Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/integrations/o365/defense_evasion_microsoft_365_susp_oauth2_authorization.toml

Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

Description

This rule specifically only looks at indexes that match "logs-o365.audit-default*"
So that this can be used when folks are saving logs to different namespaces, this should be changed to

query = ''' from logs-o365.audit-* 

Example Data

No response