diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
index d9c4aa587a..961f552da7 100644
--- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
@@ -10,8 +10,8 @@ description: This search identifies endpoints that have caused a relatively high
   of account lockouts in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where
-  nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest
-  All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
+  All_Changes.result="*locked out*" by All_Changes.dest All_Changes.result 
+  |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search
   count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`'
 how_to_implement: "You must ingest your Windows security event logs in the `Change`\
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index 2f6f1cbfc6..8edeccc228 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -9,8 +9,8 @@ datamodel:
 description: This search detects user accounts that have been locked out a relatively
   high number of times in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management
-  All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
+  as lastTime from datamodel=Change.All_Changes where  All_Changes.result="*locked out*" 
+  by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
   |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`'
 how_to_implement: ou must ingest your Windows security event logs in the `Change`