Update o365_excessive_os_vendors_authenticating_from_user.yml

Author: nterl0k

detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml

@@ -26,7 +26,7 @@ references:
 - https://github.com/dafthack/MFASweep/tree/master
 drilldown_searches:
 - name: View the detection results for - "$user$"
-  search: '%original_detection_search% | search user = "$user$"
+  search: '%original_detection_search% | search user = "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 - name: View risk events for the last 7 days for - "$user$"