diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml
index 0940365844..e2ec6ecd2c 100644
--- a/detections/endpoint/linux_service_restarted.yml
+++ b/detections/endpoint/linux_service_restarted.yml
@@ -18,10 +18,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the process name, parent process, and commandline executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. 
-known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed 
+known_false_positives: Administrator or network operator can use this commandline for automation purposes. Filter is needed.
 references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
@@ -29,7 +29,7 @@ tags:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
   dataset:
-  -  https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id: