diff --git a/detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
index 2545cacc05..3defb5fe1b 100644
--- a/detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
+++ b/detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
@@ -6,7 +6,7 @@ id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
 known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness."
 name: "Kubernetes Azure detect most active service accounts by pod namespace"
 references: []
-search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
 tags:
   analytics_story:
     - "Kubernetes Sensitive Role Activity"
diff --git a/detections/kubernetes_azure_detect_sensitive_object_access.yml b/detections/kubernetes_azure_detect_sensitive_object_access.yml
index 2726aea834..d506228c52 100644
--- a/detections/kubernetes_azure_detect_sensitive_object_access.yml
+++ b/detections/kubernetes_azure_detect_sensitive_object_access.yml
@@ -6,7 +6,7 @@ id: 1bba382b-07fd-4ffa-b390-8002739b76e8
 known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
 name: "Kubernetes Azure detect sensitive object access"
 references: []
-search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
 tags:
   analytics_story:
     - "Kubernetes Sensitive Object Access Activity"