Changes from comments

Detections/ThreatIntelligenceIndicator/URLEntity_PaloAlto.yaml

@@ -36,7 +36,7 @@ query: |
     //| where DeviceAction !~ "block-url"
     //Select logs where URL data is populated
     | extend Url = columnifexists("RequestURL", "None")
-    | extend Url = iif(Url == "", extract("([^\"]+)", 1, tolower(AdditionalExtensions)), trim('"', Url))
+    | extend Url = iif(isempty(Url), extract("([^\"]+)", 1, tolower(AdditionalExtensions)), trim('"', Url))
     | extend Url = iif(Url !startswith "http://" and ApplicationProtocol != "ssl", strcat('http://', Url), iif(Url !startswith "https://" and ApplicationProtocol == "ssl", strcat('https://', Url), Url))
     | where isnotempty(Url)
     | extend CSL_TimeGenerated = TimeGenerated