Update o365_cross_tenant_access_change.yml

splunk · May 4, 2024 · fa0e309 · fa0e309
1 parent 86103ec
commit fa0e309
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml
@@ -33,11 +33,11 @@ tags:
   - T1484.002
   observable: 
   - name: user
-    type: user
+    type: User
     role:
     - Victim
   - name: object_attrs
-    type: object
+    type: Other
     role:
     - Attacker
   product: