diff --git a/documentation/README.md b/documentation/README.md
index 80687b5e..1b77dd80 100644
--- a/documentation/README.md
+++ b/documentation/README.md
@@ -661,7 +661,7 @@ Module to query a local copy of Maxmind's Geolite database.
 
 An expansion module to have the observable's threat score assessed by Google Threat Intelligence.
 - **features**:
->GTI assessment for the given observable, this include information about level of severity, a clear verdict (malicious, suspicious, undetected and bening) and additional information provided by the Mandiant expertise combined with the VirusTotal database.
+>GTI assessment for the given observable, this include information about level of severity, a clear verdict (malicious, suspicious, undetected and benign) and additional information provided by the Mandiant expertise combined with the VirusTotal database.
 >
 >[Output example screeshot](https://github.com/MISP/MISP/assets/4747608/e275db2f-bb1e-4413-8cc0-ec3cb05e0414)
 - **input**:
diff --git a/documentation/mkdocs/expansion.md b/documentation/mkdocs/expansion.md
index 3533a06c..62b3a48a 100644
--- a/documentation/mkdocs/expansion.md
+++ b/documentation/mkdocs/expansion.md
@@ -658,7 +658,7 @@ Module to query a local copy of Maxmind's Geolite database.
 
 An expansion module to have the observable's threat score assessed by Google Threat Intelligence.
 - **features**:
->GTI assessment for the given observable, this include information about level of severity, a clear verdict (malicious, suspicious, undetected and bening) and additional information provided by the Mandiant expertise combined with the VirusTotal database.
+>GTI assessment for the given observable, this include information about level of severity, a clear verdict (malicious, suspicious, undetected and benign) and additional information provided by the Mandiant expertise combined with the VirusTotal database.
 >
 >[Output example screeshot](https://github.com/MISP/MISP/assets/4747608/e275db2f-bb1e-4413-8cc0-ec3cb05e0414)
 - **input**: