What Changed
URLEntity_AuditLogs.yaml (v1.2.10 to v1.2.11) in the Threat Intelligence (NEW) solution (solution bumped to v3.0.20).
Two logic changes in the KQL:
URL extraction regex simplified: the extract() pattern changed from a broad RFC-style character class to http[s]?://[^\s"\]+, improving extraction reliability from JSON-serialized TargetResources.
Case normalization corrected: Indicator ObservableValue was previously cast to toupper() before comparison, while AuditLogs URLs were normalized to tolower(). This guaranteed a mismatch for any mixed-case URL IoC. Both sides are now lowercased before comparison.
Security Impact
Any URL indicator in ThreatIntelIndicators with mixed-case characters (common in domain portions of URLs) would never match against AuditLogs events, regardless of actual overlap. This is a detection blind spot: the rule was generating zero alerts for affected indicators since the toupper() vs tolower() comparison mismatch made matching structurally impossible.
Deployments running v1.2.10 of this rule should treat all URL IoC hits against AuditLogs as unverified prior to this fix. After updating to v1.2.11, expect potential alert volume from previously suppressed matches.
Affected Files
Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_AuditLogs.yaml
(packaging artefacts: 3.0.20.zip, ReleaseNotes.md, Solution_ThreatIntelligenceUpdated.json, mainTemplate.json)