From 2331d4e2158ce2d140339acadeea952217014ac9 Mon Sep 17 00:00:00 2001
From: Kevin Friedemann <kfriedemann@microsoft.com>
Date: Thu, 5 Oct 2023 17:19:32 -0400
Subject: [PATCH] Removed entity to meet 5 maximum requirement

---
 .../Analytic Rules/PossibleWebpBufferOverflow.yaml            | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/Solutions/Microsoft 365 Defender/Analytic Rules/PossibleWebpBufferOverflow.yaml b/Solutions/Microsoft 365 Defender/Analytic Rules/PossibleWebpBufferOverflow.yaml
index 37103a77832..c50561d78f5 100644
--- a/Solutions/Microsoft 365 Defender/Analytic Rules/PossibleWebpBufferOverflow.yaml	
+++ b/Solutions/Microsoft 365 Defender/Analytic Rules/PossibleWebpBufferOverflow.yaml	
@@ -41,10 +41,6 @@ entityMappings:
   fieldMappings:
   - identifier: ProcessId
     columnName: InitiatingProcessId
-- entityType: Process
-  fieldMappings:
-  - identifier: CommandLine
-    columnName: InitiatingProcessCommandLine
 - entityType: Process
   fieldMappings:
   - identifier: CommandLine