admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

typo

Browse Source
This commit is contained in:
mvelazco
2023-10-26 18:04:33 -04:00
parent 74a138e96e
commit 697b23ff08
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml
+1 -1
View File
@@ -9,7 +9,7 @@ data_source:
- UPDATE_DATA_SOURCE
description: UPDATE_DESCRIPTION
search: >
`o365_management_activity` `Workload=AzureActiveDirectory Operation="Update authorization policy."
`o365_management_activity` Workload=AzureActiveDirectory Operation="Update authorization policy."
| eval index_number = if(mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps") >= 0, mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps"), -1)
| search index_number >= 0
| eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number)