diff --git a/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
index c5d3cf32e1..253891d97d 100644
--- a/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
+++ b/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
@@ -1,4 +1,4 @@
-name: Multiple Okta Users With Invalid Credentails From The Same IP
+name: Multiple Okta Users With Invalid Credentials From The Same IP
 id: 19cba45f-cad3-4032-8911-0c09e0444552
 version: 2
 date: '2020-07-21'
@@ -12,12 +12,12 @@ search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalC
   as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users
   values(user) as users by src_ip, displayMessage, outcome.reason, country, state,
   city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter` '
+  |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` '
 how_to_implement: This search is specific to Okta and requires Okta logs are being
   ingested in your Splunk deployment.
 known_false_positives: A single public IP address servicing multiple legitmate users
   may trigger this search. In addition, the threshold of 5 distinct users may be too
-  low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise
+  low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise
   the threshold or except specific IP adresses from triggering this search.
 references: []
 tags: