Update persistence_azure_conditional_access_policy_modified.toml (#1788)

2022-02-22 15:26:28 -03:00
parent 5e073af69d
commit 8664ef59f4
1 changed files with 2 additions and 6 deletions
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/09/01"
 maturity = "production"
-updated_date = "2021/07/20"
+updated_date = "2022/02/20"
 integration = "azure"

 [rule]
@@ -30,11 +30,7 @@ type = "query"

 query = '''
 event.dataset:(azure.activitylogs or azure.auditlogs) and
-  (
-    azure.activitylogs.operation_name:"Update policy" or
-    azure.auditlogs.operation_name:"Update policy"
-  ) and
-  event.outcome:(Success or success)
+event.action:"Update conditional access policy" and event.outcome:(Success or success)
 '''