Update o365_sharepoint_suspicious_search_behavior.yml

nterl0k · web-flow · commit d11d2df008b9 · 2025-02-02T12:59:26.000-05:00
diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml
@@ -54,11 +54,6 @@ tags:
   mitre_attack_id: 
   - T1213.002 
   - T1552
-  observable: 
-  - name: user
-    type: User
-    role:
-    - Victim
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security
