Update o365_sharepoint_suspicious_search_behavior.yml

splunk · Jan 15, 2025 · fb41db9 · fb41db9
1 parent 0adf977
commit fb41db9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml
@@ -32,7 +32,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 - name: Investigate search behavior by $user$ 
-  search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = $user|s$'
+  search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 tags: