Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml using wrong ActivityDisplayName

[quangmsft]

Describe the bug
This analytic rule template is querying for

AuditLogs
  | where ActivityDisplayName =~'Add member to role completed (PIM activation)'
  | where Result =~ "failure"

Which does not return any results

To Reproduce
Steps to reproduce the behavior:
Run the query in Log Analytics and get no results

Expected behavior
The query should return results for failed/rejected PIM request

Additional context
Using the query below instead would return results for rejected PIM request. This might be because the ActivityDisplayName has been updated in the logs, so where it used to be 'Add member to role completed (PIM activation)' the product has been changed and now is generating 'Add member to role request denied (PIM activation)'.

AuditLogs
| where ActivityDisplayName =~'Add member to role request denied (PIM activation)'

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-sudkharat]

Hi @quangmsft, thanks for flagging this issue, we will soon get back to you on this. Thanks!

[v-rbajaj]

Hi @quangmsft, we have reached out to concerned team for this issue, we will get back to you once there is an update

[v-rbajaj]

Hi @quangmsft, thanks for suggesting this change.

We have checked the documentation here could see both of them are still referenced Add member to role request denied (PIM activation) or Add member to role completed (PIM activation)

So we have decided that we will update query with the following code change and will raise a PR.

AuditLogs
 | where (ActivityDisplayName =~'Add member to role completed (PIM activation)' and Result =~ "failure") or ActivityDisplayName =~'Add member to role request denied (PIM activation)'

Since this can take some time to get live on the solution, you can update it manually for the time being.