Issue with False Positives from AWSCloudTrail logs in from "Malformed user agent" Analytic

**Describe the bug**
When ingesting AWS CloudTrail logs using the Microsoft Sentinel AWS connector, CloudTrail events generated by AWS services may legitimately populate the UserAgent field with the value of the calling AWS service - for example: user-subscriptions.amazonaws.com.

This behavior can be confirmed as expected in this document under the "userAgent" section. [CloudTrail record contents for management, data, and network activity events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html)

When a connection comes from the "user-subscriptions.amazonaws.com" service - it creates a false=positive detection due to this logic in the analytic: ` | where UserAgent startswith "User" or UserAgent startswith '\"'`

**To Reproduce**
When ingesting AWSCloudTrail logs that include calls from user-subscriptions.amazonaws.com service into Sentinel using the default connector, run the following:
`AWSCloudTrail
| where (UserAgent startswith "User" and UserAgent endswith ".amazonaws.com")`

**Expected behavior**
Given the widespread use of AWS CloudTrail logs, exclude this useragent in the default analytic.

Something like:
`| where not(UserAgent == "user-subscriptions.amazonaws.com" and Type == "AWSCloudTrail")`