diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml
index 2932f48493..9b06356fc6 100644
--- a/stories/active_directory_password_spraying.yml
+++ b/stories/active_directory_password_spraying.yml
@@ -4,19 +4,24 @@ version: 1
 date: '2021-04-07'
 author: Mauricio Velazco, Splunk
 type: batch
-description: Monitor for activities and techniques associated with Password Spraying attacks against Active Directory environments.
+description: Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
 narrative: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.
  Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. 
  Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing 
  a single account with many passwords. This technique allows an adversary to remain undetected. \
 
- Password Spraying can be leverages by adversaries to obtain initial access in a network or to escalate privileges in an environment where access has been already obtained.
+ Password Spraying can be leveraged by adversaries to obtain initial access in a network or to escalate privileges in an environment where access has been already obtained.
 
- This Analytic Story is focused on detecting potential Password Spraying attacks against Active Directory environments. It presents 
+ This Analytic Story is focused on detecting potential Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the 
+ 'Account Logon' and 'Logon/Logoff' Advanced Audit Policy categories. It presents 9 different detection analytics which aid defenders in identifyng instances where one source 
+ user, source host or source process fails to authenticate against a target or targets using multiple users. A user, host or process failing to authenticate with multiple
+ users is not a common behavior for legitimate systems and should be monitored by blue teams. Possible false positive scenarios include but are not limited to 
+ vulnerability scanners, remote administration tools and missconfigured systems. These can be quickly spotted and addded to an allow list. 
 references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-password-spraying-with-security-event-auditing
 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-password-spraying
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
 tags:
   analytic_story:
   - Active Directory Password Spraying