diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index 489352502b..b7a125bd2e 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -2,22 +2,22 @@ name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
 id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
 version: 3
 date: '2021-01-26'
-description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
+description: This search looks for a spike in number of of AWS security Hub alerts
+  for an EC2 instance in 4 hours intervals
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub
-  inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
+  Hub inputs. The threshold_value should be tuned to your environment and schedule
+  these searches according to the bucket span interval.
 type: ESCU
 references: []
 author: Bhavin Patel, Splunk
-search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance 
-| bucket span=4h _time 
-| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest 
-| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev 
-| eval threshold_value = 3 
-| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) 
-| search isOutlier=1 
-| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg
-| `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
+search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
+  _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
+  as vendor_account values(vendor_region) as vendor_region values(severity) as severity
+  by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev
+  | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
+  * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
+  vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
 known_false_positives: None
 tags:
   analytics_story:
@@ -29,3 +29,6 @@ tags:
   - DE.AE
   security_domain: network
   asset_type: AWS Instance
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json