diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
index e4750549b7..eeb7ce7699 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
@@ -42,7 +42,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: Remote system discovery with PowerView on $dest$ by $user$
+  message: Remote system discovery with PowerView on $dest$ by $user_id$
   risk_objects:
   - field: dest
     type: system
diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index 178ee60e24..d41f5d4154 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -47,7 +47,7 @@ drilldown_searches:
   latest_offset: $info_max_time$
 rba:
   message: A suspicious powershell process $process_name$ that tries to create a remote
-    thread on target process $TargetImage$ with eventcode $EventCode$ in host $dest$
+    thread on target process $TargetImage$ on host $dest$
   risk_objects:
   - field: dest
     type: system
diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index 1645a71a88..0420c5905e 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -42,7 +42,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: Remote system discovery enumeration with adsisearcher on $dest$ by $user$
+  message: Remote system discovery enumeration with adsisearcher on $dest$ by $user_id$
   risk_objects:
   - field: dest
     type: system
diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
index 05261a81fe..f7d8bc5480 100644
--- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
@@ -15,10 +15,14 @@ description: The following analytic detects an application attempting to connect
   within the network.
 data_source:
 - Sysmon EventID 11
-search: '`sysmon` EventCode=11  TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
-  = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) | stats count min(_time)
-  as firstTime max(_time) as lastTime by action dest file_name file_path  process_guid
-  process_id user_id vendor_product Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: |-
+  `sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
+      = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) 
+  | stats count min(_time)
+      as firstTime max(_time) as lastTime by action dest file_name file_path process_guid
+      process_id user_id vendor_product process_name 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `schcache_change_by_app_connect_and_create_adsi_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -44,7 +48,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: process $Image$ create a file $TargetFilename$ in host $dest$
+  message: Process $process_name$ created a file $file_name$ on host $dest$ 
   risk_objects:
   - field: dest
     type: system