diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
index b92fd512b0..35bf0a03a3 100644
--- a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
+++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
@@ -6,4 +6,4 @@ tests:
   attack_data:
   - file_name: windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
-    source: WinEventLog:security
\ No newline at end of file
+    source: WinEventLog:Security
\ No newline at end of file