fix

splunk · Oct 10, 2023 · 69bd526 · 69bd526
1 parent 0a08f14
commit 69bd526
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml
@@ -32,10 +32,10 @@ tags:
   - T1110.003
   - T1110.004
   observable:
-  - name: UPDATE
-    type: UPDATE
+  - name: src_ip
+    type: IP Address
     role:
-    - UPDATE
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security