TI Map Domain entity to Cloud App Events
Open
Analytic Rules
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 3.8k
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 125
Description
**Describe the bug**
Detection "TI Map Domain entity to Cloud App Events" does not work. https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat%20Intelligence%20(NEW)/Analytic%20Rules/DomainEntity_CloudAppEvents_Updated.yaml
**To Reproduce**
1. Line 32: extend DomainName = tolower(IndicatorType) - should be tolower(ObservableValue)
2. list_tlds (declared line 24) is never used
3. Line 53: extend PAUrl = columnifexists("RequestURL", "None") - RequestURL is not part of the CloudAppEvents schema (see closed issue #12348)
4. Because CloudAppEvents will never have a result in the innerunique join on line 49, this detection will never trigger.
Contributor guide
Assessment
This issue has not been assessed yet.