Update PIMElevationRequestRejected.yaml

Azure · Oct 17, 2023 · b9a157b · b9a157b
1 parent 473df66
commit b9a157b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml b/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml
@@ -21,7 +21,7 @@ tags:
   - AADSecOpsGuide
 query: |
   AuditLogs
-  | where (ActivityDisplayName =~'Add member to role completed (PIM activation)' and Result =~ "failure") or ActivityDisplayName =~'Add member to role request denied (PIM activation)'
+  | ActivityDisplayName =~'Add member to role request denied (PIM activation)'
   | mv-apply ResourceItem = TargetResources on 
     (
         where ResourceItem.type =~ "Role"
@@ -54,5 +54,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: InitiatingIpAddress
-version: 1.0.6
+version: 1.0.7
 kind: Scheduled