diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
index c5a2018122..269900eaeb 100644
--- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -6,28 +6,36 @@ author: Mauricio Velazco, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: 'The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. 
-  This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain 
-  initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. I certain scenarios, adversaries may execute a password spraying attack against disabled users. 
-  In this logic, the number of unique users is hardcoded to 10 but can or should be customized to fit especific environments.
-  Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x12 means 
-  `clients credentials have been revoked` (account disabled, expired or locked out).\
-  
-  This detection will trigger on the domain controller against which the offending host performs the password spraying attack.\
-  
-  The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.'
-search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 
- | bucket span=2m _time
- | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
- | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
- | eval upperBound=(comp_avg+comp_std*3)
- | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
- | search isOutlier=1
- | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` '
-how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with multiple disabled domain users using the Kerberos protocol. This behavior could
+  represent an adversary performing a Password Spraying attack against an Active Directory
+  environment using Kerberos to obtain initial access or elevate privileges. As attackers
+  progress in a breach, mistakes will be made. I certain scenarios, adversaries may
+  execute a password spraying attack against disabled users. In this logic, the number
+  of unique users is hardcoded to 10 but can or should be customized to fit especific
+  environments. Event 4768 is generated every time the Key Distribution Center issues
+  a Kerberos Ticket Granting Ticket (TGT). Failure code 0x12 means `clients credentials
+  have been revoked` (account disabled, expired or locked out).\
+
+  This detection will trigger on the domain controller against which the offending
+  host performs the password spraying attack.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
+search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
+  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
+  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
+  comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
+  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | search isOutlier=1 | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple disabled domain
+  users is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners and missconfigured systems.
 references:
-  - https://attack.mitre.org/techniques/T1110/003/ 
+- https://attack.mitre.org/techniques/T1110/003/
 tags:
   analytic_story:
   - Active Directory Password Spraying
@@ -46,3 +54,6 @@ tags:
   - Account_Name
   - Client_Address
   security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log