From 2bcae0cee7f08f17935e507bab541f8a140ca219 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sat, 20 Apr 2024 14:26:58 -0400
Subject: [PATCH] Update o365_application_available_to_other_tenants.yml

Better User / ServicePrincipal parsing from Actor field
---
 .../cloud/o365_application_available_to_other_tenants.yml     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml
index a05cc9ccb7..2131c7b46a 100644
--- a/detections/cloud/o365_application_available_to_other_tenants.yml
+++ b/detections/cloud/o365_application_available_to_other_tenants.yml
@@ -9,7 +9,7 @@ description: The following analytic identifies the configuration of Azure Active
 data_source: 
 - Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add application.","Update application.") ModifiedProperties{}.Name=AvailableToOtherTenants
-| eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',"AvailableToOtherTenants")),"false"),"removed",true(),"added"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = "AvailableToOtherTenants", user = mvindex('Actor{}.ID',0)
+| eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',"AvailableToOtherTenants")),"false"),"removed",true(),"added"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = "AvailableToOtherTenants", user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',1),true(),mvindex('Actor{}.ID',0))
 | search result = "added"
 | stats values(ActorIpAddress) as src, count, min(_time) as firstTime, max(_time) as lastTime by signature, user, object, object_name, object_attrs, result
 | `security_content_ctime(firstTime)` 
@@ -61,4 +61,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
     sourcetype: o365:management:activity
-    source: o365
\ No newline at end of file
+    source: o365