diff --git a/macros/filter_rare_process_allow_list.yml b/macros/filter_rare_process_allow_list.yml
index da94ac43eb..86322fa870 100644
--- a/macros/filter_rare_process_allow_list.yml
+++ b/macros/filter_rare_process_allow_list.yml
@@ -1,3 +1,3 @@
-definition: (process_name=*)
+definition: search process_name=*
 description: Add rare process names to this macro that are allowed in your organization
 name: filter_rare_process_allow_list
\ No newline at end of file