diff --git a/aws/logs_monitoring/tests/approved_files/TestParseAwsWafLogs.test_waf_rule_group_with_excluded_and_nonterminating_rules.approved.json b/aws/logs_monitoring/tests/approved_files/TestParseAwsWafLogs.test_waf_rule_group_with_excluded_and_nonterminating_rules.approved.json
index 58e3e8cc..0426e449 100644
--- a/aws/logs_monitoring/tests/approved_files/TestParseAwsWafLogs.test_waf_rule_group_with_excluded_and_nonterminating_rules.approved.json
+++ b/aws/logs_monitoring/tests/approved_files/TestParseAwsWafLogs.test_waf_rule_group_with_excluded_and_nonterminating_rules.approved.json
@@ -1,30 +1,34 @@
 {
     "ddsource": "waf",
     "message": {
-        "ruleGroupList": {
-            "AWS#AWSManagedRulesSQLiRuleSet": {
-                "excludedRules": {
-                    "GenericRFI_BODY": {
-                        "exclusionType": "EXCLUDED_AS_COUNT"
+        "ruleGroupList": [
+            {
+                "excludedRules": [
+                    {
+                        "exclusionType": "EXCLUDED_AS_COUNT",
+                        "ruleId": "GenericRFI_BODY"
                     },
-                    "second_exclude": {
-                        "exclusionType": "EXCLUDED_AS_COUNT"
+                    {
+                        "exclusionType": "EXCLUDED_AS_COUNT",
+                        "ruleId": "second_exclude"
                     }
-                },
-                "nonTerminatingMatchingRules": {
-                    "first_nonterminating": {
-                        "exclusionType": "REGULAR"
+                ],
+                "nonTerminatingMatchingRules": [
+                    {
+                        "exclusionType": "REGULAR",
+                        "ruleId": "first_nonterminating"
                     },
-                    "second_nonterminating": {
-                        "exclusionType": "REGULAR"
+                    {
+                        "exclusionType": "REGULAR",
+                        "ruleId": "second_nonterminating"
                     }
-                },
+                ],
+                "ruleGroupId": "AWS#AWSManagedRulesSQLiRuleSet",
                 "terminatingRule": {
-                    "SQLi_QUERYARGUMENTS": {
-                        "action": "BLOCK"
-                    }
+                    "action": "BLOCK",
+                    "ruleId": "SQLi_QUERYARGUMENTS"
                 }
             }
-        }
+        ]
     }
 }