diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
index 2b76f5e55c..480b108247 100644
--- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
@@ -7,7 +7,8 @@ type: batch
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user has created
   an open/public S3 bucket over the aws cli.
-search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
+search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli*
+  ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control
@@ -41,8 +42,8 @@ tags:
   impact: 60
   kill_chain_phases:
   - Actions on Objectives
-  message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI
-    with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$
+  message: User $userIdentity.userName$ has created an open/public bucket $bucketName$
+    using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$
     $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$
     $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
   mitre_attack_id: