Tune Azure Firewall deny/protocol detections for Azure Firewall

[v-kasghosh]

Refines two Azure Firewall analytic rule queries to reduce noise and improve matching accuracy. The abnormal port-to-protocol rule now uses a leftanti join with both destination port and protocol to only flag unseen combinations. The several-deny-actions rule replaces placeholder threshold references with real variables, raises network-rule-specific sensitivity, and aggregates network protocols before emitting a combined protocol value.

Required items, please complete

Change(s):

• Abnormal Port to Protocol.yaml
• SeveralDenyActionsRegistered.yaml

Reason for Change(s):

• Azure Firewall - Abnormal Port to Protocol.yaml and SeveralDenyActionsRegistered.yaml #14328

Version Updated:

• 1.1.5
• 1.1.3
• 3.07

Testing :

[contentautomationbot]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.