diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index 86fad5692c..855bd7b839 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -3,29 +3,25 @@ id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
 version: 1
 date: '2020-09-12'
 description: Find EC2 instances being created with previously unseen instance types.
-how_to_implement: "You must be ingesting your cloud infrastructure logs from your
-  cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial`
-  to build the initial table of instance types observed and times. You must also enable the second
-  baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and
-  to age out old data. You can also provide additional filtering for this search by
-  customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro."
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider. You should run the baseline search `Previously Seen Cloud Compute Instance
+  Types - Initial` to build the initial table of instance types observed and times.
+  You must also enable the second baseline search `Previously Seen Cloud Compute Instance
+  Types - Update` to keep this table up to date and to age out old data. You can also
+  provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
+  macro.
 type: ESCU
 references: []
 author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count
-    from datamodel=Change where All_Changes.action=created 
-    by All_Changes.Instance_Changes.instance_type, All_Changes.user 
-| `drop_dm_object_name("All_Changes")` 
-| `drop_dm_object_name("Instance_Changes")` 
-| where instance_type != "unknown"
-| lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data 
-| eventstats max(enough_data) as enough_data 
-| where enough_data=1 
-| eval firstTimeSeenInstanceType=min(firstTimeSeen) 
-| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") 
-| table firstTime, user, dest, count, instance_type
-| `security_content_ctime(firstTime)` 
-| `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
+  as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
+  All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
+  | where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types
+  instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats
+  max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen)
+  | where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(),
+  "-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)`
+  | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
 known_false_positives: It is possible that an admin will create a new system using
   a new instance type that has never been used before. Verify with the creator that
   they intended to create the system with the new instance type.
@@ -41,3 +37,6 @@ tags:
   risk_score: 20
   risk_object_type: user
   risk_object: user
+  automated_detection_testing: passed
+  dataset:
+  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json