diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml
index 740a738ff5..222479150d 100644
--- a/detections/cloud/o365_sharepoint_malware_detection.yml
+++ b/detections/cloud/o365_sharepoint_malware_detection.yml
@@ -38,7 +38,7 @@ tags:
   - name: file_name
     type: File Name
     role:
-    - Victim	
+    - Victim
   - name: signature
     type: Other
     role:
@@ -63,4 +63,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
     sourcetype: o365:management:activity
-    source: o365
\ No newline at end of file
+    source: o365
diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml
index d3e775cbb4..8f2d42adc4 100644
--- a/detections/cloud/o365_zap_activity_detection.yml
+++ b/detections/cloud/o365_zap_activity_detection.yml
@@ -48,7 +48,7 @@ tags:
   - name: src_user
     type: User
     role:
-    - Attacker	
+    - Attacker
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,4 +67,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
     sourcetype: o365:management:activity
-    source: o365
\ No newline at end of file
+    source: o365