diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
index ded1815871..c60d8b286d 100644
--- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
@@ -24,7 +24,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI
   | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
   | eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress
   | eval  upperBound=(ip_avg+ip_std*3)
-  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1
   | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
   log category.