Update o365_multiple_os_vendors_authenticating_from_user.yml

nterl0k · web-flow · commit 0d3b963a4d63 · 2025-01-15T14:17:36.000-05:00
diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
@@ -54,7 +54,7 @@ tags:
   - name: user
     type: User
     role:
-    - Attacker
+    - Victim
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security
