Update o365_email_hard_delete_excessive_volume.yml

detections/cloud/o365_email_hard_delete_excessive_volume.yml

@@ -35,41 +35,33 @@ drilldown_searches:
   search: '`o365_management_activity` Workload=Exchange (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) AND UserId = "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: message: The user $user$ deleted an excessing number of emails [$count$] within a short timeframe
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  threat_objects:
+  - field: src
+    type: ip_address
 tags:
   analytic_story: 
   - Office 365 Account Takeover
   - Suspicious Emails
   - Data Destruction
-  asset_type: Cloud
-  confidence: 50
-  impact: 50
-  message: The user $user$ deleted an excessing number of emails [$count$] within a short timeframe
+  asset_type: O365 Tenant
   mitre_attack_id: 
   - T1070
   - T1070.008
   - T1485
-  observable: 
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields: 
-  - _time
-  - Workload
-  - Folder.Path 
-  risk_score: 25
   security_domain: threat
 tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
     source: o365
-	sourcetype: o365:management:activity
+	sourcetype: o365:management:activity