diff --git a/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml b/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml
index c46aecafab..cd71f7b720 100644
--- a/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml
+++ b/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml
@@ -61,6 +61,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/citrix/cve-2023-4966-citrix.log
-    source: suricata
-    sourcetype: suricata
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/citrix/nginx_kv_cve_2023-4966-citrix.log
+    source: nginx:plus:kv
+    sourcetype: nginx:plus:kv