diff --git a/detections/smb_traffic_spike_mltk.yml b/detections/smb_traffic_spike_mltk.yml
index 8800247155..b5b44c2251 100644
--- a/detections/smb_traffic_spike_mltk.yml
+++ b/detections/smb_traffic_spike_mltk.yml
@@ -27,6 +27,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 50
+      macros:
+        - smb_traffic_spike_mltk_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -111,7 +113,7 @@ investigations:
     type: splunk
 known_false_positives: If you are seeing more results than desired, you may consider
   reducing the value of the threshold in the search. You should also periodically
-  re-run the support search to re-build the ML model on the latest data.
+  re-run the support search to re-build the ML model on the latest data. Please update the `smb_traffic_spike_mltk_filter` macro to filter out false positive results 
 maintainers:
   - company: Splunk
     email: rvaldez@splunk.com
diff --git a/macros/smb_traffic_spike_mltk_filter.yml b/macros/smb_traffic_spike_mltk_filter.yml
index befb062f4a..ee09da9bcd 100644
--- a/macros/smb_traffic_spike_mltk_filter.yml
+++ b/macros/smb_traffic_spike_mltk_filter.yml
@@ -1,3 +1,3 @@
 definition: search *
 description: Use this macro to add additional filters for SMB traffic spike detection using MLKT
-name: smb_traffic_spike_mltkfilter
+name: smb_traffic_spike_mltk_filter
diff --git a/macros/unauthorized_dns_servers_filter.yml b/macros/unauthorized_dns_servers_filter.yml
index 6c8c3b8dca..919e3fd05e 100644
--- a/macros/unauthorized_dns_servers_filter.yml
+++ b/macros/unauthorized_dns_servers_filter.yml
@@ -1,2 +1,3 @@
+definition: search *
 description: Use this macro to add additional filters for DNS Query Requests Resolved by Unauthorized DNS Servers detection
 name: unauthorized_dns_servers_filter