diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index cf0bf78c3a..35957793cd 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -5,20 +5,22 @@ date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
-  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
-search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
-| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This analytics is to detect a gmail containing a link that are known
+  to be abused by malware or attacker like pastebin, telegram and discord to deliver
+  malicious payload. This event can encounter some normal email traffic within organization
+  and external email that normally using this application and services.
+search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
+  "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains
+  min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address
+  subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_with_known_abuse_web_service_link_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
+  logs related to gsuite having the file attachment metadata like file type, file
   extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
+known_false_positives: normal email contains this link that are known application
+  within the organization or network can be catched by this detection.
 references:
 - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
 tags:
@@ -39,7 +41,6 @@ tags:
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
   - Source:Endpoint
@@ -50,8 +51,8 @@ tags:
     type: User
     role:
     - attacker
-  - name: destination{}.address 
+  - name: destination{}.address
     type: User
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed