Query Period Value Incosistency

[kevinbasoftcat]

Describe the bug
The query period set in the template link below is 70m. When this is deployed and then referenced the return value is 1h10m. Could the template be updated to match the value once deployed so that any automated deployment of these templates does not see this as a changing value.

Azure-Sentinel/Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousServicePrincipalcreationactivity.yaml

Line 12 in b228a2f

queryPeriod: 70m

To Reproduce
We currently utilise an autoamted solution using terraform to install the Content Hub solution and then deploy the rule templates using the data contained within the template. After an initial deployment an additional re-run will return the value change due to the template containing different settings to the deployed value.

Expected behavior
The template query value should match the value of the setting once deployed.

Screenshots

Additional context
Updating the template value to 1h10m rather than 70m will then allow the values to match.

[v-visodadasi]

Hi @kevinbasoftcat , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!