Creating Analytic Rule for URL IOC

[v-utpalkumar]

Change(s):

• This is a new rule.

Reason for Change(s):

• The rule based on domain-name IOC is already in place, but the customer is requesting a rule based on url IOC also.

Version Updated:

• Not required (new rule)

Testing Completed: Below is a summary of the testing performed, including the corresponding screenshots.

• The query was executed in the Log Analytics workspace and returned no errors.
• The main template has been successfully deployed without errors.
• Validation completed successfully, and the analytic rule was saved as part of the Sentinel Custom deployment.

[contentautomationbot]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[v-utpalkumar]

Test Screenshots Document: Threat_Intelligence_URL_WebSession.docx

[Copilot]

Pull request overview

This PR introduces a new analytic rule for URL-based Indicator of Compromise (IOC) detection, complementing the existing domain-name IOC rule at customer request.

Changes:

• Added new analytic rule URLEntity_imWebSession.yaml to detect malicious URLs in web session events using ASIM schema
• Updated solution metadata to reflect the addition of the 52nd analytic rule
• Added release notes entry for version 3.0.14

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 2 comments.

File	Description
Solutions/Threat Intelligence (NEW)/ReleaseNotes.md	Documents the addition of URL IOC analytic rule in version 3.0.14
Solutions/Threat Intelligence (NEW)/Package/createUiDefinition.json	Updates UI definition to include the new analytic rule and increments total count to 52
Solutions/Threat Intelligence (NEW)/Data/Solution_ThreatIntelligenceUpdated.json	Adds reference to the new URLEntity_imWebSession.yaml rule file
Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_imWebSession.yaml	New analytic rule file implementing URL IOC detection against web session events

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rahul0216]

Please address the inline comments.

[rahul0216]

Looks good.