Update NRT_AuthenticationMethodsChangedforVIPUsers.yaml (#11736)

Added square brackets to watchlist query because column names with spaces cannot be referenced by just using ".

Author: AndreasRogge

Solutions/Microsoft Entra ID/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml

@@ -15,7 +15,7 @@ tags:
   - AADSecOpsGuide
 query: |
   let security_info_actions = dynamic(["User registered security info", "User changed default security info", "User deleted security info", "Admin updated security info", "User reviewed security info", "Admin deleted security info", "Admin registered security info"]);
-  let VIPUsers = (_GetWatchlist('VIPUsers') | distinct "User Principal Name");
+  let VIPUsers = (_GetWatchlist('VIPUsers') | distinct ["User Principal Name"]);
   AuditLogs
   | where Category =~ "UserManagement"
   | where ActivityDisplayName in (security_info_actions)
@@ -62,5 +62,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: InitiatingIpAddress
-version: 1.0.3
+version: 1.0.4
 kind: NRT