diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
index 8cea3ed666..f7f7620d2e 100644
--- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
@@ -1,21 +1,26 @@
 author: Bhavin Patel, Splunk
 date: '2021-01-12'
-description: This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. 
+description: This search detects newly added IP addresses/CIDR blocks to the list
+  of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
+  to use this technique so that they can bypass the MFA system.
 how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity
 id: c783dd98-c703-4252-9e8a-f19d9f66949e
-known_false_positives: Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
+known_false_positives: Unless it is a special case, it is uncommon to continually
+  update Trusted IPs to MFA configuration.
 name: O365 Bypass MFA via Trusted IP
 references:
 - https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
 - https://attack.mitre.org/techniques/T1562/007/
 search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
-| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
-| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
-| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0")
-| mvexpand ip_addresses_new_added
-| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
-|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`'
+  | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
+  | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
+  | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand
+  ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
+  |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old)
+  as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account
+  status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `o365_bypass_mfa_via_trusted_ip_filter`'
 tags:
   analytics_story:
   - Office 365 Detections
@@ -25,5 +30,8 @@ tags:
   mitre_attack_id:
   - T1562.007
   security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip.json
 type: ESCU
 version: 1