diff --git a/rules/cloud/gworkspace/gworkspace_mfa_disabled.yml b/rules/cloud/gworkspace/gworkspace_mfa_disabled.yml
index 3730e5c1c..ec1798985 100644
--- a/rules/cloud/gworkspace/gworkspace_mfa_disabled.yml
+++ b/rules/cloud/gworkspace/gworkspace_mfa_disabled.yml
@@ -4,6 +4,7 @@ description: Detects when multi-factor authentication (MFA) is disabled.
 author: Austin Songer
 status: experimental
 date: 2021/08/26
+modified: 2021/08/29
 references:
     - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
     - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION
@@ -17,7 +18,7 @@ detection:
             - ENFORCE_STRONG_AUTHENTICATION
             - ALLOW_STRONG_AUTHENTICATION
     eventValue:
-        new_value: false
+        new_value: 'false'
     condition: all of them
 level: medium
 tags: