Update azure_unusual_authentication_interruption.yml

2021-11-26 11:41:33 -06:00
parent b260f25cc0
commit 0a18b42445
1 changed files with 3 additions and 3 deletions
@@ -10,13 +10,13 @@ logsource:
  product: azure
  service: azure.signinlogs
 detection:
-  selection:
+  selection1:
    ResultType: 50097
    ResultDescription: 'Device authentication is required'
-  selection:
+  selection2:
    ResultType: 50155
    ResultDescription: 'DeviceAuthenticationFailed'
-  selection:
+  selection3:
    ResultType: 50158
    ResultDescription: 'ExternalSecurityChallenge - External security challenge was not satisfied'
    condition: selection1 or selection2 or selection3