Order Entra brute-force series before anomaly calc

Adds an explicit `sort by TimeGenerated asc` before building `make_list` arrays in the Entra authenticated Windows device brute-force analytic rule, ensuring time-series values are ordered correctly for anomaly decomposition. Bumps the rule version from 2.0.2 to 2.0.3 to reflect the query update.

Author: v-sabiraj

Solutions/Microsoft Entra ID/Analytic Rules/BruteForceAgainstanEntraAuthenticatedWindowsDevice.yaml

@@ -26,6 +26,7 @@ query: |
                             by bin(TimeGenerated, authenticationWindow), UserDisplayName, UserPrincipalName
   | extend FailureSuccessDiff = FailureCount - SuccessCount
   | where FailureSuccessDiff > 0
+  | sort by TimeGenerated asc
   | summarize Diff = make_list(FailureSuccessDiff, 10000), TimeStamp = make_list(TimeGenerated, 10000) by UserDisplayName, UserPrincipalName//, tostring(IPAddresses)
   | extend (Anomalies, Score, Baseline) = series_decompose_anomalies(Diff, sensitivity, -1, 'linefit')  
   | mv-expand Diff to typeof(double), TimeStamp to typeof(datetime), Anomalies to typeof(double), Score to typeof(double), Baseline to typeof(long)
@@ -66,5 +67,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPAddressFirst    
-version: 2.0.2
+version: 2.0.3
 kind: Scheduled