diff --git a/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
index 3a42b2749f..cd214b7b56 100644
--- a/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
+++ b/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
@@ -6,7 +6,7 @@ id: 7f5c2779-88a0-4824-9caa-0f606c8f260f
 known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness."
 name: "Kubernetes GCP detect most active service accounts by pod"
 references: []
-search: "`google_gcp_pubsub_message  data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`"
+search: "`google_gcp_pubsub_message`  data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`"
 tags:
   analytics_story:
     - "Kubernetes Sensitive Role Activity"