From c3d478e2e50ee6229e74466d73b62c2f5ccd9333 Mon Sep 17 00:00:00 2001 From: Manuel Melendez Date: Mon, 30 Oct 2023 13:30:13 -0700 Subject: [PATCH] Running checks again --- .../Analytic Rules/DomainEntity_CommonSecurityLog.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml index 66077dc9648..e7eb4107718 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml @@ -41,7 +41,7 @@ query: | | summarize make_list(tld); // Retrieve threat intelligence indicators within the specified time range let Domain_Indicators = - ThreatIntelligenceIndicator + ThreatIntelligenceIndicator | where TimeGenerated >= ago(ioc_lookBack) | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Filtering out rows where the Confidence Score is less than 50 as they would not have an Alert Priority label.