diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 0b7f461771..06d912fc42 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -14,14 +14,14 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   related to credential dumping or file writes. searchprotocolhost.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_guid
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_guid [| tstats
+  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_id [| tstats
   `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
-  !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
+  !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
   | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
+  process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.