Merge pull request #14690 from Azure/v-sabiraj-updatethreatintellAR

Normalize URL matching in AuditLogs TI rule

Author: v-sabiraj

Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_AuditLogs.yaml

@@ -30,15 +30,15 @@ query: |
   let AuditEvents = materialize(AuditLogs
     | where TimeGenerated >= ago(dt_lookBack)
     // Extract the URL that is contained within the JSON data
-    | extend Url = extract("(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+)", 1,tostring(TargetResources))
+    | extend Url = tolower(extract("(http[s]?://[^\\s\\\"\\\\]+)", 1, tostring(TargetResources)))
     | extend userPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
     | extend TargetResourceDisplayName = tostring(TargetResources[0].displayName));
   let AuditUrls = AuditEvents | distinct Url = tolower(Url) | summarize make_list(Url);
   ThreatIntelIndicators
   //extract key part of kv pair
        | extend IndicatorType = replace(@"\[|\]|\""", "", tostring(split(ObservableKey, ":", 0)))
        | where IndicatorType == "url"
-       | extend Url = toupper(ObservableValue)
+       | extend Url = tolower(ObservableValue)
        | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
   | where TimeGenerated >= ago(ioc_lookBack)
   | where tolower(Url) in (AuditUrls)
@@ -78,5 +78,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: Url
-version: 1.2.10
+version: 1.2.11
 kind: Scheduled

Solutions/Threat Intelligence (NEW)/Data/Solution_ThreatIntelligenceUpdated.json

@@ -76,7 +76,7 @@
   ],
   "Metadata": "SolutionMetadata.json",
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Threat Intelligence (NEW)\\",
-  "Version": "3.0.19",
+  "Version": "3.0.20",
   "TemplateSpec": false,
   "StaticDataConnectorIds": [
     "ThreatIntelligenceTaxii",