From 3f6eda261ed485e1813ef974043250081bcfa847 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 4 Nov 2022 09:56:25 -0700
Subject: [PATCH] Carried over changes from external PR to repo

---
 detections/cloud/o365_disable_mfa.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml
index f29540759a..2abb084e33 100644
--- a/detections/cloud/o365_disable_mfa.yml
+++ b/detections/cloud/o365_disable_mfa.yml
@@ -7,11 +7,13 @@ type: TTP
 datamodel: []
 description: This search detects when multi factor authentication has been disabled,
   what entitiy performed the action and against what user
-search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats
-  count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation
-  UserId ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
-  | `o365_disable_mfa_filter`'
-how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+search: '`o365_management_activity` Operation="Disable Strong Authentication." 
+| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation UserId ResultStatus object
+| rename UserType AS user_type, Operation AS action, UserId AS src_user, object AS user, ResultStatus AS result
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `o365_disable_mfa_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity
 known_false_positives: Unless it is a special case, it is uncommon to disable MFA
   or Strong Authentication
@@ -60,4 +62,4 @@ tags:
   - dest
   - ResultStatus
   risk_score: 64
-  security_domain: threat
+  security_domain: threat
\ No newline at end of file