diff --git a/macros/ms_defender.yml b/macros/ms_defender.yml
index bed2e5be4f..62b3d7beaa 100644
--- a/macros/ms_defender.yml
+++ b/macros/ms_defender.yml
@@ -1,4 +1,4 @@
-definition: ( source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational" 
+definition: source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational" 
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environment.
 name: ms_defender