Update o365_excessive_os_vendors_authenticating_from_user.yml

nterl0k · web-flow · commit 51ba4b9394d8 · 2025-01-08T08:26:05.000-05:00
diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -72,4 +72,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log
     source: o365
-	sourcetype: o365:management:activity
+    sourcetype: o365:management:activity
