diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
index 7f4c1d55aa..7cd8050eb2 100644
--- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
+++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
@@ -51,7 +51,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections [ ListingReason: $Reasons$ ]
+  message: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src_ip$
   risk_objects:
     - field: src_ip
       type: system