diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
index 7b09b5e0f6..5b4851a0ae 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for cloud compute instances being created with previously
   unseen image IDs.
 search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
-  as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
+  as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
   | where image_id != "unknown" | lookup previously_seen_cloud_compute_images image_id
   as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index 87efc54db6..1498019242 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -8,7 +8,7 @@ datamodel:
 - Change
 description: Find EC2 instances being created with previously unseen instance types.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
-  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
+  as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
   | where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types
   instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats