Merge pull request #5269 from ep3p/patch-5

Fix "Vlaue" dictionary key in URLEntity_OfficeActivity.yaml

Detections/ThreatIntelligenceIndicator/URLEntity_OfficeActivity.yaml

@@ -37,7 +37,7 @@ query: |
     | extend Url = tostring(split(Url, ';')[0])
     | extend OfficeActivity_TimeGenerated = TimeGenerated
     // Project a single user identity that we can use for entity mapping
-    | extend User = iif(isnotempty(UserId), UserId, iif(isnotempty(Actor), tostring(parse_json(Actor)[0].ID), tostring(parse_json(Parameters)[0].Vlaue))) 
+    | extend User = iif(isnotempty(UserId), UserId, iif(isnotempty(Actor), tostring(parse_json(Actor)[0].ID), tostring(parse_json(Parameters)[0].Value)))
   ) on Url
   | where OfficeActivity_TimeGenerated < ExpirationDateTime
   | summarize OfficeActivity_TimeGenerated = arg_max(OfficeActivity_TimeGenerated, *) by IndicatorId, Url
@@ -53,5 +53,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: URLCustomEntity
-version: 1.2.1
+version: 1.2.2
 kind: Scheduled