Don't filter on arbitrary id

Detections/ThreatIntelligenceIndicator/DomainEntity_DnsEvents.yaml

@@ -30,10 +30,9 @@ query: |
     | summarize make_list(tld);
     ThreatIntelligenceIndicator
     | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
-    | where isnotempty(DomainName)
     | where Active == true
     // Picking up only IOC's that contain the entities we want
-    | where ExternalIndicatorId startswith 'domain'
+    | where isnotempty(DomainName)
     | join (
          DnsEvents
         | where TimeGenerated > ago(dt_lookBack)