SDK and SDK Licensing details for the app
cachetools
This app uses the cachetools module, which is licensed under the MIT License (MIT), Copyright (c) 2014-2020 Thomas Kemmer.
google-api-python-client
This app uses the google-api-python-client module, which is licensed under the Apache Software License (Apache 2.0), Copyright (c) Google LLC.
google-auth
This app uses the google-auth module, which is licensed under the Apache Software License (Apache 2.0), Copyright (c) Google Cloud Platform.
google-auth-httplib2
This app uses the google-auth-httplib2 module, which is licensed under the Apache Software License (Apache 2.0), Copyright (c) Google Cloud Platform.
google-auth-oauthlib
This app uses the google-auth-oauthlib module, which is licensed under the Apache Software License (Apache 2.0), Copyright (c) Google Cloud Platform.
httplib2-wheel
This app uses the httplib2-wheel module, which is licensed under the MIT License (MIT), Copyright (c) Joe Gregorio.
oauthclient
This app uses the oauthclient module, which is licensed under the Apache Software License (Apache 2.0), Copyright (c) Google Inc.
pyasn
This app uses the pyasn module, which is licensed under the MIT License (MIT), Copyright (c) Hadi Asghari.
pyasn-modules
This app uses the pyasn-modules module, which is licensed under the BSD License (BSD-2-Clause), Copyright (c) Ilya Etingof.
rsa-wheel
This app uses the rsa-wheel module, which is licensed under the Apache Software License (ASL 2), Copyright (c) Sybren A. Stuvel.
uritemplate-wheel
This app uses the uritemplate-wheel module, which is licensed under the OSI Approved, Apache Software License, BSD License (BSD 3-Clause License or Apache License, Version 2.0), Copyright (c) Ian Stapleton Cordasco.
Explanation of the Asset Configuration Parameters
The asset configuration parameters affect [test connectivity] and all the other actions of the application. Below are the explanation and usage of all these parameters.
-
Base URL: The URL used to connect with the Chronicle server. It represents the Chronicle platform's API base URL. Example: https://backstory.googleapis.com
The user should not include the API version in this parameter as it would get overridden with the specific API versions for the respective actions. The API versions used for each of the actions are specified in this section.
-
Contents of Service Account JSON File: This file contents will be used to authenticate with the Google APIs.
-
Scope: ["https://www.googleapis.com/auth/chronicle-backstory"]
-
Number of Retries: The value of this parameter defines the number of attempts for which the action will keep on retrying if the Chronicle API continuously returns the HTTP 429 (RESOURCE_EXHAUSTED) error. If the error gets eliminated before the number of retries gets exhausted, then, the action execution will continue along its workflow with the next set of API calls and if the error is still persistent and all the number of retries are exhausted, then, the action will fail with the latest error message being displayed.
-
Retry Wait Period (in seconds): The value of this parameter defines the waiting period in seconds for which to hold the current execution of the action on receiving the HTTP 429 (RESOURCE_EXHAUSTED) error and then, retry the same API call after the waiting period is exhausted. This ensures that the integration provides a mechanism of attempting to overcome the HTTP 429 (RESOURCE_EXHAUSTED) error.
Service account
This app requires a pre-configured service account to operate. Please follow the procedure outlined at this link to create a service account. At the end of the creation process, the admin console should ask you to save the config as a JSON file. Copy the contents of the JSON file in the clipboard and paste it as the value of the "Contents of Service Account JSON file" asset configuration parameter.
Or else
Your Customer Experience Engineer (CEE) will provide you with a Google Developer Service Account Credential to enable the Google API client to communicate with the Chronicle API. Copy the contents of the JSON file in the clipboard and paste it as the value of the "Contents of Service Account JSON file" asset configuration parameter.
For more details visit the below-listed links:
Creating a service account
Understanding service accounts
API Versions used in the actions
Search API
- This API uses /v1 endpoint. The actions using this API are as follows:
- List Alerts
- List Assets
- List Events
- List IoCs
- List IoC Details
- Domain Reputation
- IP Reputation
Detection Engine API
- This API uses /v2 endpoint. The actions using this API are as follows:
- List Rules
- List Detections
Explanation of the Chronicle Actions' Parameters
Test Connectivity (Action Workflow Details)
- This action will test the connectivity of the Phantom server to the Chronicle instance by making an initial API call to the ListIoCs endpoint using the provided asset configuration parameters.
- The action validates the provided asset configuration parameters. Based on the API call response, the appropriate success and failure message will be displayed when the action gets executed.
- Note:
- There are a total of 8 reputation-related asset configuration parameters and 7 on poll action-related asset configuration parameters that are not validated while running test connectivity for optimum performance and are only validated in their respective actions. You can find more details about these parameters in their respective section of the action.
List Assets
- Action Parameter: Artifact Indicator
- The Artifact Indicator parameter enables search by selecting anyone from given artifact indicators.
- Valid Values:
- Domain Name
- Destination IP Address
- MD5 File Hash
- SHA1 File Hash
- SHA256 File Hash
- Action Parameter: Value
- The user can provide artifact value into the Value action parameter.
- Action Parameter: Time Range
- This parameter will be used for specifying the time range of the search.
- User can provide time using this '<digit><d/h/m/s>' time format. Here, d = Day, h = Hour, m = Minutes, and s = Seconds.
- Note: The Start time and End time will be calculated using the specified time range. The end time will be present time and according to the specified time range, the start time will be calculated for the search.
- Action Parameters: Start Time and End Time
- These parameters will be used for specifying the time range of the search.
- Users can provide time using this 'yyyy-MM-ddTHH:mm:ssZ' time format. Here, y=Year, M=Month, d=Day, H=Hour, m=Minutes, s=Seconds.
- Note: The number of returned assets can be reduced over a shorter period using these parameters.
- Action Parameter: Limit
- This parameter is used to limit the number of assets results to return.
- The user can specify between 1 and 10,000. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 assets results.
- Note:
- If the user doesn’t provide any of the time-related action parameters, the action will perform a search for the last three days.
- If the user provides [Time Range] and other time-related action parameters, the priority will be given to the [Time Range] action parameter and the search will be performed according to its given value.
- Example:
- Get a list of assets that accessed the specified domain artifact
- Artifact Indicator = Domain Name
- Value = wp.com
- Start Time = 1970-01-01T00:00:00Z
- End Time = 1970-01-10T00:00:00Z
- Fetch assets results for the IP artifact for the last three days (Here, the Present time is 2020-01-03T00:00:00Z)
- Artifact Indicator = Destination IP Address
- Value = <IP_ADDRESS>
- Time Range = 3d
- Filtering assets results based on the specifying time range for the IP artifact
- Artifact Indicator = Destination IP Address
- Value = <IP_ADDRESS>
- Start Time = 1970-01-01T00:00:00Z
- End Time = 1970-01-05T00:00:00Z
List Alerts
- Action Parameter: Time Range
- This parameter will be used for specifying the time range of the search.
- User can provide time using this '<digit><d/h/m/s>' time format. Here, d = Day, h = Hour, m = Minutes, and s = Seconds.
- Note: The Start time and End time will be calculated using the specified time range. The end time will be present time and according to the specified time range, the start time will be calculated for the search.
- Action Parameters: Start Time and End Time
- These parameters will be used for specifying the time range of the search.
- Users can provide time using this 'yyyy-MM-ddTHH:mm:ssZ' time format. Here, y=Year, M=Month, d=Day, H=Hour, m=Minutes, s=Seconds.
- Note: The number of returned alerts can be reduced over a shorter period using these parameters.
- Action Parameter: Limit
- This parameter is used to limit the number of alerts results to return.
- The user can specify between 1 and 10,000. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 alerts results.
- Action Parameter: Alert Type
- This parameter will be used to fetch alerts of a particular type. Its default value is 'All'.
- Valid Values:
- Asset Alerts
- User Alerts
- All
- Note:
- If the user doesn’t provide any of the time-related action parameters, the action will perform a search for the last three days.
- If the user provides [Time Range] and other time-related action parameters, the priority will be given to the [Time Range] action parameter and the search will be performed according to its given value.
- If the Alert Type is selected to 'All' then, based on the selected type, the limit parameter will result in fetching those many (or less if not that many asset alerts present) asset alerts as well as those many (or less if not that many user alerts present) user alerts in the output. But due to the known API limitation, the results returned by the API for the asset and user alerts are not consistent with the provided page_size attribute in the API call.
- Due to the above-mentioned API limitation, the number of asset alerts being returned (when the selected Alert Type is 'Asset Alerts' or 'All') and the number of user alerts being returned (when the selected Alert Type is 'User Alerts' or 'All') will be inconsistent with the Limit action parameter, i.e., the user can receive less or more number of alerts than the specified limit.
- Example:
- Get a list of security alerts for the last three days (Here, the Present time is 2020-01-03T00:00:00Z)
- Get a list of security alerts for the specified time
- Start Time= 2019-01-01T00:00:00Z
- End Time= 2020-01-01T00:00:00Z
- Get a list of all alerts for the default time range, i.e., last three days
- Alert Type= All
- Limit= 50
List Events
- Action Parameter: Asset Indicator
- The Asset Indicator parameter enables search by selecting anyone from given asset indicators.
- Valid Values:
- Hostname
- Asset IP Address
- MAC Address
- Product ID
- Action Parameter: Value
- The user can provide asset value into the Value action parameter.
- Action Parameter: Time Range
- This parameter will be used for specifying the time range of the search.
- User can provide time using this '<digit><d/h/m/s>' time format. Here, d = Day, h = Hour, m = Minutes, and s = Seconds.
- Note: The Start time and End time will be calculated using the specified time range. The end time will be present time and according to the specified time range, the start time will be calculated for the search.
- Action Parameters: Start Time and End Time
- These parameters will be used for specifying the time range of the search. The user specifies the time for the asset you are investigating using the reference time action parameter
- Users can provide time using this 'yyyy-MM-ddTHH:mm:ssZ' time format. Here, y=Year, M=Month, d=Day, H=Hour, m=Minutes, s=Seconds.
- Note: The number of returned events can be reduced over a shorter period using these parameters.
- Action Parameter: Limit
- This parameter is used to limit the number of events results to return.
- The user can specify between 1 and 10,000. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 events results.
- Note:
- If the user doesn’t provide any of the time-related action parameters, the action will perform a search for the last three days.
- If the [Reference Time] action parameter is not given, the action will consider the start time as reference time. And if the value is given for it, the value will be validated and used in the search request.
- If the user provides [Time Range] and other time-related action parameters, the priority will be given to the [Time Range] action parameter and the search will be performed according to its given value.
- Example:
- Get a list of events discovered on the specified Hostname asset
- Asset Indicator = Hostname
- Value = franklin-guzman-laptop
- Start Time = 2019-11-01T20:37:00Z
- End Time = 2019-11-02T20:37:00Z
- Reference Time = 2019-11-02T20:37:00Z
- Filtering events results for the specified Asset IP Address for the last three days (Here, the Present time is 2020-01-03T00:00:00Z)
- Asset Indicator = Asset IP Address
- Value = <IP_ADDRESS>
- Time Range = 3d
- Filtering events results based on the specifying time range for the specified Asset IP Address.
- Asset Indicator = Asset IP Address
- Value = <IP_ADDRESS>
- Start Time = 2019-01-01T00:00:00Z
- End Time = 2020-01-01T00:00:00Z
- Reference Time = 2020-01-01T00:00:00Z
List IoCs
- Action Parameter: Time Range
- This parameter will be used for specifying the time range of the search.
- User can provide time using this '<digit><d/h/m/s>' time format. Here, d = Day, h = Hour, m = Minutes, and s = Seconds.
- Note: The Start time and End time will be calculated using the specified time range. The end time will be present time and according to the specified time range, the start time will be calculated for the search.
- Action Parameters: Start Time
- This parameter will be used for specifying the start time of the search.
- Users can provide time using this 'yyyy-MM-ddTHH:mm:ssZ' time format. Here, y=Year, M=Month, d=Day, H=Hour, m=Minutes, s=Seconds.
- Note: IoCs returned by this method are the IoCs that were discovered by Chronicle within the specified time range in the enterprise environment. There might be IoCs within your data that were present prior to their discovery by the Chronicle.
- Action Parameter: Limit
- This parameter is used to limit the number of IoCs results to return.
- The user can specify between 1 and 10,000. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 IoCs results.
- Note:
- If the user doesn’t provide any of the time-related action parameters, the action will perform a search for the last three days.
- If the user provides [Time Range] and other time-related action parameters, the priority will be given to the [Time Range] action parameter and the search will be performed according to its given value.
- Example:
- Get a list of all of the possible IoC discovered within the enterprise for the last three days (Here, the Present time is 2020-01-03T00:00:00Z)
- Get a list of all of the possible IoC discovered within the enterprise starting from the specified time.
- Start Time= 2019-01-01T00:00:00Z
List IoC Details
- Action Parameter: Artifact Indicator
- The Artifact Indicator parameter enables search by selecting anyone from given artifact indicators.
- Valid Values:
- Domain Name
- Destination IP Address
- Action Parameter: Value
- The user can provide artifact value into the Value action parameter.
- Example:
- Fetch threat intelligence associated with the specific domain artifact
- Artifact Indicator = Domain Name
- Value = wp.com
- Fetch threat intelligence associated with the specific IP artifact
- Artifact Indicator = Destination IP Address
- Value = <IP_ADDRESS>
Domain Reputation
- Reputation Decision Algorithm
- There is a total of 8 asset configuration parameters that will use in this algorithm. These parameter values will be used for deriving anyone of reputation from 'Malicious', 'Suspicious', and 'Unknown' for the specified artifact. Chronicle provides details about the Domain/IP which includes Categories, Severity, and Confidence Score. The reputation calculation can be controlled using these 3 properties. Here, 'Malicious' reputation has higher priority over 'Suspicious' reputation which means if any of the details of the sources of the retrieved domain IoC from search falls under the 'Malicious' criteria, then, reputation will be defined as 'Malicious' and won’t check for the 'Suspicious' criteria. If the retrieved IoC doesn’t fall under any one of the criteria configured for 'Malicious' and 'Suspicious', then, reputation will be derived as 'Unknown'.
- Action Parameter: Domain Name
- This parameter will be used to specify the value of the domain artifact for search. It is a required action parameter.
- Asset Configuration Parameters: Malicious categories for reputation, Malicious severity for reputation, Malicious Str Confidence score for reputation, and Malicious Int Confidence score for reputation
- These parameters will be used for deriving the 'Malicious' reputation for the specified artifact. Chronicle provides details about the IoC which includes Categories, Severity, and Confidence Score. The reputation calculation can be controlled using these 3 properties. Using the values of these parameters, if any of the details of the sources of retrieved domain IoC from search falls under these values, then, reputation will be derived as a 'Malicious'. You can identify this in the action output data path as this action will set the value of reputation datapath to 'Malicious'.
- Asset Configuration Parameters: Suspicious categories for reputation, Suspicious severity for reputation, Suspicious Str Confidence score for reputation, and Suspicious Int Confidence score for reputation
- These parameters will be used for deriving the 'Suspicious' reputation for the specified artifact. Chronicle provides details about the IoC which includes Categories, Severity, and Confidence Score. The reputation calculation can be controlled using these 3 properties. Using the values of these parameters, if any of the details of the sources of retrieved domain IoC from search falls under these values, then, reputation will be derived as a 'Suspicious'. You can identify this in the action output data path as this action will set the value of reputation datapath to 'Suspicious'.
- Note:
- Using the values of asset configuration parameters, if retrieved IoC from search does not fall under any of the values, then, reputation will be derived as an 'Unknown'. You can identify this in the action output data path as this action will set the value of reputation datapath to 'Unknown'.
- If the user doesn’t configure any values for these asset configuration parameters, reputation will be derived as an 'Unknown'.
- If the search will not retrieve any of the sources for a specified domain artifact, then, reputation will be derived as an 'Unknown'.
- Here, 'Malicious' reputation has higher priority over 'Suspicious' reputation which means if any of the details of the sources of the retrieved domain IoC from search falls under the 'Malicious' criteria, then, reputation will be defined as 'Malicious' and won't check for the 'Suspicious' criteria.
- Example:
- Derive reputation of threat intelligence associated with the specific domain artifact
- Domain Name = wp.com (Action parameter)
- Malicious severity for reputation = [“High”, “Medium”] (Asset configuration parameter)
Sample response for this search:
{"sources":[{"sourceUrl": "........","confidenceScore": {"strRawConfidenceScore": "30"},"rawSeverity": "Medium","category": ".......","addresses": [......],.....}]}
Reputation will be defined as ‘Malicious’ as retrieved IoC from search has ‘Medium’ rawSeverity in its sources.
IP Reputation
- Reputation Decision Algorithm
- There is a total of 8 asset configuration parameters that will use in this algorithm. These parameter values will be used for deriving anyone of reputation from 'Malicious', 'Suspicious', and 'Unknown' for the specified artifact. Chronicle provides details about the Domain/IP which includes Categories, Severity, and Confidence Score. The reputation calculation can be controlled using these 3 properties. Here, 'Malicious' reputation has higher priority over 'Suspicious' reputation which means if any of the details of the sources of the retrieved IP IoC from search falls under the 'Malicious' criteria, then, reputation will be defined as 'Malicious' and won’t check for the 'Suspicious' criteria. If the retrieved IoC doesn’t fall under any one of the criteria configured for 'Malicious' and 'Suspicious', then, reputation will be derived as 'Unknown'.
- Action Parameter: Destination IP Address
- This parameter will be used to specify the value of the IP artifact for search. It is a required action parameter.
- Asset Configuration Parameters: Malicious categories for reputation, Malicious severity for reputation, Malicious Str Confidence score for reputation, and Malicious Int Confidence score for reputation
- These parameters will be used for deriving the 'Malicious' reputation for the specified artifact. Chronicle provides details about the IoC which includes Categories, Severity, and Confidence Score. The reputation calculation can be controlled using these 3 properties. Using the values of these parameters, if any of the details of the sources of retrieved IP IoC from search falls under these values, then, reputation will be derived as a 'Malicious'. You can identify this in the action output data path as this action will set the value of reputation datapath to 'Malicious'.
- Asset Configuration Parameters: Suspicious categories for reputation, Suspicious severity for reputation, Suspicious Str Confidence score for reputation, and Suspicious Int Confidence score for reputation
- These parameters will be used for deriving the 'Suspicious' reputation for the specified artifact. Chronicle provides details about the IoC which includes Categories, Severity, and Confidence Score. The reputation calculation can be controlled using these 3 properties. Using the values of these parameters, if any of the details of the sources of retrieved IP IoC from search falls under these values, then, reputation will be derived as a 'Suspicious'. You can identify this in the action output data path as this action will set the value of reputation datapath to 'Suspicious'.
- Note:
- Using the values of asset configuration parameters, if retrieved IoC from search does not fall under any of the values, then, reputation will be derived as an 'Unknown'. You can identify this in the action output data path as this action will set the value of reputation datapath to 'Unknown'.
- If the user doesn’t configure any values for these asset configuration parameters, reputation will be derived as an 'Unknown'.
- If the search will not retrieve any of the sources for specified IP artifact, then, reputation will be derived as an 'Unknown'.
- Here, 'Malicious' reputation has higher priority over 'Suspicious' reputation which means if any of the details of the sources of the retrieved IP IoC from search falls under the 'Malicious' criteria, then, reputation will be defined as 'Malicious' and won't check for the 'Suspicious' criteria.
- Example:
- Derive reputation of threat intelligence associated with the specific domain artifact
- Destination IP Address = <IP_ADDRESS> (Action parameter)
- Suspicious Int Confidence Score Range for Reputation = 10,30 (Asset configuration parameter)
Sample response for this search:
{"sources":[{"sourceUrl": "........","confidenceScore": {"strRawConfidenceScore": "21"},"rawSeverity": "Low","category": "........","addresses": [......],.....}]}
Reputation will be defined as 'Suspicious' as retrieved IoC from search has 21 strRawConfidenceScore in its sources which lies between the 10 and 30.
List Rules
- Action Parameter: Limit
- This parameter will be used to limit the number of rules to return.
- The user can specify a valid non-zero integer. The default value is 1000. If the limit is not provided, it will fetch by default 1000 rules.
- Example:
- Get a list of 200 rules within the enterprise.
List Detections
- Action Parameter: Rule ID(s)
- This parameter will be used for specifying the comma-separated rule ID(s) of which the detections will be fetched.
- The user can specify rule ID(s) as a comma-separated list. The rule ID(s) can be provided with or without version ID appended to it.
- Action Parameter: Alert State
- This parameter will be used for specifying whether to filter the detections based on whether they are ALERTING or NOT_ALERTING. Its default value is ALL.
- Valid Values:
- ALERTING
- NOT_ALERTING
- ALL
- Action Parameter: Time Range
- This parameter will be used for specifying the time range of the search.
- User can provide time using this '<digit><d/h/m/s>' time format. Here, d = Day, h = Hour, m = Minutes, and s = Seconds.
- Note: The Start time and End time will be calculated using the specified time range. The end time will be present time and according to the specified time range, the start time will be calculated for the search.
- Action Parameters: Start Time and End Time
- These parameters will be used for specifying the time range of the search.
- Users can provide time using this 'yyyy-MM-ddTHH:mm:ssZ' time format. Here, y=Year, M=Month, d=Day, H=Hour, m=Minutes, s=Seconds.
- Note: The number of returned detections can be reduced over a shorter period using these parameters.
- Action Parameter: Limit
- This parameter is used to limit the number of detections to return per rule ID.
- The user can specify a valid non-zero integer. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 detections.
- Note:
- If the user doesn’t provide any of the time-related action parameters, the action will perform a search for the last three days.
- If the user provides [Time Range] and other time-related action parameters, the priority will be given to the [Time Range] action parameter and the search will be performed according to its given value.
- Due to the API limitation, the action may encounter an HTTP 429 (RESOURCE_EXHAUSTED) error for the Rule ID(s) with a large number of detections. These Rule ID(s) will be stored in the action_result.data.*.rule_ids_with_partial_detections.*.rule_id datapath. The partially fetched detections will be displayed in the action output.
- Example:
- Get a list of 200 detections of ALERTIING type for the ruleId, ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d, discovered within the enterprise for the last three days.
- Rule IDs= ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d
- Alert State= ALERTING
- Time Range= 3d
- Limit= 200
- Get a list of 100 detections of NOT_ALERTIING type for the ruleIds, ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d and ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d@v_1605892822_687503000, discovered within a specified Start Time and End Time.
- Rule IDs= ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d, ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d@v_1605892822_687503000
- Alert State= NOT_ALERTIING
- Start Time= 2019-11-01T20:37:00Z
- End Time= 2021-02-01T20:37:00Z
- Limit= 100
On Poll
What is On Poll
- It will ingest data from the external system into the phantom server in the form of containers and artifacts. There are two approaches to polling which are mentioned below.
- POLL NOW (Manual polling)
-
It will fetch the data every time as per the corresponding asset configuration parameters. It doesn’t store the last run context of the fetched data. The corresponding asset configuration parameters for the POLL NOW are the Time range for POLL NOW, Max results for POLL NOW.
- Scheduled/Interval Polling
- Scheduled Polling: The ingestion action can be triggered at every specified timestamp interval.
- Interval Polling: The ingestion action can be triggered at every time range interval.
- It will fetch the data every time as per the corresponding asset configuration parameters based on the stored context from the previous ingestion run. It stores the last run context of the fetched data. It starts fetching data based on the combination of the values of stored context for the previous ingestion run and the corresponding asset configuration parameters having higher priority. The corresponding asset configuration parameters for the scheduled/interval polling are the Start time for scheduled/interval POLL, Max results for scheduled/interval POLL.
Containers and Artifacts creation
-
We have configured eight ingestion run modes which you can select from the [Ingestion Run Mode] asset configuration parameters. Below are the eight modes
- IoC Domain Matches: It will ingest only the domain IoCs discovered within the enterprise.
- Assets with Alerts: It will ingest only the 3rd party security asset alerts tracked within the enterprise.
- User Alerts: It will ingest only the 3rd party security user alerts tracked within the enterprise.
- All Alerts: It will ingest only the 3rd party security alerts (asset alerts and security alerts) tracked within the enterprise.
- Alerting Detections: It will ingest only the alerting detections, for the specified Rule ID(s), tracked within the enterprise.
- Not-alerting Detections: It will ingest only the not-alerting detections, for the specified Rule ID(s), tracked within the enterprise.
- All Detections: It will ingest all the detections (alerting and not-alerting), for the specified Rule ID(s), tracked within the enterprise.
- All: It will ingest all the 3rd party security asset alerts, user alerts, alerting detections, not_alerting detections and domain IoCs tracked/discovered within the enterprise.
- Container
-
A container is a composite object that consists of one or more artifacts that can be automated. Containers are the top-level data structure that Playbooks operate on. Every container has a common header, and beneath that, the ability to store arbitrary less structured JSON.
- Artifacts
-
Artifacts are objects that are associated with a Container and serve as corroboration or evidence related to the Container.
- For the security alerts (asset alerts and user alerts), IoCs and detections (Alerting and Not-alerting) data which we are fetching will be ingested in the form of groups of entities(five groups; one for each of the ingestion run mode) with the group getting created as a container and entities getting created as artifacts in the respective container. Below is the explanation based on the ingestion run mode for that.
- IoC Domain Matches
In this mode, one container will be created for the domain IoC matches.
- Container 1 :- IoC Domain Matches - creation_timestamp
- This container will be used to store fetched IOC data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. IoC Domain Matches - 2019-01-01T00:00:00Z.
- Assets with Alerts
In this mode, one container will be created for 3rd party security asset alerts.
- Container 1 :- Asset with Alerts - creation_timestamp
- This container will be used to store fetched security asset alerts data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Asset with Alerts - 2019-01-01T00:00:00Z.
- User Alerts
In this mode, one container will be created for 3rd party security user alerts.
- Container 1 :- User Alerts - creation_timestamp
- This container will be used to store fetched security user alerts data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. User Alerts - 2019-01-01T00:00:00Z.
- Alerting Detections
In this mode, one container will be created for the detections having alertState as 'ALERTING'.
- Container 1 :- Alerting Detections - creation_timestamp
- This container will be used to store fetched alerting detections data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Alerting Detections - 2019-01-01T00:00:00Z.
- Not-alerting Detections
In this mode, one container will be created for the detections having alertState as 'NOT_ALERTING'.
- Container 1 :- Not-alerting Detections - creation_timestamp
- This container will be used to store fetched alerting detections in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Not-alerting Detections - 2019-01-01T00:00:00Z.
- All Alerts
For this mode, two containers will be created for each type of data. One container will be created for the security asset alerts data and another container will be created for the security user alerts.
- Container 1 :- Assets with Alerts - creation_timestamp
- This container will be used to store fetched security asset alerts data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Asset with Alerts - 2019-01-01T00:00:00Z.
- Container 2 :- User Alerts - creation_timestamp
- This container will be used to store fetched security user alerts data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. User Alerts - 2019-01-01T00:00:00Z.
- All Detections
For this mode, two containers will be created for each type of data. One container will be created for the Alerting Detections and another container will be created for the Not-alerting Detections.
- Container 1 :- Alerting Detections - creation_timestamp
- This container will be used to store fetched alerting detections data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Alerting Detections - 2019-01-01T00:00:00Z.
- Container 2 :- Not-alerting Detections - creation_timestamp
- This container will be used to store fetched not-alerting detections in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Not-alerting Detections - 2019-01-01T00:00:00Z.
- All
For this mode, five containers will be created for each type of data.
- Container 1 :- IoC Domain Matches - creation_timestamp
- This container will be used to store fetched IoC data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. IoC Domain Matches - 2019-01-01T00:00:00Z.
- Container 2 :- Asset with Alerts - creation_timestamp
- This container will be used to store fetched security asset alerts data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Asset with Alerts - 2019-01-01T00:00:00Z.
- Container 3 :- User Alerts - creation_timestamp
- This container will be used to store fetched security user alerts data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. User Alerts - 2019-01-01T00:00:00Z.
- Container 4 :- Alerting Detections - creation_timestamp
- This container will be used to store fetched alerting detections data in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Alerting Detections - 2019-01-01T00:00:00Z.
- Container 5 :- Not-alerting Detections - creation_timestamp
- This container will be used to store fetched not-alerting detections in the form of artifacts. The container will be saved with a creation timestamp in its name e.g. Not-alerting Detections - 2019-01-01T00:00:00Z.
- To make ingested data more manageable in the containers and artifacts, we have provided the configuration parameter to specify the maximum allowed artifacts in the single container. I.e. [Max allowed artifacts in a single container]
Stored Context
-
It is the concept of storing the context of the previous ingestion run. This concept will be used in the scheduled/interval polling. It will use the state file to store the last run context. This state file will be created for the created asset for the application on the phantom platform.
- State file location:
- For non-NRI Instances: /opt/phantom/local_data/app_states/8925dbb5-abe1-4e5d-b053-326e35e1e194
- For NRI Instances: /home/phanru/phantomcyber/local_data/app_states/8925dbb5-abe1-4e5d-b053-326e35e1e194
- The default format of state file: {"app_version": "2.0.0"}
Parameters
- Manual Polling - Poll Now
It will fetch the data every time as per the corresponding asset configuration parameters. It doesn’t store the last run context of the fetched data. The corresponding asset configuration parameters for the POLL NOW are the [Time range for POLL NOW], [Max results for POLL NOW].
- Asset Configuration Parameter - Time range for POLL NOW
This is an optional parameter. This parameter will be used to specify the time range for the search in the manual polling. Possible values format: 'start_time, end_time' or <digit><d/h/m/s> or 'start_time' where d = Day, h = Hour, m = Minutes, and s = Seconds. If the value is not given, the value will be considered as 3d(means the last three days).
- Format 1 - 'start_time, end_time'
-
Using this format you can provide start time and end time both for a specified time. You can provide time using this 'yyyy-MM-ddTHH:mm:ssZ' time format. Here, y=Year, M=Month, d=Day, H=Hour, m=Minutes, s=Seconds.
E.g. 2020-03-20T00:00:00Z, 2020-06-20T00:00:00Z
- Format 2 - <digit><d/h/m/s>
-
Using this format you can informally provide a time. For example, 3d = 3 Days, 3m = 3 Minutes. The Start time and End time will be calculated using the specified value. The end time will be present time and according to the specified time range, the start time will be calculated for the search.
E.g. 10d
- Format 3 - 'start_time'
-
Using this format you can provide start time only. The end time will be considered as the present time.
E.g. 2020-03-20T00:00:00Z
- Asset Configuration Parameter - Max results for POLL NOW
This is an optional parameter. This parameter is used to specify the maximum number of results to return from API calls in the manual polling. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 results.
Example:
- Run the manual poll for 'All' ingestion run mode for the last ten days.
- Time range for POLL NOW = 10d
- Max results for POLL NOW = 10000
- Ingestion Run Mode = All
- Scheduled/Interval Polling
It will fetch the data every time as per the corresponding asset configuration parameters based on the stored context from the previous ingestion run. It stores the last run context of the fetched data. It starts fetching data based on the combination of the values of stored context for the previous ingestion run and the corresponding asset configuration parameters having higher priority. The corresponding asset configuration parameters for the scheduled/interval polling are the [Start time for scheduled/interval POLL], [Max results for scheduled/interval POLL].
- Asset Configuration Parameter - Start time for scheduled/interval POLL
This parameter will be used to specify the start time for the search. Possible values format: 'start_time' or <digit><d/h/m/s> where d = Day, h = Hour, m = Minutes, and s = Seconds.
- Format 1 - <digit><d/h/m/s>
-
Using this format you can informally provide a time. For example, 3d = 3 Days, 3m = 3 Minutes. The Start time and End time will be calculated using the specified value. The end time will be present time and according to the specified value, the start time will be calculated for the search.
E.g. 10d
- Format 2 - 'start_time'
-
Using this format you can provide start time only. The end time will be considered as the present time.
E.g. 2020-03-20T00:00:00Z
- Asset Configuration Parameter - Max results for scheduled/interval POLL
This is an optional parameter. This parameter is used to specify the maximum number of results to return from API calls. The default value is 10,000. If the limit is not provided, it will fetch by default 10,000 results.
Example:
- Run the Scheduled poll for 'All' ingestion run mode for the last three days.
- Start time for scheduled/interval POLL = 3d
- Max results for scheduled/interval POLL = 10000
- Ingestion Run Mode = All
- Asset Configuration Parameter - Backdate Start Time in minutes (for scheduled polling)
This is an optional parameter. This parameter is used to backdate the start time for ‘Assets with Alerts’, ‘User Alerts’, ‘Alerting Detections’, ‘Not-alerting detections’, ‘All Alerts’, ‘All Detections’, and ‘All’ run modes. This parameter can be used to prevent (or minimize) the late-breaking for the mentioned run modes. The default value is 15 minutes (15m).
Example:
- Run the Scheduled poll for the last three days with backdate start time set to 15 minutes.
- Start time for scheduled/interval POLL = 3d
- Backdate Start Time in minutes (for scheduled polling) = 15m
- Ingestion Run Mode = All
- Stored Context - State file intervention
The state file will be used to save the last run context. For the first run, the state is mentioned below. Hence, the action will run as the provided asset configuration parameters. After performing the first run, the action will save the individual last run context for the IoC, Asset Alerts, User Alerts, Alerting Detection, and Not-alerting Detection for the scheduled/interval polling.
- State file without the stored context of the previous run: {"app_version": "2.0.0"}
- State file with the stored context of the previous run: {"app_version": "2.0.0","last_run_ioc_time": "2020-01-03T00:00:00Z", "last_run_alert_time": "2020-01-03T00:00:00Z", "last_run_user_alert_time": "2020-01-03T00:00:00Z", "last_run_alerting_detection_time": "2020-01-03T00:00:00Z", "last_run_not_alerting_detection_time": "2020-01-03T00:00:00Z"}
- Common Asset parameters
- Asset Configuration Parameter - Alert Severity (JSON formatted list)
This parameter will be used to filter fetched security asset alerts data based on the alert severity. It is an optional parameter. This action will ingest only those alerts which have specified severity. If the value is not provided, it will ingest all fetched data into the container. This parameter will be validated and used only when the ingestion run mode is either ‘All’, ‘All Alerts’, or ‘Assets with Alerts’.
- Asset Configuration Parameter - Max allowed artifacts in a single container
This is an optional parameter. This parameter is used to specify the maximum allowed artifacts in a single container to ingest. The default value is 10,000. If the value is not provided, it will set it to 10,000 by default. If the container limit is exhausted, this action will create a new container with a creation timestamp and start ingestion in it.
- Asset Configuration Parameter - Fetch all live rules created in the Detection Engine
This parameter will be used to fetch the (alerting and not-alerting) detections. If this parameter is set to true (or checked), then the action will first fetch all the rules and fetch the detections for the live rules. If the value is set to false (or unchecked), then the detections will be fetched based on the Comma-separated Rule ID(s) (with or without versionId) for fetching the detections asset configuration parameter. This parameter will be used only when the ingestion run mode is either ‘All’, ‘All Detections’, ‘Alerting Detections’, or ‘Not-alerting Detections’.
- Asset Configuration Parameter - Comma-separated Rule ID(s) (with or without versionId) for fetching the detections
This parameter will be used to fetch the (alerting and not-alerting) detections. It is an optional parameter. The detections will be fetched for the provided Rule ID(s). The user can provide multiple values in the form of a comma-separated string. If the value is not provided and Fetch all live rules created in the Detection Engine asset configuration parameter is set to true, it will ingest detections for all the live rules. This parameter will be validated and used only when the ingestion run mode is either ‘All’, ‘All Detections’, ‘Alerting Detections’, or ‘Not-alerting Detections’.
- Note:
- For Scheduled/Interval Polling, if the user adds a new Rule ID to the existing list of Rule IDs, the On Poll action will be triggered, for all the current Rule IDs (including the newly added Rule ID), with the last run context of the previous scheduled/interval run. This may lead to the data loss of the detections of the newly added Rule ID. To overcome this issue, user can perform any one of the following options:
- Create a new asset and configure it with the required Rule ID(s).
- Reset the state file mentioned in this section.
Manual Polling (POLL NOW)
- In this case, every time the action will create a new container. If the fetched data has more data than the specified value of ‘Max allowed artifacts in a single container’, it will create multiple containers to ingest data as it satisfies the maximum allowed artifacts limit in a single container.
Scheduled/Interval Polling
The action will determine the run whether is the first run or not based on the stored context for scheduled/interval polling.
- For the first ingestion run for Scheduled/Interval polling
- In this case, every time the action will create a new container. If the fetched data has more data than the specified value of [Max allowed artifacts in a single container], it will create multiple containers to ingest data as it satisfies the maximum allowed artifacts limit in a single container.
- For the subsequent ingestion run for Scheduled/Interval polling
- In this case, there three possible ways to ingest artifacts into the container.
- Container does not exist: In this way, the action will create a new container and start ingesting artifacts in it.
- Container already exists and having a sufficient margin for artifacts creation: In this way, the action will ingest artifacts into the already existing container.
- Container already exists and not having sufficient margin: In this way, the action will ingest artifacts into the already existing container until the limit is reached, then, the action will create a new container and start ingesting artifacts in it.
Sample of Ingested Artifacts
There are a total of two types of artifacts getting ingested into the phantom server which are mentioned below.
- Alert Artifact
This artifact will be created when ingestion run mode is either ‘All’, ‘All Alerts’, or ‘Assets with Alerts’. This artifact will be ingested into the separate container named ‘Assets with Alerts <creation_timestamp>’.
-
- Sample response of the ListAlerts endpoint which is used to fetch the alerts data:
{
"asset": {
"hostname": "mary-gonzalez-laptop"
},
"alertInfos": [
{
"name": "if match then match [1]",
"sourceProduct": "Rule Generated Alert [456def]",
"severity": "High",
"timestamp": "2020-01-27T22:07:12Z",
"rawLog": "...",
"uri": [“...”]
}
]
}
- Sample ‘Alert artifact’ which gets created from the received response:
{
...
"cef": {
"assetIndicator": "hostname",
"assetValue": "mary-gonzalez-laptop",
"alertName": "if match then match [1]",
"sourceProduct": "Rule Generated Alert [456def]"
"severity": "High",
"timestamp": "2020-01-27T22:07:12Z",
"rawLog": "..."
"uri": "...",
}
...
}
- User Alert Artifact
This artifact will be created when ingestion run mode is either ‘All’, ‘All Alerts’ or User Alerts’. This artifact will be ingested into the separate container named User Alerts <creation_timestamp>’.
-
- Sample response of the ListAlerts endpoint which is used to fetch the user alerts data:
{
"user": {
"email"<EMAIL_ADDRESS>},
"alertInfos": [
{
"name": "Unspecified",
"sourceProduct": "Office 365",
"timestamp": "2020-09-07T19:46:44Z",
"rawLog": "...",
"uri": [“...”]
}
]
}
- Sample ‘User Alert artifact’ which gets created from the received response:
{
...
"cef": {
"userIndicator": "email",
"userValue"<EMAIL_ADDRESS>"alertName": "Unspecified",
"sourceProduct": "Office 365",
"timestamp": "2020-09-07T19:46:44Z",
"rawLog": "...",
"uri": "...",
}
...
}
- IoC Domain Artifact
This artifact will be created when ingestion run mode is either ‘All’ or ‘IoC Domain Matches’. This artifact will be ingested into the separate container named ‘IoC Domain Matches <creation_timestamp>’.
-
- Sample response of the ListIoCs endpoint which is used to fetch the IoCs data:
{
"artifact": {
"domainName": "speedtest.net"
},
"firstSeenTime": "2018-11-05T12:00:57Z",
"iocIngestTime": "2018-07-21T20:00:00Z",
"uri": [“...”],
"lastSeenTime": "2020-03-23T23:51:00.241330Z",
"sources": [
{
"category": "IP Check Services",
"source": "ET Intelligence Rep List",
"rawSeverity": "Info",
"confidenceScore": {
"normalizedConfidenceScore": "Medium",
"intRawConfidenceScore": 0
}
}
]
}
- Sample ‘IoC Domain artifact’ which gets created from the received response:
{
...
"cef": {
"artifactIndicator": "domainName",
"artifactValue": "speedtest.net",
"category": "IP Check Services",
"rawSeverity": "Info",
"normalizedConfidenceScore": "Medium",
"iocIngestTime": "2018-07-21T20:00:00Z",
"uri": “...”,
"lastSeenTime": "2020-03-23T23:51:00.241330Z",
"sources": "ET Intelligence Rep List",
"firstSeenTime": "2018-11-05T12:00:57Z",
"intRawConfidenceScore": "0",
"rawJSON": '{"artifact": {"domainName": "speedtest.net"}, "sources": [{"source": "ET Intelligence Rep List", "confidenceScore": {"normalizedConfidenceScore": "Medium", "intRawConfidenceScore": 0}, "rawSeverity": "Info", "category": "IP Check Services"}], "iocIngestTime": "2018-07-21T20:00:00Z", "firstSeenTime": "2018-11-05T12:00:57Z", "lastSeenTime": "2020-03-23T23:51:00.241330Z", "uri": ["..."]}'
}
...
}
NOTE -
Here, the category, sources, rawSeverity, normalizedConfidenceScore, intRawConfidenceScore keys of the IoC Domain Artifact are the details of IoC sources and it has comma-separated string datatype. There are chances to retrieved multiple sources for a single IoC so that to club all the details in the single key make all these keys as a comma-separated string.
- Alerting Detection Artifact
This artifact will be created when ingestion run mode is either ‘All’, ‘All Detections’ or ‘Alerting Detections’. This artifact will be ingested into the separate container named ‘Alerting Detections <creation_timestamp>’.
-
- Sample response of the ListDetections endpoint which is used to fetch the Alerting Detections data:
{
"type": "RULE_DETECTION"
"detection": [
{,
"ruleName": "ms_office_to_suspicious_url",
"urlBackToProduct": "...",
"uri": [“...”],
"ruleId": "ru_c25c2673-6551-4156-bf96-e883225feb6c",
"ruleVersion": "ru_c25c2673-6551-4156-bf96-e883225feb6c@v_1601246241_474367000",
"alertState": "ALERTING",
"ruleType": "MULTI_EVENT",
"detectionFields": [
{
"key": "hostname",
"value": "betty-decaro-pc",
}
],
}
],
"createdTime": "2020-10-04T20:11:35.159233Z",
"id": "de_f3769bfc-7cfc-43c7-bca2-5e9b413c63c2",
"timeWindow": {
"startTime": "2020-10-04T17:34:48Z",
"endTime": "2020-10-04T17:35:48Z",
},
"collectionElements": [...]
"detectionTime": "2020-10-04T17:35:48Z"
}
- Sample ‘Alerting Detection artifact’ which gets created from the received response:
{
...
"cef": {
"alertState": "Alerting",
"createdTime": "2020-10-04T20:11:35.159233Z",
"detectionId": "de_f3769bfc-7cfc-43c7-bca2-5e9b413c63c2",
"detectionTime": "2020-10-04T17:35:48Z",
"events": [{"..."}],
"ruleId": “ru_c25c2673-6551-4156-bf96-e883225feb6c”,
"ruleName": "ms_office_to_suspicious_url",
"ruleType": "MULTI_EVENT",
"uri": "...",
"versionId": "ru_c25c2673-6551-4156-bf96-e883225feb6c@v_1601246241_474367000",
}
...
}
- Not-alerting Detection Artifact
This artifact will be created when ingestion run mode is either ‘All’, ‘All Detections’ or ‘Not-alerting Detections’. This artifact will be ingested into the separate container named ‘Alerting Detections <creation_timestamp>’.
-
- Sample response of the ListDetections endpoint which is used to fetch the Alerting Detections data:
{
"type": "RULE_DETECTION"
"detection": [
{,
"ruleName": "ms_office_to_suspicious_url",
"urlBackToProduct": "...",
"uri": [“...”],
"ruleId": "ru_c25c2673-6551-4156-bf96-e883225feb6c",
"ruleVersion": "ru_c25c2673-6551-4156-bf96-e883225feb6c@v_1601246241_474367000",
"alertState": "NOT_ALERTING",
"ruleType": "MULTI_EVENT",
"detectionFields": [
{
"key": "hostname",
"value": "betty-decaro-pc",
}
],
}
],
"createdTime": "2020-10-30T17:59:07.388755Z",
"id": "de_5f498fa7-9db2-4f16-58d1-fe2025c7b457",
"timeWindow": {
"startTime": "2020-10-30T16:07:48Z",
"endTime": "2020-10-30T16:08:48Z",
},
"collectionElements": [...]
"detectionTime": "2020-10-30T16:08:48Z"
}
- Sample ‘Not-alerting Detection artifact’ which gets created from the received response:
{
...
"cef": {
"alertState": "Not Alerting",
"createdTime": "2020-10-30T17:59:07.388755Z",
"detectionId": "de_5f498fa7-9db2-4f16-58d1-fe2025c7b457",
"detectionTime": "2020-10-30T16:08:48Z",
"events": [{"..."}],
"ruleId": “ru_c25c2673-6551-4156-bf96-e883225feb6c”,
"ruleName": "ms_office_to_suspicious_url",
"ruleType": "MULTI_EVENT",
"uri": "...",
"versionId": "ru_c25c2673-6551-4156-bf96-e883225feb6c@v_1601246241_474367000",
}
...
}
Error code caveats
-
Handling for HTTP 429 (RESOURCE_EXHAUSTED) Error
The Chronicle API enforces limits on the volume of requests that can be made by anyone against the Chronicle platform. If the user reaches or exceeds the query limit, the Chronicle API server returns HTTP 429 (RESOURCE_EXHAUSTED) to the caller. Hence, while executing the actions of the Chronicle Phantom integration, there were situations where the actions failed due to the above-mentioned API error. To handle this scenario, we have implemented the below-mentioned logic.
- Scenarios when the user may encounter this error
- This error can be encountered when the user wants to fetch a large number of data and the Chronicle instance also has a large volume of data for the provided parameters. The actions for which this error can be encountered are as follows:
- List Events
- List Rules
- List Detections
- For all the other actions, if the user runs multiple actions, simultaneously, then this error can be encountered.
- Mitigation Strategy
- The action will execute as per the normal action flow.
- If the Chronicle APIs return HTTP 429 (RESOURCE_EXHAUSTED) error, then, the retry API calls workflow will be executed. The retry workflow is governed by the 2 asset configuration parameters named “Retry Wait Period(in seconds)” and “Number Of Retries”. The explanation of both the parameters is provided below.
-
Number of Retries: The value of this parameter defines the number of attempts for which the action will keep on retrying if the Chronicle API continuously returns the HTTP 429 (RESOURCE_EXHAUSTED) error. If the error gets eliminated before the number of retries gets exhausted, then, the action execution will continue along its workflow with the next set of API calls and if the error is still persistent and all the number of retries are exhausted, then, the action will fail with the latest error message being displayed.
-
Retry Wait Period (in seconds): The value of this parameter defines the waiting period in seconds for which to hold the current execution of the action on receiving the HTTP 429 (RESOURCE_EXHAUSTED) error and then, retry the same API call after the waiting period is exhausted. This ensures that the integration provides a mechanism of attempting to overcome the HTTP 429 (RESOURCE_EXHAUSTED) error. If the error persists, then the user should retry the action by providing a greater value to this parameter.
-
The HTTP 500 Internal Server Error
The 500 Internal Server Error is a general HTTP status code which means that something on the server has gone wrong, but the server couldn't be more precise about the exact issue. There are certain cases where this error may occur with this Chronicle Phantom Integration which are listed below. There are possibilities to get this error in any other invalid scenarios.
- Action - List Assets
- When the destination IP address is not valid but it has a valid IP format.
- Action - List Events
- When the asset IP address is not valid but it has a valid IP format.
- When an incorrect product ID is given for the asset.


{% extends "base.html" %} {% block page_info %} · logout {% endblock %} {% block content %}
You have been logged out.


How much reinforcement do you wish?
Level 1:
Double the strength
Level 2:
Triple the strength
Level 3:
Increase strength fivefold
Go back


{% extends "petitions/petition_form/petitionform_list.html" %} {% block replacedatefilter%} {%endblock%} {% block petitiontableheading %}
This table shows all the petitions that are eligible and have not been done any admissibility test. You can search using any criteria
{% endblock %} {% block addbutton %} {% if perms.petitions.add_admissibilityform %}


Examples¶
Examples based on real world datasets¶
Applications to real world problems with some medium sized datasets or interactive user interface.
Model Selection¶
Examples concerning model selection, mostly contained in the
sklearn.grid_search
and sklearn.cross_validation
modules.


Lagom Framework + Play Framework
This is a Scala Sbt activator project that demonstrates the legacy word count example using the Lagom Framework integrated with play where we are hitting our lagom rest services via Play.
This is a microservice based Kafka Producer/Consumer application where one is the producer which produces data in Kafka and persist events in Cassandra Db. The other service consumes data from Kafka and gives the word count of the words.
The play integration provides us a way to call our lagom services via a user interface which was not provided before.
# Prerequisites
Scala 2.11.8
Sbt 0.13.13
Clone Project
1:git clone gihub-url
2:cd app-name
3:sbt clean compile
Steps to Install and Run Zookeeper and Kafka on your system:
1: Download kafka_2.11-<IP_ADDRESS> from
here
2: Extract downloaded file
tar -xzvf kafka_2.11-<IP_ADDRESS>.tgz
cd kafka_2.11-<IP_ADDRESS>
3: Start Servers
Start Zookeeper:
bin/zookeeper-server-start.sh config/zookeeper.properties
Start Kafka server:
bin/kafka-server-start.sh config/server.properties
Steps to Install and Run Cassandra on your system:
1: Download Cassandra from
here
2: Extract downloaded file
tar -xzvf apache-cassandra-3.0.10-bin.tar.gz
cd apache-cassandra-3.0.10/bin
3:Start Cassandra server:
./cassandra
Command to start all services:
sbt runAll
The play routes which are used to hit the lagom rest services are :
localhost:9000/ localhost:9000/api/hello/:id
localhost:9000/change localhost:9000/api/hello/:id with body as : {"message":"new-welcome-message"}
localhost:9000/wordCount localhost:9000/api/wordcount
localhost:9000/latest localhost:9000/api/latest
For any issue please raise a ticket @
Github Issue


?I
Collector:
T.
G.
YUNCKER
No.
18,186
Preser
TRUMAN
G.
YUNCKER
HERBARIUM
OF
DEPAUW
UNIVERSITY
(DPU)
PURCHASED
BY
NY
IN
1987
BOTANICAL
CARDER
HERBARIUM
T.
G.
YUNCKER
DEPAUW
UNIV.
HERBARIUM.
58373
PLANTS
OF
JAMAICA
Parish:
St*
Thomas
Date:
Feb.
15,
1958
Bot.
Name:
Capraria
biflora
LĒ
Vern.
Name:
,
Shrub,
about
2
ft.
high}
flowers
white,
faintlv
tinged
with
pink.
In
open
area,
Montego
Poin-t-Alt.
0-20
ft.
6
The
University
of
Texas
Herbarium
(LL,
TEX)
Capraria
biflora
L.
Det:
J.
Williams
&
B.L.
Turner,
30
Jul
1996
01334383
Legend -
Level of confidence that token is an accurately-transcribed word
extremely low
very low
low
undetermined
medium
high
very high


jmlr jmlr2009 jmlr2009-43 jmlr2009-43-reference knowledge-graph by maker-knowledge-mining
Source: pdf
Author: Thomas Abeel, Yves Van de Peer, Yvan Saeys
Abstract: Java-ML is a collection of machine learning and data mining algorithms, which aims to be a readily usable and easily extensible API for both software developers and research scientists. The interfaces for each type of algorithm are kept simple and algorithms strictly follow their respective interface. Comparing different classiﬁers or clustering algorithms is therefore straightforward, and implementing new algorithms is also easy. The implementations of the algorithms are clearly written, properly documented and can thus be used as a reference. The library is written in Java and is available from http://java-ml.sourceforge.net/ under the GNU GPL license. Keywords: open source, machine learning, data mining, java library, clustering, feature selection, classiﬁcation


Fiery explosions as Hong Kong police storm into university held by protesters after all-night ...
by EndPlayHONG KONG - HONG KONG (AP) - Fiery explosions as Hong Kong police storm into university held by protesters after all-night standoff.
HONG KONG - HONG KONG (AP) - Fiery explosions as Hong Kong police storm into university held by protesters after all-night standoff.


Now it's Version 3.x
3rd Release public / 2019
proActive reCompilation!
Starting with version 3, browser prefixes are no longer included, and the project was also given a shorter name. Some preconfigurations, which were previously written to a layout file, are now included in the main file. Even today, a few websites still have version 1.1.1.
/*!
* cFlex :: v3.0.8
* License :: MIT
* Update :: 30.08.2019
* Create :: 22.08.2014
* Author :: Michael S. RitZenhoff
* https://github.com/msritzenhoff/cFlex
*/
/*!
* cFlex :: v3.0.8
* License :: MIT
* https://github.com/msritzenhoff/cFlex
*/
2nd Release internal / 2017
In 2017, several projects with CLIFFlex, still with prefixes, had already been implemented. More and more manufacturers used CSS-Flexbox and one or the other established itself. One could have changed, but due to the filling amount of Extras & Styles in their CSS, the decision was made to stay with our own. A few websites still have version 1.1.1 and doing great.
/*
CLIFFlex
Version : 2.0.0
Update : 25.10.2017
Create : 22.08.2014
Author : Michael S. RitZenhoff
*/
1st Release internal / 2014
In 2014 I started to use CSS-Flexbox with many browser-prefixes. At that time there was no mention of the modern browsers. The then named CLIFFlex was used in the first projects.
/*
CLIFFlex
Version : 1.1.1
Create : 22.08.2014
Author : M. S. RitZenhoff
*/


City of Zion is launching its first
dAPPs Competition
And we want you to get involved
The City of Zion council is promoting a decentralised apps (dApps) competition to further elevate the NEO developer community.
13500
Total Gas Prize
Up to 10 Winners
receiving 1350 gas each
Registration starts
16th of September 2017
Submission deadline
16th of November 2017
Competition details
The City of Zion (COZ) Council is happy to promote the first NEO dApps competition. Individual developers or teams are invited to join the NEO Slack #develop channel and submit their work to compete for 10 prizes of 1350 GAS.
Registration
Registration form will open on this URL on the 16th of September 2017 for entry in to the City of Zion dAPPs competition. The registration will require the Slack and GitHub username of team members, together with the GitHub repository for the smart contract sources.
Entry Submissions
Submissions must be made by the 16th of November 2017 11:59 EST.
Any entries after this deadline will not be accepted as part of this competition.
Applications can be made in teams or by individuals. Winners will be selected as per the voting process laid out in City of Zion governance item 7.
Submission requirements
All submissions should be a working minimal viable product (MVP). The dApps submitted should have been demonstrated to work on testnet environments to be eligible for rewards. Smart contract code must be MIT licensed and properly documented. The remainder of the business logic, or supporting features around it can be fully proprietary.
Competition prizes
On the 26st of November 2017 the City of Zion council will announce a list of 10 winners in Slack and on this competition page. Each winner will receive 1350 GAS to launch their applications, from which at least 500 GAS should be used to deploy the dApp.
Support
For the development phase the City of Zion council will provide testnet NEO and GAS for developers and teams on our Slack. The winning participants are invited to join us at the #develop channel to help further their progress.
About
City of Zion (COZ) is a global community of open source enthusiasts for the NEO blockchain, with the shared goal of helping NEO achieve its full potential. See our governance page for more information about our community. Our name comes from the last human city in the Matrix films.
Good Luck!
City of Zion Council


UD Canvas Editor Buttons
| Name | Description | Availability | Type |
|---|---|---|---|
| jQuery Widgets | Add dynamic UI widgets to a Canvas page (tabs, accordion, dialog, glossary, self-test) Available only in jQuery subaccount | pre-installed in IT>ATS sub-account | Editor Button |
| iFrameIT | add an iframe containing Canvas File or 3rd party (secure) content to a Canvas page | by request | Editor Button |
| UDCapture embed | Embed a UDCapture lecture into a Canvas page | pre-installed | Editor Button |
These are all anonymous apps and should not require much maintenance. The only dependent file is /canvas/oembed/index.php, which is required for the jQuery Widgets. The custom css and js files for the UD account must also be in place.
Currently there is no online storage location for the most recent versions...I have them on my chromebit. When I decide where they should live, I will put the link here. It is a shame that Instructure changed the way custom code is stored. They make you upload rather than link it now, so it means that losing the files or version errors are now both likely scenarios as time goes by.


health smallpox beds contacts public number case epidemic Health []. contact isolation infected response cases tracing initial available days hospital attack day time capacity {border-style estimated px;} requirements #ffffff;} HCWs clinical used ;():–. control high need needed size virus workers Public Smallpox Sydney based isolated release required scenario Fig Sciences analysis assumed outbreak people quarantine respirators surge traced workforce Infectious Medicine PPE data influential intervention model Sydney. commencing million px; response. starting using worst-case {font-family (%) Medical Sensitivity Sydney, care described diagnosis event font-size isolation, large percentage population proportion protection rapid require scenarios shown systems vaccination varying Australia. HCW MacIntyreCR, Population bed contacts. control. different disease double; early infection infectious private rates risk scenario, scenarios. shows smallpox. study traced. treatment Australia Australia, Australian Diseases. Ebola Planning Research Results South [], beds, border-color border-width cases. community critical determine effect epidemic, epidemic. estimate hospitals impact including infected, medical modelled modified new plans previous respiratory severe solid; transmission vaccination, vaccination. working {font-style {font-weight ChughtaiAA, Clinical Disease Given Table Time Vaccination Whilst [updated average bioterrorism bold capacity, cases, conditions courier; day. days. deaths em; factors half immunity include index infections maximum missed onset original outbreaks parameters patient practitioners, preparedness pt;} published reach result ring showed single size, space speed staff start surveillance total tracing. trained triage urgent work


Invincible Starlets Make History After Winning CECAFA Title
by Harmon EllenHarambee Starlets on Monday, November 25, made history after emerging the Cecafa champions for the first time ever. The team achieved the feat after beating their rivals Tanzania 2-0 during the final.
The win is largely attributed to super-sub Jentrix Shikangwa who joined the game from the bench to open the scoring from the spot in the 70th minute.
Starlets completed the championships without conceding a single goal.
Below are some of the results of the triumphant Kenyan team.
Kenya 2-0 Ethiopia
Kenya 12-0 Djibouti
Kenya 3-0 Uganda
Kenya 5-0 Burundi
Kenya 2-0 Tanzania
Various leaders took to social media to congratulate the team for the historic win.
"Congratulations Harambee Starlets for the magnificent performance in the CECAFA championship. You have brought glory to the nation and we are proud of you. To us, you stand tall as legends, and to the continent, you are definitely champions," congratulated Mombasa Governor Hassan Joho.
"Congratulations to Harambee Starlets who have won the CECAFA Women's Championship after beating Tanzania 2-0 in today's final. Well done ladies. You are one more reason why I am proud to be a Kenyan," stated Senator Cleophas Malala.
The win came shortly after the team got nominated for the women's national team by the Confederation of African Football (Caf).
It was the second time the team received the nomination in three years.
Here's a video.


ITS::WICS::LogUtils - Log utility functions for WICS
node_log_id
Return a string to represent a node or value in a log message. Each type of node/value is marked differently, and where possible the name of the node is used. Elements also have id/xml:id attributes included when present.
log_match
Logs a global rule match.
Arguments are an ITS::Rule
and a match hash pointer (the arguments used in an ITS::iterate_matches
handler),
and a Log::Any
object to use to log the given rule match.
log_new_rule
Log the creation of a new rule.
Arguments are the created rule,
its matched FutureNodes in an array ref,
and the Log::Any
object to use for logging.
get_or_set_id
Either returns an element's id value, or sets one, logs the change, and returns it.
Arguments are: element to get or set ID from/on,
ITS::DOM
object containing the element,
and the Log::Any
object to log ID setting with.
Nathan Glenn<EMAIL_ADDRESS>This software is Copyright (c) 2013 by DFKI.
This is free software, licensed under:
The MIT (X11) License


## Mauricio Laine
#### Software Developer / Android
{% include svg/github.svg alt="Visit Github Project" %}
Mauricio Laine is currently pursuing a Master's Degree in Computer Science & Engineering at the University of
Washington. Mauricio has been working in the field of mobile app development for the past five years. His current focus
is on machine learning mechanisms to identify objects in mobile applications.
## Oscar Guerrero
#### Software Developer / Android
{% include svg/github.svg alt="Visit Github Project" %}
Oscar Guerrero is a Master's student in the Paul G. Allen School of Computer Science and Engineering at the University
of Washington. Oscar has more than nine years of professional experience. Also, solid knowledge understanding mobile
native development tools and ample expertise developing native Android apps.


The function that we implemented in the previous exercise checks integer datatypes, but not about floats. So, please expand the conditional block so that floats are counted too.


Today's naptime special--Coraline squalling, find her stripped, poo everywhere, diaper MIA. Where was it? She'd put it in the diaper pail!
11/15/2009, 1:42:37 PM
Favs: 0
Retweets: 0
link--- layout: tweet ---
Today's naptime special--Coraline squalling, find her stripped, poo everywhere, diaper MIA. Where was it? She'd put it in the diaper pail!
11/15/2009, 1:42:37 PM
Favs: 0
Retweets: 0
link


Money Play:a) Should red redouble? If redoubled should White take?
pips Red=26 White=101
(CorrectAnswer= 0/0, ErrorScore= 0)
b) Move the two checkers on White’s 3-pt to his 2-pt. Should Red redouble? If redoubled should White take?
c) Move the two checkers on White’s 4-pt to his 2-pt. Should Red redouble? If redoubled should White take?
Position submitted by Chris Purchase
A very instructive position: if Red had another checker on his ace-point all three positions would be too good to double and pass because with two checkers on his ace-point and one checker closed out Red has a redouble which White must drop.
The tactical opportunities afforded by the blot on the ace-point changes things in White’s favour. He can slot his open point, get hit, pick up and then close out the second checker.
With the 2-pt open that is good enough to make it no redouble for Red. With the 3-pt open Red can escape more easily and that makes it a redouble and a take. With the 4-pt open the escape is even easier and that makes it too good to redouble/pass.
c) Move the two checkers on White’s 4-pt to his 2-pt. Should Red redouble? If redoubled should White take?
Position submitted by Chris Purchase
A very instructive position: if Red had another checker on his ace-point all three positions would be too good to double and pass because with two checkers on his ace-point and one checker closed out Red has a redouble which White must drop.
The tactical opportunities afforded by the blot on the ace-point changes things in White’s favour. He can slot his open point, get hit, pick up and then close out the second checker.
With the 2-pt open that is good enough to make it no redouble for Red. With the 3-pt open Red can escape more easily and that makes it a redouble and a take. With the 4-pt open the escape is even easier and that makes it too good to redouble/pass.
Cube analysis 2-ply cubeless equity +0.419 0.610 0.145 0.054 - 0.390 0.000 0.000 Cubeful equities: 1. No double +0.623 2. Double, pass +1.000 (+0.377) 3. Double, take +0.573 (-0.050) Proper cube action: No redouble, take (11.8%)


Ocala events
-
tom barnard kennesaw death
John Zalewski profiles | LinkedIn
Current: President at Freestone LLC; Past: Managing Director at Glendorn, General manager at Prism, . Education: Southern Illinois University, Carbondale .
http://www.linkedin.com/pub/dir/John/Zalewskirealtors Deerfield | Find realtors in Deerfield, IL
Results 1 - 15 of 3507 . realtors for Deerfield, IL. Find phone numbers, addresses, maps, driving directions and reviews for realtors in Deerfield, IL.
http://business.dailyherald.com/deerfield+il/realtors.zq.htmlCollin County, Texas Public Records Directory
Sheriff Sales broken link? View Collin County Sheriff information about real and personal property sales including listing of properties or equipment. Free Search .
http://publicrecords.onlinesearches.com/TX_Collin.htm
1603 north nimitz highway honolulu Upcoming events in Ocala
- Sponsored event
p i mortgage calculator
Apr 6 - Dance It Studio
kona luau combination activitis minooka community high school yearbooks
industrial revolution factory owners Hottest Tickets
-
Apr 11yucatan rat like animal
Amway Center -
Apr 28mens ruffled shirts chicago
Amway Center -
Jun 25nhs pay rise england
Bob Carr Performing Arts Center -
Mar 30come giocare in borsa
Amway Center -
Aug 27east haddam park recreation website
Amway Center -
Jun 21new york hot dog company
Amway Center -
Sep 13kings of leon merchandise
Francis Field -
Mar 17san diego exhaust hoods
St Augustine Amphitheatre -
Oct 8web counter free hosting
Amway Center -
May 4projector lamp<PHONE_NUMBER>
Bob Carr Performing Arts Center
Ocala's best venues
-
Wealth
Aug 13, 2009. Investors 1424 views · Buying With Real Estate America 372 views . 1 112 Freestone Capital Management Seattle WA 1,525,000,000 750 2,033,333 0 . Ptns., LLC Bannockburn IL 152,000,000 101 1,504,951 5,000 500,000 3 154 . 35 241 IRON Financial Northbrook IL 779,000,000 778 1,001,285 0 .
http://www.slideshare.net/guestad97956/wealth-1855885 -
2018 counter point dr | houston, tx 77055 - Keller Williams Realty
Are you currently working with a Real Estate Professional/Agent? Since you . Freestone. Ft. Bend. Galveston. Garza. Gillepsie. Gillespie. Gonzales. Grayson .
http://www.kw.com/homes-for-sale/77055/TX/HOUSTON/2018-COUNTER-POINT-DR/3yd-HARMLSTX-18857424.html -
NASD Members F - Shepherd Smith Edwards & Kantas
725 NORTH MCKINLEY ROAD, SUITE 200, LAKE FOREST, IL 60045 . 950 SKOKIE BLVD, SUITE 200, NORTHBROOK, IL 60062 . FREESTONE SECURITIES, LLC . REIT Attorneys - Real Estate Investment Trusts Investment Loss .
http://www.stockbroker-fraud.com/lawyer-attorney-1218118.htmlwild rose lourdes species
98 people's favorite
-
Susan Zissman | LinkedIn
Location: Northbrook, Illinois (Greater Chicago Area); Industry: Airlines/ . Broker- Owner, Bentley Properties; Kerri Johnson Business Systems Analyst at Claire's... Erik Morgan · Pete Forras Freestone Capital Management; Anthony Yelk .
http://www.linkedin.com/pub/susan-zissman/45/893/95a -
July 2011 - Hoosier Owners and Providers for the Elderly
Jul 1, 2011 . Blessing v. Freestone, 520 U.S. 329 (1997) and revised by the . properties in the lower quartile in terms of occupancy rates. . Glen Ellyn, IL .
http://www.hoosierownersandproviders.org/Uploads/1107.pdf


Output
- Raw: The signal is displayed as recieved
- Calculate: [darkline - signal ] / highlevel
- Transmittance: if [darkline - base] is lower than transmissionlevel the signal will be set to 100.
The idea is that the spectrum of the light source is here not strong enought.
At the other points y = 100*[(darkline-signal)/high_level]/[(darkline-base)/high_level]
- Absorbance: if [darkline - base] is lower than transmissionlevel the signal will be set to 0.
At the other points y = log10[(darkline-base)/high_level]/[(darkline-signal)/high_level]
Here is room for improvement I think.
Save / Load
The displayed Data can be saved in a csv-file
[float , float \n]
This file could be read by the program


---
layout: archive
title: Lean Prover Zulip Chat Archive
permalink: 116395maths/49506xorisnotassociative.html
---
The archive URL format has changed. Please find this page at:
https://leanprover-community.github.io/archive/stream/116395-maths/topic/xor.20is.20not.20associative.html


LVMH just agreed to buy Tiffany for $16.2 billion — here are 17 of the most iconic brands the French luxury giant already owns, Business Insider - Business Insider Singapore
by Dominic-Madori Davis, Business Insider US- Luxury conglomerate LVMH just agreed to acquire jewelry retailer Tiffany & Co. for $16.2 billion.
- According to the New York Times, it is LVMH’s priciest acquisition to date and also the most expensive deal ever made in the wider luxury sector.
- LVMH’s portfolio already includes 75 different brands that range from wines and spirits to leather goods and cosmetics.
- Tiffany will now join brands such as Christian Dior, Louis Vuitton, and Hennessy as part of LVMH’s expansive portfolio.
- Visit Business Insider’s homepage for more stories.
LVMH just agreed to buy Tiffany & Co. for a record $16.2 billion, Business Insider’s Mary Hanbury previously reported.
It marks the priciest acquisition LVMH has ever made and is also the wider luxury sector’s most expensive deal in history, according to the New York Times. The deal, which is still pending approval by Tiffany’s shareholders, is expected to close in mid-2020.
Tiffany is now set to join the luxury conglomerate’s already-extensive collection of brands, which range from the cosmetics store Sephora and fashion house Christian Dior to French newspaper Le Parisien. In total, LVMH owns 75 different brands.
Here are 17 of the most iconic brands the luxury giant currently owns, ranked in chronological order of LVMH’s acquisition date.
Le Bon Marché Rive Gauche: Le Bon Marché opened in 1852. In 1984, before Bernard Arnault created LVMH, he bought luxury goods company Agache-Willot-Boussac. He renamed it Financière Agache and sold some of the company’s assets. One of the assets he kept was Le Bon Marché, which became part of the LVMH Group in 1987.
Year acquired by LVMH: 1984
Type of goods: High-end department store
Most recognizable for: Le Bon Marché is recognized as being the world’s first department store. The Paris store is noted for its high-end retail and careful selection of goods across the store.
Source: LVMH, 24, New York Times
Louis Vuitton: Louis Vuitton was one of the first acquisitions LVMH made, when the group was first founded in the 1980s. The name Louis Vuitton is found within the title of LVMH, whose initials came from the merger between Louis Vuitton and Moët Hennessy.
Year acquired by LVMH: 1987
Type of goods: Luxury Retailer
Most recognizable for: The brand is known for its bright orange shopping bags and its leather products, which are usually heavily emblazoned with its “LV” logo.
Source: The Fashion Law
Dom Pérignon: This company is one of the oldest among LVMH’s portfolio. The Champagne company was one of the initial brands part of Moët Hennessy, which later merged with Louis Vuitton to create LVMH.
Year acquired by LVMH: 1987
Type of goods: Champagne
Most recognizable for: Dom Pérignon is one of the oldest companies in LVMH’s portfolio. It was founded in 1668.
Source: New York Times
Hennessy: Founded in 1765, the famous cognac brand has since become one of the most famous liquors in the world.
Year acquired by LVMH: 1987
Type of goods: Wine & Spirits
Most recognizable for: Hennessy is one of the most famous cognac brands in the world. The brand’s headquarters are in Cognac, France, about a five-hour drive from Paris.
Source: Investopedia
Moët & Chandon: Founded in 1743, Moët & Chandon has since become one of the most popular Champagnes in the world.
Year acquired by LVMH: 1987
Type of goods: Wine & Spirits
Most recognizable for: Moët & Chandon is one of the most famous Champagnes in the world. Prices start at around $40 a bottle.
Source: Investopedia
Givenchy: The luxury brand was founded in 1952, and has since become one of the most popular brands in the world.
Year acquired by LVMH: 1988
Type of goods: Luxury Retail
Most recognizable for: Givenchy is best known for creating the iconic little black dress Audrey Hepburn wore in the film “Breakfast at Tiffany’s.”
Source: The Fashion Law, Who What Wear
Sephora: The global cosmetic chain was founded in 1969, and was acquired by LVMH nearly 30 years later.
Year acquired by LVMH: 1997
Type of goods: Cosmetics, Retailer
Most recognizable for: Sephora is known for being one of the top beauty stores in the world. Sephora has more store locations than its rival, Ulta, and carries a variety of high-end brands, among them Fenty Beauty by Rihanna and Kat Von D.
Source: The Fashion Law
Marc Jacobs: Named after its founder, the brand Marc Jacobs was founded in 1984. Its namesake founder was once the creative director of Louis Vuitton before he left the brand to focus on his own.
Year acquired by LVMH: 1997
Type of goods: Luxury Retail & Cosmetics
Most recognizable for: Marc Jacobs was founded by designer Marc Jacobs in 1984. Jacobs was previously the creative director of Louis Vuitton.
Source: The Fashion Law
Benefit Cosmetics: Benefit Cosmetics was founded in 1976 in San Francisco, California, and has since spread globally.
Year acquired by LVMH: 1999
Type of goods: Cosmetics
Most recognizable for: Benefit is a cosmetics company, best known for its makeup. It is sold in Sephora, which is also an LVMH brand.
Source: Crunchbase
Fendi: This brand, founded in 1925, was once led by legendary designer Karl Lagerfeld. It was previously owned by both Prada and LVMH, until the latter bought out Prada in 2001. Over the years, LVMH has raised its ownership stakes to 84%.
Year acquired by LVMH: 2000
Type of goods: Luxury Retail
Most recognizable for: Fendi is a luxury brand, best known for its signature “F” print. The brand recently launched a collection with rapper Nicki Minaj.
Source: The Fashion Law, Elle
Fresh: This brand was launched in Boston in 1991 and is known for its natural product line.
Year acquired by LVMH: 2000
Type of goods: Cosmetics
Most recognizable for: Fresh is known for its expansive collection of natural products. It is sold in Sephora.
Bulgari: The famous jewelry brand, founded in 1884, sold to LVMH for $6.01 billion in an all-share deal. The Fashion Law reports that the Bulgari family sold their 50.4% controlling stake in their namesake brand for 3% of LVMH.
Year acquired by LVMH: 2011
Type of goods: Jewelry
Most recognizable for: Luxury jewelry brand Bulgari is known for its watches and diamond necklaces.
Source: The Fashion Law
Kat Von D Beauty: This cosmetics line was launched in 2008 and is named after its namesake founder, tattoo artist and model Kat Von D. It is owned by KENDO, the beauty incubator owned by LVMH.
Year acquired by LVMH: 2008
Type of goods: Cosmetics
Most recognizable for: Kat Von D Beauty was founded by tattoo artist Kat von D. The brand is known for its eyeshadow palettes.
Source: Fashion Retail
Le Parisien: According to LVMH’s website, this newspaper was founded in 1944, and is read by nearly 18 million people each month. Reuters reports that LVMH offered to buy Le Parisien, and its sister paper Aujourd’hui en France, for $54.38 million in 2015.
Year acquired by LVMH: 2015
Type of goods: Tabloid
Most recognizable for: Le Parisien is one of the most notable tabloids in France, along with Le Figaro and Le Liberation.
Rimowa: Founded in 1989, LVMH obtained an 80% stake in Rimowa for roughly $700 million. The company is now run by Alexandre Arnault, son of LVMH’s CEO, Bernard Arnault.
Year acquired by LVMH: 2016
Type of goods: Luggage
Most recognizable for: Rimowa is a luggage company. The brand made headlines after launching a collection of luggage with the brand Supreme in December 2018.
Source: The Fashion Law, Rimowa
Christian Dior: Per The Fashion Law, LVMH acquired Christian Dior in a $13.1 billion deal. Previously, the brand was owned by Groupe Arnault, a private holding company owned by LVMH CEO Bernard Arnault.
Year acquired by LVMH: 2017
Type of goods: Luxury retail
Most recognizable for: Dior is a luxury brand, best known for its gowns and handbags. Celebrities such as Rihanna and Jennifer Lawrence are noted faces of the brand.
Source: The Fashion Law
Fenty Beauty by Rihanna & Fenty: In a deal with one of the biggest pop stars on the planet, LVMH’s launch of the Fenty Brands made Rihanna the first woman of color to launch a label with LVMH, and the first woman to have an original brand with the luxury conglomerate.
Year acquired by LVMH: Fenty Beauty by Rihanna (2017), Fenty (2019)
Type of goods: Cosmetics & Luxury Clothes
Most recognizable for: In 2017, Fenty Beauty by Rihanna launched a 40-shade range of foundations, which helped to revolutionize diversity in the beauty industry. The shade range has since expanded to 50 shades.


Black and White 1 and 1/2 Stars (Out of 4) Reviewed by Mac VerStandig<EMAIL_ADDRESS>http://www.moviereviews.org April 17, 2000
---Please note, a copy of this review will be posted to http://www.moviereviews.org/black_and_white.htm ---
Imagine Larry Clark's Kids with big name stars and a director conflicted about what can and cannot be shown on screen. The shock value is lost. That is exactly what Black and White is, an honest look at the streets of New York City that has little effect on the viewer.
The film opens with a certain sexual act involving two Caucasian girls and an African-American guy in the not-so-thick woods. Little kids look on as their presumably virgin-eyes are corrupted. This is undoubtedly the film's most effective scene because a) the three actors are unknown to most audiences, which provides a certain reality, and b) it is the most graphic that the movie has to offer. From there on, everything is downhill.
Director James Toback attempts to tap one of Generation X's most peculiar traits: upper-class white teenagers attempting to infiltrate lower-class black society. His characters can be divided into three basic groups: trust-fund teens that meet the above criteria, poor black teens that want to make a better life for themselves and poor black teens that seem to altogether lack such drive.
The language used in Black and White is, in a way, very revealing. A classroom scene shows that the teenagers' teachers care. Yet their vocabularies are a dense version of broken English perhaps most similar to Ebonics. Although the infamous language of Mark Furman is considered derogatory, a similar word, `niga,' apparently isn't. In the aforementioned class, kids swear and no one flinches. Yet when such language is used at fancy dinner tables, the teens' parents are outraged. There is a great contradiction between street settings and home settings, yet the movie's subjects haven't figured that out.
Mid-film finds one of the few actual plot moments; a murder is committed. The most surprising thing about this scene isn't that the New York City District Attorney's son commits the murder or that the victim dies almost immediately, but rather the tame nature of how this is shown. For a film that apparently seeks to shock, a little blood might have been appropriate.
The same can be said of the sex, or lack thereof. Other than the aforementioned opening, no such acts are shown on screen. The characters constantly talk about it, and much happens off screen, but Toback seems to have gotten scared for reasons unapparent to this critic. Perhaps it is that big name stars like Elijah Wood, Claudia Schiffer and Gaby Hoffman aren't willing to show themselves on screen; an argument for a lesser-known cast.
The ultimate goal of Black and White is to make the viewer ask him or herself questions. Here's one to start with: `What else is playing at the local theatre?'
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


By becoming a Simonyan Foundation volunteer, you can help make a difference in the lives of those in need. As a volunteer, you will have the opportunity to make new friends, gain new skills and meet others who share your desire to make the world a better place. You will actively contribute to shaping a better future for children and their families with your support.
INESSA HAYRAPETYAN
ART TEACHER
DAVID BEKCHYAN
WEB DEVELOPER
ANI ELOYAN
EDITOR
MARIANNA VIRABYAN
EDITOR
ROSE MKRTCHYAN
PROJECT MANAGER
INESA VIRABYAN
PEDAGOG
RAFAEL YEPREMYAN
TEEN WORKER
MARINE YARDUMYAN
DANCER


Load some climate data and current meteorological observations to start using ForecastDualKc. You can also download an example dataset to start generating foreacasts.
Load some climate data and current meteorological observations to start using ForecastDualKc. You can also download an example dataset to start generating foreacasts.


uniform float time;
uniform vec2 res;
uniform vec2 tex0res;
uniform vec2 tex1res;
uniform vec2 tex2res;
uniform vec2 tex3res;
uniform sampler2D tex0;
uniform sampler2D tex1;
uniform sampler2D tex2;
uniform sampler2D tex3;
powered by WebGL1.0
special thanks to wgld.org
@McbeEringi.｡:+*


--- title: core functions for vision keywords: fastai sidebar: home_sidebar summary: "API details." description: "API details." ---
arr2im
arr2im(arr)
arr
Convert array to PIL image
im2bytes
im2bytes(im, rt=0, format='png')
im
rt
0
format
'png'
Convert image to bytes/encoded bytes
check_im
check_im(im, sz=256)
sz
256
Check size of image is same as sz
open_im
open_im(im)
Open image


Our product solves the problem with the lack of fast, context-specific and most importantly - untampered help out there. We solve that problem for our users by providing them an instant and specific help from people that may have already walked the same path and bought the same product. So next time, when you visit a site and you can't find a review or an answer that satisfies your information needs, you can open up our chat widget and ask a non-formal question to one of our helpers.


TAB switch between staged/unstaged area
l stage line, unstage in cached mode
h stage hunk, unstage in cached mode
L reset line
H reset hunk
{super_key}-z undo last action
c/C commit (C to include unstaged)
m amend previous commit
f make fixup commit
o open file at hunk
,/. go to next/previous hunk (also: j/k in vintageous mode)
? show this help popup
{super_key}-, Change Settings for current syntax


Friday October 11 - Sunday October 13. NHRA Mello Yello Drag Racing Series
Can you feel the ground shaking as the dragrace cars zoom by? Students and faculty from the University of South Carolina are measuring the ground shaking of dragrace cars at the zMAX Dragway with seismic devices!


Home
Menu
Reservation
Rebels
Contact
Account
Menu Rebels
{{service.name}}
{{service.price | currency}}
Total:
{{total() | currency}}


A surprising fact is coconut oil can be a very good natural makeup remover. Keep your skin safe from harmful chemicals using coconut oil and thank me later
Don't waste your money buying expensive exfoliators. Just dip a lemon slice on sugar and gently rub on your lips. Don't be too rough.
For glowing and spot free skin thik hack is a must. Mix a tea spoon of honey and a tea spoon of turmeric in a bowl. Apply this finely mixed paste twice in a week. You can store it in your freezer for 2 days at best.
 Pour blended aloe vera gel inside the bottle and shake it well. Your own toner is ready. You can store it for a week.


Generic Observable type, used to create Game Events.
More...
#include <Observable.h>
template<class TData>
class game::Observable< TData >
Generic Observable type, used to create Game Events.
- Template Parameters
-
◆ Observable()
◆ ~Observable()
◆ GetId()
◆ Subscribe()
◆ triggered()
Abstract function that checks if the Observable was triggered.
- Returns
- A tuple that specifies wether the event was triggered (value 0) and optionally contains the trigger data (value 1).
◆ Unsubscribe()
Unregister an Observer by it's unique subscription id.
- Parameters
-
| id | The unique subscription id |
◆ Update()
Updates the observable i.e. verifies if the observable was triggered. If triggered, the callback function of all registered Observers is executed.
Implements game::ObservableBase.
The documentation for this class was generated from the following file:
- Project_2DGameSDK/include/2DGameSDK/event/observable/Observable.h


The player who takes the last match
wins
loses
Left side player:
Human
Computer - Beginner
Computer - Expert
Right side player:
Human
Computer - Beginner
Computer - Expert
Left side player begins
Right side player begins