diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml
index 6401427b3e..82698acb6c 100644
--- a/detections/cloud/o365_cross_tenant_access_change.yml
+++ b/detections/cloud/o365_cross_tenant_access_change.yml
@@ -33,11 +33,11 @@ tags:
   - T1484.002
   observable: 
   - name: user
-    type: user
+    type: User
     role:
     - Victim
   - name: object_attrs
-    type: object
+    type: Other
     role:
     - Attacker
   product: