updating hunting query

splunk · Nov 9, 2023 · 8c0c057 · 8c0c057
1 parent 5070105
commit 8c0c057
Showing 1 changed file with 0 additions and 5 deletions.
diff --git a/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml b/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml
@@ -38,11 +38,6 @@ tags:
   - T1110
   - T1110.003
   - T1110.004
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security