Invalid YAML content in file Exploration Queries/InputEntity_Account/UserAccount_ScreenshotHosts.yaml

[reijoh]

Describe the bug
Invalid YAML content in file "https://github.com/Azure/Azure-Sentinel/blob/master/Exploration%20Queries/InputEntity_Account/UserAccount_ScreenshotHosts.yaml".

To Reproduce
Steps to reproduce the behavior:

1. Download the file
2. Use PowerShell
3. Install-Module powershell-yaml
4. Get-Content -LiteralPath "Exploration Queries/InputEntity_Account/UserAccount_ScreenshotHosts.yaml" -Raw | ConvertFrom-Yaml
5. Observe error:

Exception calling "Load" with "1" argument(s): "While scanning a literal block scalar, found extra spaces in first line."
At /home/me/Modules/powershell-yaml/0.4.7/powershell-yaml.psm1:48 char:9
+         $yamlStream.Load([YamlDotNet.Core.IParser] $parser)
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Expected behavior
YAML file should be converted into a PowerShell PSCustomObject.

Screenshots
N/A

Desktop (please complete the following information):

• OS: Ubuntu
• Browser N/A
• Version 22.04.5

Current content

Id: 81d63625-6617-455d-b1e3-ee5ed989e5f8
DisplayName: Screenshots taken
Description: Summary of hosts on which the user has taken screenshots
InputEntityType: Account
InputFields:
  - Name + UPNSuffix
OutputEntityTypes:
  - Host
QueryPeriodBefore: 24h
QueryPeriodAfter: 24h
DataSources:
  - DeviceEvents
Tactics:
  - Exfiltration
query: |
  
  let HostScreenshot= (Account_Name:string, Account_UPNSuffix:string){
    let p_Account_UPN = strcat(Account_Name,'@',Account_UPNSuffix);
    DeviceEvents 
    | where ActionType =='ScreenshotTaken' 
    | where InitiatingProcessAccountUpn =~ p_Account_UPN
    | summarize Count=count() by DeviceName
    | top 10 by Count desc
    | project Host_UnstructuredName=DeviceName
  };
  HostScreenshot('<Account_Name>', '<Account_UPNSuffix>')

Valid content

Id: 81d63625-6617-455d-b1e3-ee5ed989e5f8
DisplayName: Screenshots taken
Description: Summary of hosts on which the user has taken screenshots
InputEntityType: Account
InputFields:
  - Name + UPNSuffix
OutputEntityTypes:
  - Host
QueryPeriodBefore: 24h
QueryPeriodAfter: 24h
DataSources:
  - DeviceEvents
Tactics:
  - Exfiltration
query: |
  let HostScreenshot= (Account_Name:string, Account_UPNSuffix:string){
    let p_Account_UPN = strcat(Account_Name,'@',Account_UPNSuffix);
    DeviceEvents 
    | where ActionType =='ScreenshotTaken' 
    | where InitiatingProcessAccountUpn =~ p_Account_UPN
    | summarize Count=count() by DeviceName
    | top 10 by Count desc
    | project Host_UnstructuredName=DeviceName
  };
  HostScreenshot('<Account_Name>', '<Account_UPNSuffix>')