arm ttk fixes

Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Guest user exfiltration following Power Platform defense impairment.yaml

@@ -92,6 +92,7 @@ query: |
       TenantIsolationRemovalTimestamp,
       GroupRemovalTimestamp,
       InstanceUrl,
+      EnvironmentId,
       AccountName,
       UPNSuffix,
       GuestAccountName,
@@ -125,5 +126,5 @@ alertDetailsOverride:
     isolation and removed the security group used to control access to {{{InstanceUrl}}.
     Exfiltration alerts associated with guest users were then detected from user {{{GuestUser}}'
 customDetails:
-  EnvironmentId: EnvironmentId
+  Environment: EnvironmentId
 version: 3.2.0

Solutions/Microsoft Business Applications/Analytic Rules/Power Apps - App activity from unauthorized geo.yaml

@@ -79,7 +79,6 @@ alertDetailsOverride:
   alertDescriptionFormat: 'User {{ActorName}} activity associated with app {{AppName}}
     from an unauthorized geolocation: {{Location}}'
 customDetails:
-  EnvironmentId: EnvironmentId
-  PowerAppsAppName: AppName
-  PowerAppsAppId: AppId
+  Environment: EnvironmentId
+  App: AppId
 version: 3.2.0

Solutions/Microsoft Business Applications/Analytic Rules/Power Apps - Bulk sharing of Power Apps to newly created guest users.yaml

@@ -109,6 +109,6 @@ alertDetailsOverride:
     domains. List of domain s {{InvitedDomains}}'
 customDetails:
   EnvironmentName: EnvironmentName
-  EnvironmentId: EnvironmentId
+  Environment: EnvironmentId
   PowerAppsAppName: AppName
-version: 3.1.3
+version: 3.2.0

Solutions/Microsoft Business Applications/Analytic Rules/Power Apps - Multiple users access a malicious link after launching new app.yaml

@@ -188,8 +188,8 @@ alertDetailsOverride:
     app {{AppName}}.  Click here to navigate to the Power Apps Portal to examine the
     app: https://make.powerapps.com/environments/{{EnvironmentId}}/apps'
 customDetails:
-  EnvironmentId: EnvironmentId
+  Environment: EnvironmentId
   PowerAppsAppName: AppName
-  PowerAppsAppId: AppId
+  PowerAppsApp: AppId
   AppCreator: AppCreator
 version: 3.2.0

Solutions/Microsoft Business Applications/Analytic Rules/Power Automate - Departing employee flow activity.yaml

@@ -66,6 +66,6 @@ alertDetailsOverride:
   alertDescriptionFormat: '{{ActorName}} is on the terminated employees watchlist
     and carried out {{EventOriginalType}} in environment id {{EnvironmentId}}.'
 customDetails:
-  EnvironmentId: EnvironmentId
+  Environment: EnvironmentId
   FlowDetails: FlowId
 version: 3.2.0

Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - Connector added to a sensitive environment.yaml

@@ -61,6 +61,6 @@ alertDetailsOverride:
   alertDescriptionFormat: '{{ActorName}} added a new API connector in environment
     id {{EnvironmentId}}. This environment has been listed as sensitive.'
 customDetails:
-  EnvironmentId: EnvironmentId
-  ConnectionId: ConnectionId
+  Environment: EnvironmentId
+  Connection: ConnectionId
 version: 3.2.0

Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - DLP policy updated or removed.yaml

@@ -82,6 +82,6 @@ alertDetailsOverride:
   alertDescriptionFormat: A DLP policy {{PolicyName}} was as modfiied or deleted.
     Event type {{EventType}}
 customDetails:
-  PolicyId: PolicyId
+  Policy: PolicyId
   PolicyName: PolicyName
-version: 3.1.3
+version: 3.2.0

Solutions/Microsoft Business Applications/Data Connectors/DynamicsFinOpsPollerConnector/DynamicsFinOps_PollingConfig.json

@@ -21,7 +21,7 @@
                 "ClientSecret": "[[parameters('clientSecret')]",
                 "ClientId": "[[parameters('clientId')]",
                 "GrantType": "client_credentials",
-                "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]",
+                "TokenEndpoint": "[[concat('https://login.', 'microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]",
                 "TokenEndpointHeaders": {
                     "Content-Type": "application/x-www-form-urlencoded"
                 },