diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml
index eae9475267..f0a30d0c78 100644
--- a/data_sources/windows_defender_alerts.yml
+++ b/data_sources/windows_defender_alerts.yml
@@ -54,7 +54,7 @@ fields:
   - AttackTechniques
   - DetectionSource
   - Severity
-example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", 
+example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", 
   "category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25", 
   "EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null, 
   "RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null, 
@@ -64,4 +64,4 @@ example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-ab
   "Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application": 
   null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId": 
   null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers", 
-  "Severity": "High"}, "Tenant": "DefaultTenant"}
+  "Severity": "High"}, "Tenant": "DefaultTenant"}'