diff --git a/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml
index 2aa47bbf0e..268a9cf325 100644
--- a/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml
+++ b/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml
@@ -5,7 +5,7 @@ date: '2022-08-02'
 author: Marissa Bower, Rod Soto, Splunk
 type: TTP
 datamodel: []
-search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_drilldown_dashboard_disclosure_filter`'
+search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`'
 description: Splunk drilldown vulnerability disclosure in Dashboard application that can potentially allow exposure of tokens from privilege users. An attacker can create dashboard and share it to privileged user (admin) and detokenize variables using external urls within dashboards drilldown function.
 how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options.
 known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations.
diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml
index 23404f523f..653b7fcc2c 100644
--- a/detections/experimental/network/remote_desktop_network_traffic.yml
+++ b/detections/experimental/network/remote_desktop_network_traffic.yml
@@ -13,7 +13,7 @@ description: This search looks for network traffic on TCP/3389, the default port
   on your network.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND
-  All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source
+  All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source AND all_Traffic.action="allowed"
   by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_desktop_network_traffic_filter` '
 how_to_implement: To successfully implement this search you need to identify systems