diff --git a/detections/cloud/o365_email_hard_delete_excessive_volume.yml b/detections/cloud/o365_email_hard_delete_excessive_volume.yml
index 9c0f857a8d..a1c85790c0 100644
--- a/detections/cloud/o365_email_hard_delete_excessive_volume.yml
+++ b/detections/cloud/o365_email_hard_delete_excessive_volume.yml
@@ -37,7 +37,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: message: The user $user$ deleted an excessing number of emails [$count$] within a short timeframe
+  message: The user $user$ deleted an excessing number of emails [$count$] within a short timeframe
   risk_objects:
   - field: user
     type: user