From 63dcb7f00fb89c42ce0df99c9e334a3e66d88614 Mon Sep 17 00:00:00 2001
From: Marc Schwede <9077622+schwedenmut@users.noreply.github.com>
Date: Tue, 1 Mar 2022 14:04:36 +0100
Subject: [PATCH] Update o365_excessive_authentication_failures_alert.yml

rename syntax adjusted
later needed lastTime included
---
 .../cloud/o365_excessive_authentication_failures_alert.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index 65dece8106..f778569c34 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -8,7 +8,7 @@ datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes
 search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
-  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod 
+  | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod 
   values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
   | where count > 10 
   | `security_content_ctime(firstTime)`