ad parser schema; fix entity

.script/tests/KqlvalidationsTests/CustomTables/VMwareESXi.json

@@ -0,0 +1,81 @@
+{
+    "name": "VMwareESXi",
+    "Properties": [
+        {
+            "Name": "TenantId",
+            "Type": "String"
+        },
+        {
+            "Name": "SourceSystem",
+            "Type": "String"
+        },
+        {
+            "Name": "TimeGenerated",
+            "Type": "DateTime"
+        },
+        {
+            "Name": "Computer",
+            "Type": "String"
+        },
+        {
+            "Name": "EventTime",
+            "Type": "DateTime"
+        },
+        {
+            "Name": "Facility",
+            "Type": "String"
+        },
+        {
+            "Name": "HostName",
+            "Type": "String"
+        },
+        {
+            "Name": "SeverityLevel",
+            "Type": "String"
+        },
+        {
+            "Name": "SyslogMessage",
+            "Type": "String"
+        },
+        {
+            "Name": "ProcessID",
+            "Type": "Int"
+        },
+        {
+            "Name": "HostIP",
+            "Type": "String"
+        },
+        {
+            "Name": "ProcessName",
+            "Type": "String"
+        },
+        {
+            "Name": "MG",
+            "Type": "String"
+        },
+        {
+            "Name": "Type",
+            "Type": "String"
+        },
+        {
+            "Name": "_ResourceId",
+            "Type": "String"
+        },
+        {
+            "Name": "Sub",
+            "Type": "String"
+        },
+        {
+            "Name": "OpId",
+            "Type": "String"
+        },
+        {
+            "Name": "UserName",
+            "Type": "String"
+        },
+        {
+            "Name": "Message",
+            "Type": "String"
+        }
+    ]
+}

Solutions/VMWareESXi/Analytic Rules/ESXiRootImpersonation.yaml

@@ -21,7 +21,7 @@ query: |
   | extend user = 'root'
   | extend AccountCustomEntity = user
 entityMappings:
-  - entityType: Accounr
+  - entityType: Account
     fieldMappings:
       - identifier: Name
         columnName: AccountCustomEntity