diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc
index 1ee0bb7cb71..d30e4b2a0df 100644
--- a/docs/reference/eql/functions.asciidoc
+++ b/docs/reference/eql/functions.asciidoc
@@ -132,7 +132,7 @@ If `true`, matching is case-sensitive. Defaults to `false`.
 
 [discrete]
 [[eql-fn-cidrmatch]]
-==== `cidrMatch`
+=== `cidrMatch`
 
 Returns `true` if an IP address is contained in one or more provided
 https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing[CIDR] blocks.