diff --git a/detections/prohibited_software_on_endpoint.json b/detections/prohibited_software_on_endpoint.json
index 415a86b21d..0d67c14b58 100644
--- a/detections/prohibited_software_on_endpoint.json
+++ b/detections/prohibited_software_on_endpoint.json
@@ -29,7 +29,7 @@
     "splunk": {
       "correlation_rule": {
         "notable": {
-          "nes_fields": "dest, process, user",
+          "nes_fields": "dest, process_name, user",
           "rule_description": "Prohibited software $process_name$ has been detected on $dest$.",
           "rule_title": "Prohibited Software Detected On $dest$"
         },
@@ -45,7 +45,7 @@
           "earliest_time": "-70m@m",
           "latest_time": "-10m@m"
         },
-        "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process | `ctime(firstTime)`| `ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares`",
+        "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `ctime(firstTime)`| `ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares`",
         "suppress": {
           "suppress_fields": "dest,user",
           "suppress_period": "86400s"
@@ -57,7 +57,7 @@
   "entities": [
     "dest"
   ],
-  "how_to_implement": "To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or populated via Windows event logs, after enabling process tracking in your Windows audit settings. In addition, you must also have processes marked as \"prohibited\" in the Enterprise Security `interesting processes` table. To include the processes marked as \"prohibited\", which is included with ES Content Updates, run the included search `Support - Add Prohibited Processes to ES`.",
+  "how_to_implement": "To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as \"prohibited\" in the Enterprise Security `interesting processes` table. To include the process names marked as \"prohibited\", which is included with ES Content Updates, run the included search <code>Add Prohibited Processes to Enterprise Security</code>.",
   "id": "a51bfe1a-94f0-48cc-b4e4-b6ae50145893",
   "investigations": [
     {
@@ -141,7 +141,7 @@
       "PR.DS"
     ]
   },
-  "modification_date": "2010-11-02",
+  "modification_date": "2019-10-11",
   "name": "Prohibited Software On Endpoint",
   "original_authors": [
     {
@@ -154,5 +154,5 @@
   "security_domain": "endpoint",
   "spec_version": 2,
   "type": "splunk",
-  "version": "1.0"
+  "version": "2.0"
 }
diff --git a/package/default/macros.conf b/package/default/macros.conf
index 718036b51e..a1f6128434 100644
--- a/package/default/macros.conf
+++ b/package/default/macros.conf
@@ -23,7 +23,7 @@ definition = lookup update=true lookup_uncommon_processes_default process_name a
 definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
 
 [prohibited_softwares]
-definition = lookup interesting_processes_lookup app as process OUTPUT is_prohibited | search is_prohibited=True
+definition = lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True
 
 [brand_abuse_dns]
 definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
diff --git a/requirements.txt b/requirements.txt
index 7033a8b07a..aa125c8d0b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 aspy.yaml==1.3.0
 attrs==19.1.0
 cfgv==2.0.1
-configparser==4.0.1
+configparser==4.0.2
 contextlib2==0.5.5
 functools32==3.2.3.post2
 futures==3.2.0