Azure AD consent detections: repair Scope regex broken by a line wrap

[sbaker-gre]

Two Azure AD consent detections extract the granted permission list with

| rex field=permissions "Scope: (?<Scope> [ ^,]+)"

The two stray spaces turn the negated class [^,]+ into a literal class of space, caret and comma, so Scope never matches. fillnull then sets it to 0 and every finding reports the application was granted permission "0".

Affected detections

• Azure AD User Consent Blocked for Risky Application
• Azure AD OAuth Application Consent Granted By User

How it broke

• v4.16.0 (2023-11): Scope: (?<Scope>[^,]+)
• 195547e (2025-02-06, output normalization) wrapped the search across lines and split the pattern at (?<Scope> / [ ^,]+), leaving a line break and indentation inside the regex
• Add YAML Formatting Job #3889 (2026-02-25, YAML formatting job) folded the block back onto one line, turning the break into the spaces shipped today

Fix
Restore Scope: (?<Scope>[^,]+), the form three sibling detections in the same release already use. Version bumps on both detections.

Verification

• Live azure:monitor:aad "Consent to application" events, 45 days: shipped pattern matches 0 of 18, restored pattern matches 18 of 18.
• contentctl-ng build passes; unit tests pass in a local Splunk 10.4 container with CIM 8.5.0 and Splunk_TA_microsoft-cloudservices 6.3.3.
• Note for reviewers: the unit test cannot catch this class of bug. The fixture holds one consent event, and the tester passes on any non-zero result count, so a non-matching regex still yields one row. Correctness of Scope was checked on live data.

🤖 Generated with Claude Code