Update Azure Firewall - Abnormal Port to Protocol.yaml

Author: v-kasghosh

Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml

@@ -66,8 +66,7 @@ query: |
   | join kind=leftouter (LearningPortToProtocol1) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
   | where LearningTimeProtocol != AlertTimeProtocol),
   (AlertTimePortToProtocol2 
-  | join kind=leftouter (LearningPortToProtocol2) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
-  | where LearningTimeProtocol != AlertTimeProtocol),
+  | join kind=leftanti (LearningPortToProtocol2) on $left.AlertTimeDstPort == $right.LearningTimeDstPort, $left.AlertTimeProtocol == $right.LearningTimeProtocol),
   (AlertTimePortToProtocol3 
   | join kind=leftouter (LearningPortToProtocol3) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
   | where LearningTimeProtocol != AlertTimeProtocol))