diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md
index 3d8a64c5c6..48fdc09227 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md
@@ -68,7 +68,7 @@ Microsoft Defender for Endpoint utilized `audit` framework from linux to track n
     service auditd start
     ```
 
-**On SLES15** systems, SYSCALL auditing in `auditd` is disabled by default and can explain missing events.
+**On SLES 12 and 15** systems, SYSCALL auditing in `auditd` is disabled by default and can explain missing events.
 
 1. To validate that SYSCALL auditing is not disabeld, list the current audit rules: