diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml
index 2b43eb0af1..4483ff8063 100644
--- a/detections/cloud/o365_added_service_principal.yml
+++ b/detections/cloud/o365_added_service_principal.yml
@@ -1,18 +1,17 @@
 name: O365 Added Service Principal
 id: 1668812a-6047-11eb-ae93-0242ac130002
-version: 1
-date: '2022-02-03'
+version: 2
+date: '2023-08-02'
 author: Rod Soto, Splunk
 status: production
 type: TTP
 description: This search detects the creation of a new Federation setting by alerting
   about an specific event related to its creation.
 data_source: []
-search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service
-  principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
-  as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
-  as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
-  Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created")  
+  | stats count by src_user src_user_type action Operation authentication_service Workload
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `o365_added_service_principal_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity
@@ -63,6 +62,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal.log
     sourcetype: o365:management:activity
     source: o365
diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml
index ea5b9d514e..5f6519b72b 100644
--- a/detections/cloud/o365_excessive_sso_logon_errors.yml
+++ b/detections/cloud/o365_excessive_sso_logon_errors.yml
@@ -1,7 +1,7 @@
 name: O365 Excessive SSO logon errors
 id: 8158ccc4-6038-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
+version: 2
+date: '2023-08-02'
 author: Rod Soto, Splunk
 status: production
 type: Anomaly
@@ -9,9 +9,11 @@ description: This search detects accounts with high number of Single Sign ON (SS
   logon errors. Excessive logon errors may indicate attempts to bruteforce of password
   or single sign on token hijack or reuse.
 data_source: []
-search: '`o365_management_activity`  Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired
-  | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress
-  UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed 
+  | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId Operation Workload
+  | where count >= 5
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `o365_excessive_sso_logon_errors_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity
@@ -55,6 +57,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2.json
     sourcetype: o365:management:activity
     source: o365
diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml
index d3a5f76e2e..2db5563348 100644
--- a/detections/cloud/o365_new_federated_domain_added.yml
+++ b/detections/cloud/o365_new_federated_domain_added.yml
@@ -1,16 +1,16 @@
 name: O365 New Federated Domain Added
 id: e155876a-6048-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
+version: 2
+date: '2023-08-02'
 author: Rod Soto, Splunk
 status: production
 type: TTP
 description: This search detects the addition of a new Federated domain.
 data_source: []
-search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
-  as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
-  UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`o365_management_activity` Operation IN("*add*", "*new*") AND Operation="*domain*"
+  | stats count by Workload Operation Target{}.ID Actor{}.ID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `o365_new_federated_domain_added_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity.
@@ -63,7 +63,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain.log
     sourcetype: o365:management:activity
-    source: exchange
+    source: o365
     update_timestamp: true