diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
index ce9d8a2477..7c44fc1448 100644
--- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
@@ -13,7 +13,7 @@ references: []
 author: Rico Valdez, Splunk
 
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time)
-    as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change.All_Changes
+    as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change
     where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user 
 | `drop_dm_object_name("All_Changes")` 
 | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data 
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
 | where enough_data=1 
 | eval firstTimeSeenUser=min(firstTimeSeen) 
 | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") 
-| table firstTime user dest object_id count
+| table firstTime user command object_id count
 | `security_content_ctime(firstTime)` 
 | `cloud_instance_modified_by_previously_unseen_user_filter`'