Update reconnaissance_web_server_discovery_or_fuzzing_activity.toml

Author: Aegrah

rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml

@@ -45,8 +45,8 @@ from
     http.request.method == "GET" and 
     http.response.status_code in (404, 403)
 
-| eval Esql_url_text  = case(url.original is not null, url.original, url.full)
-| eval Esql.url_lower = to_lower(Esql_url_text)
+| eval Esql.url_text  = case(url.original is not null, url.original, url.full)
+| eval Esql.url_lower = to_lower(Esql.url_text)
 
 | keep
     @timestamp,