TI Map Domain entity to Cloud App Events

[defend-pippa]

Describe the bug
Detection "TI Map Domain entity to Cloud App Events" does not work. https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat%20Intelligence%20(NEW)/Analytic%20Rules/DomainEntity_CloudAppEvents_Updated.yaml

To Reproduce

1. Line 32: extend DomainName = tolower(IndicatorType) - should be tolower(ObservableValue)
2. list_tlds (declared line 24) is never used
3. Line 53: extend PAUrl = columnifexists("RequestURL", "None") - RequestURL is not part of the CloudAppEvents schema (see closed issue TI map Domain entity to Cloud App Events #12348)
4. Because CloudAppEvents will never have a result in the innerunique join on line 49, this detection will never trigger.

[v-utpalkumar]

Hello defend-pippa, thank you for highlighting this! We’ll examine it further and provide you with updates once we have more information. Thanks!