diff --git a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml
index e1c7e62df5..4e1569beb3 100644
--- a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml
+++ b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: UPDATE
-    data: UPDATE
-    source: UPDATE
-    sourcetype: UPDATE
-    update_timestamp: true
+  - file_name: gws_login.json
+  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json
+  source: gws_login
+  sourcetype: gws:reports:login
+  update_timestamp: true