Update ADOSecretNotSecured.yaml

Changing to 1d

Detections/AzureDevOpsAuditing/ADOSecretNotSecured.yaml

@@ -15,7 +15,7 @@ relevantTechniques:
 query: |
   let keywords = dynamic(["secret", "secrets", "password", "PAT", "passwd", "pswd", "pwd", "cred", "creds", "credentials", "credential", "key"]);
   AzureDevOpsAuditing
-  | where TimeGenerated > ago(30d)
+  | where TimeGenerated > ago(1d)
   | where OperationName =~ "Library.VariableGroupModified"
   | extend Type = tostring(Data.Type)
   | extend VariableGroupId = tostring(Data.VariableGroupId)
@@ -33,4 +33,4 @@ entityMappings:
   - entityType: IP
     fieldMappings:
       - identifier: Address
-        columnName: IPCustomEntity
+        columnName: IPCustomEntity