[qayyum-jfreaks]

Change(s):

• WhoisFreaks solution bumped to 3.0.2 (Data/Solution_WhoisFreaks.json, SolutionMetadata.json, Package/mainTemplate.json, new Package/3.0.2.zip).
• Analytic Rules/WhoisFreaks-HighConfidenceThreat.yaml: confidence filter changed from toint(confidence) >= 80 or confidence =~ "high" to todouble(confidence) >= 0.8; rule description now states the 0 to 1 confidence scale and the 0.8 threshold.
• Analytic Rules/WhoisFreaks-FreshNRD-Burst.yaml: fixed threshold of 5,000 distinct domains per hour replaced with a daily baseline comparison. The rule now runs daily over an 8-day window and alerts when the last 24 hours of distinct NRD domains is at least 50% above the average of the previous seven daily loads and more than three standard deviations from it. Requires at least three baseline days.
• Package/createUiDefinition.json: workspace dropdown filters on the exact resource group path, and a workspace region field with a mismatch warning was added (3.0.1).
• ReleaseNotes.md: added 3.0.1 and 3.0.2 rows.

Reason for Change(s):

• The WhoisFreaks threat feed reports confidence as a decimal between 0 and 1 (for example 1.0). The previous integer comparison never matched, so the high-confidence rule could never fire.
• WhoisFreaks NRD feeds are polled once per day and deliver roughly 250k to 300k domains in a single poll. The 5,000-per-hour threshold therefore fired on every normal daily load and produced no signal. The baseline query alerts only on an abnormal day.
• The createUiDefinition resource-group filter used a substring match that could list workspaces from other resource groups with similar names, and deployments to a region other than the workspace's region could fail silently.
• ReleaseNotes.md only listed 3.0.0 while the package had moved to 3.0.1.

Version Updated:

• Yes
• WhoisFreaks-HighConfidenceThreat: 1.0.0 -> 1.0.1
• WhoisFreaks-FreshNRD-Burst: 1.0.0 -> 1.0.1
• Solution package: 3.0.0 -> 3.0.2. Version 3.0.1 (createUiDefinition workspace and region fixes) was published to Content Hub through Partner Center on 16-10-2026 but never committed to this repo; this PR includes its package and release-note row so GitHub matches the published offer, then adds 3.0.2.

[v-rusraut]

Hi qayyum-jfreaks ,
Please update the Change History description in the release notes and keep it concise, preferably one or two lines only.

Also, please provide screenshots showing:

The data connector is connected successfully.
The data is being ingested successfully.
The Analytics Rule query is running successfully.

[qayyum-jfreaks]

Hi qayyum-jfreaks , Please update the Change History description in the release notes and keep it concise, preferably one or two lines only.

Also, please provide screenshots showing:

The data connector is connected successfully. The data is being ingested successfully. The Analytics Rule query is running successfully.

v-rusraut