diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml
index 66f3a90cdf..b456dd61f9 100644
--- a/detections/cloud/circle_ci_disable_security_job.yml
+++ b/detections/cloud/circle_ci_disable_security_job.yml
@@ -7,11 +7,12 @@ type: Anomaly
 datamodel: []
 description: This search looks for disable security job in CircleCI pipeline.
 search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
-  vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
+  vcs.url as url workflows.* as *  | stats values(job_name) as job_names by workflow_id
   workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
   workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval
   mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
-  mandatory_job_executed=0 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  mandatory_job_executed=0 | rex field=url "(?<repository>[^\/]*\/[^\/]*)$" 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `circle_ci_disable_security_job_filter`'
 how_to_implement: You must index CircleCI logs.
 known_false_positives: unknown
diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml
index 841e0e187d..4b3b0e7e76 100644
--- a/detections/cloud/circle_ci_disable_security_step.yml
+++ b/detections/cloud/circle_ci_disable_security_step.yml
@@ -11,7 +11,8 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
   job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
   * , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name
   AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names,
-  "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | `security_content_ctime(firstTime)`
+  "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0
+  | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"  | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
 how_to_implement: You must index CircleCI logs.
 known_false_positives: unknown
diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml
index 7a2bdc59b3..c9e1871502 100644
--- a/detections/cloud/github_dependabot_alert.yml
+++ b/detections/cloud/github_dependabot_alert.yml
@@ -7,10 +7,10 @@ type: Anomaly
 datamodel: []
 description: This search looks for Dependabot Alerts in Github logs.
 search: '`github` alert.id=* action=create | rename repository.full_name as repository,
-  repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
+  repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time)
   as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
   alert.external_identifier alert.external_reference alert.fixed_in alert.severity
-  repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  repository repository_url user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `github_dependabot_alert_filter`'
 how_to_implement: You must index GitHub logs. You can follow the url in reference
   to onboard GitHub logs.
diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml
index 456afb76ef..324cb25e39 100644
--- a/detections/cloud/github_pull_request_from_unknown_user.yml
+++ b/detections/cloud/github_pull_request_from_unknown_user.yml
@@ -7,11 +7,12 @@ type: Anomaly
 datamodel: []
 description: This search looks for Pull Request from unknown user.
 search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
-  check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref
+  repository.full_name check_suite.pull_requests{}.head.ref
   check_suite.head_commit.message | rename check_suite.head_commit.author.name as
-  user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref
+  user repository.full_name as repository check_suite.pull_requests{}.head.ref
   as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` 
+  | `github_pull_request_from_unknown_user_filter`'
 how_to_implement: You must index GitHub logs. You can follow the url in reference
   to onboard GitHub logs.
 known_false_positives: unknown