False Positives from "Correlate Unfamiliar sign-in properties & atypical travel alerts" When Changing User Risk

[v-visodadasi]

Required items, please complete

Change(s):

• Modified query to exclude events where the Comments field starts with "Risk detail: Admin"

Reason for Change(s):

• To exclude alerts that are the result of admin actions, helping to reduce false positives.

Version Updated:

• Yes

Testing Completed:

• Yes

[contentautomationbot]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.