diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
index 139ef9838e..d48b6406bd 100644
--- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
@@ -5,22 +5,29 @@ date: '2021-04-01'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: The following detection identifies any malformed policy document exceptions with a status of `failure`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur.
-search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com)
-| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn 
-| where count >= 2
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)`
-| `aws_iam_assume_role_policy_brute_force_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
-known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. 
+description: The following detection identifies any malformed policy document exceptions
+  with a status of `failure`. Meaning, when an adversary is attempting to identify
+  a role name, multiple failures will occur.
+search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
+  (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
+  lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
+  aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion
+  userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`'
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
+  than a value to identify suspicious activity in your environment.
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users.
 references:
 - https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
 - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
@@ -37,4 +44,5 @@ tags:
   - userAgent
   - errorCode
   - requestParameters.policyName
-  security_domain: access
\ No newline at end of file
+  security_domain: access
+  automated_detection_testing: passed