diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index bda1992328..1cc521b9a8 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -56,7 +56,7 @@ tags:
   confidence: 50
   risk_score: 25
   context:
-  - source:endpoint
+  - Source:Endpoint
   - stage:Privilege Escalation
   - Stage:Persistence
   message: a commandline $process$ executed on $dest$