Merge pull request #2854 from splunk/fix_obs_type

fix incorrect observable type

detections/cloud/azure_ad_user_enabled_and_password_reset.yml

@@ -14,8 +14,8 @@ search: ' `azuread` (operationName="Enable account" OR operationName="Reset pass
   OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName
   startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m 
   | rename properties.* as * | rename targetResources{}.userPrincipalName
-  as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
-  | stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName,
+  as user | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(operationName) values(initiatedBy) as initiatedBy by _time, user,
   result | `azure_ad_user_enabled_and_password_reset_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -36,12 +36,12 @@ tags:
   mitre_attack_id:
   - T1098
   observable:
-  - name: userPrincipalName
-    type: User Name
+  - name: user
+    type: User
     role:
     - Victim
   - name: initiatedBy
-    type: User Name
+    type: User
     role:
     - Attacker
   product:

detections/endpoint/detect_certify_with_powershell_script_block_logging.yml

@@ -39,7 +39,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: command

detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml

@@ -57,11 +57,11 @@ tags:
       role:
         - Victim
     - name: src_user
-      type: User Name
+      type: User
       role:
         - Victim
     - name: user
-      type: User Name
+      type: User
       role:
         - Victim
     - name: ssl_hash

detections/endpoint/windows_suspect_process_with_authentication_traffic.yml

@@ -55,7 +55,7 @@ tags:
       role:
         - Victim
     - name: user
-      type: User Name
+      type: User
       role:
         - Victim
     - name: process_name