diff --git a/rules/cloud/azure_kubernetes_events_deleted.yml b/rules/cloud/azure_kubernetes_events_deleted.yml
index 4693d487b..775c650a0 100644
--- a/rules/cloud/azure_kubernetes_events_deleted.yml
+++ b/rules/cloud/azure_kubernetes_events_deleted.yml
@@ -10,14 +10,14 @@ references:
 logsource:
   service: azure.activitylogs
 detection:
-    selection_operationname:
+    selection_operation_name:
           - properties.message: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE
-    condition: all of them 
+    condition: selection_operation_name
 level: medium
 tags:
     - attack.defense_evasion
     - attack.t1562
     - attack.t1562.001
 falsepositives:
-- Events deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
+- Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.