diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
index 4572087327..896d91227f 100644
--- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
@@ -10,7 +10,7 @@ datamodel:
 description: The following analytic identifies a process performing an outbound connection on port 88 used by default by the network authentication protocol
   Kerberos. Typically, on a regular Windows endpoint, only the lsass.exe process is the one tasked with connecting to the Kerberos Distribution Center 
   to obtain Kerberos tickets. Identifying an unknown process using this protocol may be evidence of an adversary abusing the Kerberos protocol.
-search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name!=lsass.exe by _time Processes.process_id
   Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`