diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
index 3368c5eaa5..d8b1646bcc 100644
--- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
@@ -52,7 +52,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: null
+  - name: src_ip
     type: IP Address
     role:
     - Attacker