Enhancment for MicrosoftEntraID (#43586)

* enhancment for MicrosoftEntraID

* added release notes

* added release notes

Author: sharonfi99

Packs/MicrosoftEntraID/ModelingRules/MicrosoftEntraID/MicrosoftEntraID.xif

@@ -185,6 +185,7 @@ filter category in("Administrative", "Policy", "Alert") and (CategoryValue = nul
 | alter
         xdm.event.type = arrayindex(split(operationName, "/"), 0),
         xdm.target.cloud.project_hierarchy = if(arraystring(split(properties -> hierarchy, "/"), "") != "", split(properties -> hierarchy, "/"), arraystring(arraycreate(properties -> tenantId, properties -> subscriptionId), "") != "", arraycreate(properties -> tenantId, properties -> subscriptionId), null),
+        xdm.target.cloud.project_id = if(json_extract_scalar(properties , "$.subscriptionId") != null, json_extract_scalar(properties , "$.subscriptionId"), arraystring(split(properties -> hierarchy, "/"), "") != "", arrayindex(split(properties -> hierarchy, "/"), -1)),
         xdm.network.rule = if(category = "Policy", to_string (properties -> policies), null),
         xdm.alert.severity = if(to_string(SEVERITY) != "" and to_string(SEVERITY) != null, to_string(SEVERITY), null),
         xdm.alert.name = if(ALERT_NAME != "" and ALERT_NAME != null, ALERT_NAME, ruleName != "" and ruleName != null, ruleName, null),

Packs/MicrosoftEntraID/ReleaseNotes/1_0_25.md

@@ -0,0 +1,6 @@
+
+#### Modeling Rules
+
+##### Microsoft Entra ID Modeling Rule
+
+Updated the Microsoft Entra ID Modeling Rule to map the Subscription ID from Resource logs into **xdm.target.cloud.project_id**.

Packs/MicrosoftEntraID/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Azure Logs",
     "description": "Normalizes various Azure logs to the Cortex Data Model (XDM) schema, including Azure Entra ID events ingested via the Office 365 data source and Azure logs ingested via the Azure Event Hub data source.",
     "support": "xsoar",
-    "currentVersion": "1.0.24",
+    "currentVersion": "1.0.25",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",