remove extraquote

Author: patel-bhavin

detections/application/cisco_duo_admin_login_unusual_os.yml

@@ -42,7 +42,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A user $user$ has logged in using an unusual OS using browser $access_device.browser$ from $src_ip$.
+  message: A user $user$ has logged in using an unusual OS $access_device.os$ using browser $access_device.browser$ from $src_ip$.
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_bulk_policy_deletion.yml

@@ -44,7 +44,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A user $user$ has deleted more than 3 policies"
+  message: A user $user$ has deleted more than 3 policies
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_bypass_code_generation.yml

@@ -41,7 +41,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A user $user$ has generated a bypass code"
+  message: A user $user$ has generated a bypass code
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_allow_devices_without_screen_lock.yml

@@ -41,7 +41,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to allow devices without screen lock by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to allow devices without screen lock by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_allow_network_bypass_2fa.yml

@@ -43,7 +43,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to allow network bypass 2FA by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to allow network bypass 2FA by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_allow_old_flash.yml

@@ -41,7 +41,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to allow old flash by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to allow old flash by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_allow_old_java.yml

@@ -42,7 +42,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to allow old java by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to allow old java by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_allow_tampered_devices.yml

@@ -43,7 +43,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to allow tampered devices by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to allow tampered devices by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_bypass_2fa.yml

@@ -40,7 +40,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to allow access without 2FA by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to allow access without 2FA by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user

detections/application/cisco_duo_policy_deny_access.yml

@@ -41,7 +41,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A policy has been created or updated to deny access by user $user$ with email $admin_email$"
+  message: A policy has been created or updated to deny access by user $user$ with email $admin_email$
   risk_objects:
   - field: user
     type: user