fixing macro

splunk · Oct 10, 2023 · 40298ce · 40298ce
1 parent a2d6aee
commit 40298ce
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml
@@ -7,7 +7,7 @@ status: production
 type: TTP
 data_source: []
 description: UPDATE_DESCRIPTION
-search: ' o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon 
+search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon 
   |  bucket span=5m _time
   |  stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip
   |  where unique_accounts > 10