Update DomainEntity_SecurityAlert.yaml

Azure · Aug 9, 2023 · 317ce89 · 317ce89
1 parent 7cc1f69
commit 317ce89
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml
@@ -31,8 +31,8 @@ query: |
   // Create a list of TLDs in our threat feed for later validation
   let list_tlds = ThreatIntelligenceIndicator
     | where TimeGenerated >= ago(ioc_lookBack)
-    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
     | where Active == true and ExpirationDateTime > now()
+    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
     | where isnotempty(DomainName)
     | extend parts = split(DomainName, '.')
     | extend tld = parts[(array_length(parts)-1)]