updated investigation header

terrancedejesus · terrancedejesus · commit 130c6b95d342 · 2025-10-31T08:48:24.000-04:00
diff --git a/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml b/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml
@@ -25,7 +25,7 @@ license = "Elastic License v2"
 name = "M365 Identity Login from Impossible Travel Location"
 note = """## Triage and analysis
 
-### Investigating M365 Identity Login from M365 Identity Login from Impossible Travel Location
+### Investigating M365 Identity Login from Impossible Travel Location
 
 Microsoft 365's cloud-based services enable global access, but this can be exploited by adversaries logging in from disparate locations within short intervals, indicating potential account compromise. The detection rule identifies such anomalies by analyzing login events for rapid geographic shifts, flagging suspicious activity that may suggest unauthorized access attempts.
 
