version bump

detections/cloud/o365_application_registration_owner_added.yml

@@ -1,6 +1,6 @@
 name: O365 Application Registration Owner Added
 id: c068d53f-6aaa-4558-8011-3734df878266
-version: 4
+version: 5
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_concurrent_sessions_from_different_ips.yml

@@ -1,6 +1,6 @@
 name: O365 Concurrent Sessions From Different Ips
 id: 58e034de-1f87-4812-9dc3-a4f68c7db930
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_cross_tenant_access_change.yml

@@ -1,6 +1,6 @@
 name: O365 Cross-Tenant Access Change
 id: 7c0fa490-12b0-4d0b-b9f5-e101d1e0e06f
-version: 4
+version: 5
 date: '2024-11-14'
 author: Steven Dick
 status: production

detections/cloud/o365_disable_mfa.yml

@@ -1,6 +1,6 @@
 name: O365 Disable MFA
 id: c783dd98-c703-4252-9e8a-f19d9f5c949e
-version: 5
+version: 6
 date: '2024-11-14'
 author: Rod Soto, Splunk
 status: production

detections/cloud/o365_excessive_sso_logon_errors.yml

@@ -1,6 +1,6 @@
 name: O365 Excessive SSO logon errors
 id: 8158ccc4-6038-11eb-ae93-0242ac130002
-version: 6
+version: 7
 date: '2024-11-14'
 author: Rod Soto, Splunk
 status: production

detections/cloud/o365_external_guest_user_invited.yml

@@ -1,6 +1,6 @@
 name: O365 External Guest User Invited
 id: 8c6d52ec-d5f2-4b2f-8ba1-f32c047a71fa
-version: 4
+version: 5
 date: '2024-11-14'
 author: Steven Dick
 status: production

detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml

@@ -1,6 +1,6 @@
 name: O365 File Permissioned Application Consent Granted by User
 id: 6c382336-22b8-4023-9b80-1689e799f21f
-version: 4
+version: 5
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml

@@ -1,6 +1,6 @@
 name: O365 Mail Permissioned Application Consent Granted by User
 id: fddad083-cdf5-419d-83c6-baa85e329595
-version: 4
+version: 5
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml

@@ -1,6 +1,6 @@
 name: O365 Multiple AppIDs and UserAgents Authentication Spike
 id: 66adc486-224d-45c1-8e4d-9e7eeaba988f
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml

@@ -1,6 +1,6 @@
 name: O365 Multiple Failed MFA Requests For User
 id: fd22124e-dbac-4744-a8ce-be10d8ec3e26
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml

@@ -1,6 +1,6 @@
 name: O365 Multiple Mailboxes Accessed via API
 id: 7cd853e9-d370-412f-965d-a2bcff2a2908
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 data_source:

detections/cloud/o365_new_forwarding_mailflow_rule_created.yml

@@ -1,6 +1,6 @@
 name: O365 New Forwarding Mailflow Rule Created
 id: 289ed0a1-4c78-4a43-9321-44ea2e089c14
-version: 4
+version: 5
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 data_source: []

detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml

@@ -1,6 +1,6 @@
 name: O365 OAuth App Mailbox Access via EWS
 id: e600cf1a-0bef-4426-b42e-00176d610a4d
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production

detections/cloud/o365_pst_export_alert.yml

@@ -1,6 +1,6 @@
 name: O365 PST export alert
 id: 5f694cc4-a678-4a60-9410-bffca1b647dc
-version: 5
+version: 6
 date: '2024-11-14'
 author: Rod Soto, Splunk
 status: production

detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml

@@ -1,6 +1,6 @@
 name: O365 SharePoint Allowed Domains Policy Changed
 id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c
-version: 5
+version: 6
 date: '2024-11-14'
 author: Steven Dick
 status: production