diff --git a/rules/cloud/azure_kubernetes_events_deleted.yml b/rules/cloud/azure_kubernetes_events_deleted.yml
index aa209c993..586761a02 100644
--- a/rules/cloud/azure_kubernetes_events_deleted.yml
+++ b/rules/cloud/azure_kubernetes_events_deleted.yml
@@ -6,7 +6,7 @@ status: experimental
 date: 2021/07/24
 references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
-	  - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
+    - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
 logsource:
   service: azure.activitylogs
 detection: