From 31b04f33a96e995fb9a71794245be8f19bd3a3ca Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 16 Feb 2021 16:26:07 -0500 Subject: [PATCH] fixed minor spelling mistake reported by George Starcher via user slack --- .../application/okta_user_logins_from_multiple_cities.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index 80a5e47e0b..35dba10164 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Splunk type: batch datamodel: [] -description: This search detects logins from the same user from different states in +description: This search detects logins from the same user from different cities in a 24 hour period. search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)