diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 33377bd2ce..52d4a25641 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -24,8 +24,8 @@ search: '| from read_ssa_enriched_events()
   OR field0="java.exe" OR field0="powershell.exe"
 
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
-  parent_process_name]) | into write_ssa_detected_events();'
+  dest_user_id), body=create_map([ "process_name", process_name, "parent_process",
+  parent_process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon logs. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
 known_false_positives: There are circumstances where an application may legitimately