diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml
index 2c779438cc..aed78fecb1 100644
--- a/detections/endpoint/potentially_malicious_code_on_commandline.yml
+++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: Uses machine learning to detect potentially malicious command lines
-search: '| tstats count from datamodel="Endpoint.Processes" by Processes.process | `drop_dm_object_name(Processes)`  | `potentially_malicious_code_on_cmdline_tokenize_score`'
+search: '| tstats count from datamodel="Endpoint.Processes" by Processes.process | `drop_dm_object_name(Processes)`  | `potentially_malicious_code_on_cmdline_tokenize_score` | `potentially_malicious_code_on_commandline_filter`'
 how_to_implement: UPDATE_HOW_TO_IMPLEMENT
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references: