ing

detections/endpoint/detect_critical_alerts_from_security_tools.yml

@@ -62,7 +62,7 @@ tags:
   - sourcetype
   risk_score: 5025
   security_domain: endpoint
-  manual_testing: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Since integration tests compare these two values, we are setting this to manual test.
+  manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Since integration tests compare these two values, we are setting this to manual test.
 tests:
 - name: True Positive Test
   attack_data: