diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml
index ad209b99b8..46ddb6a39c 100644
--- a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml	
+++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml	
@@ -44,8 +44,8 @@ entityMappings:
       - identifier: DisplayName
         columnName: Name
       - identifier: FullName
-        columnName: User_Id
+        columnName: User_id
       - identifier: UPNSuffix
         columnName: UPNSuffix
-version: 1.0.2
-kind: Scheduled
\ No newline at end of file
+version: 1.0.3
+kind: Scheduled