diff --git a/detections/kubernetes_gcp_scan_fingerprint_attack.yml b/detections/kubernetes_gcp_scan_fingerprint_attack.yml
index 699ad418c9..4b3984cd7d 100644
--- a/detections/kubernetes_gcp_scan_fingerprint_attack.yml
+++ b/detections/kubernetes_gcp_scan_fingerprint_attack.yml
@@ -27,7 +27,7 @@ detect:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
         latest_time: -10m@m
-      search: sourcetype="google:gcp:pubsub:message" data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous"   | rename data.protoPayload.requestMetadata.callerIp as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as methond values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`  | `kubernetes_gcp_scan_fingerprint_detection`
+      search: sourcetype="google:gcp:pubsub:message" data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" | rename data.protoPayload.requestMetadata.callerIp as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`  | `kubernetes_gcp_scan_fingerprint_detection`
 eli5: In this search we can detect unauthenticated web requests and possible attack against a GCP cluster, by looking at k8s authentication data, user agent, source IPs and destionation
 entities:
   - k8s_cluster_name