PLC-Program-Upload"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-waterplant",
+            "timestamp": "2025-09-19T08:30:14.567Z",
+            "event_type": "DeviceConfigurationChange",
+            "device_details": {"device_id": "PLC-WATER-03", "ip_address": "10.2.1.30", "vendor": "Schneider Electric"},
+            "change_details": {"type": "program-upload", "status": "succeeded", "source_ip": "10.2.2.88", "user": "engineer_account"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-02-Unusual-Protocol-Activity",
+        "rule_name": "SCADA网络中可疑协议活动",
+        "alert_date": "2025-09-19T09:45:50Z",
+        "tags": ["protocol", "network-anomaly", "scada"],
+        "severity": "Medium",
+        "reference": "SCADA网络中出现异常的FTP连接",
+        "description": "SCADA 网络段中，主机 SCADA-HMI-02 发起了到内部主机的 FTP 连接。该协议通常不用于SCADA数据传输，表明可能存在数据外泄或恶意文件传输。",
+        "artifacts": [
+            {"type": "source_device", "value": "SCADA-HMI-02"},
+            {"type": "source_ip", "value": "10.1.1.22"},
+            {"type": "destination_ip", "value": "10.1.1.99"},
+            {"type": "protocol", "value": "FTP", "port": 21}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-line02",
+            "timestamp": "2025-09-19T09:45:49.111Z",
+            "event_type": "NetworkFlow",
+            "flow_details": {
+                "source_ip": "10.1.1.22",
+                "destination_ip": "10.1.1.99",
+                "destination_port": 21,
+                "protocol": "TCP"
+            },
+            "network_context": {"segment": "SCADA-Network-Zone", "reason": "Unusual protocol for data transfer"}
+        }
+    },
+    {
+        "source": "OT",
+        "rule_id": "OT-Rule-01-PLC-Configuration-Change",
+        "rule_name": "PLC配置未经授权修改",
+        "alert_date": "2025-09-19T10:18:25Z",
+        "tags": ["plc", "unauthorized-change", "firmware"],
+        "severity": "Critical",
+        "reference": "燃气输送系统PLC05上发生未授权的设置更改",
+        "description": "检测到燃气输送系统 PLC-GAS-05 的运行参数（如压力阈值）发生未经授权的修改。此行为可能导致燃气泄漏或其他严重的安全事故。",
+        "artifacts": [
+            {"type": "device_id", "value": "PLC-GAS-05"},
+            {"type": "ip", "value": "10.3.1.50"},
+            {"type": "protocol", "value": "DNP3"},
+            {"type": "change_type", "value": "Runtime-Parameter-Change"}
+        ],
+        "raw_log": {
+            "sensor_id": "ot-sensor-gas-station",
+            "timestamp": "2025-09-19T10:18:24.777Z",
+            "event_type": "DeviceConfigurationChange",
+            "device_details": {"device_id": "PLC-GAS-05", "ip_address": "10.3.1.50", "vendor": "Rockwell"},
+            "change_details": {"type": "parameter-change", "status": "succeeded", "source_ip": "10.3.2.112", "user": "remote_access"}
+        }
+    }
+])
+
+proxy_alert = [
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-01-Malware-Download-Blocked",
+        "rule_name": "阻止恶意软件下载",
+        "alert_date": "2025-09-18T19:00:15Z",
+        "tags": ["malware", "download", "blocked"],
+        "severity": "Critical",
+        "reference": "用户a.smith尝试从恶意站点下载可执行文件",
+        "description": "代理服务器阻止了用户 a.smith 从已知恶意域名下载一个可执行文件。该文件被安全引擎标记为恶意软件。",
+        "artifacts": [
+            {"type": "username", "value": "a.smith"},
+            {"type": "source_ip", "value": "192.168.2.54"},
+            {"type": "destination_url", "value": "http://malware-distro.com/update.exe"},
+            {"type": "threat_name", "value": "Trojan.Agent"},
+            {"type": "action", "value": "Blocked"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-01",
+            "timestamp": "2025-09-18T19:00:14.998Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "a.smith", "ip_address": "192.168.2.54"},
+            "access_details": {
+                "url": "http://malware-distro.com/update.exe",
+                "method": "GET",
+                "status": "403 Forbidden",
+                "policy": "Blocklist-ThreatIntel"
+            },
+            "threat_details": {
+                "verdict": "Malicious",
+                "reason": "Threat intelligence match",
+                "engine": "Antivirus Scan"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-02-C2-Communication-Blocked",
+        "rule_name": "阻止C2通信",
+        "alert_date": "2025-09-18T19:05:30Z",
+        "tags": ["c2", "cobaltstrike", "blocked"],
+        "severity": "Critical",
+        "reference": "主机FIN-WKS-JDOE-05尝试连接C2服务器",
+        "description": "代理服务器检测并阻止了来自主机 FIN-WKS-JDOE-05 对已知命令与控制 (C2) 服务器的连接请求。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_domain", "value": "known-bad.c2.server"},
+            {"type": "threat_type", "value": "C2 Traffic"},
+            {"type": "action", "value": "Blocked"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-02",
+            "timestamp": "2025-09-18T19:05:29.876Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
+            "access_details": {
+                "url": "https://known-bad.c2.server/api/v1/data",
+                "method": "POST",
+                "status": "403 Forbidden",
+                "policy": "ThreatIntel-C2"
+            },
+            "threat_details": {
+                "verdict": "Malicious",
+                "reason": "Known C2 domain/IP"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-03-Phishing-URL-Detected",
+        "rule_name": "访问钓鱼网站被阻止",
+        "alert_date": "2025-09-18T19:10:45Z",
+        "tags": ["phishing", "url-threat", "blocked"],
+        "severity": "High",
+        "reference": "用户c.jones尝试访问钓鱼网站",
+        "description": "代理服务器阻止了用户 c.jones 访问一个伪装成公司登录门户的钓鱼网站。",
+        "artifacts": [
+            {"type": "username", "value": "c.jones"},
+            {"type": "source_ip", "value": "192.168.3.88"},
+            {"type": "destination_url", "value": "http://mycorp-ssologin.net/portal"},
+            {"type": "threat_type", "value": "Phishing"},
+            {"type": "action", "value": "Blocked"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-01",
+            "timestamp": "2025-09-18T19:10:44.666Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "c.jones", "ip_address": "192.168.3.88"},
+            "access_details": {
+                "url": "http://mycorp-ssologin.net/portal",
+                "status": "403 Forbidden",
+                "policy": "Phishing-Blocklist"
+            },
+            "threat_details": {
+                "verdict": "Malicious",
+                "reason": "URL impersonation pattern"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-04-Unauthorized-Cloud-Storage",
+        "rule_name": "未经授权的云存储访问",
+        "alert_date": "2025-09-18T19:15:20Z",
+        "tags": ["data-exfiltration", "cloud-storage"],
+        "severity": "Medium",
+        "reference": "用户d.chen访问个人Dropbox账户",
+        "description": "用户 d.chen 访问了未经公司授权的个人云存储服务（Dropbox）。这可能用于数据外泄。",
+        "artifacts": [
+            {"type": "username", "value": "d.chen"},
+            {"type": "source_ip", "value": "192.168.4.12"},
+            {"type": "destination_domain", "value": "dropbox.com"},
+            {"type": "threat_type", "value": "Policy Violation"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-03",
+            "timestamp": "2025-09-18T19:15:19.444Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "d.chen", "ip_address": "192.168.4.12"},
+            "access_details": {
+                "url": "https://www.dropbox.com/home",
+                "status": "200 OK",
+                "policy": "Block-Unauthorized-Cloud-Storage"
+            },
+            "security_context": {
+                "action": "Alert Only",
+                "reason": "Policy violation: Access to unauthorized cloud storage"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-05-High-Risk-Category-Access",
+        "rule_name": "访问高风险内容类别",
+        "alert_date": "2025-09-18T19:20:05Z",
+        "tags": ["policy-violation", "high-risk"],
+        "severity": "Low",
+        "reference": "用户m.li访问赌博网站",
+        "description": "用户 m.li 访问了被归类为“赌博”的高风险网站。该行为违反了公司的网络使用策略。",
+        "artifacts": [
+            {"type": "username", "value": "m.li"},
+            {"type": "source_ip", "value": "192.168.5.31"},
+            {"type": "destination_domain", "value": "online-casino.com"},
+            {"type": "category", "value": "Gambling"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-01",
+            "timestamp": "2025-09-18T19:20:04.555Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "m.li", "ip_address": "192.168.5.31"},
+            "access_details": {
+                "url": "http://www.online-casino.com/play",
+                "status": "200 OK",
+                "policy": "Permit-Alert"
+            },
+            "security_context": {
+                "category": "Gambling",
+                "action": "Alert Only"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-06-Suspicious-User-Agent",
+        "rule_name": "可疑用户代理访问",
+        "alert_date": "2025-09-18T19:25:50Z",
+        "tags": ["anomaly", "botnet", "reconnaissance"],
+        "severity": "Medium",
+        "reference": "FIN-WKS-JDOE-05使用异常用户代理访问网络",
+        "description": "主机 FIN-WKS-JDOE-05 发起的网络请求使用了异常的用户代理（User-Agent），这可能与僵尸网络或自动化脚本活动有关。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "user_agent", "value": "Mozilla/5.0 (Windows NT 6.1; WOW64) Gecko/20100101 Firefox/56.0"},
+            {"type": "threat_type", "value": "Botnet/C2"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-02",
+            "timestamp": "2025-09-18T19:25:49.111Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
+            "access_details": {
+                "url": "http://api.external-service.org/check",
+                "user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64) Gecko/20100101 Firefox/56.0",
+                "status": "200 OK"
+            },
+            "security_context": {
+                "reason": "User-Agent mismatch with known browser patterns"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-07-SSL-Inspection-Bypass",
+        "rule_name": "SSL检查规避尝试",
+        "alert_date": "2025-09-18T19:30:25Z",
+        "tags": ["evasion", "ssl-tls", "policy-violation"],
+        "severity": "High",
+        "reference": "用户j.doe尝试绕过SSL检查",
+        "description": "用户 j.doe 尝试访问一个通过无效证书来规避 SSL 检查的网站。该行为可能用于隐藏恶意流量或访问不当内容。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_domain", "value": "bad-cert-site.com"},
+            {"type": "threat_type", "value": "Evasion"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-02",
+            "timestamp": "2025-09-18T19:30:24.789Z",
+            "event_type": "SSLConnection",
+            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
+            "ssl_details": {
+                "url": "https://bad-cert-site.com",
+                "verdict": "Blocked",
+                "reason": "Invalid or untrusted SSL certificate"
+            },
+            "security_context": {
+                "action": "Blocked",
+                "reason": "SSL inspection bypass attempt"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-08-File-Upload-to-Suspicious-Domain",
+        "rule_name": "文件上传到可疑域名",
+        "alert_date": "2025-09-18T19:35:10Z",
+        "tags": ["data-exfiltration", "file-upload"],
+        "severity": "Medium",
+        "reference": "用户a.smith向可疑域名上传文件",
+        "description": "用户 a.smith 上传了一个文件到已知信誉低下的域名。这可能表明数据外泄正在进行。",
+        "artifacts": [
+            {"type": "username", "value": "a.smith"},
+            {"type": "source_ip", "value": "192.168.2.54"},
+            {"type": "destination_domain", "value": "data-receiver.ru"},
+            {"type": "action", "value": "file-upload"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-03",
+            "timestamp": "2025-09-18T19:35:09.600Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "a.smith", "ip_address": "192.168.2.54"},
+            "access_details": {
+                "url": "http://data-receiver.ru/upload.php",
+                "method": "POST",
+                "file_size_bytes": 1200000,
+                "status": "200 OK"
+            },
+            "security_context": {
+                "reason": "File upload to a low-reputation domain"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-09-High-Volume-DNS-Queries",
+        "rule_name": "高频DNS查询",
+        "alert_date": "2025-09-18T19:40:40Z",
+        "tags": ["dns", "reconnaissance", "data-tunneling"],
+        "severity": "High",
+        "reference": "主机FIN-WKS-JDOE-05发起大量异常DNS查询",
+        "description": "主机 FIN-WKS-JDOE-05 在短时间内发起大量异常 DNS 查询。该行为可能与 DNS 隧道通信或侦察活动有关。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "query_count", "value": 500}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-dns-gw-01",
+            "timestamp": "2025-09-18T19:40:39.123Z",
+            "event_type": "DNSQuery",
+            "user_details": {"ip_address": "192.168.1.101"},
+            "query_details": {
+                "domain_list": ["a.exfil.dns.com", "b.exfil.dns.com", "..."],
+                "query_rate": "100 queries/sec"
+            },
+            "security_context": {
+                "reason": "High-volume, rapid-fire DNS queries"
+            }
+        }
+    },
+    {
+        "source": "Proxy",
+        "rule_id": "PROXY-Rule-10-Policy-Violation-Circumvention",
+        "rule_name": "试图规避策略",
+        "alert_date": "2025-09-18T19:45:25Z",
+        "tags": ["evasion", "circumvention", "vpn"],
+        "severity": "High",
+        "reference": "用户j.doe尝试访问VPN服务",
+        "description": "用户 j.doe 试图访问并连接到 VPN 服务，以规避公司的网络代理和内容过滤策略。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_domain", "value": "nordvpn.com"},
+            {"type": "threat_type", "value": "Circumvention"}
+        ],
+        "raw_log": {
+            "proxy_server": "proxy-gw-02",
+            "timestamp": "2025-09-18T19:45:24.777Z",
+            "event_type": "WebAccess",
+            "user_details": {"username": "j.doe", "ip_address": "192.168.1.101"},
+            "access_details": {
+                "url": "https://nordvpn.com/login",
+                "status": "403 Forbidden",
+                "policy": "Block-VPN-Anonymizers"
+            },
+            "security_context": {
+                "action": "Blocked",
+                "reason": "Attempt to access a VPN service to bypass security controls"
+            }
+        }
+    }
+]
+ueba_alert = [
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-01-Lateral-Movement-Spike",
+        "rule_name": "夜间异常横向移动",
+        "alert_date": "2025-09-23T22:35:00Z",
+        "tags": ["lateral-movement", "anomaly", "after-hours", "compromised-account"],
+        "severity": "High",
+        "reference": "用户j.doe账户在非工作时间异常登录多台服务器",
+        "description": "用户 j.doe 的账户在夜间（非其通常工作时间）异常登录了多台不属于其日常工作范围的服务器。这与该账户的历史行为基线存在显著偏差，可能表明账户已被盗用。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "time_of_day", "value": "After-hours"},
+            {"type": "login_count", "value": 7},
+            {"type": "login_targets", "value": ["SRV-FINANCE-02", "SRV-HR-05", "DB-PROD-01"]}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T22:34:59.789Z",
+            "event_type": "LoginAnomaly",
+            "user_details": {"username": "j.doe", "department": "Finance"},
+            "behavioral_details": {
+                "login_time": "22:30-22:35",
+                "normal_login_time": "09:00-18:00",
+                "login_target_change_score": 9.5,
+                "login_rate_score": 8.8
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-02-Unusual-Data-Volume-Download",
+        "rule_name": "非正常数据外发量",
+        "alert_date": "2025-09-23T11:15:20Z",
+        "tags": ["data-exfiltration", "anomaly", "insider-threat"],
+        "severity": "High",
+        "reference": "用户h.lin下载大量文件到个人云存储",
+        "description": "用户 h.lin 在短时间内从公司的 SharePoint 下载了异常大批量的文件，并将其同步到个人 Google Drive。这与该用户的历史数据传输习惯严重不符。",
+        "artifacts": [
+            {"type": "username", "value": "h.lin"},
+            {"type": "data_source", "value": "SharePoint"},
+            {"type": "data_destination", "value": "Google Drive"},
+            {"type": "data_volume_gb", "value": 2.5},
+            {"type": "file_count", "value": 150}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T11:15:19.444Z",
+            "event_type": "DataTransferAnomaly",
+            "user_details": {"username": "h.lin", "department": "HR"},
+            "behavioral_details": {
+                "normal_data_volume_gb_24h": 0.05,
+                "current_data_volume_gb_24h": 2.5,
+                "volume_deviation_score": 9.8,
+                "destination_deviation_score": 9.0
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-03-Account-Brute-Force-Multiple-Sources",
+        "rule_name": "多源账户暴力破解",
+        "alert_date": "2025-09-23T05:40:55Z",
+        "tags": ["authentication", "brute-force", "distributed-attack"],
+        "severity": "High",
+        "reference": "来自多个IP地址对单个账户的暴力破解",
+        "description": "检测到针对账户 s.brown 的大量失败登录尝试，这些尝试来自多个不同的外部 IP 地址。这表明可能存在分布式暴力破解攻击。",
+        "artifacts": [
+            {"type": "target_username", "value": "s.brown"},
+            {"type": "failed_logins", "value": 58},
+            {"type": "source_ip_count", "value": 12},
+            {"type": "time_window_minutes", "value": 10}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T05:40:54.666Z",
+            "event_type": "AuthenticationAnomaly",
+            "user_details": {"username": "s.brown", "department": "Sales"},
+            "behavioral_details": {
+                "failed_login_rate": 5.8,
+                "failed_login_rate_score": 9.2,
+                "ip_source_entropy": 7.1
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-04-Service-Account-Unusual-Access",
+        "rule_name": "服务账户异常访问",
+        "alert_date": "2025-09-23T14:50:30Z",
+        "tags": ["service-account", "anomaly", "privilege-escalation"],
+        "severity": "High",
+        "reference": "服务账户SVC-APP-01访问敏感数据库",
+        "description": "服务账户 SVC-APP-01 通常仅用于应用程序通信，但现在却尝试访问一个包含客户 PII 的数据库，这与该账户的正常行为模式严重不符。",
+        "artifacts": [
+            {"type": "account_name", "value": "SVC-APP-01"},
+            {"type": "source_ip", "value": "10.10.1.5"},
+            {"type": "action", "value": "Database Query"},
+            {"type": "target_resource", "value": "DB-CUSTOMER-PII"}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T14:50:29.999Z",
+            "event_type": "ServiceAccountAnomaly",
+            "entity_details": {"entity_name": "SVC-APP-01", "entity_type": "Service Account"},
+            "behavioral_details": {
+                "normal_access_patterns": ["App-DB-01", "App-API-Gateway"],
+                "current_access_target_deviation": 9.9
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-05-Insider-Trading-Recon",
+        "rule_name": "可疑的内部侦察活动",
+        "alert_date": "2025-09-23T10:25:40Z",
+        "tags": ["insider-threat", "reconnaissance", "data-exfiltration"],
+        "severity": "Medium",
+        "reference": "用户l.wang搜索机密项目文件",
+        "description": "用户 l.wang（非相关部门）在文件服务器上多次搜索并访问与“Project Chimera”相关的机密文件。该项目与该用户的日常职责无关。",
+        "artifacts": [
+            {"type": "username", "value": "l.wang"},
+            {"type": "source_ip", "value": "192.168.1.55"},
+            {"type": "search_keywords", "value": ["Project Chimera", "acquisition", "financial model"]},
+            {"type": "file_access_count", "value": 20}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T10:25:39.111Z",
+            "event_type": "FileAccessAnomaly",
+            "user_details": {"username": "l.wang", "department": "Marketing"},
+            "behavioral_details": {
+                "normal_file_access_path": ["/marketing/", "/campaigns/"],
+                "abnormal_file_access_path": ["/finance/projects/"]
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-06-Geographic-Login-Impossible-Travel",
+        "rule_name": "异地登录（不可能行程）",
+        "alert_date": "2025-09-23T08:10:15Z",
+        "tags": ["impossible-travel", "geolocation", "compromised-account"],
+        "severity": "High",
+        "reference": "用户m.li在两地同时或短时间登录",
+        "description": "用户 m.li 的账户在 10 分钟内分别从中国和美国登录。这在物理上是不可能的，强烈表明账户已被盗用。",
+        "artifacts": [
+            {"type": "username", "value": "m.li"},
+            {"type": "login_1_ip", "value": "203.0.113.1"},
+            {"type": "login_1_country", "value": "China"},
+            {"type": "login_2_ip", "value": "198.51.100.25"},
+            {"type": "login_2_country", "value": "United States"}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T08:10:14.543Z",
+            "event_type": "ImpossibleTravel",
+            "user_details": {"username": "m.li", "department": "R&D"},
+            "behavioral_details": {
+                "time_between_logins_min": 10,
+                "distance_km": 11000,
+                "speed_kph": 66000
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-07-Workstation-Communication-Anomaly",
+        "rule_name": "工作站异常通信",
+        "alert_date": "2025-09-23T13:45:00Z",
+        "tags": ["network-anomaly", "workstation", "c2"],
+        "severity": "Medium",
+        "reference": "WKS-ENG-12与不寻常主机通信",
+        "description": "工程工作站 WKS-ENG-12 突然开始与一个不属于公司网络的内部主机进行高频通信，这偏离了其日常通信模式，可能表明感染或侦察行为。",
+        "artifacts": [
+            {"type": "hostname", "value": "WKS-ENG-12"},
+            {"type": "source_ip", "value": "192.168.4.12"},
+            {"type": "destination_ip", "value": "192.168.5.88"},
+            {"type": "protocol", "value": "TCP", "port": 4444}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T13:44:59.123Z",
+            "event_type": "NetworkFlowAnomaly",
+            "entity_details": {"entity_name": "WKS-ENG-12", "entity_type": "Workstation"},
+            "behavioral_details": {
+                "normal_destination_ips": ["192.168.4.1", "10.10.1.10"],
+                "flow_deviation_score": 8.5
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-08-Excessive-Privilege-Use",
+        "rule_name": "特权账户异常使用",
+        "alert_date": "2025-09-23T16:10:30Z",
+        "tags": ["privileged-account", "escalation", "misuse"],
+        "severity": "High",
+        "reference": "特权账户k.smith异常查询员工工资信息",
+        "description": "特权账户 k.smith 异常地访问了包含员工工资数据的敏感数据库。尽管该账户有此权限，但此行为与该用户的日常职责无关。",
+        "artifacts": [
+            {"type": "username", "value": "k.smith"},
+            {"type": "source_ip", "value": "192.168.1.200"},
+            {"type": "resource", "value": "HR-Salary-DB"},
+            {"type": "action", "value": "read"}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T16:10:29.876Z",
+            "event_type": "PrivilegedAccessAnomaly",
+            "user_details": {"username": "k.smith", "department": "IT Operations"},
+            "behavioral_details": {
+                "normal_access_targets": ["IT-Asset-DB", "Network-Logs-DB"],
+                "deviation_reason": "Access to out-of-scope database"
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-09-Mass-File-Renaming",
+        "rule_name": "批量文件重命名/加密",
+        "alert_date": "2025-09-23T18:05:55Z",
+        "tags": ["ransomware", "data-destruction", "file-anomaly"],
+        "severity": "High",
+        "reference": "主机WKS-HR-03上发生大规模文件重命名",
+        "description": "主机 WKS-HR-03 在短时间内执行了异常大量的批量文件重命名操作，将文件扩展名改为 '.encrypted'。这与勒索软件活动的行为模式高度一致。",
+        "artifacts": [
+            {"type": "hostname", "value": "WKS-HR-03"},
+            {"type": "source_ip", "value": "192.168.2.150"},
+            {"type": "file_change_count", "value": 250},
+            {"type": "new_extension", "value": ".encrypted"}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T18:05:54.666Z",
+            "event_type": "HostFileAnomaly",
+            "entity_details": {"entity_name": "WKS-HR-03", "entity_type": "Workstation"},
+            "behavioral_details": {
+                "file_change_rate": 50,
+                "file_change_rate_score": 9.9,
+                "reason": "Mass file renaming/encryption pattern"
+            }
+        }
+    },
+    {
+        "source": "UEBA",
+        "rule_id": "UEBA-Rule-10-Account-Creation-Anomaly",
+        "rule_name": "异常账户创建",
+        "alert_date": "2025-09-23T20:45:10Z",
+        "tags": ["account-management", "anomaly", "privilege-escalation"],
+        "severity": "Medium",
+        "reference": "非IT管理员账户创建新用户",
+        "description": "非 IT 部门的管理员账户 n.jones 在非工作时间创建了一个新的高权限用户账户。此行为严重偏离了该账户的正常职责。",
+        "artifacts": [
+            {"type": "actor_username", "value": "n.jones"},
+            {"type": "source_ip", "value": "192.168.1.120"},
+            {"type": "action", "value": "user_creation"},
+            {"type": "new_username", "value": "temp_admin_user"}
+        ],
+        "raw_log": {
+            "ueba_engine": "ueba-core-engine",
+            "timestamp": "2025-09-23T20:45:09.111Z",
+            "event_type": "AccountManagementAnomaly",
+            "user_details": {"username": "n.jones", "department": "Facilities"},
+            "behavioral_details": {
+                "normal_activities": ["door-access-control", "HVAC-management"],
+                "deviation_reason": "Out-of-scope user management activity"
+            }
+        }
+    }
+]
+ti_alert = [
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-01-Malicious-IP-Inbound",
+        "rule_name": "来自恶意IP的入站连接",
+        "alert_date": "2025-09-23T20:50:00Z",
+        "tags": ["malicious-ip", "reconnaissance", "botnet"],
+        "severity": "High",
+        "reference": "来自俄罗斯僵尸网络IP的扫描尝试",
+        "description": "防火墙日志显示，来自一个已知僵尸网络基础设施的恶意 IP 地址 185.22.67.123 尝试连接到内部网络。",
+        "artifacts": [
+            {"type": "source_ip", "value": "185.22.67.123"},
+            {"type": "destination_ip", "value": "10.10.10.50"},
+            {"type": "country", "value": "Russia"},
+            {"type": "threat_list", "value": "Botnet C2 IPs"}
+        ],
+        "raw_log": {
+            "source_type": "Firewall",
+            "timestamp": "2025-09-23T20:49:59.876Z",
+            "action": "DENY",
+            "protocol": "TCP",
+            "src_ip": "185.22.67.123",
+            "dst_ip": "10.10.10.50",
+            "dst_port": 22,
+            "rule_name": "deny_all_malicious_ips"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-02-C2-Domain-Outbound",
+        "rule_name": "内部主机尝试连接C2域名",
+        "alert_date": "2025-09-23T20:55:30Z",
+        "tags": ["c2", "malware", "outbound"],
+        "severity": "Critical",
+        "reference": "主机WKS-HR-03连接到恶意C2域名",
+        "description": "内部主机 WKS-HR-03 (192.168.2.150) 尝试通过代理服务器连接到一个被威胁情报标记为命令与控制 (C2) 服务器的域名。",
+        "artifacts": [
+            {"type": "source_ip", "value": "192.168.2.150"},
+            {"type": "destination_domain", "value": "evil.c2-server.net"},
+            {"type": "threat_list", "value": "APT C2 Domains"}
+        ],
+        "raw_log": {
+            "source_type": "Proxy",
+            "timestamp": "2025-09-23T20:55:29.987Z",
+            "action": "BLOCK",
+            "user": "j.smith",
+            "src_ip": "192.168.2.150",
+            "url": "http://evil.c2-server.net/beacon"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-03-Malicious-File-Hash-Match",
+        "rule_name": "内部文件哈希匹配恶意情报",
+        "alert_date": "2025-09-23T21:00:15Z",
+        "tags": ["malware", "file-hash", "endpoint"],
+        "severity": "High",
+        "reference": "主机FIN-WKS-JDOE-05上发现恶意文件",
+        "description": "终端日志显示，主机 FIN-WKS-JDOE-05 上存在一个文件的 SHA256 哈希值与一个已知的恶意软件（勒索软件）哈希值匹配。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "file_path", "value": "C:\\Users\\j.doe\\Downloads\\invoice.exe"},
+            {"type": "file_hash_sha256", "value": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"},
+            {"type": "threat_list", "value": "Ransomware Hashes"}
+        ],
+        "raw_log": {
+            "source_type": "EDR",
+            "timestamp": "2025-09-23T21:00:14.654Z",
+            "event_name": "File_Creation_Detected",
+            "file_hash_sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+            "file_path": "C:\\Users\\j.doe\\Downloads\\invoice.exe"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-04-Phishing-URL-Access",
+        "rule_name": "访问钓鱼URL",
+        "alert_date": "2025-09-23T21:05:40Z",
+        "tags": ["phishing", "url-threat"],
+        "severity": "Medium",
+        "reference": "用户d.chen访问钓鱼URL",
+        "description": "用户 d.chen 访问了一个被威胁情报标记为钓鱼网站的 URL。虽然访问被允许，但该行为需要进一步调查。",
+        "artifacts": [
+            {"type": "username", "value": "d.chen"},
+            {"type": "source_ip", "value": "192.168.4.12"},
+            {"type": "url", "value": "http://my-corp-sso-secure.cc/login"},
+            {"type": "threat_list", "value": "Phishing URLs"}
+        ],
+        "raw_log": {
+            "source_type": "Proxy",
+            "timestamp": "2025-09-23T21:05:39.111Z",
+            "action": "ALLOW",
+            "user": "d.chen",
+            "src_ip": "192.168.4.12",
+            "url": "http://my-corp-sso-secure.cc/login"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-05-Known-Vulnerability-Scan",
+        "rule_name": "已知漏洞扫描活动",
+        "alert_date": "2025-09-23T21:10:20Z",
+        "tags": ["vulnerability", "scan", "reconnaissance"],
+        "severity": "High",
+        "reference": "来自IP 104.22.56.78的Log4j漏洞扫描",
+        "description": "来自 IP 地址 104.22.56.78 的流量模式与 Log4j (CVE-2021-44228) 漏洞的扫描特征相匹配。该 IP 被列在恶意扫描者列表中。",
+        "artifacts": [
+            {"type": "source_ip", "value": "104.22.56.78"},
+            {"type": "destination_ip", "value": "10.10.10.200"},
+            {"type": "vulnerability", "value": "Log4j (CVE-2021-44228)"}
+        ],
+        "raw_log": {
+            "source_type": "IPS/IDS",
+            "timestamp": "2025-09-23T21:10:19.456Z",
+            "action": "DROP",
+            "src_ip": "104.22.56.78",
+            "dst_ip": "10.10.10.200",
+            "signature_id": "IDS_Log4j_Scan_Pattern"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-06-Data-Exfiltration-Endpoint-Match",
+        "rule_name": "数据外泄端点连接",
+        "alert_date": "2025-09-23T21:15:50Z",
+        "tags": ["exfiltration", "data-theft"],
+        "severity": "Medium",
+        "reference": "主机WKS-ENG-12连接到数据外泄端点",
+        "description": "主机 WKS-ENG-12 (192.168.4.12) 尝试连接到一个被标记为数据外泄端点的 IP 地址 45.33.20.10。",
+        "artifacts": [
+            {"type": "hostname", "value": "WKS-ENG-12"},
+            {"type": "source_ip", "value": "192.168.4.12"},
+            {"type": "destination_ip", "value": "45.33.20.10"},
+            {"type": "threat_list", "value": "Data Exfiltration Endpoints"}
+        ],
+        "raw_log": {
+            "source_type": "Firewall",
+            "timestamp": "2025-09-23T21:15:49.123Z",
+            "action": "BLOCK",
+            "src_ip": "192.168.4.12",
+            "dst_ip": "45.33.20.10",
+            "dst_port": 80
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-07-Malicious-Domain-DNS-Query",
+        "rule_name": "DNS查询恶意域名",
+        "alert_date": "2025-09-23T21:20:10Z",
+        "tags": ["dns", "malware"],
+        "severity": "Medium",
+        "reference": "主机IT-ADMIN-01查询恶意域名",
+        "description": "IT-ADMIN-01 (192.168.10.5) 主机向内部 DNS 服务器查询了一个被列为恶意软件分发站点的域名。",
+        "artifacts": [
+            {"type": "source_ip", "value": "192.168.10.5"},
+            {"type": "query_domain", "value": "malware-repo.xyz"},
+            {"type": "threat_list", "value": "Malware Drop Zones"}
+        ],
+        "raw_log": {
+            "source_type": "DNS",
+            "timestamp": "2025-09-23T21:20:09.543Z",
+            "src_ip": "192.168.10.5",
+            "query_domain": "malware-repo.xyz",
+            "response": "blocked"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-08-Suspicious-Country-Access",
+        "rule_name": "来自受限制国家的连接",
+        "alert_date": "2025-09-23T21:25:00Z",
+        "tags": ["geofencing", "risk-country"],
+        "severity": "Low",
+        "reference": "来自受限制国家朝鲜的连接尝试",
+        "description": "来自 IP 地址 175.45.176.1 的连接尝试，该 IP 归属于一个被公司安全策略列为高风险或受限制的国家/地区（朝鲜）。",
+        "artifacts": [
+            {"type": "source_ip", "value": "175.45.176.1"},
+            {"type": "country", "value": "North Korea"}
+        ],
+        "raw_log": {
+            "source_type": "Firewall",
+            "timestamp": "2025-09-23T21:24:59.000Z",
+            "action": "DENY",
+            "src_ip": "175.45.176.1",
+            "dst_ip": "52.8.10.20",
+            "dst_port": 443,
+            "rule_name": "geo_block_north_korea"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-09-Compromised-Account-Credential",
+        "rule_name": "内部账户凭据出现在暗网",
+        "alert_date": "2025-09-23T21:30:35Z",
+        "tags": ["compromised-credentials", "darkweb", "insider-threat"],
+        "severity": "High",
+        "reference": "账户l.wang的凭据出现在暗网数据库",
+        "description": "威胁情报源报告，用户 l.wang (l.wang@mycorp.com) 的凭据（用户名和密码）在一个已泄露的暗网数据库中被发现。",
+        "artifacts": [
+            {"type": "username", "value": "l.wang"},
+            {"type": "email", "value": "l.wang@mycorp.com"},
+            {"type": "leak_source", "value": "Dark Web Credential Dump"}
+        ],
+        "raw_log": {
+            "source_type": "Threat Intelligence Feed",
+            "timestamp": "2025-09-23T21:30:34.888Z",
+            "alert_source": "credential-monitoring-service",
+            "details": "Credential 'l.wang@mycorp.com:password123' found in pastebin dump."
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-10-Honeypot-Interaction",
+        "rule_name": "与公司蜜罐交互",
+        "alert_date": "2025-09-23T21:35:10Z",
+        "tags": ["honeypot", "attacker-activity", "reconnaissance"],
+        "severity": "Medium",
+        "reference": "IP 1.1.1.1与蜜罐服务进行交互",
+        "description": "IP 地址 1.1.1.1 (可能为攻击者) 与公司内部的蜜罐服务建立了连接。该行为表示有针对性的侦察或攻击尝试。",
+        "artifacts": [
+            {"type": "source_ip", "value": "1.1.1.1"},
+            {"type": "destination_ip", "value": "10.10.10.250"},
+            {"type": "device_type", "value": "Honeypot"}
+        ],
+        "raw_log": {
+            "source_type": "Honeypot",
+            "timestamp": "2025-09-23T21:35:09.999Z",
+            "action": "ATTEMPTED_ACCESS",
+            "src_ip": "1.1.1.1",
+            "dst_ip": "10.10.10.250",
+            "dst_port": 21,
+            "service": "ftp"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-11-Malicious-IP-Outbound",
+        "rule_name": "内部主机连接到恶意IP",
+        "alert_date": "2025-09-23T21:40:05Z",
+        "tags": ["malicious-ip", "outbound", "botnet"],
+        "severity": "High",
+        "reference": "主机WKS-HR-03尝试连接到恶意IP",
+        "description": "主机 WKS-HR-03 (192.168.2.150) 尝试连接到一个被列为恶意基础设施的 IP 地址 5.6.7.8。",
+        "artifacts": [
+            {"type": "source_ip", "value": "192.168.2.150"},
+            {"type": "destination_ip", "value": "5.6.7.8"},
+            {"type": "threat_list", "value": "Malicious IPs"}
+        ],
+        "raw_log": {
+            "source_type": "Firewall",
+            "timestamp": "2025-09-23T21:40:04.999Z",
+            "action": "DENY",
+            "src_ip": "192.168.2.150",
+            "dst_ip": "5.6.7.8",
+            "dst_port": 443
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-12-Suspicious-URL-Inbound",
+        "rule_name": "入站邮件中的可疑URL",
+        "alert_date": "2025-09-23T21:45:30Z",
+        "tags": ["phishing", "email"],
+        "severity": "Medium",
+        "reference": "邮件中检测到可疑URL",
+        "description": "邮件安全网关检测到一封入站邮件中包含一个被威胁情报标记为可疑或钓鱼的 URL。",
+        "artifacts": [
+            {"type": "sender_email", "value": "noreply@sso-update.com"},
+            {"type": "url", "value": "https://sso-update.mycorp.io"},
+            {"type": "threat_list", "value": "Suspicious URLs"}
+        ],
+        "raw_log": {
+            "source_type": "Email Gateway",
+            "timestamp": "2025-09-23T21:45:29.876Z",
+            "action": "QUARANTINE",
+            "sender": "noreply@sso-update.com",
+            "recipient": "j.doe@mycorp.com",
+            "subject": "Important Security Notice",
+            "body_snippet": "Please update your password via this link: https://sso-update.mycorp.io"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-13-Known-Attacker-IP",
+        "rule_name": "与已知攻击者IP的交互",
+        "alert_date": "2025-09-23T21:50:00Z",
+        "tags": ["apt", "attacker", "reconnaissance"],
+        "severity": "Critical",
+        "reference": "来自APT组织IP的扫描",
+        "description": "来自一个被确定为APT（高级持续威胁）组织使用的 IP 地址 103.203.20.12 的流量被检测到。",
+        "artifacts": [
+            {"type": "source_ip", "value": "103.203.20.12"},
+            {"type": "threat_actor", "value": "Fancy Bear"}
+        ],
+        "raw_log": {
+            "source_type": "IPS/IDS",
+            "timestamp": "2025-09-23T21:49:59.000Z",
+            "action": "ALERT",
+            "src_ip": "103.203.20.12",
+            "dst_ip": "10.10.10.50",
+            "signature_id": "IDS_Known_APT_Scan"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-14-Ransomware-Hash-Downloaded",
+        "rule_name": "勒索软件哈希被下载",
+        "alert_date": "2025-09-23T21:55:45Z",
+        "tags": ["ransomware", "download", "endpoint"],
+        "severity": "Critical",
+        "reference": "主机MKT-WKS-ASMITH-01下载勒索软件文件",
+        "description": "终端日志显示，主机 MKT-WKS-ASMITH-01 上下载的一个文件与一个已知的勒索软件哈希值匹配。",
+        "artifacts": [
+            {"type": "hostname", "value": "MKT-WKS-ASMITH-01"},
+            {"type": "file_hash_sha256", "value": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"},
+            {"type": "file_path", "value": "C:\\Users\\a.smith\\Downloads\\document.zip"}
+        ],
+        "raw_log": {
+            "source_type": "EDR",
+            "timestamp": "2025-09-23T21:55:44.888Z",
+            "event_name": "File_Download_Detected",
+            "file_hash_sha256": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
+            "file_path": "C:\\Users\\a.smith\\Downloads\\document.zip"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-15-Cryptocurrency-Miner-Domain",
+        "rule_name": "加密货币挖矿域名连接",
+        "alert_date": "2025-09-23T22:00:20Z",
+        "tags": ["cryptomining", "malware"],
+        "severity": "Medium",
+        "reference": "主机FIN-WKS-JDOE-05连接到加密货币挖矿池",
+        "description": "主机 FIN-WKS-JDOE-05 尝试连接到一个被威胁情报标记为加密货币挖矿池的域名。",
+        "artifacts": [
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "destination_domain", "value": "mine-xmr.pool.net"}
+        ],
+        "raw_log": {
+            "source_type": "Proxy",
+            "timestamp": "2025-09-23T22:00:19.999Z",
+            "action": "BLOCK",
+            "user": "j.doe",
+            "src_ip": "192.168.1.101",
+            "url": "http://mine-xmr.pool.net/miner"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-16-Dark-Web-Mention",
+        "rule_name": "公司信息出现在暗网",
+        "alert_date": "2025-09-23T22:05:00Z",
+        "tags": ["darkweb", "intel", "breach"],
+        "severity": "High",
+        "reference": "暗网论坛提及公司名称和泄露数据",
+        "description": "在暗网的一个黑客论坛上，公司名称 'MyCorp' 被提及，并附有泄露员工数据的链接。",
+        "artifacts": [
+            {"type": "company_name", "value": "MyCorp"},
+            {"type": "leak_type", "value": "Employee Data"}
+        ],
+        "raw_log": {
+            "source_type": "Dark Web Monitor",
+            "timestamp": "2025-09-23T22:04:59.000Z",
+            "details": "Post on 'Breach Forums' discussing 'MyCorp' and 'staff email list'"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-17-Malicious-IP-Port-Scan",
+        "rule_name": "来自恶意IP的端口扫描",
+        "alert_date": "2025-09-23T22:10:30Z",
+        "tags": ["malicious-ip", "reconnaissance", "port-scan"],
+        "severity": "Medium",
+        "reference": "来自IP 134.119.50.60的大规模端口扫描",
+        "description": "来自一个已知恶意 IP 的 134.119.50.60 对内部资产进行大规模端口扫描，试图发现开放的服务。",
+        "artifacts": [
+            {"type": "source_ip", "value": "134.119.50.60"},
+            {"type": "destination_ip", "value": "10.10.10.0/24"},
+            {"type": "threat_list", "value": "Malicious Scanners"}
+        ],
+        "raw_log": {
+            "source_type": "IPS/IDS",
+            "timestamp": "2025-09-23T22:10:29.876Z",
+            "action": "ALERT",
+            "src_ip": "134.119.50.60",
+            "dst_ip": "10.10.10.10, 10.10.10.20, ...",
+            "signature_id": "Port_Scan_TCP_Syn"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-18-Spear-Phishing-Email-Detected",
+        "rule_name": "鱼叉式网络钓鱼邮件检测",
+        "alert_date": "2025-09-23T22:15:15Z",
+        "tags": ["spear-phishing", "email"],
+        "severity": "High",
+        "reference": "针对CEO的鱼叉式钓鱼邮件",
+        "description": "一封针对 CEO (j.smith@mycorp.com) 的鱼叉式钓鱼邮件，该邮件模仿了客户公司的通信，并包含一个恶意附件。",
+        "artifacts": [
+            {"type": "recipient_email", "value": "j.smith@mycorp.com"},
+            {"type": "sender_email", "value": "info@customer-relations-co.org"},
+            {"type": "subject", "value": "Regarding Q3 contract renewal"}
+        ],
+        "raw_log": {
+            "source_type": "Email Gateway",
+            "timestamp": "2025-09-23T22:15:14.666Z",
+            "action": "BLOCK",
+            "sender": "info@customer-relations-co.org",
+            "recipient": "j.smith@mycorp.com",
+            "subject": "Regarding Q3 contract renewal",
+            "threat_details": "Targeted phishing, known malicious sender, attachment scan"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-19-Vulnerability-Exploit-Attempt",
+        "rule_name": "已知漏洞利用尝试",
+        "alert_date": "2025-09-23T22:20:00Z",
+        "tags": ["vulnerability", "exploit", "attack"],
+        "severity": "Critical",
+        "reference": "针对Web服务器的SQL注入尝试",
+        "description": "Web 应用防火墙 (WAF) 检测到针对 Web 服务器 (10.10.10.100) 的一个 SQL 注入尝试，该模式与已知的攻击工具和方法相符。",
+        "artifacts": [
+            {"type": "source_ip", "value": "172.67.100.200"},
+            {"type": "destination_ip", "value": "10.10.10.100"},
+            {"type": "attack_type", "value": "SQL Injection"}
+        ],
+        "raw_log": {
+            "source_type": "WAF",
+            "timestamp": "2025-09-23T22:19:59.123Z",
+            "action": "BLOCK",
+            "src_ip": "172.67.100.200",
+            "dst_ip": "10.10.10.100",
+            "request_uri": "/api/users?id=' OR 1=1 --",
+            "rule_id": "WAF_SQLI_Rule_01"
+        }
+    },
+    {
+        "source": "TI",
+        "rule_id": "TI-Rule-20-Social-Media-Threat-Mention",
+        "rule_name": "公司在社交媒体被提及为攻击目标",
+        "alert_date": "2025-09-23T22:25:00Z",
+        "tags": ["social-media", "intel", "targeting"],
+        "severity": "Medium",
+        "reference": "Twitter上提及公司为即将攻击目标",
+        "description": "在公共社交媒体平台（Twitter）上，一个可疑账户发布了关于将 'MyCorp' 作为即将攻击目标的帖子。",
+        "artifacts": [
+            {"type": "platform", "value": "Twitter"},
+            {"type": "mention_text", "value": "MyCorp is next. #breach"},
+            {"type": "threat_actor_alias", "value": "CyberViking"}
+        ],
+        "raw_log": {
+            "source_type": "Social Media Monitor",
+            "timestamp": "2025-09-23T22:24:59.000Z",
+            "details": "Tweet by user @CyberViking: 'MyCorp is next. #breach #hack'"
+        }
+    }
+]
+
+iam_alert = [
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-01-Excessive-Permission-Grant",
+        "rule_name": "账户权限异常提升",
+        "alert_date": "2025-09-23T23:05:00Z",
+        "tags": ["privilege-escalation", "iam", "access-anomaly"],
+        "severity": "High",
+        "reference": "用户j.doe账户被授予敏感管理员权限",
+        "description": "用户 j.doe 的账户被授予 'Global Administrator' 权限。此权限提升发生在非IT管理员的操作下，且不符合其日常工作职责，可能表明特权提升攻击。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "actor_account", "value": "l.smith"},
+            {"type": "permission_granted", "value": "Global Administrator"},
+            {"type": "platform", "value": "Azure AD"}
+        ],
+        "raw_log": {
+            "service": "Azure AD",
+            "timestamp": "2025-09-23T23:04:59.888Z",
+            "event_type": "RoleAssignment",
+            "actor": {"user_id": "l.smith"},
+            "target": {"user_id": "j.doe"},
+            "details": {"role": "Global Administrator", "reason": "Unjustified elevation"}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-02-Impossible-Travel-Login",
+        "rule_name": "异地登录（不可能行程）",
+        "alert_date": "2025-09-23T23:10:30Z",
+        "tags": ["impossible-travel", "geolocation", "compromised-account"],
+        "severity": "High",
+        "reference": "用户c.jones账户在两地同时登录",
+        "description": "用户 c.jones 的账户在 10 分钟内分别从美国和日本登录。这在物理上是不可能的，强烈表明账户已被盗用。",
+        "artifacts": [
+            {"type": "username", "value": "c.jones"},
+            {"type": "login_1_ip", "value": "198.51.100.25"},
+            {"type": "login_1_location", "value": "New York, USA"},
+            {"type": "login_2_ip", "value": "203.0.113.50"},
+            {"type": "login_2_location", "value": "Tokyo, Japan"}
+        ],
+        "raw_log": {
+            "service": "Okta",
+            "timestamp": "2025-09-23T23:10:29.987Z",
+            "event_type": "AuthenticationSuccess",
+            "user": {"username": "c.jones"},
+            "geolocations": [{"country": "USA", "ip": "198.51.100.25"}, {"country": "Japan", "ip": "203.0.113.50"}],
+            "details": {"time_between_logins_min": 10}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-03-Brute-Force-Attack-Password-Spraying",
+        "rule_name": "多账户密码喷洒攻击",
+        "alert_date": "2025-09-23T23:15:20Z",
+        "tags": ["brute-force", "password-spraying", "authentication"],
+        "severity": "High",
+        "reference": "来自IP 104.22.56.78的密码喷洒攻击",
+        "description": "来自单个 IP 地址 104.22.56.78 对多个用户账户进行了大量的失败登录尝试。该攻击模式与密码喷洒攻击一致。",
+        "artifacts": [
+            {"type": "source_ip", "value": "104.22.56.78"},
+            {"type": "failed_logins", "value": 50},
+            {"type": "target_user_count", "value": 10}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-23T23:15:19.444Z",
+            "event_type": "AuthenticationFailure",
+            "src_ip": "104.22.56.78",
+            "details": {"target_users": ["j.doe", "a.smith", "c.jones", "..."], "password_attempted": "Spring2025!"}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-04-New-Privileged-Account-Created",
+        "rule_name": "非授权创建特权账户",
+        "alert_date": "2025-09-23T23:20:55Z",
+        "tags": ["account-creation", "privileged-account", "insider-threat"],
+        "severity": "Medium",
+        "reference": "非IT管理员账户创建新管理员用户",
+        "description": "非 IT 部门的管理员账户 s.brown 在非工作时间创建了一个新的高权限用户账户，名为 'temp_admin_user'。",
+        "artifacts": [
+            {"type": "actor_username", "value": "s.brown"},
+            {"type": "new_username", "value": "temp_admin_user"},
+            {"type": "source_ip", "value": "192.168.1.55"},
+            {"type": "time_of_day", "value": "After-hours"}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-23T23:20:54.666Z",
+            "event_type": "UserCreation",
+            "actor": {"username": "s.brown", "department": "Facilities"},
+            "target": {"username": "temp_admin_user", "groups": ["Domain Admins"]}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-05-Unusual-API-Call-Cloud",
+        "rule_name": "云服务账户异常API调用",
+        "alert_date": "2025-09-23T23:25:40Z",
+        "tags": ["cloud-security", "iam", "api-call-anomaly"],
+        "severity": "High",
+        "reference": "AWS账户'App-Service'在异常地点调用API",
+        "description": "AWS 服务账户 'App-Service' 通常仅从美国东部地区发起 API 调用，但现在却从欧洲地区发起了异常的 'EC2 StartInstances' API 调用。",
+        "artifacts": [
+            {"type": "account_name", "value": "App-Service"},
+            {"type": "api_call", "value": "EC2:StartInstances"},
+            {"type": "source_region", "value": "eu-west-1"},
+            {"type": "normal_region", "value": "us-east-1"}
+        ],
+        "raw_log": {
+            "service": "AWS CloudTrail",
+            "timestamp": "2025-09-23T23:25:39.111Z",
+            "event_name": "StartInstances",
+            "user_identity": {"type": "AssumedRole", "principal_id": "App-Service"},
+            "source_ip_address": "85.234.11.22",
+            "aws_region": "eu-west-1"
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-06-Multiple-Failed-MFA-Attempts",
+        "rule_name": "多因素认证失败尝试",
+        "alert_date": "2025-09-23T23:30:10Z",
+        "tags": ["mfa", "authentication", "brute-force"],
+        "severity": "Medium",
+        "reference": "用户h.lin多次尝试失败的MFA验证",
+        "description": "用户 h.lin 在短时间内多次尝试失败的多因素认证（MFA）。这可能表明攻击者已经窃取了其密码，并正在尝试绕过 MFA。",
+        "artifacts": [
+            {"type": "username", "value": "h.lin"},
+            {"type": "failed_attempts", "value": 5},
+            {"type": "source_ip", "value": "203.0.113.100"},
+            {"type": "mfa_method", "value": "TOTP"}
+        ],
+        "raw_log": {
+            "service": "Okta",
+            "timestamp": "2025-09-23T23:30:09.543Z",
+            "event_type": "AuthenticationFailure",
+            "user": {"username": "h.lin"},
+            "details": {"reason": "MFA challenge failed", "mfa_method": "TOTP"}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-07-Admin-Password-Reset-Anomaly",
+        "rule_name": "管理员账户密码重置异常",
+        "alert_date": "2025-09-23T23:35:00Z",
+        "tags": ["privileged-account", "password-reset", "compromised-account"],
+        "severity": "Critical",
+        "reference": "管理员账户k.smith在异常时间被重置密码",
+        "description": "管理员账户 k.smith 的密码在非工作时间被重置，且重置请求来自一个不属于正常管理员工作站的 IP 地址。",
+        "artifacts": [
+            {"type": "username", "value": "k.smith"},
+            {"type": "source_ip", "value": "192.168.10.20"},
+            {"type": "time_of_day", "value": "After-hours"}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-23T23:34:59.000Z",
+            "event_type": "PasswordReset",
+            "user": {"username": "k.smith"},
+            "details": {"action_by_ip": "192.168.10.20", "action_by_user": "SERVICE_ACCOUNT_PRV"}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-08-New-User-Accessing-Sensitive-Data",
+        "rule_name": "新创建用户访问敏感数据",
+        "alert_date": "2025-09-23T23:40:15Z",
+        "tags": ["new-user", "insider-threat", "data-exfiltration"],
+        "severity": "Medium",
+        "reference": "新用户n.jones创建后立即访问敏感数据",
+        "description": "新创建的用户 n.jones 在其账户创建后 1 小时内，尝试访问一个包含客户 PII 的文件服务器。此行为与新员工的正常入职流程不符。",
+        "artifacts": [
+            {"type": "username", "value": "n.jones"},
+            {"type": "source_ip", "value": "192.168.2.150"},
+            {"type": "resource", "value": "FileServer-HR-PII"}
+        ],
+        "raw_log": {
+            "service": "File Server",
+            "timestamp": "2025-09-23T23:40:14.999Z",
+            "event_type": "FileAccess",
+            "user": {"username": "n.jones"},
+            "file_path": "/sensitive/hr/pii/customers.xlsx",
+            "access_result": "Denied"
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-09-Service-Account-Interactive-Login",
+        "rule_name": "服务账户异常交互式登录",
+        "alert_date": "2025-09-23T23:45:30Z",
+        "tags": ["service-account", "anomaly", "lateral-movement"],
+        "severity": "High",
+        "reference": "服务账户SVC-APP-01在工作站进行登录",
+        "description": "服务账户 'SVC-APP-01' 通常仅用于自动化进程，但现在却在工作站上进行了交互式登录。这强烈表明账户已被攻击者盗用。",
+        "artifacts": [
+            {"type": "account_name", "value": "SVC-APP-01"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "login_type", "value": "Interactive"}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-23T23:45:29.876Z",
+            "event_type": "LoginSuccess",
+            "user": {"username": "SVC-APP-01"},
+            "src_ip": "192.168.1.101",
+            "login_type": "Interactive"
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-10-Account-Creation-Followed-by-Compromise",
+        "rule_name": "新账户创建后立即被盗用",
+        "alert_date": "2025-09-23T23:50:00Z",
+        "tags": ["account-compromise", "new-user", "suspicious-activity"],
+        "severity": "High",
+        "reference": "新账户'temp_admin_user'被创建后立即登录异地",
+        "description": "新创建的账户 'temp_admin_user' 在其创建后 10 分钟内，从一个异常的外部 IP 地址 203.0.113.20 进行了首次登录。这表明该账户可能被恶意创建并立即被盗用。",
+        "artifacts": [
+            {"type": "username", "value": "temp_admin_user"},
+            {"type": "login_ip", "value": "203.0.113.20"},
+            {"type": "time_since_creation_min", "value": 10}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-23T23:50:00.000Z",
+            "event_type": "LoginSuccess",
+            "user": {"username": "temp_admin_user"},
+            "src_ip": "203.0.113.20"
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-11-High-Frequency-Access-Denied",
+        "rule_name": "账户高频访问拒绝",
+        "alert_date": "2025-09-23T23:55:10Z",
+        "tags": ["reconnaissance", "lateral-movement", "access-denied"],
+        "severity": "Medium",
+        "reference": "用户a.smith高频访问被拒绝的资源",
+        "description": "用户 a.smith 在短时间内对多个权限不足的资源进行了高频访问尝试。这可能是攻击者在进行侦察，试图发现可利用的权限。",
+        "artifacts": [
+            {"type": "username", "value": "a.smith"},
+            {"type": "source_ip", "value": "192.168.2.54"},
+            {"type": "denied_attempts", "value": 30},
+            {"type": "time_window_sec", "value": 60}
+        ],
+        "raw_log": {
+            "service": "File Server",
+            "timestamp": "2025-09-23T23:55:09.123Z",
+            "event_type": "AccessDenied",
+            "user": {"username": "a.smith"},
+            "resource_list": ["/finance/docs/", "/hr/payroll/", "/ceo/private/"],
+            "access_result": "Denied"
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-12-Shared-Credential-Used-Unusual-Context",
+        "rule_name": "共享凭据异常使用",
+        "alert_date": "2025-09-24T00:00:20Z",
+        "tags": ["shared-account", "anomaly", "lateral-movement"],
+        "severity": "Low",
+        "reference": "共享账户'Guest-User'在异常时间登录",
+        "description": "共享账户 'Guest-User' 通常仅在白天使用，但在凌晨 2:00 进行了登录。这表明该共享账户可能被滥用。",
+        "artifacts": [
+            {"type": "username", "value": "Guest-User"},
+            {"type": "source_ip", "value": "192.168.3.88"},
+            {"type": "time_of_day", "value": "Unusual-hours"}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-24T00:00:19.999Z",
+            "event_type": "LoginSuccess",
+            "user": {"username": "Guest-User"},
+            "src_ip": "192.168.3.88"
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-13-Credential-Theft-Attempt-Local-Admin",
+        "rule_name": "本地管理员账户凭据盗窃尝试",
+        "alert_date": "2025-09-24T00:05:00Z",
+        "tags": ["credential-theft", "lateral-movement", "endpoint"],
+        "severity": "High",
+        "reference": "主机FIN-WKS-JDOE-05上发生本地凭据转储",
+        "description": "主机 FIN-WKS-JDOE-05 上检测到 Mimikatz 等凭据转储工具的活动。攻击者可能试图从本地系统窃取管理员或域账户凭据。",
+        "artifacts": [
+            {"type": "hostname", "value": "FIN-WKS-JDOE-05"},
+            {"type": "source_ip", "value": "192.168.1.101"},
+            {"type": "tool_name", "value": "Mimikatz"}
+        ],
+        "raw_log": {
+            "service": "EDR",
+            "timestamp": "2025-09-24T00:04:59.876Z",
+            "event_type": "ProcessActivity",
+            "src_ip": "192.168.1.101",
+            "process_name": "cmd.exe",
+            "command_line": "powershell.exe -e JABNAGkAbQBpAGsAYQB0AHoAIAB... "
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-14-Role-Assignment-Anomaly-Cloud",
+        "rule_name": "云角色分配异常",
+        "alert_date": "2025-09-24T00:10:30Z",
+        "tags": ["cloud-security", "iam", "role-anomaly"],
+        "severity": "High",
+        "reference": "用户c.jones被授予'IAMFullAccess'角色",
+        "description": "用户 c.jones 被授予 AWS 'IAMFullAccess' 角色，该角色允许创建和管理所有 IAM 资源。此权限与该用户的开发人员角色不符。",
+        "artifacts": [
+            {"type": "username", "value": "c.jones"},
+            {"type": "role_granted", "value": "IAMFullAccess"},
+            {"type": "platform", "value": "AWS"}
+        ],
+        "raw_log": {
+            "service": "AWS CloudTrail",
+            "timestamp": "2025-09-24T00:10:29.999Z",
+            "event_name": "AttachUserPolicy",
+            "user_identity": {"type": "AssumedRole", "principal_id": "AdminRole"},
+            "details": {"user_id": "c.jones", "policy_name": "IAMFullAccess"}
+        }
+    },
+    {
+        "source": "IAM",
+        "rule_id": "IAM-Rule-15-Account-Lockout-Threshold-Exceeded",
+        "rule_name": "账户锁定阈值超出",
+        "alert_date": "2025-09-24T00:15:15Z",
+        "tags": ["authentication", "account-lockout", "brute-force"],
+        "severity": "Medium",
+        "reference": "账户j.doe因高频失败登录被锁定",
+        "description": "用户 j.doe 的账户因在 5 分钟内多次失败登录而达到锁定阈值。这可能是针对该账户的直接暴力破解攻击。",
+        "artifacts": [
+            {"type": "username", "value": "j.doe"},
+            {"type": "failed_logins", "value": 6},
+            {"type": "lockout_time", "value": "2025-09-24T00:15:15Z"}
+        ],
+        "raw_log": {
+            "service": "Active Directory",
+            "timestamp": "2025-09-24T00:15:14.543Z",
+            "event_type": "AccountLockout",
+            "user": {"username": "j.doe"},
+            "src_ip": "192.168.1.101",
+            "details": {"lockout_threshold": 5, "current_failures": 6}
+        }
+    }
+]
+
 cloud_alert = [
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "IAM",
         "rule_id": "CLOUD-AWS-IAM-01-Root-User-Activity",
@@ -4170,7 +4829,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Compute",
         "rule_id": "CLOUD-AZ-COMPUTE-02-VM-Reconnaissance",
@@ -4194,7 +4853,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Storage",
         "rule_id": "CLOUD-GCP-STORAGE-03-Public-Bucket-Access",
@@ -4219,7 +4878,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "EC2",
         "rule_id": "CLOUD-AWS-EC2-04-Instance-Stop-Anomaly",
@@ -4244,7 +4903,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "IAM",
         "rule_id": "CLOUD-AZ-IAM-05-High-Risk-User-Login",
@@ -4268,7 +4927,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Network",
         "rule_id": "CLOUD-GCP-NET-06-Firewall-Rule-Modified",
@@ -4293,7 +4952,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "S3",
         "rule_id": "CLOUD-AWS-S3-07-Sensitive-File-Uploaded",
@@ -4318,7 +4977,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Networking",
         "rule_id": "CLOUD-AZ-NET-08-New-VPN-Gateway-Created",
@@ -4342,7 +5001,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "IAM",
         "rule_id": "CLOUD-GCP-IAM-09-Service-Account-API-Spike",
@@ -4366,7 +5025,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "Database",
         "rule_id": "CLOUD-AWS-DB-10-Unusual-RDS-Access",
@@ -4391,7 +5050,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Storage",
         "rule_id": "CLOUD-AZ-STORAGE-11-Blob-Deletion",
@@ -4415,7 +5074,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "IAM",
         "rule_id": "CLOUD-GCP-IAM-12-High-Risk-Role-Assigned",
@@ -4440,7 +5099,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "Lambda",
         "rule_id": "CLOUD-AWS-LAMBDA-13-Lambda-Inbound-Connection",
@@ -4463,7 +5122,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Database",
         "rule_id": "CLOUD-AZ-DB-14-Large-Query-DB-Anomaly",
@@ -4488,7 +5147,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Compute",
         "rule_id": "CLOUD-GCP-COMPUTE-15-VM-Outbound-C2-Traffic",
@@ -4514,7 +5173,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "IAM",
         "rule_id": "CLOUD-AWS-IAM-16-Failed-Auth-Spike",
@@ -4539,7 +5198,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "App Service",
         "rule_id": "CLOUD-AZ-APPSERV-17-Web-Shell-Detected",
@@ -4563,7 +5222,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Database",
         "rule_id": "CLOUD-GCP-DB-18-DB-Access-from-Unusual-Location",
@@ -4587,7 +5246,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "Network",
         "rule_id": "CLOUD-AWS-NET-19-Unauthorized-Security-Group-Change",
@@ -4613,7 +5272,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "IAM",
         "rule_id": "CLOUD-AZ-IAM-20-Service-Principal-Creation",
@@ -4637,7 +5296,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Cloud Functions",
         "rule_id": "CLOUD-GCP-FUNC-21-Func-Outbound-Connection",
@@ -4661,7 +5320,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "Storage",
         "rule_id": "CLOUD-AWS-STORAGE-22-S3-Bucket-Policy-Change",
@@ -4684,7 +5343,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Key Vault",
         "rule_id": "CLOUD-AZ-KEYVAULT-23-Key-Vault-Excessive-Access",
@@ -4709,7 +5368,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Network",
         "rule_id": "CLOUD-GCP-NET-24-VPN-Gateway-Traffic-Spike",
@@ -4733,7 +5392,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "IAM",
         "rule_id": "CLOUD-AWS-IAM-25-Credential-Key-Leak-in-Github",
@@ -4755,7 +5414,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Storage",
         "rule_id": "CLOUD-AZ-STORAGE-26-Sas-Token-Misuse",
@@ -4780,7 +5439,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "BigQuery",
         "rule_id": "CLOUD-GCP-BQ-27-BigQuery-Large-Data-Export",
@@ -4805,7 +5464,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "AWS",
         "service": "IAM",
         "rule_id": "CLOUD-AWS-IAM-28-Unusual-AssumeRole",
@@ -4829,7 +5488,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "Azure",
         "service": "Virtual Network",
         "rule_id": "CLOUD-AZ-NET-29-Peer-Network-Connection",
@@ -4853,7 +5512,7 @@ cloud_alert = [
         }
     },
     {
-        "source": "CLOUD",
+        "source": "Cloud",
         "cloud_provider": "GCP",
         "service": "Compute Engine",
         "rule_id": "CLOUD-GCP-COMPUTE-30-New-VM-with-External-IP",
@@ -4877,3 +5536,164 @@ cloud_alert = [
         }
     }
 ]
+cloud_alert.extend([
+    {
+        "source": "Cloud",
+        "cloud_provider": "AWS",
+        "service": "IAM",
+        "rule_id": "CLOUD-AWS-IAM-01-Root-User-Activity",
+        "rule_name": "Root账户活动",
+        "alert_date": "2025-09-23T23:05:00Z",
+        "tags": ["iam", "privileged-account", "security-best-practice"],
+        "severity": "High",
+        "reference": "AWS Root账户进行登录",
+        "description": "AWS Root账户在非指定设备上进行了登录。出于安全最佳实践，Root账户应被锁定且只在紧急情况下使用。",
+        "artifacts": [
+            {"type": "account_id", "value": "123456789012"},
+            {"type": "user_identity", "value": "Root"},
+            {"type": "event_name", "value": "ConsoleLogin"}
+        ],
+        "raw_log": {
+            "platform": "AWS",
+            "service": "CloudTrail",
+            "timestamp": "2025-09-23T23:04:59.888Z",
+            "event_name": "ConsoleLogin",
+            "userIdentity": {"type": "Root"},
+            "sourceIPAddress": "203.0.113.10",
+            "user_agent": "Mozilla/5.0"
+        }
+    },
+    {
+        "source": "Cloud",
+        "cloud_provider": "Azure",
+        "service": "Compute",
+        "rule_id": "CLOUD-AZ-COMPUTE-02-VM-Reconnaissance",
+        "rule_name": "虚拟机内部侦察",
+        "alert_date": "2025-09-23T23:10:30Z",
+        "tags": ["compute", "reconnaissance", "lateral-movement"],
+        "severity": "Medium",
+        "reference": "Azure VM进行内部网络扫描",
+        "description": "Azure 虚拟机 'prod-web-01' 突然开始对内部虚拟网络中的其他资源进行大规模端口扫描。这可能表明该虚拟机已被入侵。",
+        "artifacts": [
+            {"type": "vm_name", "value": "prod-web-01"},
+            {"type": "vm_ip", "value": "10.0.0.4"},
+            {"type": "scan_type", "value": "TCP Port Scan"}
+        ],
+        "raw_log": {
+            "platform": "Azure",
+            "service": "Network Watcher",
+            "timestamp": "2025-09-23T23:10:29.987Z",
+            "event_type": "NetworkSecurityGroupFlowEvent",
+            "properties": {"src_ip": "10.0.0.4", "dest_ip": "10.0.0.0/24", "dest_port_range": "*", "protocol": "TCP"}
+        }
+    },
+    {
+        "source": "Cloud",
+        "cloud_provider": "GCP",
+        "service": "Storage",
+        "rule_id": "CLOUD-GCP-STORAGE-03-Public-Bucket-Access",
+        "rule_name": "公开访问的存储桶",
+        "alert_date": "2025-09-23T23:15:20Z",
+        "tags": ["storage", "misconfiguration", "data-leak"],
+        "severity": "High",
+        "reference": "GCP存储桶被设置为公开可访问",
+        "description": "名为 'mycorp-customer-data' 的 GCP Cloud Storage 存储桶的权限被修改为公开可访问。这可能导致敏感数据泄露。",
+        "artifacts": [
+            {"type": "bucket_name", "value": "mycorp-customer-data"},
+            {"type": "permission_change", "value": "publicAccess: True"},
+            {"type": "user_identity", "value": "api-service-account"}
+        ],
+        "raw_log": {
+            "platform": "GCP",
+            "service": "Cloud Audit Logs",
+            "timestamp": "2025-09-23T23:15:19.444Z",
+            "methodName": "storage.buckets.setIamPolicy",
+            "principalEmail": "api-service-account@mycorp.iam.gserviceaccount.com",
+            "resource": {"type": "storage_bucket", "name": "mycorp-customer-data"}
+        }
+    },
+    {
+        "source": "Cloud",
+        "cloud_provider": "AWS",
+        "service": "IAM",
+        "rule_id": "CLOUD-AWS-IAM-01-Root-User-Activity",
+        "rule_name": "Root账户活动",
+        "alert_date": "2025-09-24T08:30:00Z",
+        "tags": ["iam", "privileged-account", "security-best-practice"],
+        "severity": "High",
+        "reference": "AWS Root账户在新的IP地址登录",
+        "description": "AWS Root账户从一个以前未知的IP地址进行了登录。出于安全最佳实践，Root账户应被锁定且只在紧急情况下使用。",
+        "artifacts": [
+            {"type": "account_id", "value": "123456789012"},
+            {"type": "user_identity", "value": "Root"},
+            {"type": "event_name", "value": "ConsoleLogin"}
+        ],
+        "raw_log": {
+            "platform": "AWS",
+            "service": "CloudTrail",
+            "timestamp": "2025-09-24T08:29:59.123Z",
+            "event_name": "ConsoleLogin",
+            "userIdentity": {"type": "Root"},
+            "sourceIPAddress": "1.2.3.4",
+            "user_agent": "Mozilla/5.0"
+        }
+    },
+    {
+        "source": "Cloud",
+        "cloud_provider": "Azure",
+        "service": "Compute",
+        "rule_id": "CLOUD-AZ-COMPUTE-02-VM-Reconnaissance",
+        "rule_name": "虚拟机内部侦察",
+        "alert_date": "2025-09-24T09:15:45Z",
+        "tags": ["compute", "reconnaissance", "lateral-movement"],
+        "severity": "Medium",
+        "reference": "Azure VM进行内部网络端口扫描",
+        "description": "Azure 虚拟机 'dev-app-02' 突然开始对内部虚拟网络中的其他虚拟机进行大规模端口扫描。这可能表明该虚拟机已被入侵。",
+        "artifacts": [
+            {"type": "vm_name", "value": "dev-app-02"},
+            {"type": "vm_ip", "value": "10.0.1.5"},
+            {"type": "scan_type", "value": "UDP Port Scan"}
+        ],
+        "raw_log": {
+            "platform": "Azure",
+            "service": "Network Watcher",
+            "timestamp": "2025-09-24T09:15:44.765Z",
+            "event_type": "NetworkSecurityGroupFlowEvent",
+            "properties": {"src_ip": "10.0.1.5", "dest_ip": "10.0.1.0/24", "dest_port_range": "*", "protocol": "UDP"}
+        }
+    }
+])
+
+
+def get_mock_alerts() -> list:
+    mock_alerts = []
+    # 汇总所有已定义的各类模拟告警列表
+    all_alert_groups = (
+        edr_alerts,
+        ndr_alert,
+        dlp_alert,
+        mail_alert,
+        ot_alert,
+        proxy_alert,
+        ueba_alert,
+        ti_alert,
+        iam_alert,
+        cloud_alert,
+    )
+
+    for alert_group in all_alert_groups:
+        if isinstance(alert_group, list):
+            mock_alerts.extend(alert_group)
+
+    return mock_alerts
+
+
+if __name__ == "__main__":
+    rule_list = []
+    alerts = get_mock_alerts()
+    for alert in alerts:
+        if alert.get("rule_id") not in rule_list:
+            rule_list.append(alert.get("rule_id"))
+            print(alert.get("rule_id"))
+            print(alert.get("rule_name"))
+            print("----------------")
diff --git a/Mock/rule.py b/Mock/rule.py
new file mode 100644
index 0000000..fcde739
--- /dev/null
+++ b/Mock/rule.py
@@ -0,0 +1,239 @@
+from Lib.ruledefinition import RuleDefinition
+
+rule_list = [
+    RuleDefinition(
+        rule_id="EDR-Rule-11-Suspicious-Process-Spawned-by-Office",
+        rule_name="Office应用启动可疑进程",
+        deduplication_fields=["hostname", "process_name"],
+        source="EDR"
+    ),
+    RuleDefinition(
+        rule_id="EDR-Rule-21-CobaltStrike-Beacon-Detected",
+        rule_name="检测到Cobalt Strike C2 Beacon",
+        deduplication_fields=["hostname"],
+        deduplication_window="1h",
+        source="EDR"
+    ),
+    RuleDefinition(
+        rule_id="EDR-Rule-07-Credential-Dumping-LSASS",
+        rule_name="LSASS内存凭据窃取",
+        deduplication_fields=["hostname", "target_process"],
+        source="EDR"
+    ),
+    RuleDefinition(
+        rule_id="EDR-Rule-01-Suspicious-PowerShell-Execution",
+        rule_name="可疑的PowerShell命令执行",
+        deduplication_fields=["hostname"],
+        deduplication_window="1h",
+        source="EDR"
+    ),
+    RuleDefinition(
+        rule_id="EDR-Rule-02-Unusual-Network-Connection-to-External",
+        rule_name="异常外部网络连接",
+        deduplication_fields=["hostname", "destination_ip"],
+        source="EDR"
+    ),
+    RuleDefinition(
+        rule_id="NDR-Rule-05-Suspect-C2-Communication",
+        rule_name="可疑的命令与控制（C2）通信",
+        deduplication_fields=["hostname"],
+        source="NDR"
+    ),
+    RuleDefinition(
+        rule_id="NDR-Rule-12-Lateral-Movement-Attempt",
+        rule_name="主机到主机的横向移动尝试",
+        deduplication_fields=["hostname", "destination_ip"],
+        deduplication_window="1h",
+        source="NDR"
+    ),
+    RuleDefinition(
+        rule_id="NDR-Rule-15-Unauthorized-Data-Exfiltration",
+        rule_name="异常数据外泄",
+        deduplication_fields=["hostname", "data_volume"],
+        source="NDR"
+    ),
+    RuleDefinition(
+        rule_id="NDR-Rule-01-C2-Beaconing",
+        rule_name="C2 信标（Beaconing）流量",
+        deduplication_fields=["hostname", "destination_ip"],
+        deduplication_window="1h",
+        source="NDR"
+    ),
+    RuleDefinition(
+        rule_id="NDR-Rule-02-Internal-Port-Scan",
+        rule_name="内部端口扫描",
+        deduplication_fields=["source_ip", "scan_type"],
+        source="NDR"
+    ),
+    RuleDefinition(
+        rule_id="DLP-Rule-08-Financial-Record-Transfer-to-USB",
+        rule_name="财务记录传输到可移动设备",
+        deduplication_fields=["hostname", "username"],
+        source="DLP"
+    ),
+    RuleDefinition(
+        rule_id="DLP-Rule-09-Source-Code-Upload-to-Pastebin",
+        rule_name="源代码上传到公共网站",
+        deduplication_fields=["hostname", "username"],
+        deduplication_window="1h",
+        source="DLP"
+    ),
+    RuleDefinition(
+        rule_id="DLP-Rule-10-Health-Information-Transfer",
+        rule_name="受保护健康信息（PHI）传输",
+        deduplication_fields=["hostname", "username", "data_classification"],
+        source="DLP"
+    ),
+    RuleDefinition(
+        rule_id="DLP-Rule-11-Leaked-API-Key-in-Code",
+        rule_name="API密钥泄露",
+        deduplication_fields=["hostname", "username", "repository"],
+        source="DLP"
+    ),
+    RuleDefinition(
+        rule_id="DLP-Rule-12-Internal-SSN-Transfer",
+        rule_name="",
+        deduplication_fields=["hostname", "username"],
+        deduplication_window="1h",
+        source="DLP"
+    ),
+    RuleDefinition(
+        rule_id="ES-Rule-01-Phishing-URL-Detected",
+        rule_name="邮件中检测到钓鱼URL",
+        deduplication_fields=["sender_email"],
+        source="Email"
+    ),
+    RuleDefinition(
+        rule_id="ES-Rule-02-Malicious-Attachment-Detected",
+        rule_name="邮件中检测到恶意附件",
+        deduplication_fields=["sender_email"],
+        source="Email"
+    ),
+    RuleDefinition(
+        rule_id="ES-Rule-03-BEC-Spoofing-CEO",
+        rule_name="商业邮件欺诈（BEC）- 冒充CEO",
+        deduplication_fields=["sender_email", "subject"],
+        source="Email"
+    ),
+    RuleDefinition(
+        rule_id="ES-Rule-04-Credential-Phishing-Page",
+        rule_name="凭据钓鱼页面链接",
+        deduplication_fields=["sender_email", "subject"],
+        deduplication_window="10m",
+        source="Email"
+    ),
+    RuleDefinition(
+        rule_id="ES-Rule-05-Fileless-Malware-Detected",
+        rule_name="邮件中检测到无文件恶意软件",
+        deduplication_fields=["sender_email"],
+        source="Email"
+    ),
+    RuleDefinition(
+        rule_id="OT-Rule-01-PLC-Configuration-Change",
+        rule_name="PLC配置未经授权修改",
+        deduplication_fields=["device_id"],
+        source="OT"
+    ),
+    RuleDefinition(
+        rule_id="OT-Rule-02-Unusual-Protocol-Activity",
+        rule_name="SCADA网络中可疑协议活动",
+        deduplication_fields=["source_device"],
+        source="OT"
+    ),
+    RuleDefinition(
+        rule_id="OT-Rule-03-Controller-Stop-Command",
+        rule_name="控制器收到停止命令",
+        deduplication_fields=["device_id"],
+        source="OT"
+    ),
+    RuleDefinition(
+        rule_id="PROXY-Rule-01-Malware-Download-Blocked",
+        rule_name="阻止恶意软件下载",
+        deduplication_fields=["source_ip"],
+        source="Proxy"
+    ),
+    RuleDefinition(
+        rule_id="PROXY-Rule-02-C2-Communication-Blocked",
+        rule_name="阻止C2通信",
+        deduplication_fields=["source_ip"],
+        source="Proxy"
+    ),
+    RuleDefinition(
+        rule_id="PROXY-Rule-03-Phishing-URL-Detected",
+        rule_name="访问钓鱼网站被阻止",
+        deduplication_fields=["source_ip"],
+        source="Proxy"
+    ),
+    RuleDefinition(
+        rule_id="UEBA-Rule-01-Lateral-Movement-Spike",
+        rule_name="夜间异常横向移动",
+        deduplication_fields=["username"],
+        source="UEBA"
+    ),
+    RuleDefinition(
+        rule_id="UEBA-Rule-02-Unusual-Data-Volume-Download",
+        rule_name="非正常数据外发量",
+        deduplication_fields=["username", "data_destination"],
+        source="UEBA"
+    ),
+    RuleDefinition(
+        rule_id="UEBA-Rule-03-Account-Brute-Force-Multiple-Sources",
+        rule_name="多源账户暴力破解",
+        deduplication_fields=["target_username"],
+        source="UEBA"
+    ),
+    RuleDefinition(
+        rule_id="TI-Rule-01-Malicious-IP-Inbound",
+        rule_name="来自恶意IP的入站连接",
+        deduplication_fields=["destination_ip"],
+        source="TI"
+    ),
+    RuleDefinition(
+        rule_id="TI-Rule-02-C2-Domain-Outbound",
+        rule_name="内部主机尝试连接C2域名",
+        deduplication_fields=["destination_domain"],
+        source="TI"
+    ),
+    RuleDefinition(
+        rule_id="TI-Rule-03-Malicious-File-Hash-Match",
+        rule_name="内部文件哈希匹配恶意情报",
+        deduplication_fields=["hostname"],
+        source="TI"
+    ),
+    RuleDefinition(
+        rule_id="IAM-Rule-01-Excessive-Permission-Grant",
+        rule_name="账户权限异常提升",
+        deduplication_fields=["username", "platform"],
+        source="IAM"
+    ),
+    RuleDefinition(
+        rule_id="IAM-Rule-02-Impossible-Travel-Login",
+        rule_name="异地登录（不可能行程）",
+        deduplication_fields=["username"],
+        source="IAM"
+    ),
+    RuleDefinition(
+        rule_id="IAM-Rule-03-Brute-Force-Attack-Password-Spraying",
+        rule_name="多账户密码喷洒攻击",
+        deduplication_fields=["source_ip"],
+        source="IAM"
+    ),
+    RuleDefinition(
+        rule_id="CLOUD-AWS-IAM-01-Root-User-Activity",
+        rule_name="Root账户活动",
+        deduplication_fields=["platform", "service"],
+        source="Cloud"
+    ),
+    RuleDefinition(
+        rule_id="CLOUD-AZ-COMPUTE-02-VM-Reconnaissance",
+        rule_name="虚拟机内部侦察",
+        deduplication_fields=["vm_name", "vm_ip"],
+        source="Cloud"
+    ),
+    RuleDefinition(
+        rule_id="CLOUD-GCP-STORAGE-03-Public-Bucket-Access",
+        rule_name="公开访问的存储桶",
+        deduplication_fields=["bucket_name"],
+        source="Cloud"
+    ),
+]