Merge pull request #12428 from Azure/v-sabiraj-updatingrule

Update IPEntity_CustomSecurityLog.yaml

Author: v-atulyadav

Solutions/Threat Intelligence/Analytic Rules/IPEntity_CustomSecurityLog.yaml

@@ -45,7 +45,7 @@ query: |
         CommonSecurityLog
         | where TimeGenerated >= ago(dt_lookBack)
         | extend MessageIP = extract(IPRegex, 0, Message)
-        | extend CS_ipEntity = iff(isnotempty(SourceIP), SourceIP, DestinationIP)
+        | extend CS_ipEntity = iff((not(ipv4_is_private(SourceIP)) and isnotempty(SourceIP)), SourceIP, DestinationIP)
         | extend CS_ipEntity = iff(isempty(CS_ipEntity) and isnotempty(MessageIP), MessageIP, CS_ipEntity)
         | extend CommonSecurityLog_TimeGenerated = TimeGenerated
     )
@@ -65,5 +65,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: SourceIP       
-version: 1.2.3
+version: 1.2.4
 kind: Scheduled