typo

splunk · Oct 26, 2023 · 697b23f · 697b23f
1 parent 74a138e
commit 697b23f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml
@@ -9,7 +9,7 @@ data_source:
 - UPDATE_DATA_SOURCE
 description: UPDATE_DESCRIPTION
 search: >
-  `o365_management_activity` `Workload=AzureActiveDirectory Operation="Update authorization policy."
+  `o365_management_activity` Workload=AzureActiveDirectory Operation="Update authorization policy."
   | eval index_number = if(mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps") >= 0, mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps"), -1)
   | search index_number >= 0 
   | eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number)