diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml
index 5ca1917571..218429fef1 100644
--- a/detections/deprecated/detection_of_dns_tunnels.yml
+++ b/detections/deprecated/detection_of_dns_tunnels.yml
@@ -1,7 +1,7 @@
 name: Detection of DNS Tunnels
 id: 104658f4-afdc-499f-9719-17a43f9826f4
 version: 2
-date: '2017-09-18'
+date: '2022-02-15'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
@@ -12,7 +12,14 @@ description: This search is used to detect DNS tunneling, by calculating the sum
   originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
   method of transmission for data exfiltration, command and control, or evasion of
   security controls can often be detected by noting an unusually large volume of DNS
-  traffic. Deprecated because existing detection is doing the same.
+  traffic. \
+
+  NOTE:Deprecated because existing detection is doing the same. This detection is 
+  replaced with two other variations, if you are using MLTK then you can use this 
+  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard 
+  deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, 
+  as an alternantive.   
+   
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT
   (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"