diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml
index bfdec76ee6..792cd43ea5 100644
--- a/detections/cloud/o365_applicationimpersonation_role_assigned.yml
+++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml
@@ -50,6 +50,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/application_impersonation_role_assigned/application_impersonation_role_assigned.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/application_impersonation_role_assigned.log
     source: O365
     sourcetype: o365:management:activity
diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index e8bad136a8..13a8f65441 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -22,7 +22,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/
 tags:
   analytic_story:
-  - Office 365 Detections
+  - O365 Identity Compromise Techniques
   asset_type: Office 365
   confidence: 80
   impact: 80
diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml
index d31bcd99a4..942d3a6328 100644
--- a/detections/cloud/o365_excessive_sso_logon_errors.yml
+++ b/detections/cloud/o365_excessive_sso_logon_errors.yml
@@ -17,7 +17,7 @@ references:
 - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
 tags:
   analytic_story:
-  - Office 365 Detections
+  - O365 Identity Compromise Techniques
   - Cloud Federated Credential Abuse
   asset_type: Office 365
   confidence: 80
diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml
index 7fc381ba04..0679f797bc 100644
--- a/detections/cloud/o365_suspicious_user_email_forwarding.yml
+++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml
@@ -19,7 +19,7 @@ known_false_positives: unknown
 references: []
 tags:
   analytic_story:
-  - Office 365 Detections
+  - O365 Compromised Identity Abuse
   - Data Exfiltration
   asset_type: Office 365
   confidence: 60