diff --git a/rules/integrations/azure/impact_azure_service_principal_credentials_added.toml b/rules/integrations/azure/impact_azure_service_principal_credentials_added.toml index c9e558e27..2d15cabfe 100644 --- a/rules/integrations/azure/impact_azure_service_principal_credentials_added.toml +++ b/rules/integrations/azure/impact_azure_service_principal_credentials_added.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2021/05/05" maturity = "production" -updated_date = "2021/07/20" +updated_date = "2022/02/28" integration = "azure" [rule] @@ -37,7 +37,7 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal credentials." and event.outcome:(success or Success) +event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal credentials" and event.outcome:(success or Success) '''