changes

splunk · Nov 9, 2023 · d463865 · d463865
1 parent 3151599
commit d463865
Showing 1 changed file with 0 additions and 5 deletions.
diff --git a/detections/cloud/o365_multi_source_failed_authentications_spike.yml b/detections/cloud/o365_multi_source_failed_authentications_spike.yml
@@ -35,11 +35,6 @@ tags:
   - T1110
   - T1110.003
   - T1110.004
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security